Missouri governor’s office responsible for teacher data leak
krebsonsecurity.com
krebsonsecurity.com
The interview with Dr. Khan, the University of Missouri-St. Louis professor who helped verify the original vulnerability, he discusses another time when a Missouri State government website had a different vulnerability, and how the reaction was different:
I asked Dr. Khan if this type of flaw was something commonly seen.
He indicated this was a common problem. He advised in 2016, he wanted
to verify his voter registration, so he Googled "check voter registration"
on his smart phone. He stated he clicked on the Missouri Secretary of
State's website and as soon as the page loaded, he observed the page was
loading through "plain http." [...] [T]he website was indexed in Google in
this way, so anyone who Googled the Secretary of State's website, would be
routed through that link. [...] [H]e emailed the Chief Security Officer and
advised them of the problem and the fix for it. He stated he received an
email thanking him for reporting the issue and was advised they would correct
the issue.
[1]: https://s3.documentcloud.org/documents/21271820/redacted-inf...But of course as the governor of Missouri he personally appoints the Superintendent of the State Highway Patrol (as well as the Director of the Department of Public Safety of which the State Highway Patrol is one division).
State highway patrol officers are the “go to” cops for statewide officials.
In many states, there are some domain specific LE agencies, but also one general competence agency. In several cases (sometimes as a result of a merger between Highway Patrol and State Police where the former name was retained) the general-competence LE agency is the highway patrol.
Prosecutor won't charge reporter who uncovered database flaw - https://news.ycombinator.com/item?id=30318208 - Feb 2022 (121 comments)
The governor of Missouri still doesn’t know how websites work - https://news.ycombinator.com/item?id=29752259 - Dec 2021 (21 comments)
Reporter may be prosecuted for using “view source” - https://news.ycombinator.com/item?id=29737412 - Dec 2021 (163 comments)
Reporter who told Missouri officials of website flaw did 'nothing out of line' - https://news.ycombinator.com/item?id=29098289 - Nov 2021 (190 comments)
Gov. Parson releases video attacking newspaper for viewing HTML - https://news.ycombinator.com/item?id=28980855 - Oct 2021 (26 comments)
Gov Parson pushes to prosecute reporter who found security flaw in state site - https://news.ycombinator.com/item?id=28946392 - Oct 2021 (525 comments)
Governor vows criminal prosecution of reporter who found flaw in state website - https://news.ycombinator.com/item?id=28866805 - Oct 2021 (678 comments)
Would a journalist have a legal claim for defamation against the Governor? Seems like a stretch.
It's unfortunate that a public figure - and that's a fairly loosely defined status - can be defamed pretty much at will.
There is additional lower court jurisprudence for "involuntary public figures" (the canonical example being a private citizen who receives public attention for an act of heroism), but that test hasn't been developed fully and it's unclear if it would even apply here (since the name of the reporter hasn't featured prominently in other reporting).
(The "public figure" nature of the Governor or his office also doesn't apply here, since he's the accused defamer and not the defamee.)
> A person can become an "involuntary public figure" as the result of publicity, even though that person did not want or invite the public attention. A person can also become a "limited public figure" by engaging in actions which generate publicity within a narrow area of interest. For example, [jokes about] ... Terry Rakolta [an activist who spearheaded a boycott of the show Married ... with Children] were fair comments ... within the confines of her public conduct [and] protected by Ms. Rakolta's status as a "limited public figure".
Celebrites have a hard time suing for defamation due to their status as public figures. The reporter in this case likely qualifies as an "involuntary public figure" due to the coverage of all this, and might be a public figure just by being a reporter.
Maybe. I actually can't find a ton of case law on print reporters as public figures: there's a great deal of case law for television journalists (nearly universally in their favor), but comparatively little for newspaper journalists.
> “We are grateful to the member of the media who brought this to the state’s attention,” was the proposed quote attributed to the state’s education commissioner before Parson began shooting the messenger.
1. refuse to accept or be associated with. "she has repudiated policies associated with previous party leaders"
2. deny the truth or validity of. "the minister repudiated allegations of human rights abuses"
3. refuse to fulfill or discharge (an agreement, obligation, or debt). "breach of a condition gives the other party the right to repudiate a contract"
Did you mean this word?
We have to accept that the government needs to spend some money in order fulfill basic functions like protecting sensitive data because anybody that does good work in IT demands far higher pay than what you typically earn in the private sector. I see this all the time.
If billionaires and venture-backed firms are the only ones that can reasonably attract and retain technical talent, we will never solve this problem. The IT pay disparity between the public and private sector is staggering and with inflation, who's gonna take a 60-70% pay cut to work in a public IT job?
In a lot of ways, it feels like the Ron Swanson schtick from Parks and Recreation: if you're anti-government, you strive to get in power so that you can run government badly, thus proving that government is bad and that we should drown it in the bathtub.
I think you can be a good governor and even possibly be ... not smart.
You just need to be able to find good people to listen to. In fact some folks told him it wasn't the reporter's fault early on.
It seems Mike Parson is the first two, and incapable of the last.
Sadly it seems he does all this at the expense of good governance and the people of Mussouri in order to target people he doesn't like.
The intent was the chilling effect and the governor got what he wanted. The reporter, subject matter expert & newspaper all had to be involved in a criminal investigation and incur all the costs that go with it.
This was a direct attack on a free press using the full menace of the state and there are unlikely to be an repercussions for it. Quite the opposite there are members of his constituency that believe that the press are enemies and deserve this treatment.
I use the idea of that generally in a way that IMO fits your description as well.
Reporter, newspaper, another politician, even an institution, any could fall into that category IMO.
While I don't doubt the seriousness of his actions regarding attacking / threatening the press, I think for guys like him he would be happy to target anyone / think that kept him in power.
They're speaking different languages and seeing different things.
Parsons - like many politicians - sees situations exclusively as status and power plays. So when someone with low status says "This is broken", of course he goes on the attack.
It's inconceivable in his world that someone might be trying to warn him about a real problem that needs to be fixed. At best he sees it as an attack on his position, at worst he turns it into a mini-campaign he can use for political gain.
The fact there was a real problem is irrelevant and invisible to him. It's simply not something that interests him.
I always wonder what it was that (I don't want to get into politics in detail here) that made Trump respond almost allergically to the news about COVID early on in 2020. There's nothing about him or his general 'platform' that meant he had to reject any news about it at all outright and dig in his heels until it was too late.
He could have even fed his own authoritarian inclination and declared his own great patriotic war on COVID / made it all about him in a way. Had he done so I wonder if he still would be president ...
But he made his call. Was it because he wanted to just reject any 'bad news' or maybe it was more like you're describing? Whatever it was, he perhaps saw it as a status / power play on him in one way or another.
I really don't know but it is an interesting explanation for people's responses at times.
These are the absolute last people we should ever want in charge of anything
I kinda meant to indicate the last trumps the good parts of the first but I agree that does seem confusing.
Never change Missouri politics. You get what you vote for.
its unlikely he will face any meaningful repercussions for attempting to scapegoat the press.
I agree that there isn't much that can be done considering it's unlikely the legislature will hold the Governor accountable, but it's not right to say no one was materially hurt.
The legal system is great if you can afford it, but often times you get exactly as much justice as you can afford. There's a reason that, despite the societal harm they individually account for, drug offenses get much more jail time than "white collar crimes".
That said, the State attacking private citizens(this is what court cases are, an attempted attack to inflict financial damages or jail time) for checks notes alerting the State that it isn't properly protecting its citizens, is not something that should be solely handled with a penalty of "possibly not winning reelection".
No, things should not be where a politician gets away with baselessly threatening his opponents with taxpayer funded legal action that could easily cost them time, money, and freedom.
You must be kidding. As governor, Parson is the most powerful person in the state. And he's threatening to prosecute people who turned out to be innocent (arguably were known to be innocent from the word go). When flagrant abuse of power, and evil intent occur, its impossible that "No one was materially hurt".
[1] https://www.nbcnews.com/politics/congress/eric-greitens-form...
The answer to your question is no. Why on earth would I change my party affiliation based solely on the actions of two members of the party?
I'll also add, other than this small stain, Parsons has been good. No major changes or upsets. It's boring here in Missouri politically, and I like that.
I think you did that because it's pretty obvious why someone might sour on an organization whose highest leaders continued in a pattern of bad behavior. In fact, quite the opposite of your claim here, I think it would be common sense to change your opinion on an organization based on a pattern of misbehavior by its top leaders.
The reality of modern American politics, though, as I think you demonstrate as do most people, is that Negative Partisanship is the only factor at all that matters. The people on "your team" can do anything at all, because "the other team" is worse. This is the sentiment that drives all American politics at the state and federal level.
Completely and utterly wrong assumption about me on your part. Both parties suck. There is a lesser evil, and that's the evil I unfortunately subscribe to. Wish there was a better way, but there isn't, so I'm stuck with what I got.
Sounds like you have swallowed their propaganda entirely if you think they are bad but they have convinced you the other guy is worse.
In this case, it was not a guy but a woman running against Parsons.
(Wow, those are some downvotes! People reacted to this comment like a Missouri voter reacts to a female gubernatorial candidate.)
I'm sure we could compile a list of elected officials across a spectrum of political parties where no consequences are faced (for an action, in-action, decision, cover-up, etc) when they may be warranted. I don't think this is a valid argument.
Is it?
>There is a lesser evil, and that's the evil I unfortunately subscribe to. Wish there was a better way, but there isn't, so I'm stuck with what I got.
So, in a sense, by subscribing to a lesser of two evils idea, you're doing the same thing as "the other team is worse" (the thing I said).
It is what it is, negative partisanship does drive everything, and the first step to better politics is admitting we have a problem.
I couldn't have said it any better.
It's all a political theater. (both sides)
Negative Partisanship, drives anger and fear.
Fear and anger drive donations and votes.
Fear and anger drive views/clicks, news outlets and the media, everybody wins!
Wash, rinse, repeat, circa 1776!
You literally just made a both sides argument. I'm not a fan of either party, but I'm also not a supporter of the idea that both sides are both equally bad. Only one side stormed the Capitol in an explicit attempt to reverse en election result they did not like, and persists to this day in insisting that they actually won.
Yes, both sides have some problems, both say and do super annoying things, but 'both sides' is just giving the Republican Party an out, where instead we should hold them to account for trying to tip over the table and destroy our democracy.
I never suggested that. There are plenty of people walking around who are unaffiliated or support 3rd parties. Not being a "Republican" doesn't make you a "Democrat".
> Why on earth would I change my party affiliation based on the actions of two members of the party?
They are not just "two members of the party", they are last two heads of the party in your state. When Republicans stopped doing things I agreed with, I stopped calling myself a Republican.
If only both sides of the fence understood that...
If you must register for primaries in your state, then that's fine. But that's where the association would end in my book.
* One abortion clinic in the entire state! It would be zero if not for the pesky courts. If Mike gets his way, Missouri will be "the most Pro-Life state in the country!"
* No permit required for open or concealed carry! Sell or buy your guns with whoever you like. You can even point your guns at filthy liberals with your finger on the trigger and the governor will pardon you of any crimes you may be convicted of
* 54% of the state is fully vaccinated, one of the lowest rates in the country! If you need any more encouragement to visit, masks are optional and actually frowned upon by the better class of Missouri citizens (conservatives)!
* Current Missouri Senator Josh Hawley attempted to overthrow the government on Jan 6!
* No voting by mail! "So if they don’t [feel safe voting in person], then don’t go out and vote". Great words, Mike!
Consider Florida. A lot of people really don't like DeSantis but the alternative the DNC of Florida put up was...a literal methhead[0]. Oregon has Kate Brown who has signed extremely unpopular legislation in Oregon but the opposition was...a guy who isn't even a Republican anymore[1]. Texas has Greg Abbott who is universally hated in Texas after the energy fiasco of 2021 but his opponent is a guy who failed to win a Senate election[2], let alone the governorship (have fun donating to that).
It's easy to look at the political parties of a state's elected representatives and make assumptions about the people there but it's very important to consider the actual people being elected before you draw conclusions about the politics of the citizens.
[0]https://www.sun-sentinel.com/news/politics/fl-ne-andrew-gill...
I didn't draw any conclusions, they said they were Republican in Missouri who disagreed with the Governor. I simply asked if that made them "re-think" their their affiliation.
That so many people assumed I was asking them to switch to Democrat is evidence of how dug in our society has become. It contains two big assumptions.
1. Re-assessing your affiliation based on political performance is the same as switching to another party
2. If you aren't a Republican, you must be a Democrat
The whole gov/system is by default 2 party system.
Some of the questions that you are asked during your citizenship interview is what are the two main parties.
Im not saying I like it. But it’s a fair assumption to make when literally all voters only consider the two parties.
[1] https://news.gallup.com/poll/15370/party-affiliation.aspx
You are given choices of “identifying” as Rep/Dem/Ind. Only two of them are real parties.
What does it mean to be independent then? Is it more like undecided?
Im not sure you can call that a political party.
I'm sure it means different things to different people. For me, it means that I don't follow any party's platform in lockstep. I try to judge each candidate and policy based on merits, not team affiliation and have voted for multiple parties over the years (Republican, Democratic, Libertarian, Green).
In this particular case, he's running for the exact same set of voters as before for a more prestigious office against a more popular candidate. His policies are less popular than in 2018 and he's done nothing to increase his notoriety in the last four years. This isn't to say he's not a good candidate but I find it reasonable to think that he may struggle for funding this time around more than last.
[0]https://www.abrahamlincolnonline.org/lincoln/education/failu...
At worst an alleged methhead, which he denies.
> officers were called to a West Avenue hotel around 1 a.m. and found Gillum there with two other men, one of whom was being treated for a possible drug overdose. Gillum was too inebriated to speak with officers, though he was later reported in stable condition and with normal vital signs.
...
> "I was in Miami last night for a wedding celebration when first responders were called to assist one of my friends,” Gillum said in the written release. “While I had too much to drink, I want to be clear that I have never used methamphetamines."[0]
[0] https://www.usatoday.com/story/news/politics/2020/03/13/andr...
Your mistake is understandable because the media ran with the Gillum-is-a-meth-fiend narrative.
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
As for Russian propaganda, that isn't remotely representative of the forum. You may be falling prey to the bias that causes negative data points to stand out more (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...), as well as the bias that causes internet users to feel that other commenters are foreign agents, astroturfers, spies, shills, bots, etc. On the latter, see https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme.... If anyone wants an in-depth explanation, https://news.ycombinator.com/item?id=27398725 is one of many.
No, it was not. Partisan would be asking if they were going to switch to a specific different party. I asked if they re-thought their affiliation.
> As for Russian propaganda, that isn't remotely representative of the forum.
I never claimed it was, just that it has increased the past two weeks without much moderation.
> the bias that causes internet users to feel that other commenters are foreign agents, astroturfers, spies, shills, bots, etc.
Another thing I never claimed.
All of these assumptions sound like they may be an example of the Illusion of Asymmetric Insight (https://en.wikipedia.org/wiki/Illusion_of_asymmetric_insight). Is that how this works?
Assuming you think that as bad as Parsons is for this, the Democrat opponent is worse - what is the process in Missouri for replacing Parsons on the Republican side of the ballot in the next election?
Parsons: "You sire are a horse thief. You shall hang for this."
So, "view page source," a built in browser function since forever (not even considering various built in inspectors), is illegal according to this very smart politician. That's basically all that was done here, on a publicly accessible website.
Why do we have so many people in politics that seem so hellbent on trying to attack people and find malice in what they do? I don't know much about Pasrson, but I hope this is not his standard MO.
Even things that don't really make you look bad... (early on this wasn't even thought to be the governor's office fault directly).
That's the danger in scapegoating and etc it's so easy to do for everything.
Hugo Chávez had a regular national TV show in Venezuela where he would call up his own government officials and berate them and sometimes fire them on live TV. It's a scary viral like thing if you think to do it for everything.
The public, sadly, cares more about not the job done, the track record, but instead on appearances.
I once saw a Canadian politician mocked for his haircut. Another for the way he spoke.
Not how well they did their job.
So yeah, someone says something bad about a politician, well... we keep hiring people that are better at attacking appearances, not policy.
"A lie can travel around the world, while the truth is still putting its boots on."It sounds like the guy is a confident idiot.
Edit: Most of this take is based on my experience in the military in both highly bureaucratic organization as well as very dynamic organizations that had differing structure.