Reporter who "hacked" a Missouri state website, may actually face charges, according to Missouri Gov.

[cmdcarini]

Summary

Missouri Governor Mike Parson, who was recently in the news for claiming a reporter was "hacking" a state website, after that reporter discovered SSN's and other sensitive information that were written directly in the source of the website. While this information is publicly available to anyone with a simple right click, the Gov. is now seeming to indicate prosecution of said reporter is somehow, actually moving forward. The Gov. seems to be indicating that the reporter will be charged with "Computer Tampering" 

 

Quotes

Quote

A St. Louis Post-Dispatch reporter who viewed the source HTML of a Missouri Department of Elementary and Secondary Education website is now likely to be prosecuted for computer tampering, says Missouri Governor Mike Parson.

...

"These documents show there was no network intrusion," St. Louis Post-Dispatch President and Publisher Ian Caso said this month. "As DESE initially acknowledged, the reporter should have been thanked for the responsible way he handled the matter and not chastised or investigated as a hacker."

 

My thoughts

Frankly this is somewhat frightening, and shows that those in power have an insane lack of understanding of the underlying technology, and this could lead to someone facing some severe punishments for something that is absolutely 100% not a crime. 

 

Sources

https://www.theverge.com/2021/12/31/22861188/missouri-governor-mike-parson-hack-website-source-code

https://www.ksdk.com/article/news/local/highway-patrol-finishes-investigation-post-dispatch-reporter-hacking-investigation/63-bd302d55-de72-470a-b821-f999d41def75

https://boingboing.net/2021/12/30/reporter-likely-to-be-charged-for-using-view-source-feature-on-web-browser.html

 

 

 

[adarw]

didnt this governor say that they were wrong and the reporter wasnt going to face charges before? 

 

[Fasterthannothing]

This is now too true

 

 

[Quackers101]

you mean the update to this??

 

[Jtalk4456]

36 minutes ago, cmdcarini said:

My thoughts

Frankly this is somewhat frightening, and shows that those in power have an insane lack of understanding of the underlying technology, and this could lead to someone facing some severe punishments for something that is absolutely 100% not a crime. 

While I agree the stupidity is frightening, I wouldn't worry too much in this case.

1. Both of these articles seem to be talking in the past tense and just late to the news story for whatever reason. This isn't new info as far as I can find in the article. 

2. Gov Parson has done this before.

Quote

Soon after, Governor Parson, "who has often tangled with news outlets over reports he doesn't like, announced a criminal investigation into the reporter and the Post-Dispatch."

This is a crazy dude, not necessarily the normal.

3. The only reason I can see these pieces show up all of a sudden is the investigation that was started and mentioned in the article has concluded and sent it's findings to the prosecution office.

Quote

Capt. John Hotz with the highway patrol's Public Information and Education Division said the investigation was complete and the findings were turned over to the Cole County prosecutor's office. Hotz did not provide any other information about the investigation.

There's literally no new information other than the "investigation" is over. I wonder if they inspected any elements or viewed any sources in their investigation...

4. He has NO chance of winning this in court. NONE, ZIP, ZILCH

Quote

 

[A] state cybersecurity specialist informed Sandra Karsten, the director of the Department of Public Safety, that an FBI agent said the incident "is not an actual network intrusion."

Instead, the specialist wrote, the FBI agent said the state's database was "misconfigured," which "allowed open source tools to be used to query data that should not be public."

"These documents show there was no network intrusion," St. Louis Post-Dispatch President and Publisher Ian Caso said this month. "As DESE initially acknowledged, the reporter should have been thanked for the responsible way he handled the matter and not chastised or investigated as a hacker."

 

Quote

 

"If somebody picks your lock on your house — for whatever reason, it's not a good lock, it's a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you," Parson said in a statement.

A commenter on the Post-Dispatch story offers a more apt analogy:

A better analogy would be you're walking in the street past a neighbor's house and notice their front door wide open with no one around. You can see a purse and car keys near the door. You phone that neighbor, and tell them their door is open and their purse and keys are easily visible from the street. Would Parson consider this breaking and entering?

 

He has no ground to stand on, legally or otherwise. If I remember the original reports of this well enough, I recall the reporter had reported the security issue early on and had waiting several months begging them to fix it and finally gave up and reported in the paper so they would fix it. The FBI is saying he's fine, Gov. Parson is a Whack-job and has nowhere to go with this. He just needed his five minutes defending his great state by pretending the reporter was an enemy hacker.

[Mark Kaine]

I guess i don't agree with the nothing to see here stance. what im seeing is a "gov" that should be prosecuted for cyber criminality and treason because his behavior is putting his state at massive risk since people will think twice in the future before giving important security critical info to the apparently completely inept "gov".

 

11 hours ago, Jtalk4456 said:

He has NO chance of winning this in court. NONE, ZIP, ZILCH

SO, you're saying there's a chance?

[BuckGup]

I want a cyber world war. Something to get older people to realize how ingrained and powerful the internet is in society

[Jtalk4456]

3 hours ago, Mark Kaine said:

1. I guess i don't agree with the nothing to see here stance. what im seeing is a "gov" that should be prosecuted for cyber criminality and treason because his behavior is putting his state at massive risk since people will think twice in the future before giving important security critical info to the apparently completely inept "gov".

I completely agree, he should be held liable for defamatory statements against the press. he didn't personally code the system (god I hope not) so i think prosecuting him for cyber criminality and treason doesn't make sense. Whoever made this stupid website should be sued out of their pants for gross negligence and mishandling of government data and security.

[thechinchinsong]

The governor of a state of the United States, folks. Leading the executive branch of over 6 million from the state of Missouri. I guess I'm not really surprised since I'm guessing 90% of people can't tell the difference between inspect element and the Matrix.

[wanderingfool2]

On 12/30/2021 at 6:13 PM, Jtalk4456 said:

He has no ground to stand on, legally or otherwise. If I remember the original reports of this well enough, I recall the reporter had reported the security issue early on and had waiting several months begging them to fix it and finally gave up and reported in the paper so they would fix it. The FBI is saying he's fine, Gov. Parson is a Whack-job and has nowhere to go with this. He just needed his five minutes defending his great state by pretending the reporter was an enemy hacker.

The laws regarding this are pretty stupidly written honestly.  If there was a prosecutor willing to proceed with it, I would actually bet that the charges would stick.  *as stupid and as terrible as it would be*

 

I just want to stress something here, which would make it a much "stronger" case if tried in court, from what I have read regarding the details of this.  It was not in plain text (my guess stored as a BASE64 string).  The steps would have been search a teacher, view source, find the "SIN encoded", decode  It means that he would reasonably know that the data wasn't intended to be viewed, and by decoding it he has now done the unauthorized access, and since it pertains a government entity it now is a felony.  [Did I mention how stupid the law is written].

 

All they really need to do is prove unauthorized access, the fact it was encoded and he had to decode means I think they could argue it wasn't authorized access.  (Admittedly the key analogy was actually a good one, in regards to how the law works.  It doesn't matter if the key was stupidly designed, all that matters was there was an attempt to keep the text as a non-plaintext)  *To be clear, I think logic needs to win out but sadly the law isn't written like that*

 

 

[Brooksie359]

7 hours ago, thechinchinsong said:

The governor of a state of the United States, folks. Leading the executive branch of over 6 million from the state of Missouri. I guess I'm not really surprised since I'm guessing 90% of people can't tell the difference between inspect element and the Matrix.

Well to be fair this wouldn't be the first or last time the justice system has brought ridiculous charges to court. It definitely doesn't help that you have someone pressing charges that they don't even know the meaning of. I mean it would be like someone charging someone for money laundering because they left money in their clothes when they put them into the washing machine. 

[mr moose]

19 hours ago, BuckGup said:

I want a cyber world war. Something to get older people to realize how ingrained and powerful the internet is in society

It has nothing to do with older people.  this idea that being old means you know less about technology is a stupid myth that needs to die.    There are 100's of thousands of ignorant young karens and karson's all over the internet who don't know the difference between facebook and an ISP.

[jagdtigger]

2 hours ago, wanderingfool2 said:

I just want to stress something here, which would make it a much "stronger" case if tried in court, from what I have read regarding the details of this.  It was not in plain text (my guess stored as a BASE64 string).  The steps would have been search a teacher, view source, find the "SIN encoded", decode  It means that he would reasonably know that the data wasn't intended to be viewed, and by decoding it he has now done the unauthorized access, and since it pertains a government entity it now is a felony.  [Did I mention how stupid the law is written].

Got the data and key via official channels without using illicit means, id say this is where the unauthorized access allegation burns to ashes.  Id say the governor should face charges for defamation, criminal negligence, and should pay any damages linked to this case.

[Liltrekkie]

3 hours ago, wanderingfool2 said:

The laws regarding this are pretty stupidly written honestly.  If there was a prosecutor willing to proceed with it, I would actually bet that the charges would stick.  *as stupid and as terrible as it would be*

 

I just want to stress something here, which would make it a much "stronger" case if tried in court, from what I have read regarding the details of this.  It was not in plain text (my guess stored as a BASE64 string).  The steps would have been search a teacher, view source, find the "SIN encoded", decode  It means that he would reasonably know that the data wasn't intended to be viewed, and by decoding it he has now done the unauthorized access, and since it pertains a government entity it now is a felony.  [Did I mention how stupid the law is written].

 

All they really need to do is prove unauthorized access, the fact it was encoded and he had to decode means I think they could argue it wasn't authorized access.  (Admittedly the key analogy was actually a good one, in regards to how the law works.  It doesn't matter if the key was stupidly designed, all that matters was there was an attempt to keep the text as a non-plaintext)  *To be clear, I think logic needs to win out but sadly the law isn't written like that*

 

 

They were not in a BASE64 string. They were literally in plain text, within the source code of the web page. Entire social security numbers, in plain text. Accidently hitting f12 in chrome would have revealed everything. 

 

The governor is just trying to cover his administrations incompetence, at the expense of this guy. The charges won't stick in a jury trial. They would have to charge every person who's accidently hit f12 in their life. Welp, guess we are all going to jail.

[Avocado Diaboli]

On 12/31/2021 at 2:23 AM, cmdcarini said:

Frankly this is somewhat frightening, and shows that those in power have an insane lack of understanding of the underlying technology, and this could lead to someone facing some severe punishments for something that is absolutely 100% not a crime. 

I find it funny that people take statements made by politicians at face value. This guy probably isn't dumb or uninformed enough to not know that the reporter did nothing illegal here. This is a tactic to cover his ass, because ultimately, any failure of an administration will always be blamed upon the person in charge of it. It's an entirely political move to shift blame. I know, the old adage states "never assume malice when stupidity can serve as an explanation", but with any politician I will always assume malice over ignorance, every single time, especially in instances where their error in judgement is this obvious. Because every politician has a board of experts at their side to consult before they make public statements. And I doubt nobody in his administration is aware of the fact that they messed up.

[Vishera]

So now pressing F12 makes you a hacker?

That's preposterous!

[Jtalk4456]

8 hours ago, wanderingfool2 said:

The laws regarding this are pretty stupidly written honestly.  If there was a prosecutor willing to proceed with it, I would actually bet that the charges would stick.  *as stupid and as terrible as it would be*

 

I just want to stress something here, which would make it a much "stronger" case if tried in court, from what I have read regarding the details of this.  It was not in plain text (my guess stored as a BASE64 string).  The steps would have been search a teacher, view source, find the "SIN encoded", decode  It means that he would reasonably know that the data wasn't intended to be viewed, and by decoding it he has now done the unauthorized access, and since it pertains a government entity it now is a felony.  [Did I mention how stupid the law is written].

 

All they really need to do is prove unauthorized access, the fact it was encoded and he had to decode means I think they could argue it wasn't authorized access.  (Admittedly the key analogy was actually a good one, in regards to how the law works.  It doesn't matter if the key was stupidly designed, all that matters was there was an attempt to keep the text as a non-plaintext)  *To be clear, I think logic needs to win out but sadly the law isn't written like that*

 

 

Sorry but there's no case on viewing publicly available info, which this was. There was no unauthorized access because there was no "access" in the sense that he was on a website anyone can get to. Lets say someone puts an encoded message in the Walmart parking lot and you find it. Have you done an unauthorized access of anything? No. If whoever didn't want it to be read, they shouldn't have left it in the Walmart parking lot. Now If you found it in the managers office and you aren't even an employee, that would be unauthorized access. The law is often stupidly written, but in this case there's no stupid law that would let something this ridiculous stick. Literally the FBI said he didn't hack anything, so FBI vs Gov. Parson. I'm placing my bets that a judge trusts cybersecurity experts from the government over an old white dude who is clearly off his rocker.

[Guest willies leg]

Used to be the government worked for us.

Now we work for the government.

[jagdtigger]

10 minutes ago, James Evens said:

Meanwhile in Chromium:

Firefox FTW!

[wanderingfool2]

5 hours ago, jagdtigger said:

Got the data and key via official channels without using illicit means, id say this is where the unauthorized access allegation burns to ashes.  Id say the governor should face charges for defamation, criminal negligence, and should pay any damages linked to this case.

The act of accessing non-plaintext information would be considered unauthorized access.

 

18 minutes ago, Jtalk4456 said:

Sorry but there's no case on viewing publicly available info, which this was. There was no unauthorized access because there was no "access" in the sense that he was on a website anyone can get to. Lets say someone puts an encoded message in the Walmart parking lot and you find it. Have you done an unauthorized access of anything? No. If whoever didn't want it to be read, they shouldn't have left it in the Walmart parking lot. Now If you found it in the managers office and you aren't even an employee, that would be unauthorized access. The law is often stupidly written, but in this case there's no stupid law that would let something this ridiculous stick. Literally the FBI said he didn't hack anything, so FBI vs Gov. Parson. I'm placing my bets that a judge trusts cybersecurity experts from the government over an old white dude who is clearly off his rocker.

If it was in plain text, I would say there would be nothing that could be done against them, but this was not in plain text.  If a bunch of source is visible to you, but one item was encoded then it crosses the realm of unauthorized access.  In the whole concept of cyber security this wasn't considered hacking, but again the law is stupidly written (like some laws are).  An example of another bad law, the trucker who got sentenced to 110 years in prison for losing control of his vehicle and killed 4.  The judge didn't want to give him 110 years, the prosecution after the fact even petitioned for a reduced sentence, but as the judge said the law forced him to give the sentences back to back [The governor stepped in and used his commutation abilities to reduce it to 10 years].

 

Also search Aaron Swartz as a similar example of how badly the law surrounding this is, he broke the TOS.  The law is badly written.

 

3 hours ago, Vishera said:

So now pressing F12 makes you a hacker?

That's preposterous!

This is what bugs me, everyone who keeps spouting out that it's plain text...IT WAS NOT PLAIN TEXT.  Even Linus got it wrong on the WAN show

 

5 hours ago, Liltrekkie said:

They were not in a BASE64 string. They were literally in plain text, within the source code of the web page. Entire social security numbers, in plain text. Accidently hitting f12 in chrome would have revealed everything. 

 

The governor is just trying to cover his administrations incompetence, at the expense of this guy. The charges won't stick in a jury trial. They would have to charge every person who's accidently hit f12 in their life. Welp, guess we are all going to jail.

I am tired of everyone just parroting the "it's plain text, hit f12 to see it"...jumping on that bandwagon is just plain stupid, and arguing that it wasn't BASE64 when it was just shows that you haven't looked at the events of what happened.

 

https://cdn.arstechnica.net/wp-content/uploads/2021/10/Litigation-Hold-and-Demand.pdf

The security researchers demand letter (in a defamation cease and desist)

Quote

Sensitive data should never be stored in the View State in the first place. View State is simply
Base64 encoded and can easily be viewed by anyone because it is readily available in the
browser.

So yes, it was stored in a Base64 value and it was under the variable View State (no mention of SIN, from what I can see).  So it was abstracted away from being plain text.  So hitting F12 would not reveal everything

[jagdtigger]

19 minutes ago, wanderingfool2 said:

The act of accessing non-plaintext information would be considered unauthorized access.

Cant believe you still pushing that BS. They visited this publicly available site and tok a look at the publicly available data. In this case the definition "unauthorized access" does not exist, you cant put something up on public display then sue everyone who looked at it after the fact....

[wanderingfool2]

2 minutes ago, jagdtigger said:

Cant believe you still pushing that BS. They visited this publicly available site and tok a look at the publicly available data. In this case the definition "unauthorized access" does not exist, you cant put something up on public display then sue everyone who looked at it after the fact....

Again, it's a poorly written law.  It doesn't matter if it was distributed to them, it was encoded to not be human readable without intervention...at which point a prosecution would argue that it constitutes as unauthorized access.  If it was simple plain-text, again they wouldn't have a case but it wasnt plain-text.

 

It's also better than the 99% of people here who keep saying and pushing that it was plain-text when it's not.

 

An analogy I would say is if the html source (not visible, but referenced in the source) had a comment like

GovernmentAccess.com/viewSin?name=

inside the source, it would be unauthorized access to copy the url and put in a value as a name to grab someone SIN

 

Again, I'm not justifying them pursuing him, just saying it's not an "open and shut" case like others are making it out to be; they could pursue him quite successfully (public opinion and the reasonableness being another thing though)

[Avocado Diaboli]

53 minutes ago, wanderingfool2 said:

The act of accessing non-plaintext information would be considered unauthorized access.

Nonsense. That's like saying something written in a foreign language somewhere and translating it back to English would be considered unauthorized access because it wasn't intended to be read by anyone capable of speaking English. What you're basically advocating for is this:

 

 

[jagdtigger]

18 minutes ago, wanderingfool2 said:

It doesn't matter if it was distributed to them, it was encoded to not be human readable without intervention...

BS

Encoding definition:
 

Quote

Encoding is the process of converting data into a format required for a number of information processing needs

In other words it has nothing to do with access authorization nor is it signaling any intent on if it should be readable by a human or it never should be read by said human. By your twisted logic decoding a txt from a zipfile is unauthorized access too. Oh did i mention that even reading a clear text file is just decoded binary?

Just drop it before you go off the deep-end.....

[wanderingfool2]

40 minutes ago, jagdtigger said:

BS

Encoding definition:
 

In other words it has nothing to do with access authorization nor is it signaling any intent on if it should be readable by a human or it never should be read by said human. By your twisted logic decoding a txt from a zipfile is unauthorized access too. Oh did i mention that even reading a clear text file is just decoded binary?

Just drop it before you go off the deep-end.....

I can guarantee you that if you presented text to people here in BASE64 format that the majority wouldn't recognize it being in base64 format.  Again it's all about the degrees of which to expect things.

 

I can play at the same game though, under your logic URL manipulation isn't hacking/unauthorized.  It matters a big deal in this case that it was BASE64, and determining whether or not it was unauthorized access...because the majority of the people wouldn't recognize that it's BASE64, it is not the case of just clicking view source

 

In this case, it has to be

View Source

Find Information that looks suspicious

Recognize it as BASE64

Copy the string and use a BASE64 converter.

 

Honestly, it seems to me more like the reporter might have been tipped off by someone.

 

There isn't any twisting of logic here, it's about where the line of unauthorized access gets drawn, and the fact it requires someone to find the variable, recognize information as BASE64, and decode it does I think fall into line of unauthorized access (again it's similar to how they got Aaron Swartz on breaking a TOS)

 

IIRC the stupid law was put in place when dial-up was literally you dialing a phone number to connect to a computer.  NASA had a flight launch delayed when someone dialed into their system and wrote text on the screen (the system wasn't protected).  At the time it wasn't a crime, so they wrote it into the law without the concept that the internet would become a thing.  So yea, some laws surrounding unauthorized access are massively stupidly written (as it was written in the time before even HTML was a concept)