Prosecutor won't charge reporter who uncovered database flaw
kshb.com
kshb.com
That sounds more like that "we would have prosecuted the reporter" if they hadn't discovered that the "state education commissioner initially planned to thank the newspaper for finding the problem".
They should have profusely thanked him and also given him an award.
Find a vulnerability for a big tech company, get $10,000. Find a vulnerability for the government, get prosecuted. I wonder why government IT is so far behind the private sector!
In fairness the government is, of course, not a monolith. There are multiple federal bug bounty programs out there [0] [1]. This is probably better stated as "find a vulnerability in the systems of a deeply corrupt, gerrymandered, and unpopular state's government's sites and be prosecuted in that state."
[0] https://www.hackerone.com/hack-the-pentagon
[1] https://www.dhs.gov/news/2021/12/14/dhs-announces-hack-dhs-b...
One of the most unfair cases relating to security testing I've ever read about was that involving Coalfire Labs and the Iowa courthouse: https://www.cyberscoop.com/coalfire-security-pros-arrested-f...
Here's the darknet diaries episode where I first heard about it: https://darknetdiaries.com/transcript/59/
> This decision is a relief. But it does not repair the harm done to me and my family. // My deepest desire is that somehow this situation might be redeemed. And I believe it can be. // My actions were entirely legal and consistent with established journalistic principles.
They thought they had just found a mistake in the government's IT system; instead, now that have a story about a mistake in the IT system and an idiot governor who doesn't understand infosec and is too bad a leader to delegate to people who do.
"Known to cause lots of work for legal department" could, for some bosses, be considered a negative signal in hiring. Moreover, "pisses of people with power": same.
To a good editor, yes. But I'm not sure the majority of editors are good ones, so while your point isn't exactly false, the GP's is also true (with all the other ones).
In reverse, you probably know a lot names of startup or IT personalities, that nobody outside our field would ever need to know
The display of corruption has been stellar.
The prosecutor did what the governor refused to do: Asked someone with a clue, and found out that absolutely no crime took place. Technical / factual means, not legal.
Not prosecuting means they don't think they can possibly win. Anything that comes out of their mouths after is window dressing.
I'm hoping that "the issues at the heart of the investigation have been resolved through non-legal means" is a paraphrase for saying that the DA pointed out to the governor, directly or through his aides, that any attempt to prosecute would fail and bring down a heap of public ridicule.
If so, then apparently not strenuously enough: The governor went right out and issued a press release that invites just as much ridicule as his previous statements.
"there was an argument to be made that there was a violation of law" is fantastic in the way it appears to be saying something but it's not actually saying anything.
Actually, I think I'm going to use that.
They really act as if there would be an immediate coup if people saw the rulers were flawed.
January 6 was kind of a big deal...
The governor of Missouri still doesn’t know how websites work - https://news.ycombinator.com/item?id=29752259 - Dec 2021 (21 comments)
Reporter may be prosecuted for using “view source” - https://news.ycombinator.com/item?id=29737412 - Dec 2021 (163 comments)
Reporter who told Missouri officials of website flaw did 'nothing out of line' - https://news.ycombinator.com/item?id=29098289 - Nov 2021 (190 comments)
Gov. Parson releases video attacking newspaper for viewing HTML - https://news.ycombinator.com/item?id=28980855 - Oct 2021 (26 comments)
Gov Parson pushes to prosecute reporter who found security flaw in state site - https://news.ycombinator.com/item?id=28946392 - Oct 2021 (525 comments)
Governor vows criminal prosecution of reporter who found flaw in state website - https://news.ycombinator.com/item?id=28866805 - Oct 2021 (678 comments)
Those were the governor's words, not the prosecutor's.
> Just admit you were wrong,
As I read it the prosecutor did; only the governor didn't.
> you might salvage some respect.
So to me, again: The prosecutor did, the governor didn't.
Step by step in America, the judicial branch has become more and more deferential to the executive branch when it comes to law enforcement. The reality is that I (and you) should have zero expectation that they will protect you from bad state actors at this point.
It is something everyone involved with the judiciary should be embarrassed about.
How about making it illegal for a state official to explicitly make credible threats to use unjustified state violence against someone? Similar to how it’s illegal for anyone to make credible threats of unjustified violence against anyone else.
Has there been an uproar in the population?
... Good luck.
I mean, not really, but I guess that could mean anything.
To be clear, this is in NO WAY a defense of the way the government acted in this case which was both insane and harmful, but just to say that a lot of what makes things illegal is subjective judgements about intent. This is why professional pen testers (the careful ones at least) generally specify in very clear terms what the scope of their engagement is (and still sometimes end up getting arrested). I can only imagine that doing independent security research is a mine field.
In terms of delivering something malicious to someone under no presumption of its deliverance, it's analogous to the extreme case of someone shipping a whole bunch of cocaine in a package with a book that you ordered. If we want to get closer to the actual problem, it's like you finding a paper shipped with your book and seeing a whole bunch of social securities numbers on it that may have included your own! Now if you have reasonable indication that this list was being sent out to everyone who ordered books from a specific place, of course you'd want to inform the people sending books to stop doing this so you could feel safe about your personal information.
Now imagine instead of protecting the information which has been going out to random people, the company decided to get angry and attempt to prosecute you for pointing out their negligence. It's absolute idiocracy.
As one of the Missouri residents who had their social security number exposed in this way I'd be furious at those who were delivering it.
But to use your example, if you accidentally ship you credit card to me amongst a bunch of other papers, it would still be illegal for me to sell the information on the dark web. Likewise, if the reporter in question took the SSNs and sold them on the dark web that would presumably be prosecutable as well. Now if I just took the credit card and returned it to you, I don't think any reasonable person would consider that illegal (and I certainly hope that no prosecutor would try and bring a case for it). My only point is that we ultimately are making judgements about malicious intent.
To be clear I don't mean to imply this is just some misunderstanding either. Obviously the MO governor is just being a blowhard to try and deflect blame for a really bone-headed screw up. But I see a lot of discussions in security/hacker circles where people seemingly think that if security is bad enough, then whatever you do to exploit it cannot possibly be illegal. But I don't think that is true and people should keep it in mind.
No, but even that wasn't the case here.
When X has NO -- not even "ludicrously bad" -- security, Y can't have "exploited" anything, because there was nothing for them to exploit.
Security research in general is a grey area. “Security research” of this kind is like spotting that the entire database is on file in a public library, with confidential data “encrypted” using Pig Latin, then reporting it to the librarian.
Take another example. Say you fire up Wireshark in on a public network like a coffee shop and see some unencrypted network traffic with confidential information in it. The packets were delivered to your computer and there for anyone to see. But why are you capturing traffic that wasn't intended for you (in the broader sense)? What if the traffic IS encrypted but with weak encryption that is easily cracked? As soon as you step off the path of "I am viewing information which was clearly meant for me" you're in a gray area. Of course as a society we should recognize that people who do these things and then responsibly disclose them are doing a valuable public service, but not everyone understands these things. Or in this particular case, some people are heavily incentivized to make bad faith arguments in order to deflect blame from their own screw ups. So it's worth being careful.
While it looks obscure to the uninitiated, anyone with a day-to-day familiarity with Pig Latin (e.g. a schoolchild) would be able to just read the information straight off, with little-to-no conscious “decoding” stage.
> As soon as you step off the path of "I am viewing information which was clearly meant for me" you're in a gray area.
People say that, but the law is usually quite explicit about such matters. Your “grey area” is just ignorance of the law. (And I'll go on record as saying that the law around this is usually really silly.)
If they would've continued, then the prosecutor would've been laughed out off the court by the judge. The lawyer defending the journalist would've called this the easiest case of his/her career. This statement is made to look official to save face. Plain truth is that the state simply fucked up badly, starting from the head all the way down to the tail.
Common sense won out in the case, but it certainly helped that the target was a reporter instead of a security researcher or ordinary citizen.
No, it won’t be fixed. You seem to imply that people are actually deciding things based on their understanding of the facts. I don’t think so.
I think that people in these positions don’t care if they understand technology or not. They care about how they will look. If they can get away with pleasing their confederates by pretending they don’t understand technology, they will do so. If they could please them by pretending to understand technology and do the truthful thing, they would do that. They might (or might not) actually understand technology, but this has nothing whatsoever to do with what they will actually do. They will do the most profitable thing they can plausibly get away with. In a few generations, as you say, people might have less room to blatantly pretend they don’t understand a certain level of technology, but I have a feeling that techology itself will have become proportionally more complex, too, so nothing will change in practice.
Not only is this whole thing over literally right-clicking html, but this is a Reporter working for a local newspaper.
Imagine for a moment that this story was about a regular person who is not employed as reporter with credentials and a portfolio. Depending on that individuals circumstances, it could easily be a life-ruiner. I could think of a few people.
The mistake here would be to assume that officials always correctly avoid absurd prosecutions.
He assessed a public web-page, found base64 encoded content, and decoded it. Please explain in exacting detail what you're claiming here both in terms of facts AND law.
Yes, I'm sure that would be true.
Of course, I was ALSO sure that no governor would spend months (even after being well-informed about the matter by his advisors) railing against the journalist who reported this.
I HOPE I'm right that the judicial system isn't suffering from the same malaise. But I'm not longer as sure of that as I used to be.
[1] https://breakintochat.com/blog/
[2] https://breakintochat.com/wiki/
[3] Jason Scott's blog post http://ascii.textfiles.com/archives/3826
https://www.cyberdelianyc.com/posts/view-source-the-only-cri...
The way the governor handled this situation really showed how much of a liability he feared this story would be to him and his party politically. Instead of examining the underlying conditions of the state agency responsible for the data breach, he chose to go after the messenger.
Given that every single time a company gets caught like this, the first thing we all point to is how stingy they are when it comes to security. A conservative governor doesn't want to be in a position where the solution to the problem is to spend money, so he went after the journalist instead.
https://twitter.com/govparsonmo/status/1448697768311132160?s...
> "Highway Patrol's Digital Forensic Unit"
This could have been a joke. I'm sorry, but can these people be serious?
Really, the digital forensic unit is under the umbrella of the "Highway Patrol"?
I bet they're all into decoding HTML source codes all day long...
Maybe it's the only state-wide law enforcement agency?
The judiciary, legislative, and executive branches of govt., as well as the other independent institutions of civil society, such as academia and the press, all must be strongly independent of each other for a democracy to survive.
In an autocracy, all of the institutions are coerced to bend to the will of the executive.
In this case, the executive (governor) made it very clear that he wanted this journalist prosecuted, a blatant attempt to bend the press to his will. In this case, it wasn't even the judiciary, but the prosecution, which is still in the executive branch, so nominally under the governor, who basically told the gov to go pound sand.
So, whenever you see executives undermining the independence of other branches or institutions, be VERY suspicious; it's a dead giveaway that they are interested in only their own power and not working to benefit the citizens they serve.
What crimes require a grand jury is state-specific.
About half of states require grand juries for some crimes. Of those, a bunch (minnesota, georgia are good examples) restrict grand juries to crimes that can be punished by life imprisonment/death require grand jury indictments. Others require them for any felony (New york is a good example)
People who watched a lot of law and order think grand juries get everything, because in new york, grand juries are required for all felony cases.
The other half of states do not require grand juries for indictments.
My recollection (take with grain of salt) of Kansas is:
1. A prosecutor can, but is not required to, present to a grand jury for a felony case. They can also just indict directly
2. Citizens can actually empanel a grand jury. It's something like 100 people min + 2% of the voters in the county.
3. If that grand jury indicts, prosecutor can still dismiss it, but it requires leave of the court (rather than them just being able to do it out of hand).
A technical violation of the law was not prosecuted as a result of the exercise of prosecutorial discretion not to pursue a prosecution which was not in the public interest.
Grand juries are not a solution to this problem. One glance at the shockingly high percentage of cases in which grand juries indict should be sufficient to cast doubt that they are truly filtering out bad prosecutions. That the proceedings occur in the absence of the accused and therefore deprive them of procedural fairness is another problem.
The responsibility properly lies with the prosecutor.
For helping the public... Helping protect teacher's private data.
What if the prosecutor was politically influenced against him? I don't know how, but there's got to be a better way.
This part I was not clear on. I was under the impression that what the reporter did was not a violation of the law. Or does term “technical violation” have a specific legal meaning that I’m not aware of?
Suppose there's a law that says you can't film other people without their permission. You catch a thief breaking into someone's house, film them, and give it authorities enabling their identification, then delete the footage. I'd describe this as a technical breach of the law. It probably shouldn't be prosecuted.
This is kind of analogous to the present situation, a bit of a rough analogy I admit. Whether or not a law was broken, the journalist did something that was a net positive to society, with no real victim except a red-faced politician.
Citation needed. I’ve seen no evidence that there was even an arguable violation of the law,
Ultimately there has to be a judgement of intent which at some level requires subjective assessment. In this case it is blindingly obvious that the reporter was acting in good faith so ti seems unlikely any reasonable prosecutor would pursue this case, or if they did any reasonable juror would convict.
In the article linked the prosecutor expresses that opinion.
"there is an argument to be made that there was a violation of law"
In any event, I fully support the journalist.
> I'm not in a position to help improving it, but my impression is relying on a single person is not a good idea.
> Having to face judicial charges - in this case criminal ones, perhaps - would be a tremendous stress and financial loss to this journalist. It's unacceptable that we subject citizens to face this kind of risk at the hands of a single person.
Having to face judicial charges - in this case criminal ones, perhaps - would be a tremendous stress and financial loss to this journalist. It's unacceptable that we subject citizens to face this kind of risk at the hands of a single person.
This is intentional, the governor explicitly wanted to inflict such pain to a citizen. I don't see a path to meaningful change in how the legal system is weaponized against the public as long as wealth is the primary driver of power in this country:
The legal system has always benefited the rich and powerful at the expense of everyone else.
There are all sorts of tradeoffs involved in how this sort of thing is done, and why, and those tradeoffs have evolved over thousands of years of legal systems existing.
In this case, the common tradeoff is that this is an elected official who is accountable to voters for the decisions they make. There are states where they are appointed. There are states which require grand juries.
All of these have tradeoffs - there is no "best", nor do statistics say that any of them end up any more fundamentally fair than each other. Nor do any of them have a significantly different rate of indicting objectively or subjectively innocent people (last i looked).
It's unclear exactly what you think a system should look like - i would argue any system with sufficient safeguards is not going to look very different than a preliminary hearing anyway.
Particularly your complaint about the stress/loss/etc seems unavoidable. That occurs starting with when people are investigated in the first place.
But I think it's still healthy to voice our concerns in a respectful and civil way.
I respect your view that we we should only voice a concern when we're in a position to directly help building a solution, I just don't find it (personal opinion) a healthy conduct as a citizen.
It's not healthy conduct to express strong opinions on things that you have zero experience or knowledge about.
Healthy conduct would instead be to ask questions and try to learn about those things, prior to holding a strong opinion. Or leave them alone if you don't have the time.
This unhealthy conduct is precisely one of the huge problems in society today, and i'm somewhat surprised you can't see this.
See, e.g., people in the US holding super-strong opinions about universal healthcare despite having zero knowledge or experience with it.
In practice, grand juries almost always vote to indict, unless the perp is a cop.
>As part of their cooperative agreement with the AP, most member news organizations grant automatic permission for the AP to distribute their local news reports.
There's no actual legal merit to any argument that this was unauthorized computer access. Suggesting that decoding base64 is somehow "hacking" is nonsense.