Josh Renaud reports:
The Social Security numbers of school teachers, administrators and counselors across Missouri were vulnerable to public exposure due to flaws on a website maintained by the state’s Department of Elementary and Secondary Education.
The Post-Dispatch discovered the vulnerability in a web application that allowed the public to search teacher certifications and credentials
Read more on St. Louis Post-Dispatch.
Now at this point, you’re probably asking the usual questions like “How many were potentially at risk?” “How long had this been a problem?” and “Is there any evidence that the data were accessed or downloaded for possible misuse?” But while those are all reasonable questions, my question is ‘Why is the administration engaging in “Shoot the Messenger?’ and calling the reporter a “hacker?”
According to the Post-Dispatch’s report, in both a press release on the state’s site and a letter to educators, the state blamed the Post-Dispatch for discovering the vulnerability and referred to the reporter as a hacker.
Through a multi-step process, a hacker took the records of at least three educators, decoded the HTML source code, and viewed the social security number (SSN) of those specific educators.
The letter to educators replaced “hacker” with “individual.”
Sam Clancy of KSDK in Missouri seems to have picked up the state’s claims and KSDK headlines a story: “Hacker gets SSN, other information of 3 Missouri teachers in data breach.”
KSDK probably had no idea they were accusing another journalist of being a hacker.
But kudos to the St. Louis Post-Dispatch team that found the problem, confirmed it, and then responsibly disclosed it to the state. I’m going to let their external counsel, attorney Joseph Martineau of Lewis Rice, have the last word here, although I note that Martineau seems to only use “hacker” in a criminal sense, whereas many hackers are whitehats and administrators:
“The reporter did the responsible thing by reporting his findings to DESE so that the state could act to prevent disclosure and misuse,” Martineau said in a written statement. “A hacker is someone who subverts computer security with malicious or criminal intent. Here, there was no breach of any firewall or security and certainly no malicious intent.
“For DESE to deflect its failures by referring to this as ‘hacking’ is unfounded. Thankfully, these failures were discovered.”
DESE: we’ll just wait over here for you to apologize for attempting to deflect blame to the reporter who discovered your security problem and who worked with their team to responsibly disclose it to you.
Update: The state seems to be doubling down on accusing the reporter and the press of illegal conduct. You can watch the Governor’s press conference/statement on YouTube.