A reporter from the St. Louis Post-Dispatch this week alerted Missouri education officials that a state website that lists teachers’ names and certification status had a flaw: the page returned the numbers. teachers’ social security readily available.
The Post-Dispatch also notified the teachers’ union and waited two days for the state to resolve the issue before publishing an article on Thursday revealing the safety issue.
To many, it sounded like the kind of surveillance reporting that many news agencies see as the hallmark of responsible journalism. But Governor Mike Parson of Missouri had a different point of view.
At a press conference Thursday, he said he asked prosecutors and the State Highway Patrol to investigate the journalist, whom he accused of “hacking” private information of teachers.
“This individual is not a victim,” Parson said at the press conference, without identifying the reporter or The Post-Dispatch. “They were acting against a state agency to compromise teachers’ personal information in an attempt to embarrass the state and sell titles for their media.”
He added, “We will not let this crime against teachers in Missouri go unpunished.”
The announcement infuriated journalists, other news outlets and media rights groups, who said the journalist was threatened with a criminal investigation for doing his job.
“The newspaper and the reporter did nothing wrong,” said Mark Maassen, executive director of the Missouri Press Association. “It is not uncommon for elected officials to blame the media for cases like this. But, in this case, The Post-Dispatch and their reporter should be applauded for uncovering a serious loophole and alerting the state agency. “
Missouri State Highway Patrol spokesman Captain John Hotz said the agency was “investigating potential unauthorized access to Department of Elementary and Secondary Education data.” He declined to comment further.
Locke Thompson, the Cole County district attorney, said his office will review the State Highway Patrol’s findings.
“Once the investigation is complete, I will review the evidence and determine if criminal charges are appropriate,” he said.
In a statement, Ian Caso, president and editor of The Post-Dispatch, said he was “grateful” for the work of Josh Renaud, a designer and news developer who revealed the story of problems with the website. , which is administered by the Missouri Department of Elementary and Secondary Education.
“I think he should be commended for his work and his sense of duty,” said Caso. “We are surprised and disappointed with the Governor’s response and deviation.”
Joe Martineau, an attorney for the newspaper, said it was “unfounded” for education officials to hijack failures in their computer system by describing Renaud’s report as a hack.
“A hacker is someone who subverts computer security with malicious or criminal intent,” he said. “There has been no firewall or security breach here, and certainly no malicious intent.”
The Post-Dispatch said the social security numbers of teachers, administrators and counselors were “present” in the HTML source code of the publicly accessible pages of the website. The source code for a web page can usually be found by right-clicking on it and scrolling to “view page source”.
Mr Parson, a Republican, said it was “illegal to access data and encrypted systems in order to examine the personal information of other people.”
He cited a state law that said a hacker was anyone who had gained unauthorized access to information or content. He said the reporter had no permission to “convert or decode” the information on the website.
“It was clearly a hack,” Parson said, adding that the state would investigate any loopholes found in the system.
Legal observers said they were puzzled by Mr Parson’s interpretation of what constituted hacking.
Frank Bowman, a professor of law at the University of Missouri School of Law, said it was hard to imagine the prosecution of a reporter who alerted state officials to information he had findings by examining a publicly available website.
The odds of prosecutors going after Mr. Renaud, the reporter, “are between zero and zero,” Professor Bowman said. “They’re not going to embarrass themselves like that.”
Tony Lovasco, a Republican state representative with professional computer training, said the governor’s announcement showed “a fundamental misunderstanding of both web technology and industry standard procedures for reporting vulnerabilities in security”.
“Journalists who responsibly sound the alarm on data privacy are not criminal hacking” he said on Twitter.
Teachers across the state were shocked to learn of the loopholes in the system, said Byron Clemens, spokesperson for the American Federation of Teachers local, St. Louis Local 420, adding that it was theirs. advised to obtain a copy of their credit reports to ensure that their information has not been compromised.
“It’s a shame the governor is trying to politicize what used to be a public service,” Clemens said, referring to The Post-Dispatch story.
Sandra Davidson, a professor at the Missouri School of Journalism, said while she was pissed off by the governor’s aggressive response, she said it could lead to more cutthroat reporting.
“Would it infuriate reporters, editors and publishers so much for the governor to make that kind of threat that it actually emboldens reporters?” Asked Professor Davidson.
The Post-Dispatch continued to follow the story on Friday.
He has published another article on the subject – this one examining the “massive computer failures” plaguing the state of Missouri.