Missouri Gov. Mike Parson’s wacky but chilling public persecution of a journalist he accused of “hacking” a state education website has thankfully been put to an end. Despite all the ruckus, apparently Parson still does not know what hacking actually means.
Cole County prosecutor Locke Thompson has decided not to pursue criminal charges against Josh Renaud, a journalist for the St. Louis Post-Dispatch who discovered a gaping cybersecurity hole in the Missouri Department of Elementary and Secondary Education website and published a story on it last October. The cybersecurity flaw left the social security numbers of more than 100,000 school teachers, administrators, and counselors exposed to the public.
In a statement published on Friday, Thompson thanked the governor for passing along his concerns and said his office had a zero-tolerance policy for the “unauthorised taking and using of the personal information of any person.”
“There is an argument to be made that there was a violation of law. However, upon a review of the case file, the issues at the heart of the investigation have been resolved through non-legal means,” Thompson said. “As such, it is not in the best interest of Cole County citizens to utilise the significant resources and taxpayer dollars that would be necessary to pursue misdemeanour criminal charges in this case. The investigation is now closed, and the Cole County Prosecutor’s Office will have no further comment on the matter.”
Renaud found the vulnerability by simply inspecting the website’s publicly available HTML source code, which had the teachers’ private information embedded in it, and responsibly reported it to the education department. The Post-Dispatch delayed publishing his story to give the state time to safeguard the exposed information as well as confirm that none of its other websites contained similar flaws.
While emails show that state officials originally planned to thank the paper for its discovery, those plans seem to have been scrapped by the governor, who decided to blame Renaud for the state’s cybersecurity failures and accused him of “hacking.”
“This matter is serious. The state is committing to bring to justice anyone who hacked our system and anyone who aided or encouraged them to do so — in accordance with what Missouri law allows AND requires,” Parson said on Twitter on Oct. 14. “A hacker is someone who gains unauthorised access to information or content. This individual did not have permission to do what they did. They had no authorization to convert and decode the code.”
Experts were quick to point out that Parson obviously didn’t know what hacking meant and that viewing public HTML source code, which anyone can do, is not hacking. That did not stop the governor, however, from attacking Renaud and the Post-Dispatch. His political action committee, Uniting Missouri, even released a strange video accusing the outlet of “exploiting private information,” which it did not do.
A statement from Parson’s office given to Missourinet on Saturday maintained that the incident was a hack, but seemed to back off the governor’s crusade.
“The hacking of Missouri teachers’ personally identifiable information is a clear violation of Section 569.095, RSMo, which the state takes seriously. The state did its part by investigating and presenting its findings to the Cole County Prosecutor, who has elected not to press charges, as is his prerogative,” Parson’s office said, according to Missourinet. “The Prosector believes the matter has been properly addressed and resolved through non-legal means. The state will continue to work to ensure safeguards are in place to protect state data and prevent unauthorised hacks.”
Renaud expressed relief over the prosecutor’s decision in a statement on his personal website but said it did not “repair the harm done to me and my family.” He maintained that his actions were legal and in line with journalistic principles.
The Post-Dispatch reporter called Parson’s treatment of him “political persecution of a journalist.”
“I am concerned that the governor’s actions have left the state more vulnerable to future bad actors. His high-profile threats of legal retribution against me and the Post-Dispatch likely will have a chilling effect, deterring people from reporting security or privacy flaws in Missouri, and decreasing the chance those flaws get fixed,” Renaud said.