32 ms·

Reporter may be prosecuted for using “view source”

247 points by tkdc926 5y ago

andrewfromx 5y ago
i had the same reaction at first, omg everyone knows about view source, this is a non-issue it was PUBLIC! But then the argument about "even if your lock is bad, doesn't mean someone can break into your house and steal your stuff." And I tried to look at that from the point of view of a normal non-tech person who doesn't know about view source or curl, they just know the normal view did not contain the info and someone did something "extra" and found it. I guess it comes down to how obvious and how "extra". Like what if I sent out a paper newsletter to all my neighbors but printed it on recycled paper that happen to have SSN info on the other side. Is it their fault for do something "extra" like turning the paper over and then seeing the other info?
- mikojan 5y ago
  I don't see no extra in either of these situations. I am living in an apartment complex and I wouldn't mind if someone noticed my keys in my front door, opened that door, took a look and called out for me. This cannot possibly register as breaking in? I am not even talking about motive here. The actual event in my mind is clearly benign.
- 908B64B197 5y ago
  > And I tried to look at that from the point of view of a normal non-tech person who doesn't know about view source or curl Safari read aloud would have blurted out the SSNs in this case. So even for a layman, the lock analogy falls short. > Like what if I sent out a paper newsletter to all my neighbors but printed it on recycled paper that happen to have SSN info on the other side Court would place responsability on the person who failed to inspect the paper used. There's a reason medical offices all have shredders; you can't reuse paper with patient's personal information on it.
BadThink6655321 5y ago
The lock analogy fails. First, the viewer was given the data. Second, obfuscation is not a lock.
tyingq 5y ago
What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: <input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="[SOME_BASE_64_HERE]" /> Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.
- rchaud 5y ago
  > I am totally mystified how a competent DA wouldn't have dropped this immediately. DAs have elections to win, and the risk of not having the governor's endorsement would put them in a tricky position.
- Bud 5y ago
  This is Missouri. It might be hard to find a competent DA in the entire state.
  - nobleach 5y ago
    I know you're probably saying this half-jesting... But the harsh reality is that if a judge cannot understand the minutiae of "browser requested one thing and the PLANTIFF's server sent personal info, unencrypted", then the precedent that is set is an awful one. I get that the amount of technical stuff that needs to be understood here is beyond what your average NON-hacker-news type might understand... but when it comes to prosecution, wouldn't an expert be consulted??
    - rolph 5y ago
      i hope someone realizes prosecuting this would mean the government thinks it is illegal to use a webbrowser to request HTML et. al. from a webserver. by extension missouri is deliberating a court case that questions the legality of public access to WWW.
    - ozfive 5y ago
      It's really not though. Even my parents know and understand what view source is in the browser. A browser is simply a way to render information sent. Once it was wilfully sent and in your browser you are not accessing a machine in a criminal way. I hope that if they even try to bring charges the reporter and the newspaper counter sue for violation of rights. Mozilla and the Chrome team need to weigh in on the defendant side. Anyone here from those teams willing to stand up for this guy?
webmobdev 5y ago
India also has this kind of stupid vague law that makes ethical hacking partly illegal: > The contention is over Clause 7 of the Responsible Vulnerability Disclosure and Coordination Policy, released by CERT-In on September 3. According to the clause, the reporting party must “comply with all the extant laws” like the IT Act, Section 43, which bars unauthorised access to systems. while Section 66 prescribes the corresponding punishment (jail and/or fine). > “Independent security experts may gain unauthorised access to a network when probing a system but they do so to study the vulnerabilities. So while their intent is not malicious, it could be seen as wrong under the IT Act, which is what this policy reinstates,” explains Rohin Garg of Internet Freedom Foundation (IFF), a New Delhi NGO that works to defend digital rights. Source: https://www.deccanherald.com/metrolife/metrolife-on-the-move/policy-on-reporting-cyber-vulnerabilities-is-flawed-1050102.html https://www.deccanherald.com/metrolife/metrolife-on-the-move... More here - https://internetfreedom.in/dont-penalise-cybersecurity-researchers/ https://internetfreedom.in/dont-penalise-cybersecurity-resea...
tyingq 5y ago
I'd love to be an "expert witness" and decode a small snippet of base64 on a whiteboard for the jury. Just to show that the lock analogy is bullshit.
trhway 5y ago
That is another attack on general computing. Until now an "encryption" has been required to limit your legal ability to handle information legally residing on your computer. Now even the "encryption" isn't needed, just a post-factum statement from the information sender that you used unapproved (according to post-factum given definition of approved) viewer for that information. One can see how MS may for example decide that using an old version of Word or accessing MS site by Firefox instead of Bing or from a Linux computer may be qualified as such a hacking.
iambateman 5y ago
The legal parts of this case seem straightforward. The scary thing is a governor using his platform to bully legitimate news-makers who are clearly acting in good faith. We should all hope the paper vigorously defends its first amendment rights.
nulbyte 5y ago
> Gov. Mike Parson on Wednesday expressed his opinion the Cole County prosecuting attorney would bring charges in the case of a Post-Dispatch reporter who alerted the state to a significant data vulnerability. The actual headline reflects the content of the article better: "Parson says he believes prosecutor will bring charges in Post-Dispatch case." Having read the article, I don't see anyone but Parson opine that the reporter will be prosecuted, and if this whole ordeal has done nothing else, if has at least offered adequate reason for me to dismiss Parson's opinions with prejudice.
- natechols 5y ago
  A better headline would be "MO Governor makes a fool of himself repeatedly". I would feel safe betting money on the reporter's continued freedom - the more important question is how much the paper will need to spend on legal defense before it gets thrown out. Which I suspect is actually the point, unless Parson really is that dumb.
Animats 5y ago
Section 242 of the U.S. Criminal Code: Whoever, under color of any law, statute, ordinance, regulation, or custom, willfully subjects, or causes to be subjected, any inhabitant of any State, Territory, or District to the deprivation of any rights,privileges, or immunities secured or protected by the Constitution and laws of the United States . . . shall be fined not more than$ 1,000, or imprisoned not more than one year, or both. This law has never been used to protect First Amendment rights. But, on its face, it could be.
- q1w2 5y ago
  Laws that are vague are superseded by laws that are more specific.
LatteLazy 5y ago
Doing basically anything with a computer is illegal in the US. It gives government a lot of power to deal with errant journalists or others.
ozfive 5y ago
The guy found keys in a lock, knocked on the door and said hey I found your keys in your lock you better figure out a way not to do that again since someone who had intent to do bad things could have come along instead of me.
ambrozk 5y ago
I've written a statement to be issued by the reporter in question: "If the State DA is stupid enough to help Mike Parson prosecute me to avoid blame for his own incompetence, it will be my pleasure to face him in court, make him a national laughing stock, and end his career."
techgnosis 5y ago
How do we help this guy? I Google'd "EFF Mike Parsons" and "EFF View Source" and found nothing. Surely there is a way to help this guy.
- tailspin2019 5y ago
  Funny. I literally just emailed the EFF to ask if they are looking at this case and/or are in a position to support the journalist if needed. I also asked what they suggest individuals like us can do (if anything) to help. Similar to you, I Googled first, and found a short comment from someone at the EFF but nothing indicating that they were directly involved in this case so far. I'm not even a US citizen (I'm a Brit) but something about this case makes me incredibly angry and frustrated. Not just on behalf of the journalist himself but also because of the hugely negative impact it will have on responsible disclosure of security issues in the future if this action against him proceeds.
wolverine876 5y ago
Someone - a particular political party - is attacking the free press and freedom generally. The only answer is to be heard, loudly, and vote them out of office. The cavalry isn't coming - nobody will save us but us. It's not a partisan statement. I'm not saying it to favor one party or another (though unavoidably the other party would benefit - we'd be better off with multiple parties committed to democracy). We agree on freedom and democracy for all, we stand up for it, we give our 'lives, honor, and fortune' for it, or we are not the United States. EDIT: I reworded it to remove political party names, to try to reduce any appearance of partisanship.
- anigbrowl 5y ago
  I hope you'll give some thought to the scenario where one group in a polity rejects or modifies the electoral franchise as the ultimate mechanism of decision.
- tomp 5y ago
  Unfortunately, it's actually both political parties.
  - Enginerrrd 5y ago
    That and expansion of surveillance authority is the one thing they seem to agree on.
  - wolverine876 5y ago
    You'll have to back that up somehow. I strongly believe that that it is false - for generations, both parties supported the free press and put freedom and democracy first. Even in Watergate, it was a narrow attack on the press and the Republicans eventually turned on Nixon. That is no longer true. The world isn't equal, and both-sidism is a great way to try to divert people from taking action - nobody is wrong or evil, everyone is. We need to distinguish right and from wrong and to act, now. We need to use our free will, our free moral choice, to choose and act right. We will get the consequences we choose and act upon.
    - 5y ago
kevinventullo 5y ago
“View source” is nothing like picking a lock. It’s more like opening the hood of a rental car and discovering a book full of trade secrets.
victorbstan 5y ago
Being prosecuted for data that was sent to you by the server… I hope the judge can figure out the problem with this concept.
matthias509 5y ago
This is saying that someone is hacking if they read text in a pdf which was “redacted” by changing the style of the text to be black text on a black background.
nimbius 5y ago
So it seems Parsons administration decided this is the hill to die on in 2021. he had every opportunity to pump the brakes on this investigation but decided doubling down on a journalist had a better payoff, and a more prominent ability to cast him as a white knight protecting the state of Missouri against fiendish hackers. the 'view source' prosecution strategy is certainly something id hope to keep out of the spotlight as long as possible as its chum in the water for technologists and privacy groups. the EFF could easily eviscerate it in court, as could the FSF and god help you if a cyber security firm takes interest. although most computer privacy laws in the US are written with a fire hose to catch anything remotely pertaining to an integrated circuit, these laws all generally restrict themselves to the domain of interstate commerce, healthcare, and energy. Parsons fight is against an established journalist using an established and well respected process to report an information security exploit...so its really tough to see if or how a competent prosecution hopes to land any charges outside the governors "Lol do it anyway" edict which, fwiw, feels eerily similar to the malarkey Aaron Schwartz was put through.
- ta3927590 5y ago
  Malarkey may be the intent. Knowing the case is nonsense and having no expectation of winning, you press on because even if eventually found not-guilty, the process of the defendant getting there if prosecuted can be used to destroy their career, reputation, finances, etc. Enough that it still feels like a win to the state, who rarely has much to lose in a relative sense.
- evan_ 5y ago
  > a more prominent ability to cast him as a white knight protecting the state of Missouri against fiendish hackers. The goal isn't to appear as a white knight protecting the state from hackers, it's to mount a crusade against big-city journalists.
lkxijlewlf 5y ago
The analogies about locks... It's just wrong. There was no lock. A closer analogy is opening a csv file in notepad++ vs Excel. Same data, just a slightly different view of it.
dang 5y ago
Recent and related: Reporter who told Missouri officials of website flaw did 'nothing out of line' - https://news.ycombinator.com/item?id=29098289 https://news.ycombinator.com/item?id=29098289 - Nov 2021 (190 comments) Gov. Parson releases video attacking newspaper for viewing HTML - https://news.ycombinator.com/item?id=28980855 https://news.ycombinator.com/item?id=28980855 - Oct 2021 (26 comments) Gov Parson pushes to prosecute reporter who found security flaw in state site - https://news.ycombinator.com/item?id=28946392 https://news.ycombinator.com/item?id=28946392 - Oct 2021 (525 comments)
alanh 5y ago
Parson is clearly a bad actor. View source is not a crime and it is prosecutorial misconduct — ESPECIALLY when informed by a professional that no network intrusion occurred — to charge anyone for it.
pxeger1 5y ago
Here's what I think is a better analogy than the lock picking one: It's Halloween, so you put a bowl of chocolates outside your house with a sign saying "take one". You accidentally dropped your wedding ring in there, and when a reporter digs through the chocolates and sees it, they ring the doorbell to let you know.
zenlf 5y ago
From Cuomo to this, I came to the realization that probably it’s not the governors really believed what they do or what they say, by shifting the public focus to something else more bizarrely, more outrageous, they will successfully quell any demands on accountability.
deleted 5y ago
[deleted]
quantified 5y ago
On the one hand, as someone familiar with software and computer systems, it’s hard to see the prosecution winning. And the acquittal could prove stinging for the guv and the prosecutor. On the other hand, 12 Missouri citizens and a few appellate judges could convict and uphold, making things much less safe on line in Missouri. Sad this thing is still going on. What’s really up with the governor?
- ozfive 5y ago
  Those people then should all be scrutinized to see if they have ever viewed source in a browser. I'm betting a large portion of society including the prosecutor and the governor have viewed source in the browser themselves.
- Isthatablackgsd 5y ago
  > Sad this thing is still going on. What’s really up with the governor? They are allergic to accountability it seems. That's why once it come out of their mouth, it is impossible for them to admit they fucked up. So double/triple/quadruple/quintuple-down is part of their playbook.
- magikaram 5y ago
  Parson wasn't an elected governor initially. He was the Lt. Governor from an appointed position previous election cycle. Governor and Vice Governor resigned due to a scandal, and Parson took office similar to how Ford did after Nixon. Parson did win 're-election' riding on former President Trump's coattails.
magikaram 5y ago
Alas, yet another article that displays the incompetence of my state's governing body.
- jimt1234 5y ago
  I was born and raised in St. Louis. This whole situation doesn't surprise me one bit.
- encryptluks2 5y ago
  Incompetence would mean they have no clue. I genuinely believe that is not the case, and opportunity is really what this looks like here. I've found many politicians and legal professionals to really just use whatever they can to get what they want and throw as much at the wall to see what sticks.. Incompetence at least means some good faith that they do not know better, but I believe in most instances they do but they don't care.
  - crispyambulance 5y ago
    Yes, IMHO, this is very much about governor Mike Parson using the court system as a "weapon" against the reporter (or more likely the newspaper). It actually doesn't matter that there's no way the prosecution will "win" nor does this have anything to do with caring about information security. Folks are wasting their breath if they explain why "view source" isn't hacking. The prosecution DOESN'T EVEN CARE. Hopefully the Post-Dispatch has the resources to aggressively retaliate and take a pound of flesh in return. The charges were likely brought simply because the newspaper is stretched thin and they're either being told to "shut-up" or the governor is trying to pull "a Peter Thiel style" maneuver for some past grievance.
- Finnucane 5y ago
  This doesn’t sound like incompetence. Or at least, targeting a journalist for prosecution because he revealed your incompetence sounds like a step down a bad road.
  - HPsquared 5y ago
aurizon 5y ago
I wonder if that governor will charge prisoners who look out the window for 'felonius escape rumination'
- kwhitefoot 5y ago
  Don't give them ideas!
Toutouxc 5y ago
I have no idea how US courts work. Can whatever it is that's currently happening end in the reporter "winning" and possibly walking away with some compensation?
- kposehn 5y ago
  There is malicious prosecution, which allows a defendant to sue the plaintiff for knowingly prosecuting even though they knew (or reasonably suspected) they were wrong or did so with ill intent. Typically, this can only be done after prevailing in court as I understand it and the bar for success is quite high.
- jimbob45 5y ago
  Yes[0]. It's unlikely to ever get that far though - 95% of cases settle pre-trial [1] because this kind of stuff is all fun and games until someone has to put their words on the line. Especially when you're the governor and big public losses like these weigh heavily in voters' minds. [0]https://focuslawla.com/rare-happens-plaintiff-ordered-pay-defendants-attorneys-fees-frivolous-case/ https://focuslawla.com/rare-happens-plaintiff-ordered-pay-de... [1]https://thelawdictionary.org/article/what-percentage-of-lawsuits-settle-before-trial-what-are-some-statistics-on-personal-injury-settlements/ https://thelawdictionary.org/article/what-percentage-of-laws...
  - HillRat 5y ago
    We're talking criminal prosecution here, though -- the only pre-trial settlement is a plea bargain or a dropped prosecution, neither of which are likely if the prosecutor really takes this dog to trial. The next steps are going to hinge on whether the Missouri Highway Patrol is a competent and relatively non-political entity, since they just returned their investigation to the prosecutor's office. Now, even if a jury convicts this is unlikely to stand on appeal just given the bare facts as we know them, but the state can definitely drag the reporter through jail, trial, and possible imprisonment as an example of what happens to anyone the governor takes a dislike to.
- dekhn 5y ago
  The prosecutor isn't going to initiate this case (no matter how much the governor says so) because they know they will lose and in losing, embarass the state even worse (since during discovery it will come out that the people who let the error happen in the first place were incompetent). STL covered its tracks perfectly on this one; if they did lose, it would be a token loss.
akersten 5y ago
We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would have seen this data right away without even having to use the Powerful Hacking Tool view source. A law like this would also prevent the grave injustice of being considered a criminal for incrementing a query parameter to iterate through different records (weev/AT&T, I think). That also should never have been considered "hacking". Companies need to fix their damn auth instead of relying on the CFAA being overly generous to financially/politically-endowed interests. That law needs a neuter. [0]: notwithstanding an actually-compromised server, which is no longer an agent working in its owners interest. We'd have to be very careful to word this law, but I believe we can do a lot better than what we've got today.
- kuroguro 5y ago
  I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.
  - jdavis703 5y ago
    SQL injection is probably malformed input in lots of cases and should return a 400 Bad Request. If you are returning a 200 maybe you really did want to take SQL (think of Mode or PHPMyAdmin).
    - Tagbert 5y ago
      That assumes that the server recognized it as invalid. It it had, then it should take measured to block the input, but if the attack succeeded then the server would not be recognizing the attach and would respond with a 200
    - underwater 5y ago
deleted 5y ago
[deleted]
GuB-42 5y ago
I think that it is a bit far fetched here but where do you draw the line between what is an intrusion and what is not? To continue with the prosecutor analogy of the lock, having a shitty lock doesn't allow others to enter your house, but what if there is no lock, and what if the door is wide open? If you write "do not look" on top of your source code, can you prosecute someone who looked at it? If not, can you open a package marked "for Alice" if you are Bob, even if it is unsecured. For computer security, what is punishable? Obviously, using exploits and installing rootkits is, but what about deciphering weakly encrypted streams, what about accessing "secret" urls that do not have access control, what about probing undocumented APIs. For me, it is just the prosecutor doing his job of accusation, maybe poorly, I don't know, but if there is a trial, there will be a defense attorney, and a judge, and hopefully a reasonable verdict.
- Buttons840 5y ago
  Intent matters most. If the reporter had compiled a list of every teacher and their personal information by doing nothing more than "View Source", that would be a crime. If a researcher breaks a few ciphers, and makes no effort to store the plaintext, and reports the flaw, that not a crime.
- BeetleB 5y ago
  As mentioned in another thread, the lock analogy/trespassing analogy makes no sense here. This is a case of A requesting something from B, and B giving A stuff they shouldn't have, and prosecuting A for noticing it. At no point did the journalist go into anyone's property/territory. The site simply handed out the confidential stuff.
- smhenderson 5y ago
  The article stated that the prosecutor hasn't commented on any of this yet. Everything you're attributing to the prosecutor was said by Parsons. I'm assuming the prosecutor hasn't commented because he's embarrassed to be dragged into the whole ordeal. I get that's not the point of your comment but I refuse to even acknowledge that using HTTP as intended without feeding a server a malicious request can ever be considered a crime. The only crime here is the negligence on the part of the Missouri government and the obvious abuse of power being displayed by Parsons after the fact.
lucasyvas 5y ago
If this isn't immediately thrown out, there are much worse things to start worrying about.
- indigodaddy 5y ago
  I would love to also somehow see Parson penalized for egregious waste of government resources and monies on this charade that will go nowhere immediately at trial. Also the fact that the prosecutors didn’t laugh in his face immediately is rather disappointing. I can I guess understand the Highway Patrol being forced into investigating, but there’s no excuse for the prosecutor not immediately slapping this down.
  - SauciestGNU 5y ago
    If there's a prosecution, everyone involved should be put on trial for deprivation of civil rights under color of law. This is absolutely a violation of press and speech freedoms, and retaliatory to boot.
Buttons840 5y ago
> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reported the problem to the government and later to the public. He didn't take the personal data just because his eyes saw it in passing. If the reporter compiled a database of every teachers personal information, that's another thing. That's not what happened, the reporter looked at 3 teachers to establish the pattern and then reported it.
- jrockway 5y ago
  Locks are a terrible analogy for what's going on here. This would be like the government publishing a newsletter, and then writing a bunch of teachers' social security numbers on it in invisible ink. Someone then noticed that you can still read the invisible ink, and then wrote an article about how incompetently the government managed the data. This is a simple case of an egotistical politician who wishes he was King tussling with the media that is rightfully making him look incompetent. "Anyone who disagrees with me is a criminal" is a common pattern for wannabe dictators. Vote against him at the next opportunity.
  - SauciestGNU 5y ago
    I'd say even invisible ink is taking the analogy too far. It's like the government published a newsletter, printed the PII on the back of the paper, and now wants to prosecute the first person to look at the back of the page.
    - jrockway 5y ago
      Yeah, that's fair. Comments are a little bit like invisible ink; they look like they're not there because the rendering engine doesn't display them, but they're still sent with every copy of the information. It would be better if the SSNs were white text on a white background and we were here because someone highlighted the text, though.
plutonorm 5y ago
"Don't look up" I watched it on Netflix last night and I can't get over how well it captures the insanity we witness on a daily basis. It's not a funny movie, it's painful to watch, but that's because it's a reflection of reality. Sure its over blown and silly in places, but it resonates so strongly with the idiocy of our time... It's a test with high specificity: If you don't get the resonance then you are part of the problem.
- noah_buddy 5y ago
  I have seen this movie referenced multiple times over the last several days and all I can say is, while I understand the points that McKay is trying to make, it's not funny because it's not funny and it's hardly insightful because it totally lacks any nuance and isn't particularly original. How long ago was Stephen Colbert synonymous with "dumb conservative"? Trying to claim that if you don't resonate with a film then you're a bad person is a mistake imo.
  - plutonorm 5y ago
    and not a mistake imo.

247 points by tkdc926 5y ago

i had the same reaction at first, omg everyone knows about view source, this is a non-issue it was PUBLIC! But then the argument about "even if your lock is bad, doesn't mean someone can break into your house and steal your stuff." And I tried to look at that from the point of view of a normal non-tech person who doesn't know about view source or curl, they just know the normal view did not contain the info and someone did something "extra" and found it. I guess it comes down to how obvious and how "extra". Like what if I sent out a paper newsletter to all my neighbors but printed it on recycled paper that happen to have SSN info on the other side. Is it their fault for do something "extra" like turning the paper over and then seeing the other info?

mikojan 5y ago
I don't see no extra in either of these situations. I am living in an apartment complex and I wouldn't mind if someone noticed my keys in my front door, opened that door, took a look and called out for me. This cannot possibly register as breaking in? I am not even talking about motive here. The actual event in my mind is clearly benign.
908B64B197 5y ago
> And I tried to look at that from the point of view of a normal non-tech person who doesn't know about view source or curl Safari read aloud would have blurted out the SSNs in this case. So even for a layman, the lock analogy falls short. > Like what if I sent out a paper newsletter to all my neighbors but printed it on recycled paper that happen to have SSN info on the other side Court would place responsability on the person who failed to inspect the paper used. There's a reason medical offices all have shredders; you can't reuse paper with patient's personal information on it.

BadThink6655321 5y ago

The lock analogy fails. First, the viewer was given the data. Second, obfuscation is not a lock.

tyingq 5y ago

What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: <input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="[SOME_BASE_64_HERE]" /> Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.

rchaud 5y ago
> I am totally mystified how a competent DA wouldn't have dropped this immediately. DAs have elections to win, and the risk of not having the governor's endorsement would put them in a tricky position.
Bud 5y ago
This is Missouri. It might be hard to find a competent DA in the entire state.
- nobleach 5y ago
  I know you're probably saying this half-jesting... But the harsh reality is that if a judge cannot understand the minutiae of "browser requested one thing and the PLANTIFF's server sent personal info, unencrypted", then the precedent that is set is an awful one. I get that the amount of technical stuff that needs to be understood here is beyond what your average NON-hacker-news type might understand... but when it comes to prosecution, wouldn't an expert be consulted??
  - rolph 5y ago
    i hope someone realizes prosecuting this would mean the government thinks it is illegal to use a webbrowser to request HTML et. al. from a webserver. by extension missouri is deliberating a court case that questions the legality of public access to WWW.
  - ozfive 5y ago
    It's really not though. Even my parents know and understand what view source is in the browser. A browser is simply a way to render information sent. Once it was wilfully sent and in your browser you are not accessing a machine in a criminal way. I hope that if they even try to bring charges the reporter and the newspaper counter sue for violation of rights. Mozilla and the Chrome team need to weigh in on the defendant side. Anyone here from those teams willing to stand up for this guy?

webmobdev 5y ago

India also has this kind of stupid vague law that makes ethical hacking partly illegal: > The contention is over Clause 7 of the Responsible Vulnerability Disclosure and Coordination Policy, released by CERT-In on September 3. According to the clause, the reporting party must “comply with all the extant laws” like the IT Act, Section 43, which bars unauthorised access to systems. while Section 66 prescribes the corresponding punishment (jail and/or fine). > “Independent security experts may gain unauthorised access to a network when probing a system but they do so to study the vulnerabilities. So while their intent is not malicious, it could be seen as wrong under the IT Act, which is what this policy reinstates,” explains Rohin Garg of Internet Freedom Foundation (IFF), a New Delhi NGO that works to defend digital rights. Source: https://www.deccanherald.com/metrolife/metrolife-on-the-move/policy-on-reporting-cyber-vulnerabilities-is-flawed-1050102.html https://www.deccanherald.com/metrolife/metrolife-on-the-move... More here - https://internetfreedom.in/dont-penalise-cybersecurity-researchers/ https://internetfreedom.in/dont-penalise-cybersecurity-resea...

tyingq 5y ago

I'd love to be an "expert witness" and decode a small snippet of base64 on a whiteboard for the jury. Just to show that the lock analogy is bullshit.

trhway 5y ago

That is another attack on general computing. Until now an "encryption" has been required to limit your legal ability to handle information legally residing on your computer. Now even the "encryption" isn't needed, just a post-factum statement from the information sender that you used unapproved (according to post-factum given definition of approved) viewer for that information. One can see how MS may for example decide that using an old version of Word or accessing MS site by Firefox instead of Bing or from a Linux computer may be qualified as such a hacking.

iambateman 5y ago

The legal parts of this case seem straightforward. The scary thing is a governor using his platform to bully legitimate news-makers who are clearly acting in good faith. We should all hope the paper vigorously defends its first amendment rights.

nulbyte 5y ago

> Gov. Mike Parson on Wednesday expressed his opinion the Cole County prosecuting attorney would bring charges in the case of a Post-Dispatch reporter who alerted the state to a significant data vulnerability. The actual headline reflects the content of the article better: "Parson says he believes prosecutor will bring charges in Post-Dispatch case." Having read the article, I don't see anyone but Parson opine that the reporter will be prosecuted, and if this whole ordeal has done nothing else, if has at least offered adequate reason for me to dismiss Parson's opinions with prejudice.

natechols 5y ago
A better headline would be "MO Governor makes a fool of himself repeatedly". I would feel safe betting money on the reporter's continued freedom - the more important question is how much the paper will need to spend on legal defense before it gets thrown out. Which I suspect is actually the point, unless Parson really is that dumb.

Animats 5y ago

Section 242 of the U.S. Criminal Code: Whoever, under color of any law, statute, ordinance, regulation, or custom, willfully subjects, or causes to be subjected, any inhabitant of any State, Territory, or District to the deprivation of any rights,privileges, or immunities secured or protected by the Constitution and laws of the United States . . . shall be fined not more than$ 1,000, or imprisoned not more than one year, or both. This law has never been used to protect First Amendment rights. But, on its face, it could be.

q1w2 5y ago
Laws that are vague are superseded by laws that are more specific.

LatteLazy 5y ago

Doing basically anything with a computer is illegal in the US. It gives government a lot of power to deal with errant journalists or others.

ozfive 5y ago

The guy found keys in a lock, knocked on the door and said hey I found your keys in your lock you better figure out a way not to do that again since someone who had intent to do bad things could have come along instead of me.

ambrozk 5y ago

I've written a statement to be issued by the reporter in question: "If the State DA is stupid enough to help Mike Parson prosecute me to avoid blame for his own incompetence, it will be my pleasure to face him in court, make him a national laughing stock, and end his career."

techgnosis 5y ago

How do we help this guy? I Google'd "EFF Mike Parsons" and "EFF View Source" and found nothing. Surely there is a way to help this guy.

tailspin2019 5y ago
Funny. I literally just emailed the EFF to ask if they are looking at this case and/or are in a position to support the journalist if needed. I also asked what they suggest individuals like us can do (if anything) to help. Similar to you, I Googled first, and found a short comment from someone at the EFF but nothing indicating that they were directly involved in this case so far. I'm not even a US citizen (I'm a Brit) but something about this case makes me incredibly angry and frustrated. Not just on behalf of the journalist himself but also because of the hugely negative impact it will have on responsible disclosure of security issues in the future if this action against him proceeds.

wolverine876 5y ago

Someone - a particular political party - is attacking the free press and freedom generally. The only answer is to be heard, loudly, and vote them out of office. The cavalry isn't coming - nobody will save us but us. It's not a partisan statement. I'm not saying it to favor one party or another (though unavoidably the other party would benefit - we'd be better off with multiple parties committed to democracy). We agree on freedom and democracy for all, we stand up for it, we give our 'lives, honor, and fortune' for it, or we are not the United States. EDIT: I reworded it to remove political party names, to try to reduce any appearance of partisanship.

anigbrowl 5y ago
I hope you'll give some thought to the scenario where one group in a polity rejects or modifies the electoral franchise as the ultimate mechanism of decision.
tomp 5y ago
Unfortunately, it's actually both political parties.
- Enginerrrd 5y ago
  That and expansion of surveillance authority is the one thing they seem to agree on.
- wolverine876 5y ago
  You'll have to back that up somehow. I strongly believe that that it is false - for generations, both parties supported the free press and put freedom and democracy first. Even in Watergate, it was a narrow attack on the press and the Republicans eventually turned on Nixon. That is no longer true. The world isn't equal, and both-sidism is a great way to try to divert people from taking action - nobody is wrong or evil, everyone is. We need to distinguish right and from wrong and to act, now. We need to use our free will, our free moral choice, to choose and act right. We will get the consequences we choose and act upon.
  - 5y ago

kevinventullo 5y ago

“View source” is nothing like picking a lock. It’s more like opening the hood of a rental car and discovering a book full of trade secrets.

victorbstan 5y ago

Being prosecuted for data that was sent to you by the server… I hope the judge can figure out the problem with this concept.

matthias509 5y ago

This is saying that someone is hacking if they read text in a pdf which was “redacted” by changing the style of the text to be black text on a black background.

nimbius 5y ago

So it seems Parsons administration decided this is the hill to die on in 2021. he had every opportunity to pump the brakes on this investigation but decided doubling down on a journalist had a better payoff, and a more prominent ability to cast him as a white knight protecting the state of Missouri against fiendish hackers. the 'view source' prosecution strategy is certainly something id hope to keep out of the spotlight as long as possible as its chum in the water for technologists and privacy groups. the EFF could easily eviscerate it in court, as could the FSF and god help you if a cyber security firm takes interest. although most computer privacy laws in the US are written with a fire hose to catch anything remotely pertaining to an integrated circuit, these laws all generally restrict themselves to the domain of interstate commerce, healthcare, and energy. Parsons fight is against an established journalist using an established and well respected process to report an information security exploit...so its really tough to see if or how a competent prosecution hopes to land any charges outside the governors "Lol do it anyway" edict which, fwiw, feels eerily similar to the malarkey Aaron Schwartz was put through.

ta3927590 5y ago
Malarkey may be the intent. Knowing the case is nonsense and having no expectation of winning, you press on because even if eventually found not-guilty, the process of the defendant getting there if prosecuted can be used to destroy their career, reputation, finances, etc. Enough that it still feels like a win to the state, who rarely has much to lose in a relative sense.
evan_ 5y ago
> a more prominent ability to cast him as a white knight protecting the state of Missouri against fiendish hackers. The goal isn't to appear as a white knight protecting the state from hackers, it's to mount a crusade against big-city journalists.

lkxijlewlf 5y ago

The analogies about locks... It's just wrong. There was no lock. A closer analogy is opening a csv file in notepad++ vs Excel. Same data, just a slightly different view of it.

dang 5y ago

Recent and related: Reporter who told Missouri officials of website flaw did 'nothing out of line' - https://news.ycombinator.com/item?id=29098289 https://news.ycombinator.com/item?id=29098289 - Nov 2021 (190 comments) Gov. Parson releases video attacking newspaper for viewing HTML - https://news.ycombinator.com/item?id=28980855 https://news.ycombinator.com/item?id=28980855 - Oct 2021 (26 comments) Gov Parson pushes to prosecute reporter who found security flaw in state site - https://news.ycombinator.com/item?id=28946392 https://news.ycombinator.com/item?id=28946392 - Oct 2021 (525 comments)

alanh 5y ago

Parson is clearly a bad actor. View source is not a crime and it is prosecutorial misconduct — ESPECIALLY when informed by a professional that no network intrusion occurred — to charge anyone for it.

pxeger1 5y ago

Here's what I think is a better analogy than the lock picking one: It's Halloween, so you put a bowl of chocolates outside your house with a sign saying "take one". You accidentally dropped your wedding ring in there, and when a reporter digs through the chocolates and sees it, they ring the doorbell to let you know.

zenlf 5y ago

From Cuomo to this, I came to the realization that probably it’s not the governors really believed what they do or what they say, by shifting the public focus to something else more bizarrely, more outrageous, they will successfully quell any demands on accountability.

deleted 5y ago

[deleted]

quantified 5y ago

On the one hand, as someone familiar with software and computer systems, it’s hard to see the prosecution winning. And the acquittal could prove stinging for the guv and the prosecutor. On the other hand, 12 Missouri citizens and a few appellate judges could convict and uphold, making things much less safe on line in Missouri. Sad this thing is still going on. What’s really up with the governor?

ozfive 5y ago
Those people then should all be scrutinized to see if they have ever viewed source in a browser. I'm betting a large portion of society including the prosecutor and the governor have viewed source in the browser themselves.
Isthatablackgsd 5y ago
> Sad this thing is still going on. What’s really up with the governor? They are allergic to accountability it seems. That's why once it come out of their mouth, it is impossible for them to admit they fucked up. So double/triple/quadruple/quintuple-down is part of their playbook.
magikaram 5y ago
Parson wasn't an elected governor initially. He was the Lt. Governor from an appointed position previous election cycle. Governor and Vice Governor resigned due to a scandal, and Parson took office similar to how Ford did after Nixon. Parson did win 're-election' riding on former President Trump's coattails.

magikaram 5y ago

Alas, yet another article that displays the incompetence of my state's governing body.

jimt1234 5y ago
I was born and raised in St. Louis. This whole situation doesn't surprise me one bit.
encryptluks2 5y ago
Incompetence would mean they have no clue. I genuinely believe that is not the case, and opportunity is really what this looks like here. I've found many politicians and legal professionals to really just use whatever they can to get what they want and throw as much at the wall to see what sticks.. Incompetence at least means some good faith that they do not know better, but I believe in most instances they do but they don't care.
- crispyambulance 5y ago
  Yes, IMHO, this is very much about governor Mike Parson using the court system as a "weapon" against the reporter (or more likely the newspaper). It actually doesn't matter that there's no way the prosecution will "win" nor does this have anything to do with caring about information security. Folks are wasting their breath if they explain why "view source" isn't hacking. The prosecution DOESN'T EVEN CARE. Hopefully the Post-Dispatch has the resources to aggressively retaliate and take a pound of flesh in return. The charges were likely brought simply because the newspaper is stretched thin and they're either being told to "shut-up" or the governor is trying to pull "a Peter Thiel style" maneuver for some past grievance.
Finnucane 5y ago
This doesn’t sound like incompetence. Or at least, targeting a journalist for prosecution because he revealed your incompetence sounds like a step down a bad road.
- HPsquared 5y ago

aurizon 5y ago

I wonder if that governor will charge prisoners who look out the window for 'felonius escape rumination'

kwhitefoot 5y ago
Don't give them ideas!

Toutouxc 5y ago

I have no idea how US courts work. Can whatever it is that's currently happening end in the reporter "winning" and possibly walking away with some compensation?

kposehn 5y ago
There is malicious prosecution, which allows a defendant to sue the plaintiff for knowingly prosecuting even though they knew (or reasonably suspected) they were wrong or did so with ill intent. Typically, this can only be done after prevailing in court as I understand it and the bar for success is quite high.
jimbob45 5y ago
Yes[0]. It's unlikely to ever get that far though - 95% of cases settle pre-trial [1] because this kind of stuff is all fun and games until someone has to put their words on the line. Especially when you're the governor and big public losses like these weigh heavily in voters' minds. [0]https://focuslawla.com/rare-happens-plaintiff-ordered-pay-defendants-attorneys-fees-frivolous-case/ https://focuslawla.com/rare-happens-plaintiff-ordered-pay-de... [1]https://thelawdictionary.org/article/what-percentage-of-lawsuits-settle-before-trial-what-are-some-statistics-on-personal-injury-settlements/ https://thelawdictionary.org/article/what-percentage-of-laws...
- HillRat 5y ago
  We're talking criminal prosecution here, though -- the only pre-trial settlement is a plea bargain or a dropped prosecution, neither of which are likely if the prosecutor really takes this dog to trial. The next steps are going to hinge on whether the Missouri Highway Patrol is a competent and relatively non-political entity, since they just returned their investigation to the prosecutor's office. Now, even if a jury convicts this is unlikely to stand on appeal just given the bare facts as we know them, but the state can definitely drag the reporter through jail, trial, and possible imprisonment as an example of what happens to anyone the governor takes a dislike to.
dekhn 5y ago
The prosecutor isn't going to initiate this case (no matter how much the governor says so) because they know they will lose and in losing, embarass the state even worse (since during discovery it will come out that the people who let the error happen in the first place were incompetent). STL covered its tracks perfectly on this one; if they did lose, it would be a token loss.

akersten 5y ago

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would have seen this data right away without even having to use the Powerful Hacking Tool view source. A law like this would also prevent the grave injustice of being considered a criminal for incrementing a query parameter to iterate through different records (weev/AT&T, I think). That also should never have been considered "hacking". Companies need to fix their damn auth instead of relying on the CFAA being overly generous to financially/politically-endowed interests. That law needs a neuter. [0]: notwithstanding an actually-compromised server, which is no longer an agent working in its owners interest. We'd have to be very careful to word this law, but I believe we can do a lot better than what we've got today.

kuroguro 5y ago
I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.
- jdavis703 5y ago
  SQL injection is probably malformed input in lots of cases and should return a 400 Bad Request. If you are returning a 200 maybe you really did want to take SQL (think of Mode or PHPMyAdmin).
  - Tagbert 5y ago
    That assumes that the server recognized it as invalid. It it had, then it should take measured to block the input, but if the attack succeeded then the server would not be recognizing the attach and would respond with a 200
  - underwater 5y ago

deleted 5y ago

[deleted]

GuB-42 5y ago

I think that it is a bit far fetched here but where do you draw the line between what is an intrusion and what is not? To continue with the prosecutor analogy of the lock, having a shitty lock doesn't allow others to enter your house, but what if there is no lock, and what if the door is wide open? If you write "do not look" on top of your source code, can you prosecute someone who looked at it? If not, can you open a package marked "for Alice" if you are Bob, even if it is unsecured. For computer security, what is punishable? Obviously, using exploits and installing rootkits is, but what about deciphering weakly encrypted streams, what about accessing "secret" urls that do not have access control, what about probing undocumented APIs. For me, it is just the prosecutor doing his job of accusation, maybe poorly, I don't know, but if there is a trial, there will be a defense attorney, and a judge, and hopefully a reasonable verdict.

Buttons840 5y ago
Intent matters most. If the reporter had compiled a list of every teacher and their personal information by doing nothing more than "View Source", that would be a crime. If a researcher breaks a few ciphers, and makes no effort to store the plaintext, and reports the flaw, that not a crime.
BeetleB 5y ago
As mentioned in another thread, the lock analogy/trespassing analogy makes no sense here. This is a case of A requesting something from B, and B giving A stuff they shouldn't have, and prosecuting A for noticing it. At no point did the journalist go into anyone's property/territory. The site simply handed out the confidential stuff.
smhenderson 5y ago
The article stated that the prosecutor hasn't commented on any of this yet. Everything you're attributing to the prosecutor was said by Parsons. I'm assuming the prosecutor hasn't commented because he's embarrassed to be dragged into the whole ordeal. I get that's not the point of your comment but I refuse to even acknowledge that using HTTP as intended without feeding a server a malicious request can ever be considered a crime. The only crime here is the negligence on the part of the Missouri government and the obvious abuse of power being displayed by Parsons after the fact.

lucasyvas 5y ago

If this isn't immediately thrown out, there are much worse things to start worrying about.

indigodaddy 5y ago
I would love to also somehow see Parson penalized for egregious waste of government resources and monies on this charade that will go nowhere immediately at trial. Also the fact that the prosecutors didn’t laugh in his face immediately is rather disappointing. I can I guess understand the Highway Patrol being forced into investigating, but there’s no excuse for the prosecutor not immediately slapping this down.
- SauciestGNU 5y ago
  If there's a prosecution, everyone involved should be put on trial for deprivation of civil rights under color of law. This is absolutely a violation of press and speech freedoms, and retaliatory to boot.

Buttons840 5y ago

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reported the problem to the government and later to the public. He didn't take the personal data just because his eyes saw it in passing. If the reporter compiled a database of every teachers personal information, that's another thing. That's not what happened, the reporter looked at 3 teachers to establish the pattern and then reported it.

jrockway 5y ago
Locks are a terrible analogy for what's going on here. This would be like the government publishing a newsletter, and then writing a bunch of teachers' social security numbers on it in invisible ink. Someone then noticed that you can still read the invisible ink, and then wrote an article about how incompetently the government managed the data. This is a simple case of an egotistical politician who wishes he was King tussling with the media that is rightfully making him look incompetent. "Anyone who disagrees with me is a criminal" is a common pattern for wannabe dictators. Vote against him at the next opportunity.
- SauciestGNU 5y ago
  I'd say even invisible ink is taking the analogy too far. It's like the government published a newsletter, printed the PII on the back of the paper, and now wants to prosecute the first person to look at the back of the page.
  - jrockway 5y ago
    Yeah, that's fair. Comments are a little bit like invisible ink; they look like they're not there because the rendering engine doesn't display them, but they're still sent with every copy of the information. It would be better if the SSNs were white text on a white background and we were here because someone highlighted the text, though.

plutonorm 5y ago

"Don't look up" I watched it on Netflix last night and I can't get over how well it captures the insanity we witness on a daily basis. It's not a funny movie, it's painful to watch, but that's because it's a reflection of reality. Sure its over blown and silly in places, but it resonates so strongly with the idiocy of our time... It's a test with high specificity: If you don't get the resonance then you are part of the problem.

noah_buddy 5y ago
I have seen this movie referenced multiple times over the last several days and all I can say is, while I understand the points that McKay is trying to make, it's not funny because it's not funny and it's hardly insightful because it totally lacks any nuance and isn't particularly original. How long ago was Stephen Colbert synonymous with "dumb conservative"? Trying to claim that if you don't resonate with a film then you're a bad person is a mistake imo.
- plutonorm 5y ago
  and not a mistake imo.