The existence of the account was first reported by Indy Star, which obtained copies of Pence’s emails through a Freedom of Information request.

The paper reported that Pence used the account to conduct government business, including corresponding about potentially sensitive issues. In one exchange, Pence communicated with his chief of staff and his top homeland security adviser who conveyed an update about terror-related FBI arrests in the state. However, the information in those emails were reported widely in the media at the time.

In a statement, Pence Press Secretary Marc Lotter said that his use of a personal and government email account was consistent with previous governors.

“As then-Governor Pence concluded his time in office, he directed outside counsel to review all of his communications to ensure that state-related emails are being transferred and properly archived by the state, in accordance with the law, which outside counsel has done and is continuing to do,” Lotter said. “Government emails involving his state and personal accounts are being archived by the state and are being managed according to Indiana’s Access to Public Records Act.”

Pence had used the AOL account since the mid-1990s and continued to use it throughout his time as governor until early 2016, when the account was compromised by a hack. Hackers leveraged his contacts to launch a phishing attack against his contact lists, sending an email claiming that Pence and his wife were stranded in the Philippines and needed financial help.

After the account was hacked, it was shut down and Pence began using a second AOL account, an aide said.

The use of a private email account is not prohibited by law in Indiana. However, public officials cannot use state accounts for political business.

Security experts noted to Indy Star that some of Pence’s emails were apparently confidential and sensitive enough that they could not be turned over in response to public records requests.

“The fact that these emails are stored in a private AOL account is crazy to me,” Justin Cappos, a computer security professor at New York University’s Tandon School of Engineering, told Indy Star. “This account was used to handle these messages that are so sensitive they can’t be turned over in a records request.”

According to an aide, additional security measures were taken to protect Pence’s accounts after he was chosen as Donald Trump’s vice president. Emails in both accounts were preserved and are expected to be managed according to Indiana’s public records laws, the aide added.

Pence was a vocal critic of Democratic presidential candidate Hillary Clinton’s use of a private email server as secretary of state and often criticized her for it during the presidential campaign.

Lotter rejected the comparison between the two cases, arguing that Pence’s use of a private email server was not unusual, nor did he communicate about classified information.

Pence was also embroiled in a public records dispute over the release of an email that he is seeking to keep private. The email is related to Pence’s decision to join a lawsuit seeking to block refugees from being resettled in Indiana.