Missouri governor’s office responsible for teacher data leak

https://krebsonsecurity.com/2022/02/report-missouri-governors-office-responsible-for-teacher-data-leak/

by todsacerdoti • 4 years ago

308 114 4 years ago

krebsonsecurity.com

ceejayoz3• 4 years ago

It's a pity there'll be no sanctions for what seems to be a fairly clear case of defamation.

JumpCrisscross• 4 years ago

It's a pity there'll be no sanctions for what seems to be a fairly clear case of defamation

Would a journalist have a legal claim for defamation against the Governor? Seems like a stretch.

woodruffw3• 4 years ago

Of the four necessary conditions for defamation, they'd likely have the most trouble showing the "damages" condition (since both the journalist and the newspaper have been thoroughly repudiated throughout the entire affair).

bogrollben• 4 years ago

my my my how the turntables

froggertoaster3• 4 years ago

I live in Missouri and am a Republican and can safely say - I did not appreciate Parsons going on a political witch hunt.

long_time_gone9• 4 years ago

In light of the actions of the previous Governor [1], does it make you re-think your party affiliation?

[1] https://www.nbcnews.com/politics/congress/eric-greitens-form...

froggertoaster3• 4 years ago

What should I be instead, a Democrat?

The answer to your question is no. Why on earth would I change my party affiliation based solely on the actions of two members of the party?

I'll also add, other than this small stain, Parsons has been good. No major changes or upsets. It's boring here in Missouri politically, and I like that.

brimble• 4 years ago

What really sucks is that Greitens at least seemed to give half a damn about responsible governing. I'm very much not a Republican, but I'd much rather have him back, if those are my options. That sort's rare in either party—and, I might suggest, even rarer in the party that's openly anti-government much of the time.

jimbob452• 4 years ago

The problem is that the grass is not often greener on the other side. In states like Oregon, Texas, and Florida, there very often is significant support to move to the opposing party because the incumbent governor is truly bad. However, the opposition fails to put up a compelling candidate and those states remain stuck with the fools they have.

Consider Florida. A lot of people really don't like DeSantis but the alternative the DNC of Florida put up was...a literal methhead[0]. Oregon has Kate Brown who has signed extremely unpopular legislation in Oregon but the opposition was...a guy who isn't even a Republican anymore[1]. Texas has Greg Abbott who is universally hated in Texas after the energy fiasco of 2021 but his opponent is a guy who failed to win a Senate election[2], let alone the governorship (have fun donating to that).

It's easy to look at the political parties of a state's elected representatives and make assumptions about the people there but it's very important to consider the actual people being elected before you draw conclusions about the politics of the citizens.

[0]https://www.sun-sentinel.com/news/politics/fl-ne-andrew-gill...

[1]https://en.wikipedia.org/wiki/Knute_Buehler

[2]https://www.shorturl.at/xEKZ3

endisneigh• 4 years ago

I’m curious - by the same logic should an American re-think their citizenship based on the previous presidents?

dang4• 4 years ago

Please don't take HN threads into tedious partisan flamewars. They're repetitive, off topic, usually turn nasty, and are not what HN is for.

https://news.ycombinator.com/newsguidelines.html

bastardoperator2• 4 years ago

It wasn't a witch hunt, it was an orchestrated attempt to shift blame for what is ultimately his responsibility. His behavior is unethical, immoral and costly to taxpayers. Why people still keep wearing political labels is beyond me.

mdavis6890• 4 years ago

Will you vote for him again? Will other Republicans?

Assuming you think that as bad as Parsons is for this, the Democrat opponent is worse - what is the process in Missouri for replacing Parsons on the Republican side of the ballot in the next election?

_fat_santa• 4 years ago

I remember reading the original story and it was bananas. Parsons kept doubling down and all of us were just sitting here going "oh this is not going to end well for him". And here we are...

toomuchtodo• 4 years ago

“The lady doth protest too much.” led us exactly where one might predict it to.

Never change Missouri politics. You get what you vote for.

houseofzeus• 4 years ago

At the end of the day though, what are the actual consequences for him?

nimbius• 4 years ago

great question. since Missouri is one of a handful of states that are both heavily gerrymandered and impose strict limitations on the freedom to vote, its politics effectively mimic a gerontocratic autocracy....rule by an opaque council of elders elected under such limited conditions and terms they are effectively appointees.

its unlikely he will face any meaningful repercussions for attempting to scapegoat the press.

caymanjim• 4 years ago

There are no consequences beyond egg-on-face. I think that's as it should be. He said something stupid and reactionary, from a place of ignorance, likely parroting what some underling of his said. Now he looks silly, the news gets to carp about it for a cycle, and we all move on. This is as things should be. No one was materially hurt by his ignorant claims. Journalists are (or at least should be) thick-skinned enough to handle whatever inconvenience resulted from this, and now they get to publish their followups. Schadenfreude is its own reward.

vkou• 4 years ago

In the short-term, none. In the long-term, the consequences are that he's a great candidate for a GQP presidential nomination, for being a strong, decisive leader attacked by an unfair lying press.

duxup7• 4 years ago

What is strange is he could have just said "that's bad we'll fix it" and kinda rolled on ... fairly quickly.

quantified• 4 years ago

And yet, it could have gone to a court victory for him. Glad it didn’t.

kenjackson• 4 years ago

“We are grateful to the member of the media who brought this to the state’s attention,” was the proposed quote attributed to the state’s education commissioner before Parson began shooting the messenger.

Why do we have so many people in politics that seem so hellbent on trying to attack people and find malice in what they do? I don't know much about Pasrson, but I hope this is not his standard MO.

duxup7• 4 years ago

I suspect if a lot of your platform is scapegoating to start with it is SO EASY to just use that when anything you don't like happens / makes you look bad.

Even things that don't really make you look bad... (early on this wasn't even thought to be the governor's office fault directly).

That's the danger in scapegoating and etc it's so easy to do for everything.

Hugo Chávez had a regular national TV show in Venezuela where he would call up his own government officials and berate them and sometimes fire them on live TV. It's a scary viral like thing if you think to do it for everything.

carrja99• 4 years ago

From Missouri, it is his standard MO

extra88• 4 years ago

"MO" is everyone's standard Missouri.

andrewflnr2• 4 years ago

Convincing people that your opponents are evil is an effective way to get them to vote for you.

b112• 4 years ago

Politicians live and die by attacking opponents reputations, instead of the message.

The public, sadly, cares more about not the job done, the track record, but instead on appearances.

I once saw a Canadian politician mocked for his haircut. Another for the way he spoke.

Not how well they did their job.

So yeah, someone says something bad about a politician, well... we keep hiring people that are better at attacking appearances, not policy.

ChrisMarshallNY• 4 years ago

What's that old saying?

    "A lie can travel around the world, while the truth is still putting its boots on."

duxup7• 4 years ago

I think you can be a good governor and not know much about technology.

I think you can be a good governor and even possibly be ... not smart.

You just need to be able to find good people to listen to. In fact some folks told him it wasn't the reporter's fault early on.

It seems Mike Parson is the first two, and incapable of the last.

Sadly it seems he does all this at the expense of good governance and the people of Mussouri in order to target people he doesn't like.

kasey_junk• 4 years ago

This wasn’t targeting people the governor didn’t like, this was a direct attempt to punish publication of a story that showed him in a bad light.

The intent was the chilling effect and the governor got what he wanted. The reporter, subject matter expert & newspaper all had to be involved in a criminal investigation and incur all the costs that go with it.

This was a direct attack on a free press using the full menace of the state and there are unlikely to be an repercussions for it. Quite the opposite there are members of his constituency that believe that the press are enemies and deserve this treatment.

duxup7• 4 years ago

"people he doesn't like"

I use the idea of that generally in a way that IMO fits your description as well.

Reporter, newspaper, another politician, even an institution, any could fall into that category IMO.

While I don't doubt the seriousness of his actions regarding attacking / threatening the press, I think for guys like him he would be happy to target anyone / think that kept him in power.

lotsofpulp3• 4 years ago

I do not understand how one can qualify Mike Parson as a good governor while also stating that he targets people he does not like (with legal action from taxpayer funded prosecutors).

duxup7• 4 years ago

Nope. I'm saying the opposite. I think maybe my wording confused you (I do that sometimes).

romellem• 4 years ago

The [(redacted) report][1] is worth reading for yourself. Not only does it detail that pretty much everything was done "by the book" on the journalist and researcher side, but just how ridiculous the governor's reaction was.

The interview with Dr. Khan, the University of Missouri-St. Louis professor who helped verify the original vulnerability, he discusses another time when a Missouri State government website had a different vulnerability, and how the reaction was different:

    I asked Dr. Khan if this type of flaw was something commonly seen.
    He indicated this was a common problem. He advised in 2016, he wanted
    to verify his voter registration, so he Googled "check voter registration"
    on his smart phone. He stated he clicked on the Missouri Secretary of
    State's website and as soon as the page loaded, he observed the page was
    loading through "plain http." [...] [T]he website was indexed in Google in
    this way, so anyone who Googled the Secretary of State's website, would be
    routed through that link. [...] [H]e emailed the Chief Security Officer and
    advised them of the problem and the fix for it. He stated he received an
    email thanking him for reporting the issue and was advised they would correct
    the issue.

[1]: https://s3.documentcloud.org/documents/21271820/redacted-inf...

the_only_law2• 4 years ago

Sorry for the tangent, but am I the one who finds it’s odd that this was done by the Highway Patrol? I understand that the scope of that agency probably operates outside of just the highway, but I thought most states had other law enforcement agencies that would seem more appropriate.

mikestew• 4 years ago

When I lived in Indiana, the Indiana State Police (which most residents would consider to be the equivalent to "highway patrol") investigated a lot of things that had nothing to do with patrolling highways. I imagine this situation works the same, but with poor labelling ("highway patrol" serving more like "state police" in at least some situations).

tshaddox2• 4 years ago

In many U.S. states "highway patrol" is simply the name of the state police agency, sometimes informally and sometimes formally.

jffry• 4 years ago

I found the Missouri Department of Public Safety's list of State Law Enforcement Agencies [1] and it does seem like an awkward fit no matter where you would try to put this investigation. That said, I can imagine that in many states, the largest and best-developed law enforcement agency is by necessity the one that spans the entire state for the purposes of enforcing traffic laws.

[1] https://dps.mo.gov/leagencies.php

im_down_w_otp• 4 years ago

Some folks here may be too young to remember this, but we used to colloquially call the Internet the "The Information Superhighway".

cossatot• 4 years ago

Parsons was for years a county sheriff of a rural county in Missouri (Polk County, current population ~30,000), so he was head of the Highway Patrol in the county. I suspect that as Governor he has strong relations with the Highway Patrol statewide and views them still as loyal and trustworthy to him, while he may view the more suitable branches of law enforcement (e.g., the cyber crimes division of the Department of Public Safety) as urban desk jockeys who may be less loyal and aligned with him personally, and therefore he'd rather send in his own troops for missions such as this.

bastardoperator2• 4 years ago

Who else is gonna police the information super highway?

pyuser5832• 4 years ago

In the state I live in, there are very, very few statewide law enforcement agencies. By far the largest is the state highway patrol.

State highway patrol officers are the “go to” cops for statewide officials.

dragonwriter• 4 years ago

Sorry for the tangent, but am I the one who finds it’s odd that this was done by the Highway Patrol?

In many states, there are some domain specific LE agencies, but also one general competence agency. In several cases (sometimes as a result of a merger between Highway Patrol and State Police where the former name was retained) the general-competence LE agency is the highway patrol.

joshstrange2• 4 years ago

The fact that the governor will probably face no repercussions from this sickens me. It's bad enough that our elected officials aren't capable of grasping basic tech concepts but this stinks of a coverup or at a minimum shifting the blame from his own office who was responsible for the data leak (for a decade!!!).

kodah2• 4 years ago

What is there to cover up? The existence of a bug? That seems trivial.

It sounds like the guy is a confident idiot.

joshstrange2• 4 years ago

You don't find it suspicious that the governor's office directly oversaw the group that made the mistake and then were so quick to point at the reporter as the one responsible? I sure do and the governor's office clearly doesn't deserve the benefit of the doubt in this case.

magikaram• 4 years ago

As a Missourian, and former Education sector employee, the handling of the situation shoes how terrible Parson is as a governor, and how even after the past two scandals, whether it be the opposing candidate, no one will pull him out of office.

RegW• 4 years ago

Passer by: "Oy mate! D'you know you've left your stable door open?"

Parsons: "You sire are a horse thief. You shall hang for this."

giaour2• 4 years ago

Did the governor incur any civil liability? In light of this report, it's hard to see his press conference as a defensible use of his powers and bully pulpit.

dang4• 4 years ago

Related past threads:

Prosecutor won't charge reporter who uncovered database flaw - https://news.ycombinator.com/item?id=30318208 - Feb 2022 (121 comments)

The governor of Missouri still doesn’t know how websites work - https://news.ycombinator.com/item?id=29752259 - Dec 2021 (21 comments)

Reporter may be prosecuted for using “view source” - https://news.ycombinator.com/item?id=29737412 - Dec 2021 (163 comments)

Reporter who told Missouri officials of website flaw did 'nothing out of line' - https://news.ycombinator.com/item?id=29098289 - Nov 2021 (190 comments)

Gov. Parson releases video attacking newspaper for viewing HTML - https://news.ycombinator.com/item?id=28980855 - Oct 2021 (26 comments)

Gov Parson pushes to prosecute reporter who found security flaw in state site - https://news.ycombinator.com/item?id=28946392 - Oct 2021 (525 comments)

Governor vows criminal prosecution of reporter who found flaw in state website - https://news.ycombinator.com/item?id=28866805 - Oct 2021 (678 comments)

cronix• 4 years ago

“A hacker is someone who gains unauthorized access to information or content. This individual did not have permission to do what they did. They had no authorization to convert or decode, so this was clearly a hack.”

So, "view page source," a built in browser function since forever (not even considering various built in inspectors), is illegal according to this very smart politician. That's basically all that was done here, on a publicly accessible website.

thr0wawayf002• 4 years ago

This scandal is a perfect example of how our political discourse is failing. We cannot simply talk about government budgets and taxes in simple binary terms.

We have to accept that the government needs to spend some money in order fulfill basic functions like protecting sensitive data because anybody that does good work in IT demands far higher pay than what you typically earn in the private sector. I see this all the time.

If billionaires and venture-backed firms are the only ones that can reasonably attract and retain technical talent, we will never solve this problem. The IT pay disparity between the public and private sector is staggering and with inflation, who's gonna take a 60-70% pay cut to work in a public IT job?

netizen-9368242• 4 years ago

It might help if we didn't have the least competent people possible in positions of power

thr0wawayf002• 4 years ago

Oversimplifying the problem to deflect from the underlying issues only serves the interests of those that enable scandals like this in the first place.

peatmoss• 4 years ago

Couldn't agree more. Having lived overseas really drives home the feeling that fixation on more vs. less is rather crude.

In a lot of ways, it feels like the Ron Swanson schtick from Parks and Recreation: if you're anti-government, you strive to get in power so that you can run government badly, thus proving that government is bad and that we should drown it in the bathtub.

bbertelsen• 4 years ago

The initial charges against the journalist could have been subterfuge to divert media culpability over recently acquired oversight privileges. I'm not suggesting that teachers aren't tech literate but perhaps there are some that will only remember the first headline, "journalist hacked me". Teachers unions also tend to vote in blocks.

Missouri governor’s office responsible for teacher data leak

Related Stories