Comment by romellem | Hacker News Reader

Comment by romellem | Hacker News Reader

Parent Full thread

The [(redacted) report][1] is worth reading for yourself. Not only does it detail that pretty much everything was done "by the book" on the journalist and researcher side, but just how ridiculous the governor's reaction was.

The interview with Dr. Khan, the University of Missouri-St. Louis professor who helped verify the original vulnerability, he discusses another time when a Missouri State government website had a different vulnerability, and how the reaction was different:

    I asked Dr. Khan if this type of flaw was something commonly seen.
    He indicated this was a common problem. He advised in 2016, he wanted
    to verify his voter registration, so he Googled "check voter registration"
    on his smart phone. He stated he clicked on the Missouri Secretary of
    State's website and as soon as the page loaded, he observed the page was
    loading through "plain http." [...] [T]he website was indexed in Google in
    this way, so anyone who Googled the Secretary of State's website, would be
    routed through that link. [...] [H]e emailed the Chief Security Officer and
    advised them of the problem and the fix for it. He stated he received an
    email thanking him for reporting the issue and was advised they would correct
    the issue.

[1]: https://s3.documentcloud.org/documents/21271820/redacted-inf...

Sorry for the tangent, but am I the one who finds it’s odd that this was done by the Highway Patrol? I understand that the scope of that agency probably operates outside of just the highway, but I thought most states had other law enforcement agencies that would seem more appropriate.

Parsons was for years a county sheriff of a rural county in Missouri (Polk County, current population ~30,000), so he was head of the Highway Patrol in the county. I suspect that as Governor he has strong relations with the Highway Patrol statewide and views them still as loyal and trustworthy to him, while he may view the more suitable branches of law enforcement (e.g., the cyber crimes division of the Department of Public Safety) as urban desk jockeys who may be less loyal and aligned with him personally, and therefore he'd rather send in his own troops for missions such as this.

As far as I know, there is no particular relationship between a Missouri county sheriff and the Missouri State Highway Patrol. County sheriffs are certainly not the head of any part of the Missouri State Highway Patrol.

But of course as the governor of Missouri he personally appoints the Superintendent of the State Highway Patrol (as well as the Director of the Department of Public Safety of which the State Highway Patrol is one division).

So the sheriff is part of the state highway patrol. Interesting. Not how things are done in many places.

In many U.S. states "highway patrol" is simply the name of the state police agency, sometimes informally and sometimes formally.

Yup. A.k.a., "Staties".

Who else is gonna police the information super highway?

You win the internet today

Some folks here may be too young to remember this, but we used to colloquially call the Internet the "The Information Superhighway".

Those were good times, back before the internet was a series of tubes

Just big trucks!

Or when the secret service was investigating game companies: http://www.sjgames.com/SS/

I found the Missouri Department of Public Safety's list of State Law Enforcement Agencies [1] and it does seem like an awkward fit no matter where you would try to put this investigation. That said, I can imagine that in many states, the largest and best-developed law enforcement agency is by necessity the one that spans the entire state for the purposes of enforcing traffic laws.

[1] https://dps.mo.gov/leagencies.php

When I lived in Indiana, the Indiana State Police (which most residents would consider to be the equivalent to "highway patrol") investigated a lot of things that had nothing to do with patrolling highways. I imagine this situation works the same, but with poor labelling ("highway patrol" serving more like "state police" in at least some situations).

Growing up in Georgia, there was a state law enforcement agency called the GBI (like FBI, but state). There was also a highway patrol. Personally I’d suspect the former would be the one involved in something like this.

Wow, I had no idea American police systems were so numerous. In Canada, we have the RCMP (Royal Canadian Mounted Police). In most parts of the country, that's it—they do everything, from highway patrol to intelligence. Ontario and Quebec chose to take over from the RCMP for provincial policing matters with their own police services, and many cities have their own police services for local matters, but the RCMP is the national police service and has jurisdiction everywhere.

> Sorry for the tangent, but am I the one who finds it’s odd that this was done by the Highway Patrol?

In many states, there are some domain specific LE agencies, but also one general competence agency. In several cases (sometimes as a result of a merger between Highway Patrol and State Police where the former name was retained) the general-competence LE agency is the highway patrol.

In the state I live in, there are very, very few statewide law enforcement agencies. By far the largest is the state highway patrol.

State highway patrol officers are the “go to” cops for statewide officials.

Reply on news.ycombinator.com