Emails obtained in a public-records request show what happened before the Missouri gov. falsely called the journalist a “hacker”. Officials originally drafted a statement thanking the reporter. but then later threatened to prosecute him. https://arstechnica.com/tech-policy/2021/12/missouri-planned-to-thank-security-journalist-before-governor-called-him-a-hacker/?itm_source=parsely-api
Missouri officials are trying to hide the fact that there was a serious security flaw created by the State and instead publicly blaming the individuals who responsibly reported the problem to the proper authorities.
Parson. other state officials should publicly apologize to the parties involved. thank them for their responsible handling of the situation. and encourage responsible reporting of issues moving forward.
To hide a security flaw caused by the state
Missouri officials are trying to hide the fact that there was a serious security flaw created by the State
The reporter did the responsible thing by reporting his findings so that the state could act to prevent disclosure and misuse. There was no breach of the website or any other systems, and certainly no malicious intent. For Missouri officials to deflect their failures by referring to this as 'hacking' is unfounded.
It's clear the Governor's office has a fundamental misunderstanding of both web technology and industry standard procedures for reporting security vulnerabilities. Responsible reporting of such problems should be encouraged. not met with threats of prosecution. The state is also violating First Amendment rights - "right to speak freely without the threat of government retaliation."
Viewing website HTML code is not illegal or “hacking. No statute in Missouri or on the federal level prohibits members of the general public from viewing publicly available websites or viewing the website's unencrypted source code. The State of Missouri and its officials improperly published Social Security numbers of approximately 100,000 teachers online. The data was encoded but not encrypted. No one can view encrypted data without the specific decryption key. But encoded data is simply in a different format and can be easily decoded and viewed.
The State of Missouri automatically transmitted teacher Social Security numbers to every website visitor. No one who discovered and reported this security flaw attempted to gain unauthorized access to or 'hack' the website.