Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting | Hacker News Reader

Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

krebsonsecurity.com

458 pointspicture131 comments

https://news.ycombinator.com/item?id=28866805

Missouri Gov. Mike Parson (R) .. vowed his administration would seek to prosecute and investigate .. anyone who aided the publication in its "attempt to embarrass the state and sell headlines for their news outlet."

Embarrassing governments is the natural outcome of the press doing it's job. This is what the extra constitutional protections are for.

There’s no extra constitutional protections. It’s all under free speech. Everyone is equal.

x1000 this.

The freedom of the press is a right granted to all citizenry of the United States, not a specialized permission granted to an elite caste.

The freedom of the press isn’t about cast, but it is about context.

For example based on Chaplinsky v. New Hampshire it’s constitutional to prohibit “fighting words.” Which would mean some things are fine in print but you can’t say to someone’s face because they would provoke violence.

Really appreciate this example.

It was added as an amendment, therefore it is an extra constitutional protection. Some people (a broad coalition that included both Federalists and anti-Federalists) were concerned that the Constitution, as originally written, did not ensure a protection of human rights. That's why they pushed through the Bill Of Rights.

But he’s not speaking in his capacity as the individual and citizen Michael Parson. He’s speaking in his capacity as Governor Michael Parson. We know this because he’s threatening to use his governing powers to employ government resources.

Whether state actors have a right to free speech is not, as I understand it, a settled matter of law.

This is why my outlook on the future is growing dim. Politicians are threatening revenge, using the power and purse of the state, against people who embarrass them.

This is as old as the country itself, the constitution is stronger than these thugs.

The US state has successfully suppressed free expression in a number of instances (Henry Miller and Wilhelm Reich come to mind).

The US isn't special as a democracy and it's been pretty shoddy at quite a number of times, though now isn't necessarily the worst moment. The constitution is only strong on free speech and freedom of the press if people defend it.

Edit: It's especially notable that the degree that governments in the US are run as personal fief where officials lash out at anyone who inconveniences them (as is happening here), is strongly related to how far the government is from urban centers.

I live in LA and its full of personal fiefdoms. I think you just see more talent at obfuscating it.

Your edit reminds me of an absolutely insane article I read a few days ago about an elected Juvenile Court Judge in Tennessee: https://www.propublica.org/article/black-children-were-jaile...

> though now isn't necessarily the worst moment.

Chattel slavery, the Civil War, the Trail of Tears, the internment of Japanese Americans... need I go on? Anybody who thinks America might be in a worse state now than ever before needs a serious reality check.

> the constitution is stronger than these thugs.

The Constitution is exactly as strong as the people who don’t dismissively pretend it is self-enforcing.

Alien and Sedition acts argue otherwise.

I do believe the 2nd President successfully jailed journalists for this for years, leading to the Supreme Court deciding to you know, do something about it.

Things are only as strong as the political will believes they are strong. There was a period in the 1800s where the Supreme Court was ignored for example. The Supreme Court of the late 1700s did want to protect the 1st Amendment and they did win the political battle vs Adams. But under different circumstances, a different result could have very much happened.

Media used to have more dry powder for fights before Facebook and Google intermediated everything.

Politicians are always threatening revenge for stuff like this, for as long as there has been politics.

It is only concerning if the threat is successful.

The only thing that would lead it to being successful is if people are convinced that the attempt itself isn't alarming, and don't act aggressively to do something about it.

Peacefully donating to the ACLU should be sufficient, I don't agree that violence is presently warranted. If the courts fail, then we can talk.

Funding openly Bolshevist legal trolls "for world peace" seems good idea.

Exactly. Thank you nosy media. This anti-press stuff started with Trump. Terrifying how authoritarian the right has become.

Reporters, please continue “embarrassing” all states. The sane leaders and citizens will be thanking you.

> This anti-press stuff started with Trump.

* gestures vaguely in the direction of Richard Nixon, waits for historians to chime in with earlier examples.

If ‘kizer had said “was extremely increased” by Trump it would be an accurate statement.

It’s frankly one of the planks of the shadow platform of the Trump Republican Party that journalists are enemies.

I'll leave this here:

https://en.wikipedia.org/wiki/Censorship_in_the_United_State...

Trump literally called the press the enemy of the people.

Traditionally, that's the sort of rhetoric a leader uses when they're about to send out the hit squads.

Everyone is kind of right here. I'd phrase it this way. R administrations expand the attacks on journalists (and everyone who exposes Gov wrongdoing) that were done by previous D administrations.

Trump's method to reduce accountability was to nurture animosity specifically against journalism. Behind the scenes, his admin's revenge on whistleblowers carried on pretty much the same as his predecessors.

My long position is that US press coverage has been continually (but not exclusively) deferential to authoritarianism. We see that US coverage of unconstitutional executive domestic actions is often nonexistent, until whistleblowers drag news orgs into doing their jobs (Mark Klein's evidence of NSA+AT&T collusion wasn't enough to overcome the giant press yawn. Snowden's mountain of evidence was impossible to ignore.)

The US press is somewhat better at covering the misdeeds of R administrations than of D administrations (eg: US coverage of Holder's efforts to target journalists was muted, at best.) The difference is primarily a matter of competence. We've proven repeatedly that focusing on bias instead of ineptitude just leads to the 'view from nowhere'.

> Richard Nixon

There's a case that Spiro (“nattering nabobs of negativism”) Agnew is a better Nixon-era example than Nixon himself, not that it started then, either.

I highly recommend The Boys on the Bus by Timothy Crouse[1] for some fantastic contemporaneous analysis of Richard Nixon and his relationship with the press. One part that stood out to me: Crouse believes (and presents compelling evidence) that Nixon was one of the first presidents to really understand the press, particularly the press of the nascent information age. Goldwater and Agnew were of the more reactionary anti-press strain, as other commenters have noted; Nixon (per Crouse) genuinely loved the press (if not reporters themselves) and relished in his control over it.

[1]: https://en.wikipedia.org/wiki/The_Boys_on_the_Bus

Anti-press goes back decades, centuries even.

Calling it a left/right issue just diverts from the real problem of government overreach and negative reaction to the exposure of malfeasance.

If you seriously think anti-press is a Trump phenomenon, I encourage you to look into the creation and use of the Alien and Sedition acts.

Or maybe how Lincoln treated press that was not acting as a propaganda arm of the Federal government.

If you want a more contemporary example, take a look at Obamas use of wiretapping against journalists and other attacks on press freedom.

When you treat this as a thing that only happens because of one "side", nothing is done to address the root cause.

> Calling it a left/right issue just diverts from the real problem

Alternatively, arguments like that divert from the "real" problem that half of the political discourse of this country is predicated on an "anti-press" sentiment that allows political actors to lie at will.

Yes, there have been abuses against journalists throughout history. And because of that, it's possible to take a long view that "journalism" as a whole will win, given at least a little protection. Society will survive the occasional corrupt leader. It always has.

But the current climate where republicans can simply ignore reporting by mainstream outlets and cite their own alternative media instead is somewhat unique, historically. Something like two thirds of republican voters simply... don't believe in the results of a recent election, because their thought leaders won't tell them straight what the results were. This seems like rather a more pressing threat to democracy.

The Julian Assange fiasco predates Trump's rise to power, and was (at least in my opinion) a very clear anti-press action on the part of the US.

Though it got much more dire under Trump..

https://www.theguardian.com/media/2021/sep/27/senior-cia-off...

And suppressing opposition is the natural outcome of the government doing its job. The problem isn’t whether one group or another is “doing its natural job.” The problem is that what the reporter is doing is good, and what the government is doing is bad.

"And suppressing opposition is the natural outcome of the government doing its job. " - no it isn't. It's the natural outcome of shitty people being elected. The JD isn't "jackboots on necks" or whatever.

> no it isn't. It's the natural outcome of shitty people being elected.

Okay, well it's the outcome of literally every government of non-trivial size and duration.

Your original intention, I believe, was to comment on the natural tendency of the system we've put in place. The phrasing "doing their job" has a slightly different implication, I think, of a system doing what it's "supposed" to do and not what it actually does.

Then the question is who is doing the "supposing"? I'd say if every government I've ever seen or heard of routinely engages in suppression of opposition, I'm going to suppose that the next government I encounter will as well. It's not like these are random government employees doing the suppression unprompted: they are in roles expressly intended to suppress opposition.

> attempt to embarrass the state

I hadn't realised the US had kept lèse-majesté when it broke with the UK (even in the UK, the last prosecution was in 1715, so this is particularly retro of his governorship...)

This governor needs to face a recall election or civil lawsuits for this idiotic threats and lies.

We don’t do recall elections in Missouri.

Also, sorry about Governor Hee Haw. We know he’s an embarrassment.

Missouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million

Talk about waste of resources.

I could totally fix it for $49 million. /s

This is a race to the bottom and why tech workers need to unionize. Soon someone could be fixing it for a measly $1 million. /s

Contractors in Missouri must be drooling in anticipation.

I would absolutely love to know who provided that estimate and how they arrived at that number. I understand that issues are often far more complex than they appear but this just seems ridiculous.

I know right. An immediate fix shouldn’t cost anything, right? Just don’t send social security numbers to the browser.

Turns out a bunch of other systems rely on this bug to fetch information, and no-one's entirely sure where they are, who's responsible for them, or what they do. Also the page is auto-generated though some arcane CMS such that it's really hard to figure out how to get the data off that page while keeping it other places where it needs to be, without restructuring the whole thing. Also deployment is manual and you'll need to go back and forth with some unrelated department for months to make it happen. Also there's no testing environment, no information about how to get it running—let alone any useful scripts or config/deployment management—is in the repo or otherwise available at all, and there are no tests. And it's all written in an unholy combination of ASP.NET and Java server pages. And the "database" is a standards-nonconforming CSV.

(pure speculation)

Cheap solution: put a proxy in front like Cloudworker/Lambda and modify the HTML before it gets sent to client.

Yeah maybe the current system is an emalgamation of 20 such cheap solutions accrued over decades. If they are not i a crisis, they should do ot properly

Remove SSN field from DTO - 49 million

Invoice Fee - 1 million

Not bad for -1 lines of code.

I mean it wouldn’t be a weekend fix because it’ll have to involve an audit of all existing systems to identify where else similar tomfoolery occurred.

But 50 million is a high estimate.

30 minutes removing a piece of output: $100

Knowing where sed output is generated: $49.9999M

> Knowing where sed output is generated

Is the use of "sed" intentional or a typo? Either way, I love it.

Seems quite intentional. As it is a levenshtein distance of 2, along with i being physically far away from e and a on most commonly used keyboard layouts.

What are the odds it will be going to someone he knows?

It's a disgrace the agency who produced this website is not liable for this substandard quality.

How crazy is it that code like this is deployed to production and then the customer has to pay 50 million to get it up to standards? The senator should be ashamed they are being scammed like this.

> fixing the flaw could cost the state $50 million

It's hard to imagine the kind of contorted bureaucracy that could turn such a fix into a $50 million change request, and yet, I wouldn't be surprised at all if it did cost that much.

Governor’s cousin need to eat, too.

A minor but important correction. Krebs wrote that the Gov claimed that “fixing the flaw could cost the state $50 million.” That’s not quite right. In the press conference linked in Kreb's post, the Governor actually claims that the “incident alone may cost Missouri taxpayers up to $50 million.” I’d guess this number includes an estimate for the legal cost of dealing with the data breach plus any statutory penalties the state might incur (plus a grossly inflated price for fixing the bug).

> “And then to react in this way where you don’t say ‘thank you’ but actually turn on the reporter and researchers and go after them…it’s just weird.”

it's not "weird", it's an elected official trying to deflect from being exposed as completely endangering the PII of state employees. while trying to bring charges here is ridiculous, it might not be the case in a few years as we watch the continued crumbling of institutions, where bad faith arguments made up on the fly by anyone in power become excuses to do anything. like trying to extort the government of Ukraine to work on behalf of the official's personal reelection campaign, for example.

It's kind of weird. After all, it's not like the governor is directly responsible for the flaw. Even if his opposition could have indirectly linked his administration to the flaw, his response has certainly done far more damage to his reputation than that ever could.

Most likely voters don't understand how computers work. I'm not sure it'll matter much.

I’m fairly sure he doesn’t understand. Language used makes it sounds he has no clue how html works.

Back in 90s, I was constantly being accused of hacking things just for knowing how to build a website. This was also the era of when the news would run phone polls on whether the Internet should be allowed or not.

I learn to keep my mouth shut about what I could do unless I was sure it was a tech savvy crowd.

This dude brings back a lot of those memories

> This was also the era of when the news would run phone polls on whether the Internet should be allowed or not.

Given the way things are going, perhaps we should revisit this decision. It seems that there's a population that isn't quite ready for this level of access to [mis]information.

> This was also the era of when the news would run phone polls on whether the Internet should be allowed or not.

Clearly, people answered those polls incorrectly.

It should definitely not be allowed.

I agree. Only elites should be allowed to use stuff like LSD, computers and the internet. This can be arranged simply by criminalising it; along with a social convention that elites don't get prosecuted. /s

No, no, no. More LSD. Less Internet.

For more complex cases this could be an issue, but this one is dead simple: you could do "view source" and see teachers' social security numbers. If they go to trial this case will be laughed out of court.

I still think the governor can be seen as indirectly responsible, since this is a result of insufficient security auditing.

I wouldn't be surprised if the governor acted more because he sensed an opportunity than out of fear of the story. By playing the story this way, he gets to act out the feelings of a constituency that feels judged by educated urbanites and unable to keep up with a changing world. He is standing up for the honor of Missouri against the sneering condescension of the fancy city reporter. From that point of view, he isn't dealing with a threat so much as feasting on a political opportunity.

Right, or allegedly trying to extort the government of Ukraine to end an investigation against the official's relatives. Corruption on all sides unfortunately.

which would also be bad! however, my example actually happened.

Yes, as did mine (allegedly.) See <https://www.washingtonpost.com/politics/2020/10/14/hunter-bi...>

It seems that in both cases the accused was acquitted or the investigation against them was closed. That's hardly a reasonable indicator of innocence though, as just like you said above, powerful people can often make up excuses to get away with crimes and corruption scot-free. You might be entirely right that one example really happened and the other didn't.

The underlying issue here is that there is no national legal standard for responsible disclosure. ...and with all the news of foreign ransomeware gang causing havoc, prosecutors and politicians are HUNGRY to prosecute "hackers".

My advice to a client would be not to disclose any vulnerability on a government system, due to the unfortunate legal liability. ...and if they did feel the need to disclose (which I admire), to do so anonymously to a 3rd party security researcher with the history and reputation for that sort of work (ie a reputation that even an old IT-clueless judge cannot deny).

Don't put yourself in the cross-hairs of some overzealous prosecutor who wants to show his boss/party/public that he's the one prosecutor that busted a bunch of evil hackers.

> “hacker took the records of at least three educators, decoded the HTML source code, and viewed the social security number of those specific educators.”

There's so much wrong here - am I to understand that if the state sends you SSNs in plaintext and you read them, _you're_ at fault?

Only if you decode the plaintext with your eyes.

> if the state sends you SSNs in plaintext

No no no. It was decoded from HTML, a process so complex Chrome is able to consume an entire modern desktop computer doing so.

This is so idiotic. Does Missouri really want to discourage people from reporting security vulnerabilities? It sounds like this reporter did the responsible thing and alert all affected parties. I can almost guarantee that if a decent person found this, a dozen less-decent people did too. If a decent person is afraid to report a security issue, even more less-decent folks are going to have access to this information.

Don’t try to bring logic, reason, and/or prudence into it — this is politics, which is a whole other thing.

I think the governor ought to resign. He’s taking something that is, ultimately, HIS fault and trying to pin it of course on “the media”. The SSN numbers were in the page; they were in the source code. “View source” is not decrypting a webpage. God, I know he just has no technical understanding but even then he should be smart enough to get the details and realize they weren’t “hacked”. This person clearly doesn’t understand what a free press is —- they could have legally ran the story without even alerting the state agency, but they did the right thing and this idiot governor is still trying to deflect blame.

As a citizen of the pitiful state, we tried to vote him out last election cycle. He wasn’t even elected before this, something along the lines of Nixon’s transfer of power to Ford is what happened in my state.

Yet he was re-elected.

Apparently, the SSNs were all embedded directly in the HTML file. Like … what?

    </tr><!--- {{ str(row) }} --->

I don't find it TOO much of a stretch....

(I don't know what it actually looked like in the html, just saying I could see it happening pretty easily)

When I was a student at DeVry University (a national for-profit college with 40 campuses) your SSN was your student ID. This wasn’t corrected until 2002 or 2003. :(

This was common at many schools.

My high school rolled out an ID system in 1998 using SSNs printed on every ID (staff and students). About a week later, they realized this was a bad idea and reissued 1000+ IDs without the SSN.

I still don’t know what the point of the ID cards was. They were just laminated paper, no RFID, magstripe, or barcode to open doors or to buy things from the cafeteria or school store. You didn’t need it to check out books from the library and no one ever asked to see it. And we got a new one every year.

I guess some vendor convinced the school that they needed ID cards and so they got them.

Your SSN was your driver's license number in 29 states until 2004, when Bush outlawed the practice.

Many, many institutions in the USA are built on it being a high-trust society. Now that it's falling into a low-trust state, we can expect those institutions to fail, and perhaps the state to as well.

They weren't supposed to be used as any kind of important, general ID number. It took various governments and institutions a long time to wake up to the reality that, because we really, really need such an ID and the government has displayed no intention of ever creating one, social security numbers had been forced into the role by necessity.

Kind of a nitpick, but presidents don't outlaw things. Laws passed by Congress do that, and you're right, it was in 2004. Bush signed the law, but it passed by a huge majority.

https://www.ssa.gov/legislation/legis_bulletin_010705.html

I'd initially phrased it "Bush signed a bill that outlawed...", which is much more correct, but is also an awkward sentence construction to read. Figured people would understand what I meant.

...this is also an apropos discussion for this topic, where the Missouri governor is framing this discussion in a way that's technically false but is going to score points with his constituents.

> Many, many institutions in the USA are built on it being a high-trust society. Now that it's falling into a low-trust state, we can expect those institutions to fail, and perhaps the state to as well.

Not enough people understand this, but I'm encouraged whenever I hear from those who do.

This raises the question of how we start planning now to build more appropriate institutions to avoid societal failure.

Locally, generally. Remember Gall's Law: "A complex system that works is inevitably found to have evolved from a simple system that works." Also much easier to rebuild trust in a smaller community.

I'd kinda love to blog about blue-sky social theories, but I suspect that without grounding in actual working social systems, they would remain theories.

Using your SSN for your driver's license would have been fine in a society where the SSN wasn't also being treated by banks etc. as a way to authenticate you for credit/loans/accounts.

Irving Campus ? I was there for those years.

If they were using a server-side rendering framework then what probably happened is that they used HTML comments instead of template engine comments to "remove" the SSN <td />s without understanding the ramifications.

Oh hey, my home state is on Hacker News!

Oh... sigh.

hugs

My home state is Florida. It will be alright.

As a fellow Florida-raised human, I feel your pain.

Being from Texas, I feel like Texas and Florida are in a race to wherever it is they think they are going. I feel like there needs to be a state level rivalry like colleges. Brings a new meaning to Texas State vs Florida State. Maybe they can have halftime shows too. I also think state laws should be copyrightable so that when other states copy their asinine laws, the originating state gets royalties.

Just to make sure that I got both experiences, I also lived in Texas for three years after leaving Florida.

You are a glutten for punishment! I moved out of Texas and moved to the west coast for a bit. I then eventually moved back to Texas for family reasons. Moving back was much worse of culture shock. Yes, I knew what to expect, but after being away from it and then dropped back in just reminds you of how bad different it is. Kind of like a boiling frog growing up, but then being the lobster as an adult.

I just moved to Florida after New York completely lost the fucking plot. Literally my neighborhood (Hell's Kitchen) reverted to its 1980s self, street-walking prostitutes included. Homeless encampments as far as the eye can see.

Loving it here so far.

Thanks for your input.

(waves from Texas)

Like most Missourians I know (mostly who have left their state though), it's fair to say that you've transcended where you're from.

Thanks for all you've done -- I use your work daily.

Right there with ya (my home state is NC).

At least y'all have beaches and something resembling real mountains. :-/

They gave notice and waited until the offending pages were taken down. The article does not specify what the original html looked like, it could be a simple artifact from testing, when someone dumped the entire object into a template for debugging or maybe they actually were using this as a sort of a data field and then used it, for example, in a js call call to served.

But the response from the AG shows they have no idea how internet works: “They had no authorization to convert or decode, so this was clearly a hack.”

Bigger questions: Who developed the system? Was it a contractor or in-house? If it was a contractor, are they gonna lose government contracts? Because, it sounds like they should. If it was in-house, are they gonna get training or some procedure in place to audit things going forward?

This is exactly what happened to weev. He found that information that was intended to be private was made publicly available by AT&T.

Weev went to prison for typing in URLs that he should not have. They were criminal URLs, just loke thess.

Kind of... The AT&T data wasn't public, Weev & Co. had to build a script to generate plausible ICCIDs which they then 'challenged' the AT&T servers with the URL containing the ICCID. If it was a valid iPad ICCID and registered with AT&T, the server would reply with the email address registered to it.

That seems materially different to just F12ing a website and seeing plaintext Social Security numbers.

How on earth in any reasonable estimate of what it costs to solve this problem does he come up with a crazy wack-a-doodle estmate of 50 Million? Also if they just fixed the problem when notified (prior to releasing the story) and kept a low profile we would be less likely to be reading about it. What a moron!!!!

Also, if the owners of the web site had spent a couple of dollars on a Pen-Test they would have found this low hanging fruit long before it got into production.

This is embarrassing, so lets pretend it's a crime for the reporter to report the truth. This tactic might work for the NSA, but I hope it doesn't work here.

This type of response by a high level public official is not excusable in 2021, maybe in 2005 or 2010, but it's 2021 now.

> there was no option to decode Social Security numbers for all educators in the system all at once

Sure, but this was an application where you could search for any licensed educator and get their social security number in the response. This is about as bad a PII leak as can happen to a state government.

This reminds me of the US senator demanding that FB commit to ending 'finsta'. He clearly had no idea what that term means. https://www.youtube.com/watch?v=TGt1Ukg7q4Y

I understand the mistake of being born in MO. I understand the mistake of settling there long ago.

I have minimal sympathy for those who have chosen to stay recently.

I have contempt for those who would move there now, or seek out business there.

I wonder if the page in question is cached in the internet archive.

Dupe: https://news.ycombinator.com/item?id=28866805

> for reporting

Fake news. The progressive crook wanted for exploiting and disclosing the data, not for reporting.

Actually, Krebs-on-security should know where a line drawn.

Is this the beginning of the War on Developer Tools?

Not likely. More likely the start of law suits against information technology owners who provide insecure access and threaten people.

> fixing the flaw could cost the state $50 million

Ummmmm how does something need that much money for a bug fix???

I'd be happy to fix it for half.

Dupe

Seriously though, it deserves to be said again. The website operators are negligent, IMO.

duplicate: https://news.ycombinator.com/item?id=28866805

It is like pipes.

or tubes

$50m to fix? Seems a little ridiculous…

flagged as duplicate @dang

Reply on news.ycombinator.com