Journalist won't be prosecuted for pressing 'view source'
(2022/02/15)
- Reference: 1644962229
- News link: https://www.theregister.co.uk/2022/02/15/missouri_html_hacking/
- Source link:
A reporter who faced potential hacking charges for viewing website source code in his browser can rest easier now that Missouri officials have decided not to prosecute him.
This month, Cole County Prosecutor Locke Thompson announced no charges would be filed in conjunction with the revelation that Missouri's Department of Elementary and Secondary Education's (DESE) website exposed the Social Security details of educators.
"There is an argument to be made that there was a violation of law," said Thompson in a statement
[2]
Last October, Josh Renaud, a reporter for the St Louis Post-Dispatch, found that a website run by the DESE exposed the Social Security numbers of school personnel. He did so by [3]examining the client-side source code of the website, which is publicly viewable by anyone with a web browser.
[4]
[5]
After Renaud filed [6]a story to this effect, Missouri Governor Mike Parson (R) said the state would investigate and explore legal options, and claimed the incident might cost the US state's taxpayers as much as $50m.
"Through a multi-step process, an individual took the records of at least three educators, decoded the HTML source code, and viewed the Social Security number of those specific educators," said Parson in an October press conference.
[7]
"It is unlawful to access encoded data and systems in order to examine other people's personal information and we are coordinating state resources to respond and utilize all legal methods available."
It's highly doubtful any court in the US would find it unlawful to access encoded data and the governor's claims have been widely ridiculed by cybersecurity and legal experts.
In this context, "decoded" means converting a Social Security number encoded in a format called [8]Base64 back to plain text. Encoding is a process that's reversible without a key, which makes it different from encryption, both practically and legally. Outlawing decoding would be the equivalent of banning translation from one language into another.
[9]Missouri governor demands prosecution of reporter for 'decoding HTML source code' and reporting a data breach
[10]Pen Test Partners: Anyone could view Gumtree users' GPS location by pressing F12
[11]Who'd have thought the US senator who fist pumped Jan 6 insurrectionists would propose totally unworkable anti-Big Tech law?
[12]Midwest tornado destroys Amazon warehouse, killing six after worker 'told not to leave'
Elad Gross, an attorney representing Shaji Khan, a cybersecurity professor at the University of Missouri-St. Louis who was contacted by Renaud to verify his findings, wrote a letter
Despite the absurdity of Parsons's hacking claim, Renaud welcomed the news that Missouri officials have backed down.
[14]
"This decision is a relief," said Renaud in a statement
"My actions were entirely legal and consistent with established journalistic principles. Yet Governor Mike Parson falsely accused me of being a 'hacker' in a televised press conference, in press releases sent to every teacher across the state, and in attack ads aired by his political action committee. He ordered the Highway Patrol to begin a criminal investigation, forcing me to keep silent for four anxious months.
"This was a political persecution of a journalist, plain and simple."
Renaud further expressed concern that Parson's actions will have a chilling effect on those trying to report on security and privacy flaws in Missouri.
In [16]a statement , Governor Parson's office maintained that Renaud had unlawfully hacked the school website: "The hacking of Missouri teachers' personally identifiable information was a clear violation of [17]Section 569.095 , RSMo, which the state takes seriously. The state did its part by investigating and presenting its findings to the Cole County Prosecutor, who has elected not to press charges, as is his prerogative." ®
Get our [18]Tech Resources
[1] https://bloximages.newyork1.vip.townnews.com/stltoday.com/content/tncms/assets/v3/editorial/1/bd/1bd1a21e-a1a6-5a2b-b9a3-573e59d37e05/62070d2367e2c.pdf.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2021/10/15/missouri_governor_prosecution_html_source_code/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.stltoday.com/news/local/education/missouri-teachers-social-security-numbers-at-risk-on-state-agencys-website/article_f3339700-ece0-54a1-9a45-f300321b7c82.html
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://developer.mozilla.org/en-US/docs/Glossary/Base64
[9] https://www.theregister.com/2021/10/15/missouri_governor_prosecution_html_source_code/
[10] https://www.theregister.com/2021/12/15/gumtree_data_breach_idor_f12_badness/
[11] https://www.theregister.com/2021/04/13/hawley_antitrust_bill/
[12] https://www.theregister.com/2021/12/13/deadly_midwest_storms_destroy_amazon_warehouse/
[13] https://cdn.arstechnica.net/wp-content/uploads/2021/10/Litigation-Hold-and-Demand.pdf
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://joshrenaud.com/pd/josh-renaud-personal-statement.pdf
[16] https://twitter.com/alisagbrnelson/status/1492299670684635136?s=20&t=j2Ol2TJ5mEob2TYSuGlh-A
[17] https://revisor.mo.gov/main/OneSection.aspx?section=569.095
[18] https://whitepapers.theregister.com/
This month, Cole County Prosecutor Locke Thompson announced no charges would be filed in conjunction with the revelation that Missouri's Department of Elementary and Secondary Education's (DESE) website exposed the Social Security details of educators.
"There is an argument to be made that there was a violation of law," said Thompson in a statement
[1]PDF
. "However, upon a review of the case file, the issues at the heart of the investigation have been resolved through non-legal means."[2]
Last October, Josh Renaud, a reporter for the St Louis Post-Dispatch, found that a website run by the DESE exposed the Social Security numbers of school personnel. He did so by [3]examining the client-side source code of the website, which is publicly viewable by anyone with a web browser.
[4]
[5]
After Renaud filed [6]a story to this effect, Missouri Governor Mike Parson (R) said the state would investigate and explore legal options, and claimed the incident might cost the US state's taxpayers as much as $50m.
"Through a multi-step process, an individual took the records of at least three educators, decoded the HTML source code, and viewed the Social Security number of those specific educators," said Parson in an October press conference.
[7]
"It is unlawful to access encoded data and systems in order to examine other people's personal information and we are coordinating state resources to respond and utilize all legal methods available."
It's highly doubtful any court in the US would find it unlawful to access encoded data and the governor's claims have been widely ridiculed by cybersecurity and legal experts.
In this context, "decoded" means converting a Social Security number encoded in a format called [8]Base64 back to plain text. Encoding is a process that's reversible without a key, which makes it different from encryption, both practically and legally. Outlawing decoding would be the equivalent of banning translation from one language into another.
[9]Missouri governor demands prosecution of reporter for 'decoding HTML source code' and reporting a data breach
[10]Pen Test Partners: Anyone could view Gumtree users' GPS location by pressing F12
[11]Who'd have thought the US senator who fist pumped Jan 6 insurrectionists would propose totally unworkable anti-Big Tech law?
[12]Midwest tornado destroys Amazon warehouse, killing six after worker 'told not to leave'
Elad Gross, an attorney representing Shaji Khan, a cybersecurity professor at the University of Missouri-St. Louis who was contacted by Renaud to verify his findings, wrote a letter
[13]PDF
to Missouri officials a week after Parson threatened prosecution. He explained how the only law violation with regard to the data exposure was committed by the state when it failed to secure its employees' personal information.Despite the absurdity of Parsons's hacking claim, Renaud welcomed the news that Missouri officials have backed down.
[14]
"This decision is a relief," said Renaud in a statement
[15]PDF
published through his website. "But it does not repair the harm done to me and my family."My actions were entirely legal and consistent with established journalistic principles. Yet Governor Mike Parson falsely accused me of being a 'hacker' in a televised press conference, in press releases sent to every teacher across the state, and in attack ads aired by his political action committee. He ordered the Highway Patrol to begin a criminal investigation, forcing me to keep silent for four anxious months.
"This was a political persecution of a journalist, plain and simple."
Renaud further expressed concern that Parson's actions will have a chilling effect on those trying to report on security and privacy flaws in Missouri.
In [16]a statement , Governor Parson's office maintained that Renaud had unlawfully hacked the school website: "The hacking of Missouri teachers' personally identifiable information was a clear violation of [17]Section 569.095 , RSMo, which the state takes seriously. The state did its part by investigating and presenting its findings to the Cole County Prosecutor, who has elected not to press charges, as is his prerogative." ®
Get our [18]Tech Resources
[1] https://bloximages.newyork1.vip.townnews.com/stltoday.com/content/tncms/assets/v3/editorial/1/bd/1bd1a21e-a1a6-5a2b-b9a3-573e59d37e05/62070d2367e2c.pdf.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2021/10/15/missouri_governor_prosecution_html_source_code/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.stltoday.com/news/local/education/missouri-teachers-social-security-numbers-at-risk-on-state-agencys-website/article_f3339700-ece0-54a1-9a45-f300321b7c82.html
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://developer.mozilla.org/en-US/docs/Glossary/Base64
[9] https://www.theregister.com/2021/10/15/missouri_governor_prosecution_html_source_code/
[10] https://www.theregister.com/2021/12/15/gumtree_data_breach_idor_f12_badness/
[11] https://www.theregister.com/2021/04/13/hawley_antitrust_bill/
[12] https://www.theregister.com/2021/12/13/deadly_midwest_storms_destroy_amazon_warehouse/
[13] https://cdn.arstechnica.net/wp-content/uploads/2021/10/Litigation-Hold-and-Demand.pdf
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ygwwl0zMk3nyaDy0mjfH0QAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://joshrenaud.com/pd/josh-renaud-personal-statement.pdf
[16] https://twitter.com/alisagbrnelson/status/1492299670684635136?s=20&t=j2Ol2TJ5mEob2TYSuGlh-A
[17] https://revisor.mo.gov/main/OneSection.aspx?section=569.095
[18] https://whitepapers.theregister.com/
claimed
Sorry is this post in Unicode or are these glyphs images? I'm worried a about my browser decoding your data and whether or not I'm breaking the law by reading it...
I wouldn't want to willfully decode ASCII either, so I think the reg should make sure all comments are the exact images we tap on our keyboards.
wilfully decode ASCII
Dr Paul Taylor
Once upon a time I used to be able to read (binary ASCII from) punch tape.
The State changed its tune
First Light
The journalist's newspaper, the St. Louis Post Dispatch, "obtained records through an open records request showing that the state Education Commissioner initially planned to thank the newspaper for finding the problem. But the state instead issued a news release calling the reporter a 'hacker.'"
https://www.newsobserver.com/news/technology/article258330168.html#storylink=cpy
It's both sad and scary what is happening to US politics. The idiot governor on his official website states he "has a passion for sports, agriculture, Christ, and people." But apparently not IT, or Truth. https://governor.mo.gov/about-governor
Needless to say, both the Governor and County Prosecutor involved are Republicans.
Transcendental question
Yes Me
What's the value of pi in Missouri?
Re: Transcendental question
b0llchit
Blueberry, but only when you do not look.
You see, in Missouri they serve quantum-pi. The value is first fixed when you look and is dependent on local taste. The law encodes the Heisenberg uncertainty principle for pi to the letter.
Only in the USofA
The commentard formerly known as Mister_C
On this side of the pond Renaud would be described as "a sophisticated hacker".
Being stupid is one thing. Being told you've been stupid is another. But going on to continue saying what you've been told is stupid is something else entirely.