Missouri will not prosecute 'hacker' reporter for daring to view state website HTML

The State of Missouri will not prosecute a journalist branded a “hacker” for viewing website source code and reporting a serious security leak. 

In October 2021, St. Louis Post-Dispatch reporter Josh Renaud published a story documenting the exposure of Social Security numbers belonging to teachers, administrators, and counselors caused by security flaws in the Missouri Department of Elementary and Secondary Education’s website. 

Over 100,000 SSNs were reportedly exposed. 

Renaud discovered the issue in a search function on the website and all it took to find SSNs was to press F12 and view the website’s HTML through the developer console. 

The news outlet did not go ahead with the story until the department took the impacted pages down and remove the search tool. 

St. Louis Post-Dispatch reported the flaw, that allowed anyone with a browser to view this sensitive data, privately to DESE prior to publication. However, Missouri Governor Mike Parson took a dim view of the responsible disclosure. 

On Twitter, Parson alleged that the journalist “took the records of at least three educators, decoded the HTML source code, and viewed the SSN of those specific educators.”

Parson said:

“This matter is serious. The state is committing to bring

Read More: https://www.zdnet.com/article/missouri-will-not-prosecute-hacker-reporter-for-daring-to-view-state-website-html/#ftag=RSSbaffb68