GopherProxy

#[1]Missouri Independent » Feed [2]Missouri Independent » Comments Feed
[3]alternate [4]alternate [5]alternate

IFRAME: [6]https://www.googletagmanager.com/ns.html?id=GTM-N5SMC6W

(BUTTON) [7][mobileHeader.svg] ____________________ (search)
* [8]HOME
* [9]NEWS
+ [10]Civil Rights
+ [11]Criminal Justice
+ [12]Energy + Environment
+ [13]Elections
+ [14]Health Care
+ [15]Education
* [16]COMMENTARY
* [17]ABOUT
* [18]SUBSCRIBE
* [19]DONATE

____________________ (search)
[20][headerLogo.png]
* [21]Civil Rights
* [22]Criminal Justice
* [23]Energy + Environment
* [24]Elections
* [25]Health Care
* [26]Education

10:29

News Story

* [27]Criminal Justice
* [28]Government + Politics

Missouri governor vows criminal prosecution of reporter who found flaw in
state website

The St. Louis Post-Dispatch notified a state agency and held its story while
a problem that risked exposing the social security numbers of Missouri
teachers was fixed

By: [29]Jason Hancock - October 14, 2021 10:29 am

Missouri Gov. Mike Parson during a press conference on Feb. 5, 2021
(photo courtesy of Missouri Governor’s Office).

On Tuesday, a reporter with the St. Louis Post-Dispatch [30]alerted the
state that Social Security numbers of school teachers and
administrators were vulnerable to public exposure due to flaws on a
website maintained by Missouri’s department of education.

The newspaper agreed to hold off publishing any story while the
department fixed the problem and protected the private information of
teachers around the state.

But by Thursday, Gov. Mike Parson was labeling the Post-Dispatch
reporter a “hacker” and vowing to seek criminal prosecution.

“The state does not take this matter lightly,” Parson said Thursday at
a hastily called press conference. He refused to take questions
afterward.

Parson said he had referred the matter to the Cole County Prosecutor
and has asked the Missouri State Highway Patrol to investigate.

“This administration is standing up against any and all perpetrators
who attempt to steal personal information and harm Missourians,” he
said.

According to the Post-Dispatch, one of its reporters discovered the
flaw in a web application allowing the public to search teacher
certifications and credentials. No private information was publicly
visible, but teacher Social Security numbers were contained in HTML
source code of the pages.

The state removed the search tool after being notified of the issue by
the Post-Dispatch. It was unclear how long the Social Security numbers
had been vulnerable.

In a press release Wednesday, the Office of Administration Information
Technology Services Division said that through a multi-step process, a
“hacker took the records of at least three educators, decoded the HTML
source code, and viewed the social security number of those specific
educators.”

The state is unaware of any misuse of individual information or even
whether information was accessed inappropriately outside of this
isolated incident.

Parson said Thursday that he wasn’t sure why the reporter accessed the
information. He claimed it was part of a “political game by what is
supposed to be one of Missouri’s news outlets.”

“The state is committed to bring to justice anyone who hacked our
system and anyone who aided and abetted them to do so,” Parson said,
later arguing that the reporter was “attempting to embarrass the state
and sell headlines for their news outlet.”

Republican state Rep. Tony Lovasco, who according to his legislative
biography has worked in software deployment and maintenance, tweeted
Thursday that “it’s clear [31]the Governor’s Office has a fundamental
misunderstanding of both web technology and industry standard
procedures for reporting security vulnerabilities.

“Journalists responsibly sounding an alarm on data privacy is not
criminal hacking,” he said.

Chris Vickery, a California-based data security expert, told The
Independent that it appears the department of education was
“publishing data that it shouldn’t have been publishing.

“That’s not a crime for the journalists discovering it,” he said.
“Putting Social Security numbers within HTML, even if it’s ‘non-display
rendering’ HTML, is a stupid thing for the Missouri website to do and
is a type of boneheaded mistake that has been around since day one of
the Internet. No exploit, hacking or vulnerability is involved here.”

In explaining how he hopes the reporter and news organization will be
prosecuted, Parson pointed to a state statute defining the crime of[32]
tampering with computer data. Vickery said that statute wouldn’t work
in this instance because of a recent decision by the U.S. Supreme Court
in the case of Van Buren v. United States.

The court ruled in that case that someone [33]violates the law when
they access files or other information that is off-limits to them. In
Missouri, Vickery said, the state was publishing “the HTML source to
the public internet, with no hurdles of a password or other requisite
form of authentication challenge, means the public can reasonably
assume to be authorized to view that content for the purposes of laws
related to ‘computer trespass’ forms of offense.”

The Post-Dispatch published a statement in response from its attorney,
saying the reporter “did the responsible thing by reporting his
findings to (the Department of Elementary and Secondary Education) so
that the state could act to prevent disclosure and misuse.

“A hacker is someone who subverts computer security with malicious or
criminal intent,” the statement continued. “Here, there was no breach
of any firewall or security and certainly no malicious intent. For DESE
to deflect its failures by referring to this as ‘hacking’ is unfounded.
Thankfully, these failures were discovered.”

House Minority Leader Crystal Quade, D-Springfield, said the
Post-Dispatch deserves praise for discovering a problem, not threats.

“The governor should direct his anger towards the failure of state
government to keep its technology secure and up to date and to work to
fix the problem,” she said, “not threaten journalists with prosecution
for uncovering those failures.”

X

Republishing Guidelines

▪ You must give Missouri Independent credit, including
https://missouriindependent.com and author.

▪ If you publish online, include the links from the story, and a link
to Missouri Independent.

▪ Stories may be edited for in-house style or to shorten. More
substantial changes should be noted as additional and conducted by your
publication.

▪ You can publish our graphics and any photos that are credited to
Missouri Independent with the stories with which they originally
appeared. For any other uses, you must seek permission from us at
[34][email protected]

▪ If you share the story on social media, please mention
@MO_Independent on Twitter and missouriindependent on Facebook.

▪ Don't sell the story.

▪ Don’t sell ads against the story. Feel free, however, to publish it
on a page with ads you’ve already sold.

▪ Content should not be published behind a paywall; please reach out to
the editor-in-chief if you have questions about your particular paywall
system.

Missouri governor vows criminal prosecution of reporter who found flaw in
state website

by Jason Hancock, [35]Missouri Independent
October 14, 2021

<h1>Missouri governor vows criminal prosecution of reporter
by Jason Hancock, <a href="https://missour
On Tuesday, a reporter wi
The newspaper agreed to ho
But by Thursday, Gov. Mike
“The state does not take__
Parson said he had referre
“This administration is __
According to the Post-Disp
The state removed the sear
In a press release Wednesday, the Office of Administratio
The state is unaware of any misuse of individual informat
Parson said Thursday that
“The state is committed __
Republican state Rep. Tony Lovasco, who according to his
“Journalists responsibly sounding an alarm on data priv__
Chris Vickery, a California-based data security expert, t
“That’s not a crime for the journalists discovering i____
In explaining how he hopes the reporter and news organiza
The court ruled in that case that someone <a target="_bla
The Post-Dispatch publishe
“A hacker is someone who__
House Minority Leader Crystal Quade, D-Springfield, said
“The governor should direct his anger towards the failu__
____________________________________________________________
____________________________________________________________
<a href="https://missouriindependent.com">Missouri Indep
(BUTTON) Copy to clipboard
1
[36]Creative Commons License
(BUTTON) Republish

Our stories may be republished online or in print under Creative
Commons license CC BY-NC-ND 4.0. We ask that you edit only for style or
to shorten, provide proper attribution and link to our web site. Please
see our republishing guidelines for use of photos and graphics.
Jason Hancock
[37]

Jason Hancock

Jason Hancock has been writing about Missouri since 2011, most recently
as lead political reporter for The Kansas City Star. He has spent
nearly two decades covering politics and policy for news organizations
across the Midwest, and has a track record of exposing government
wrongdoing and holding elected officials accountable.
[38]MORE FROM AUTHOR

Related News

Missouri schools with lower state funding suffered higher rates of gun
violence Missouri schools with lower state funding suffered… by
[39]Humera Lodhi September 14, 2021
Majority of Missouri congressional delegation will object to Joe
Biden’s victory Majority of Missouri congressional delegation will… by
[40]Ariana Figueroa January 6, 2021
New owners seek to revive Missouri newspapers sold by Gannett New
owners seek to revive Missouri newspapers sold… by [41]Rudi Keller
October 11, 2021

We show you the state

Democracy Toolkit //

[42]Register to vote | [43]Find your polling place | [44]Find your
legislators | [45]Election results and statistics
* DEMOCRACY TOOLKIT
+ [46]Register to vote
+ [47]Find your polling place
+ [48]Find your legislators
+ [49]Election results and statistics

[footerLogo.png]

© Missouri Independent, 2021

ABOUT US

The Missouri Independent is a nonprofit, nonpartisan news organization
dedicated to relentless investigative journalism and daily reporting
that sheds light on state government and its impact on the lives of
Missourians. This service is free to readers and other news outlets.

[50]Ethics Policy | [51]Privacy Policy
[ccwhite.png]

Our stories may be republished online or in print under Creative
Commons license CC BY-NC-ND 4.0. We ask that you edit only for style or
to shorten, provide proper attribution and link to our web site.
[52]Ethics Policy | [53]Privacy Policy
© Missouri Independent, 2021

References

Visible links
1. https://missouriindependent.com/feed/
2. https://missouriindependent.com/comments/feed/
3. https://missouriindependent.com/wp-json/wp/v2/posts/8384
4. https://missouriindependent.com/wp-json/oembed/1.0/embed?url=https://missouriindependent.com/2021/10/14/missouri-governor-vows-criminal-prosecution-of-reporter-who-found-flaw-in-state-website/
5. https://missouriindependent.com/wp-json/oembed/1.0/embed?url=https://missouriindependent.com/2021/10/14/missouri-governor-vows-criminal-prosecution-of-reporter-who-found-flaw-in-state-website/&format=xml
6. https://www.googletagmanager.com/ns.html?id=GTM-N5SMC6W
7. https://missouriindependent.com/
8. https://missouriindependent.com/
9. https://missouriindependent.com/news
10. https://missouriindependent.com/category/civil-rights/
11. https://missouriindependent.com/category/criminal-justice/
12. https://missouriindependent.com/category/energy-environment/
13. https://missouriindependent.com/category/elections/
14. https://missouriindependent.com/category/health-care/
15. https://missouriindependent.com/category/education/
16. https://missouriindependent.com/commentary
17. https://missouriindependent.com/about
18. https://missouriindependent.com/subscribe
19. https://missouriindependent.com/donate
20. https://missouriindependent.com/
21. https://missouriindependent.com/category/civil-rights/
22. https://missouriindependent.com/category/criminal-justice/
23. https://missouriindependent.com/category/energy-environment/
24. https://missouriindependent.com/category/elections/
25. https://missouriindependent.com/category/health-care/
26. https://missouriindependent.com/category/education/
27. https://missouriindependent.com/category/criminal-justice
28. https://missouriindependent.com/category/government-politics
29. https://missouriindependent.com/author/jason-hancock/
30. https://www.stltoday.com/news/local/education/missouri-teachers-social-security-numbers-at-risk-on-state-agencys-website/article_f3339700-ece0-54a1-9a45-f300321b7c82.html?utm_campaign=snd-autopilot&utm_medium=social&utm_source=undefined_stltoday
31. https://twitter.com/tonylovasco/status/1448672694065668105
32. https://revisor.mo.gov/main/OneSection.aspx?section=569.095
33. https://www.bizjournals.com/jacksonville/news/2021/10/12/supreme-court-s-decision-marks-changes-in-the-land.html
34. https://missouriindependent.com/cdn-cgi/l/email-protection
35. https://missouriindependent.com/
36. http://creativecommons.org/licenses/by-nd/4.0/
37. https://missouriindependent.com/author/jason-hancock
38. https://missouriindependent.com/author/jason-hancock
39. https://missouriindependent.com/author/humera-lodhi/
40. https://missouriindependent.com/author/ariana-figueroa/
41. https://missouriindependent.com/author/rudi-keller/
42. https://www.sos.mo.gov/elections/goVoteMissouri/register
43. https://voteroutreach.sos.mo.gov/PRD/VoterOutreach/VOSearch.aspx
44. https://house.mo.gov/legislatorlookup.aspx
45. https://www.sos.mo.gov/elections/s_default
46. https://www.sos.mo.gov/elections/goVoteMissouri/register
47. https://voteroutreach.sos.mo.gov/PRD/VoterOutreach/VOSearch.aspx
48. https://house.mo.gov/legislatorlookup.aspx
49. https://www.sos.mo.gov/elections/s_default
50. https://missouriindependent.com/ethics-policy
51. https://missouriindependent.com/privacy-policy
52. https://missouriindependent.com/ethics-policy
53. https://missouriindependent.com/privacy-policy

Hidden links:
55. https://twitter.com/MO_Independent
56. https://www.facebook.com/missouriindependent/
57. https://twitter.com/intent/tweet?text=Missouri+governor+vows+criminal+prosecution+of+reporter+who+found+flaw+in+state+website&url=https%3A%2F%2Fmissouriindependent.com%2F2021%2F10%2F14%2Fmissouri-governor-vows-criminal-prosecution-of-reporter-who-found-flaw-in-state-website%2F&via=MO_Independent
58. https://www.linkedin.com/shareArticle?mini=true&url=https://missouriindependent.com/2021/10/14/missouri-governor-vows-criminal-prosecution-of-reporter-who-found-flaw-in-state-website/&title=Missouri+governor+vows+criminal+prosecution+of+reporter+who+found+flaw+in+state+website
59. https://www.facebook.com/sharer.php?u=https%3A%2F%2Fmissouriindependent.com%2F2021%2F10%2F14%2Fmissouri-governor-vows-criminal-prosecution-of-reporter-who-found-flaw-in-state-website%2F
60. https://missouriindependent.com/cdn-cgi/l/email-protection#c2fdb1b7a0a8a7a1b6ff8fabb1b1adb7b0abe9a5adb4a7b0acadb0e9b4adb5b1e9a1b0abafabaca3aee9b2b0adb1a7a1b7b6abadace9ada4e9b0a7b2adb0b6a7b0e9b5aaade9a4adb7aca6e9a4aea3b5e9abace9b1b6a3b6a7e9b5a7a0b1abb6a7e4a3afb2f9a0ada6bbffaab6b6b2b1f8ededafabb1b1adb7b0ababaca6a7b2a7aca6a7acb6eca1adafedf0f2f0f3edf3f2edf3f6edafabb1b1adb7b0abefa5adb4a7b0acadb0efb4adb5b1efa1b0abafabaca3aeefb2b0adb1a7a1b7b6abadacefada4efb0a7b2adb0b6a7b0efb5aaadefa4adb7aca6efa4aea3b5efabacefb1b6a3b6a7efb5a7a0b1abb6a7ed
61. https://missouriindependent.com/2021/10/14/missouri-governor-vows-criminal-prosecution-of-reporter-who-found-flaw-in-state-website/
62. https://missouriindependent.com/cdn-cgi/l/email-protection#38525059565b575b537855514b4b574d4a5151565c5d485d565c5d564c165b5755
63. https://twitter.com/J_Hancock
64. https://missouriindependent.com/2021/09/14/missouri-schools-with-lower-state-funding-suffered-higher-rates-of-gun-violence/
65. https://missouriindependent.com/2021/01/06/majority-of-missouri-gop-congressional-delegation-will-object-to-joe-bidens-victory/
66. https://missouriindependent.com/2021/10/11/new-owners-seek-to-revive-missouri-newspapers-sold-by-gannett/
67. https://missouriindependent.com/cdn-cgi/l/email-protection#751c1b131a35181c06061a00071c1c1b111005101b11101b015b161a18
68. https://twitter.com/MO_Independent
69. https://www.facebook.com/missouriindependent/
70. https://apple.news/TbCHy-UAGTMK_lHEy3w_Dvg
71. https://missouriindependent.com/cdn-cgi/l/email-protection#b2dbdcd4ddf2dfdbc1c1ddc7c0dbdbdcd6d7c2d7dcd6d7dcc69cd1dddf
72. https://twitter.com/MO_Independent
73. https://www.facebook.com/missouriindependent/
74. https://apple.news/TbCHy-UAGTMK_lHEy3w_Dvg