Reporter who told Missouri officials of website flaw did 'nothing out of line'
statescoop.com
statescoop.com
> In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.”
> But in the press release, DESE called the person who discovered the vulnerability a “hacker” and said that individual “took the records of at least three educators”
This squares perfectly with my own experience. As a middle schooler I had several interactions with my school system's IT department where they baselessly accused me of hacking and malicious intent; I responsibly disclosed a method of bypassing their web content filter and they responded by going through my roaming profile and leveling charges at me of "remotely hacking computer systems" because of a screenshot of a terminal emulator they found. I was a good kid with a perfect disciplinary record. In retrospect it was a series of incompetent staffers covering for their inability by bullying a child.
The US needs to stop using public facilities (schools, the military, etc) as white-collar welfare and hire more people that actually care. Ignorance is forgivable but when combined with a steadfast opposition to personal growth it becomes malicious. It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit.
*EDIT: To clarify for anybody that would read the above as "government workers don't care": there are plenty that do. I break bread with them and want them to be able to do their jobs unimpeded by the ones that _don't_.
One thing to note is that hiring skilled IT workers is often outside budget capabilities. It’s not that they want to hire someone incompetent, they simply can’t afford to hire someone competent.
One of the more interesting possible outcomes of a UBI I hope to see in my lifetime is the ejection of many of the seat-warmers currently occupying IT positions in western public sector organisations.
Anyone on a power trip is playing this game with passion, more than a merely seat-warmer.
It is malicious intent the whole way down.
An old friend of mine teaches the first year CS curriculum at a local university. By all reports he’s phenomenally good at his job. He truly cares and his students adore him. But he’s making a fraction of the salary he could be making in industry. At some point he’s probably going to quit to do a job he’s not as good at, and doesn’t enjoy as much. Why is he paid many times less than he’s worth? Because the university wants to pay CS lecturers who teach 2000 students the same as they pay people who teach poetry to a class of 5. So my friend can’t get a competitive salary without entire departments revolting. Who’s fault is that? I don’t believe it’s malicious intent. It’s just a boring, systematic failure high up in the org chart leading to bland mediocrity. The only people who can do something about it don’t care about outcomes enough to fix the problem.
In other words, malicious intent the whole way down. Though I'm sure it feels good to blame the faceless "bureaucracy" and leave it at that...that way no one has to take responsibility.
Its possible we're using different definitions though. Malicious intent sounds to me like "I am glad you are underpaid because I enjoy your misery". Or "You might be suffering but I don't care." I can count on one hand the number of people I've heard about in the workplace who are like that.
On the other hand, go talk to people near the top of any medium-to-large org chart. You'll find a mountain of people who feel like they're overwhelmed by the minutia of the company's day to day concerns, and they don't have time to do strategic leadership. That they aren't meeting the demands their role is placing on them. Or they're failing the people below them in the org chart due to their own vague mediocrity.
I don't think hating people in this position helps. Your scorn isn't going to magically make them better at their jobs. I see it as a symptom of our crappy organisation structures failing at larger sizes. We habitually centralize power into the hands of a few people. And then the people at the top of the org chart are overwhelmed by choice and indecision. And the people at the bottom are knowledgable but powerless, and are structurally forbidden from solving their own problems. (Or, sadly, people develop a learned helplessness about solving problems in the organisation at all.)
Maybe I'm wrong, but does University gain more profit from a class of 2000 students? If so, could it be the case that your friend does not sell himself at a market price for the teaching position? Probably there's another place which pays more for similar teaching.
There's no blame at all, sometimes people like to sell their time mostly not for money, but for emotions, that's completely understandable.
But I can also see an argument that more advanced classes in later years (eg Advanced AI) are at least as valuable for the university compared to earlier subjects. They might have smaller class sizes, but if the subject material is more difficult, it'd be harder to find sufficiently knowledgable teachers. And the availability of classes like that (arguably) sets good schools apart from bad ones.
Its certainly a difficult problem. But it sounds like they aren't solving it well, and I think they're slowly driving out one of their best teachers.
They got upset when I suggested we donate 20 dollars to cover microwave budget for entire school for the year.
1. Edit, source: https://www.zippia.com/school-administrator-jobs/salary/
I think that really says more about the absolutely absurd cost of living and non-rational real estate costs in the SF bay area than it does about the school district. In many places with normal cost of living, if your US W2 take home is $129k a year, you can live a very comfortable upper middle class lifestyle. Whether or not you have a spouse or partner with their own career and your combined W2 gross income might be $210k a year.
Same as what I said above also applies to absurd real estate and cost of living in Seattle, Vancouver, New York, etc.
Salaries are higher in higher cost of living areas. You have to compare the salary to local living costs to be comparable.
blaming education administrators specifically for not having enough funds to pay competitively is drastically different than saying there is a structural problem with the local economy such that only industry X can competitively source IT talent.
in these conversations, comparing tech job X vs other job Y is relevant, because we are talking about 'jobs and wages within local economy as a whole'
This is not accurate in a globalized economy, where purchasing power parity (PPP) becomes a bit of a lie. No one is going to ask you if you're from Cambodia or another country, when you'll want to rent a server from AWS, or buy an iPhone, or maybe even a car. Global corporations aren't running charities and are instead concerned with making their products profitable - if anything, they would only use your location to increase the prices of products further if you're capable of buying them, but that's not a widespread practice nowadays for a variety of reasons.
I actually wrote a bit more about it in my blog article, "On finances and savings": https://blog.kronis.dev/articles/on-finances-and-savings which showed how much money i've made over the years while working as a software developer in Latvia (currently around 18'000 euros a year), which means that my ability to make savings is ~5x lower than many of the software developers in the US or other well paid countries - which directly impacts my ability to create a startup and pay for external services/infrastructure, should i so choose.
Of course, on the flip side, one can also talk about how much you're disadvantaging yourself by catering to a clientele of local companies: i generate my company ~20x less profits than an average engineer in Google would for their company.
But the fact of the matter is, the costs that make up the largest portion of most people's lives are locally spent.
I’m in a very reasonable market. 210 is fine, but nowhere near very comfortable upper middle class.
Of course, you should be able to cut a $129k/yr DBA if you just spend the millions needed to streamline the IT systems.
There has been massive interest in modernizing these systems.
It’s the beliefs and attitudes of leadership that cause well intentioned engineers who are willing to take a lower salary to leave
It's a good thing that's not what I did then... I said that the bad workers "crowd out those that actually give a shit", which means that there _are_ indeed people that care (albeit fewer than there should be).
> What I do see here, is that someone is speaking far outside their domain of expertise.
I spent 15 years working in government contracting, specifically in defense. I've worked with a _lot_ of civilian DoD employees (many of whom I respect immensely on a professional basis and consider my friends). I also am related to and am friends with a number of former public school teachers that left their field for greener pastures. Institutional rot isn't exactly a secret.
Per the HN guidelines please
> Assume good faith.
My personal disagreement is blaming individual people. There should be funding and education resources set up to ensure that people who make calls like this are educated enough to do so. You're in the business of personal accountability and I'm in the business of saying the people are a byproduct of the failing system. I'll bet my next paycheck if you wash out everyone that you deem lackluster and replace them with people you find to be excellent, the same outcome will be had over a matter of time.
The people that give a shit are making 10x as much by not working for a public middle school.
Fire the current lot if you want, but they'll just be replaced by the next set of people who aren't skilled enough to make market rate.
Most non-core-business organizations can't afford to hire someone competent, and therefore hire someone else.
But obviously that person isn't going to say "Gee, I'm really not great at this computer stuff, but I'll do what I can." They say "Sure, I know all about all the computer stuff!"
And then you have their leadership (who doesn't know any details), taking whatever they report up at face value.
The governor probably believed he had a leg to stand on here, because I'm sure that's exactly what his people told him.
My money's on this being purely a political decision. And for that, considering who it is and their position in the political landscape, I think it's too early to definitively call it a blunder.
It's much easier to play political games on much more abstract issues where it's harder to evaluate the options.
Meanwhile, he's received national attention.
We'll see, but it may yet be a smart play, politically speaking. I'm not saying it for-sure is, I just don't think that result's anywhere near being off the table.
So having someone technically minded in your general blob of associations is generally enough for these sorts of obviously stupid moves to get politicians in serious trouble.
The stakes are a lot lower obviously - but this is a much clearer case of technical malpractice than anything having to do with Snowden and reminds me of Morris[1]'s case - basically it's complete BS and a misuse of the law.
1. https://en.wikipedia.org/wiki/Robert_Tappan_Morris (I might be thinking of someone else - I thought there was a teenager that got the book thrown at them back in the early days of the web but maybe I'm just misremebering things)
Have you written about this anywhere? I'd love to hear more about the motivation (not that it's hard to guess possibilities) and what the process actually looked like. I hear people threatening to move to Canada all the time, but there don't seem to be too many who go through with it!
Additionally I was pleasantly surprised, when I moved up, to learn that Canada doesn't have the same culture of greed. I feel like, if you aren't making every cent possible in America that you could - if you aren't constantly extracting the absolute maximum revenue - you're looked down on. Up here I've found a much nicer focus on balancing work with interests.
The bigger problem is the risk of corruption when you start hiring 500k engineers.
Do you or have you worked in a place where "engineers" make $500K? Have you thought about what they outsource to people making 1/10th or less, and why?
That sounds reasonable, unless you're an elected government official in a state where salaries of government employees are public information. Local media outlets and your political opponents will have a field day over a government employee making a half-a-million dollar salary.
The public won't ever be able to understand or accept why one talented person should be made so wealthy in relation to the value they provide. However, the public will be fine with the same amount of money being spread out across 10 employees, since it still keeps all recipients in the poor house together with everyone else.
[1] having just 1 creates lots of bigger issues ;
Availability (what happens when he's sick or on vacation).
Technical documentation (there is none, its all in his head).
Role transfer (when he leaves there is short intense handover, then nothing).
Opinioned design - he does it his way, no discussion necessary - some will be good, but some will be bad.
When he leaves, you can't replace him. 500k engineers won't work for a place where you just maintain the system the last guy designed and wrote - they want to design and write their own stuff from scratch.
I could go on, but programming depts of 1 are usually a bad idea...
No one thought to ask IT why they used the same PW 5+ times for critical infra, its all just the kids fault for finding one of them
When banks/financial systems can get away with not upgrading a decade old Java framework with 6 month old struts vulnerability, and just blame the hacker, it is not surprising the average school sysadmin will do the same.
Because "reading HTML" is now "unencrypting".
People got caught with their pants down and are now just trying to lie their way out of it, nothing new but still sad.
> the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved.
and later:
> In reality, the Post-Dispatch discovered the vulnerability and confirmed that the nine-digit numbers were indeed Social Security numbers.
[0] https://www.stltoday.com/news/local/education/missouri-teach...
Given this, I think the journalist over-simplified the situation in their story and that the "F12" jokes are unjustified. Recognizing there's a disclosure of private information here requires a lot more technical knowledge beyond the ability to view the HTML source.
The governor is still wrong for pursuing this and what the newspaper did was right, given that they disclosed it to the responsible parties and didn't publish until the problem site was taken down.
It's hard to call this encryption.
Okay, maybe that's not very efficient.
Each pair of Base 64 characters contains a single ASCII character, plus some change. That would take three lookup tables of about 1000 entries each; given that the “change” letters could use character ranges, that would take 3 or 4 sheets of A4 (or A3, if you wanted large print).
> It's hard to call this encryption.
Best I've done so far is to recognize that "eyJ" means I'm probably looking at JSON, since `{"` followed by any letter will always begin with that.
This Base64 was placed inside an HTML document. That's a bit like a Word document, except the formatting (bold, underline, big, small, Comic Sans) is written next to the text, so the computer knows how to display it. HTML is designed to be human-readable; in fact, it's designed for humans to write directly, using a text editor.
Here's an example of an HTML document, and here's a Base64 decoding table. (There's also a printout from Wikipedia, if you want to know how people can do it in their heads.) The jury should be able to read this SSN off, with no prior experience, in about ten minutes.
This was sent, by the State's computers, to every user of the system, due to a programming error.
<!DOCTYPE html>
<html>
<head>
<title>My Webpage</title>
</head>
<body>
<h1>This is an HTML document</h1>
<p>
It might not look like much, but it's a website!
This is what they look like to computers, and
web developers. There is usually other code behind
the scenes, where sensitive data should be stored,
but this is the public part.
</p>
<!-- Internal state (public component).
Should not contain sensitive data! -->
<input type="hidden"
name="__VIEWSTATE"
id="__VIEWSTATE"
value="dDwxMjM7dDxwPGw8
U1NOOz47bDw5MTIt
MzgtNjU0Nzs+Pjs7
Pg==">
</body>
</html>See https://news.ycombinator.com/item?id=28992667
There's a good comment there that the Microsoft ASP.NET help pages specifically call out an SSN as a terrible thing to put into _VIEWSTATE :)
Our purest white-collar welfare system is the health insurance industry, I'd say. IIRC at one point Obama explicitly stated that a reason he didn't think single-payer and similar were viable to advance, is because they'd put too many people out of work.
The military is, obviously, our main work-required blue-collar welfare system, among other kinds of wealth-shuffling it does. Why, one can get nearly-European-standard-for-all public benefits, through that program, provided one is reasonably sound of body and mind. Healthcare, pension, housing, et c. [edit] education, too!
I'm not unsympathetic to those who would lose jobs from changes in the industry. Here's my thought: if government action that disrupts an industry then that action should be done piecemeal over several years to allow a softer transition.
Imagine not having 40,000 deaths a year, and many more seriously injured.
> Reviewing British fatality rates from previous centuries, demographer P. E. H. Hair concluded in 1971 that the “supercession of the horse by the internal combustion engine was by no means the disaster in terms of travel safety it is often supposed to have been,” and suggested that between 1840 and 1900, accidents involving horses produced an average yearly mortality rate of about five per 100,000 population
> fatality rates from horse-powered transportation occurred at a rate more than 15 times greater per mile in 1775 than from motor vehicles in 2000 (even using very conservative estimates for per-mile horse-related fatalities)
> In New York in 1900, 200 persons were killed by horses and horse-drawn vehicles. This contrasts with 344 auto-related fatalities in New York in 2003; given the modern city’s greater population, this means the fatality rate per capita in the horse era was roughly 75 percent higher than today. Data from Chicago show that in 1916 there were 16.9 horse-related fatalities for each 10,000 horse-drawn vehicles; this is nearly seven times the city’s fatality rate per auto in 1997.
Only if you've been not looking through e.g. the entire history of the NHTSA. Comparing horseless carriages under modern safety regulations to horse-drawn carriages not subject to those is a huge confounder. (And 1997-2000 sounds like a cherry-picked period; motor vehicles have been redesigned to kill significantly more pedestrians since then).
Modifiers like that don't really matter because the comment was acting like the alternative was zero deaths.
And modern safety regulations can only have so much influence on pedestrians especially.
> (And 1997-2000 sounds like a cherry-picked period; motor vehicles have been redesigned to kill significantly more pedestrians since then).
Well I'll assume if we were using carriages en masse they'd also be going through design changes to kill more people since that seems simplest and still supports my point that there would be many deaths.
Not necessarily, they could just mean many fewer deaths.
> Well I'll assume if we were using carriages en masse they'd also be going through design changes to kill more people since that seems simplest
It's not simple, there's a lot of complexity and path dependence to how we've ended up with these car designs and there's no reason to believe it would happen in the same way and the same order for carriages. But regardless, you have to average over such variations rather than picking one unrepresentative point.
> and still supports my point that there would be many deaths.
No it doesn't; you're cherry-picking the years when motor traffic was least deadly and comparing to a random time (or perhaps even the most deadly time?) for horse traffic.
Maybe but "Imagine not having" sure sounds like you remove the deaths entirely.
> you're cherry-picking the years
That's a quote of an article that only compares those years. I'll thank you not to accuse me of cherry-picking here.
> It's not simple, there's a lot of complexity and path dependence to how we've ended up with these car designs and there's no reason to believe it would happen in the same way and the same order for carriages. But regardless, you have to average over such variations rather than picking one unrepresentative point.
You wanted to consider "modern safety regulations" as a confounding factor.
I see three options here.
1. Let's assume carriages would have undergone the same evolution of safety. That means modern carriages would have a lower death rate than old ones. It also makes the possible cherry-picking matter a lot less because the increasing menace of transportation over the last 20 years would be the same either way.
2. We say it's too complex and ignore those factors.
3. We invent an entire alternate history in excruciating detail.
Option 2 is bad, of course. I think option 1 is fine. If you want option 3, you're on your own.
That's like saying it's fine to compare the cost of houses in New York and San Francisco by comparing the cost of a house in New York in 1998 to the cost of a house in San Francisco in 2009, because house prices change at more or less the same rate everywhere in the country. It's true that house prices tend to go up or down at a similar rate everywhere, but it's still a problem if you cherry-pick the two years you're making a comparison with!
https://www.accessmagazine.org/spring-2007/horse-power-horse...
You can criticize their choice of sources, you can dig deeper and provide more comprehensive data, but going post after post admonishing them for cherry-picking data that is just gauche. They didn't pick the years!
But since they are just presenting you with the most commonly available data, nothing you say will make them produce different results.
So it’s not completely welfare. The benefits offered exist for retention. The military can offer nice benefits because it is the largest employer in the world. It’s like the healthcare and other benefits you get from a corporate employer but much better. The larger the employer the better the benefits tend to get.
This sounds very stark, but it doesn’t tell the whole story.
1. O6 to O7 is colonel to general (or captain to admiral in the navy). Yes, 2% is a heavy cull. Then again, I think everyone involved sort of wants that cull for the top of the military. O7+ are essentially the equivalent of corporate executives. (Edit: just checked the numbers… I believe 2% is the number of generals expected out of a given class of 2lt. Promotion from colonel to general is a much higher percentage).
2. It’s fairly easy, if motivated and not socially, physically, or intellectually limited, to make it 20 years as an officer. Folks typically end up as majors (career-path bound or lower competence) or lieutenant colonels. Colonels tend to be solid all around, even if some of them have a tragic flaw. Folks capped at major usually retire at 20. Folks capped at lt col usually retire at 24-26 years.
3. Promotion from 2lt to 1lt is pretty much automatic around 2-3 years. Ditto 1lt to captain at around 4-6 years total. The first cull is from captain to major, but a big part of that cull is simply folks who don’t want to re-enlist. Most people who stay in plan on staying for 20 to get retirement. Some folks who want to stay in can’t, but this is relativity rare and is typically due to (lack of) need of the military of their skill, general lack of competence, medical issues, or legal issues (dui, etc.). I wouldn’t feel sorry for most of these people except the medical ones.
To get back to the original point, officers don’t quite look like the “welfare” that was being referred to.
That said, some of the jobs that veterans are able to get are absolutely middle class welfare.
Most vets in federal jobs are awesome and are good at what they do. That said, there is a small percentage of vets in federal jobs who are hellbent on being deadweight.
It's not a "welfare" program. Nobody good wants to work there.
I don't think that makes sense.
That doesn't make it welfare.
In my experience, most IT/CS people who seek to work for state/federal government do care.
Unfortunately the combination of extreme red tape, low pay, inability to fire lazy employees, and occasionally being punching bags for politicians trying to score cheap points with their constituents, take their toll over time.
It really sucks because I'd happily work for slightly under market rate to do work for a government office, but I just can't work for 1/3-1/2 of the pay I make working in the private sector, not with housing prices the way they are.
It contrasts to form 1099 [1] which are given to independent contractors.
If you don't mind me asking... why on Earth did you do this? My goal as a teenager was to find ways to get around content filters in middle school for fun, not so I could tell the teacher about them.
> It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit.
Administrators that "gave a shit" would be fighting to remove overzealous content filters, not reinforce them.
That presumes that the purpose of school is perceived by the participants to be something other than printing credentials that justify trans-generational wealth and power accrual.
Recent developments:
- The CS professor whose expert opinion was quoted by the newspaper article is demanding an apology and legal expenses from the state, alleging that the governor defamed and violated his free speech rights.
- The governor's political fundraising committee is running ads making this a "fake news" issue.
The email that the reporter sent, in advance of publishing the article revealing the state education website's data leakage:
> “I recently discovered a significant exposure of the sensitive data of more than 100,000 teachers on a DESE website,” Renaud wrote to the agency’s communications chief, Mallory McGowin. “At this point I am confident what I found is a genuine vulnerability — I have confirmed with three teachers from different districts that their data was exposed. I also have consulted an UMSL cybersecurity researcher who verified my findings. The P-D plans to publish a story about this sensitive data exposure, but we wanted to inform DESE first so that you would have a chance to mitigate the problem.”
> Renaud shared his timeline for publishing the story and asked for interviews with officials from DESE and the Missouri Office of Administration’s Information Technology Services Division. In a second email sent about 45 minutes later, he described the steps he’d taken in finding and confirming the vulnerability.
[0] https://www.amazon.ca/Three-Felonies-Day-Target-Innocent/dp/...
FWIW, I can't remember the last time I pressed F12 ;-)
Would I be slandered and jailed for applying to this job offering by the US Gov't? What do you think Parson would have done in this situation? I did have to press F12, so this is quite the predicament! /s
[1]. https://www.cnbc.com/2021/01/21/biden-white-house-website-ha...
Unless they've already been convicted in the past, that is a misdemeanor.
The railroad example is more interesting, though I can't find anything truly on point. All the legislation I have seen suggests you'd 1) have to intend to disrupt the service, and 2) put something on or near the tracks. I couldn't find anything even hinting that delaying a train through normal passenger controls constituted interference with a railroad.
Even if those were all felonies, I think most people don't even lead that exciting an existence :).
Very often the conductor will let you board a train late by signalling you with hand or speaking... But disobeying the conductor's signal whistle is where you step into potential illegality, because the train might (and sometimes really will) start moving that same moment.
All of this doesn't apply to city public transport - trams, metro etc. But it does apply to trains passing through the city.
https://www.stltoday.com/news/local/govt-and-politics/more-c...
Best online comment on the article:
"When the building's on fire, don't call the fire department or Parson will accuse you of arson.
I’ve found vulnerabilities in US government technology, and I know that the sensible and sane thing to do is just move on, ignore it, let it be someone else’s problem - I have no desire to end up in prison for being a Good Samaritan.
If some greater fool can deal with it, let them deal with it. People don’t want help. They want someone to blame.
https://www.youtube.com/watch?v=9IBPeRa7U8E
If anyone is curious what the political ad looks like.
It reminds me of that time, a few years after I was out of college and into a job. My professor contacted me to demo my class project to her students. To give them an idea of what they can do with web development. Her assistant told me that they couldn't figure out how to run it.
Of course, I took a day off from work, opened back up my school project, fixed the annoying bug. The web page required IIS to run so I could make Ajax requests. I decided to hardcode the data in json instead. So I went to school to present my project.
The professor was double clicking the file and it wasn't displaying properly. I inserted my USB stick, and ran it from there instead. The coral reef restaurant website appeared on the big screen. I explained that I had to make some changes so it would work locally. Before, I was using a web server.
"Web server?" she shouted. "You are not allowed to use a web server. So you guys cheated!"
At first, I thought she was just kidding. I explained that Chapter 12 specifically asks to boot up IIS in order to make use of Ajax. During my time, the rest of the class stopped at chapter 10. I completed the entire book because I was just in love with learning JavaScript. So unless you get to chapter 12, you don't learn about Ajax.
"I'll have to report you. They board might revoke your grade. Not just you but all your group."
You can only imagine how pale I became. But I understood what was happening. She had tried to run the project multiple times and failed. She couldn't debug it or figure out the issue. To save face in front of the class, she accused me of having cheated. This is the exact thing the Missourians officials are doing.
No, at the end of the day my grades were not revokes. Plus I had dropped out of college and was working in the field for a few couple years already. But it goes to show you the length people would go just to save face.
They make some money and they don't have the Governor attacking their reputation.
I have no idea what the market for those are, but I can imagine it being a better deal than having politicians trying to have you arrested.
I fixed that for you.
So far all I've seen here is the governor repeatedly make a fool of himself while the rest of the state is backing away slowly from the crazy old man.
The STL Dispatch actually really wants the state to try to sue here, and I don't think Parsons quite appreciates just how much trouble his statements can get him in.
I think the better route is impeachment for failing to take care that the laws are faithfully executed and abuse of office. But it's not clear that Missouri provides a way for the newspaper or any individual to force that issue.
Realistically, there's an IT executive in the Missouri government who screwed up, and the newspaper should be suing the state for criminal infosec practices (they did, after all, leak individual SSNs).
> Despite mounting public backlash, Missouri Gov. Michael Parson isn’t backing down from threatening to prosecute a journalist for accessing personal information of Missouri teachers to expose a security lapse in the state’s website.
..
> Yet, the governor’s office continues to contend Renaud is open to prosecution for his actions. An email to The Record from Kelli Jones, communications director for the governor’s office, said an investigation into Renaud’s actions is ongoing, but described his action as a “hack” that was more than just “a right click,” and that Renaud broke Missouri law. “The facts are that an individual accessed source code and then went a step further to convert and decode that data in order to obtain Missouri teachers’ personal information,” Jones wrote in an email.
..
> “A hacker is someone who gains unauthorized access to information or content,” Parson said during a recent press conference. “This individual did not have permission to do what they did." He said Renaud was simply attempting to "embarrass the state" and "sell headlines." "We will not let this crime go unpunished," Parson said.
https://stlrecord.com/stories/610107500-we-will-not-let-this...
The only way to effect change is to break the duopoly.
The only out is ending the symbiotic relationship at the place that fuels it and breaking the duopoly. And not giving in to cynicism.
"This video will make you angry" - https://youtu.be/rE3j_RHkqJc
The governor knows his claims are foolish and he knows he's building a controversy out of thin air. It's playing great with his constituents, and the fact that his position of power inclines people to take him seriously means he can get away with it.
Doubtful.
This is absolutely one of those cases where public attention and pressure can spare someone from getting lost in the legal system. Burying the story only helps those abusing their power.
His PAC is running ads like this. https://www.youtube.com/watch?v=9IBPeRa7U8E
To a lot of us, that looks like nonsense, but you have to remember how far through the looking-glass a lot of the conservative populace has gone... The press is now the enemy in their mind, and they don't understand technology well enough to get why these claims are ridiculous. So he gets to build steam and any pushback is just seen as more "fake news" coverage that would (of course) support their fellows in the media.
It's deeply frustrating because it's a form of social jujitsu built atop existing mistrust, and there aren't good ways to combat it.
If your premise is true (that the harder those who understand this push against it, the harder he will push back, and the voters of his state like him for that) then there is no winning strategy here.
Nope, it's ", emails said"...
In any case, the “nothing out of line” comes from a security expert reviewing the emails:
> While Missouri officials redacted most of Renaud’s second email, Katie Moussouris, the CEO of Luta Security, told StateScoop it appears he took all the right steps in disclosing a vulnerability.
> “Nothing in what you’ve shared with me looks like it was out of line with sensible coordinated vulnerability disclosure activities of any researcher trying to protect victims of sensitive data exposure,” said Moussouris, a co-author of the international standards for vulnerability disclosures.
Is it 1985 with a CRT TTY? This limitation is laughable.