TOWN AND COUNTRY — Missouri Gov. Mike Parson is doubling down on his contention that a reporter at the Post-Dispatch committed a crime by revealing a network flaw that put the Social Security numbers of thousands of teachers at risk.
It was the first time Parson responded since the Post-Dispatch reported last week on emails, obtained through a public records request, indicating the FBI told state cybersecurity officials that there was “not an actual network intrusion” and a state database was “misconfigured.”
The emails from the Department of Elementary and Secondary Education also revealed that officials there first planned to thank the newspaper for alerting them to the problem.
People are also reading…
“We are grateful to the member of the media who brought this to the state’s attention” was the proposed quote attributed to Education Commissioner Margie Vandeven.
Asked at a ribbon-cutting ceremony Tuesday whether, in light of the records provided by the state, he still believed the newspaper committed a crime, Parson said, “Most certainly I believe that. And most certainly I don’t know where that information’s coming from that you guys printed on that, whether it’s very accurate or not either. It has a tendency not to be very accurate a lot of times.”
Records also show the FBI told the state the incident was ‘not an actual network intrusion.’
The records, released in response to a Sunshine Law request to the governor’s office, showed that Angie Robinson, cybersecurity specialist for the state, emailed Department of Public Safety Director Sandra Karsten to inform her that she had forwarded emails from the Post-Dispatch to Kyle Storm with the FBI in St. Louis. Robinson said the FBI agent indicated there was no “network intrusion.”
The Post-Dispatch reported Oct. 13 that more than 100,000 Social Security numbers of Missouri educators were vulnerable on a DESE website. Post-Dispatch journalist Josh Renaud found teachers’ Social Security numbers were accessible in the HTML source code of some publicly available DESE web pages.
The newspaper informed DESE of the flaw and delayed publication of a report until the department could take action to protect the privacy of individuals in the database.
The statement thanking the reporter was changed to describe Renaud as a “hacker.” Parson the next day said the Cole County prosecutor and Missouri State Highway Patrol would open an investigation into the matter. A political action committee supporting Parson ran an ad attacking the newspaper over the incident, saying the governor was “standing up to the fake news media.”
Last week, Gov. Mike Parson accused the newspaper of hacking the Department of Elementary and Secondary Education's website.
Parson has cited a state statute that says someone tampers with computer data if he or she “without authorization or without reasonable grounds to believe that he has such authorization” accesses a computer system and “intentionally examines information about another person.”
There is no authorization required to examine public websites, but some researchers say overly broad hacking laws in many jurisdictions let embarrassed institutions lob hacking allegations against good Samaritans who try to flag vulnerabilities before they’re exploited.
Parson spokeswoman Kelli Jones said Tuesday that the investigation was still ongoing.
In a statement last week following disclosure of the records, St. Louis Post-Dispatch President and Publisher Ian Caso noted the documents showed no network intrusion.
“As DESE initially acknowledged, the reporter should have been thanked for the responsible way he handled the matter and not chastised or investigated as a hacker,” Caso said.
In this Series
- 22 updates