Missouri governor vows criminal prosecution of reporter who found flaw in state website

On Tuesday, a reporter with the St. Louis Post-Dispatch alerted the state that Social Security numbers of school teachers and administrators were vulnerable to public exposure due to flaws on a website maintained by Missouri's department of education.

The newspaper agreed to hold off publishing any story while the department fixed the problem and protected the private information of teachers around the state.

But by Thursday, Gov. Mike Parson was labeling the Post-Dispatch reporter a “hacker" and vowing to seek criminal prosecution.

“The state does not take this matter lightly," Parson said Thursday at a press conference, though he refused to take questions afterward.

Parson said he had referred the matter to the Cole County Prosecutor and has asked the Missouri State Highway Patrol to investigate.

“This administration is standing up against any and all perpetrators who attempt to steal personal information and harm Missourians," he said.

According to the Post-Dispatch, one of its reporters discovered the flaw in a web application allowing the public to search teacher certifications and credentials. No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages.

The state removed the search tool after being notified of the issue by the Post-Dispatch. It was unclear how long the Social Security numbers had been vulnerable.

Parson said Thursday that he wasn't sure why the reporter accessed the information. He claimed it was part of a “political game by what is supposed to be one of Missouri's news outlets."

“The state is committed to bring to justice anyone who hacked our system and anyone who aided and abetted them to do so," Parson said, later arguing that the reporter was “attempting to embarrass the state and sell headlines for their news outlet."

The Post-Dispatch published a statement in response from its attorney, saying the reporter “did the responsible thing by reporting his findings to (the Department of Elementary and Secondary Education) so that the state could act to prevent disclosure and misuse.

“A hacker is someone who subverts computer security with malicious or criminal intent," the statement continued. “Here, there was no breach of any firewall or security and certainly no malicious intent. For DESE to deflect its failures by referring to this as 'hacking' is unfounded. Thankfully, these failures were discovered."

Also Thursday: Top lawyers won't touch Donald Trump with a '1,000-foot pole' as legal crises escalate. WATCH:

Top lawyers won’t touch Donald Trump with a ‘1,000-foot pole’ as legal crises escalateyoutu.be

Missouri Independent is part of States Newsroom, a network of news bureaus supported by grants and a coalition of donors as a 501c(3) public charity. Missouri Independent maintains editorial independence. Contact Editor Jason Hancock for questions: info@missouriindependent.com. Follow Missouri Independent on Facebook and Twitter.