12 ms·

Prosecutor won't charge reporter who uncovered database flaw

264 points by ro_bit 5y ago

ChrisArchitect 5y ago
In the paraphrased words of Hackers... View Source - the only crime is curiosity. https://www.cyberdelianyc.com/posts/view-source-the-only-crime-is-curiosity-missouri-governor-html-hackers https://www.cyberdelianyc.com/posts/view-source-the-only-cri...
idiocrat 5y ago
Instead, the reporter should get a Medal of Honor for the Public Service.
- slater 5y ago
- Rebelgecko 5y ago
  Only members of the armed forces are eligible for the MOH, and IMO the reporter's actions don't really merit changing the rules
justinclift 5y ago
Seems to be a duplicate of: https://apnews.com/article/technology-missouri-81295aa71a574b93e0fdadda8414b94a https://apnews.com/article/technology-missouri-81295aa71a574...
- mdp2021 5y ago
  I cannot offer you details, but many articles get redistributed as an exact copy in dozens of other sites. Either it is a network, or there is legal legitimacy to copy, or the article is proposed to many...
  - hoppyhoppy2 5y ago
    It's part of how the Associated Press operates; it's why you can read about a big Missouri news story in a newspaper in California (or wherever) without the Los Angeles Times (or whoever) needing to send their own journalist to Missouri to cover it. (And likewise, a newspaper in Missouri can cover the big local news out of California even if they don't have the budget to fly their own journalists across the country on a regular basis.) >As part of their cooperative agreement with the AP, most member news organizations grant automatic permission for the AP to distribute their local news reports. https://en.wikipedia.org/wiki/Associated_Press https://en.wikipedia.org/wiki/Associated_Press
rmbyrro 5y ago
This fact tells how much the Judicial system needs improvement. The fact it depends on who's sitting on a chair to determine whether a journalist should be charged for helping the public. Unbelievable...
- toss1 5y ago
  You have pointed out a weakness, but it seems in this case that it is working. The judiciary, legislative, and executive branches of govt., as well as the other independent institutions of civil society, such as academia and the press, all must be strongly independent of each other for a democracy to survive. In an autocracy, all of the institutions are coerced to bend to the will of the executive. In this case, the executive (governor) made it very clear that he wanted this journalist prosecuted, a blatant attempt to bend the press to his will. In this case, it wasn't even the judiciary, but the prosecution, which is still in the executive branch, so nominally under the governor, who basically told the gov to go pound sand. So, whenever you see executives undermining the independence of other branches or institutions, be VERY suspicious; it's a dead giveaway that they are interested in only their own power and not working to benefit the citizens they serve.
- thr0wawayf00 5y ago
  Agreed, but this issue goes far beyond the judicial system. The way the governor handled this situation really showed how much of a liability he feared this story would be to him and his party politically. Instead of examining the underlying conditions of the state agency responsible for the data breach, he chose to go after the messenger. Given that every single time a company gets caught like this, the first thing we all point to is how stingy they are when it comes to security. A conservative governor doesn't want to be in a position where the solution to the problem is to spend money, so he went after the journalist instead.
  - encryptluks2 5y ago
    I would campaign on this alone. Say how the opposing party wants people to be insecure, exposed and that they will try prosecuting you for doing the right thing cause they have such fragile egos.
unnouinceput 5y ago
Quote: ""The state did its part by investigating and presenting its findings to the Cole County prosecutor, who has elected not to press charges, as is his prerogative," spokeswoman Kelli Jones said." If they would've continued, then the prosecutor would've been laughed out off the court by the judge. The lawyer defending the journalist would've called this the easiest case of his/her career. This statement is made to look official to save face. Plain truth is that the state simply fucked up badly, starting from the head all the way down to the tail.
- sjansen 5y ago
  Unfortunately that's not necessarily true. There are plenty of examples of prosecutorial over reach and unfair sentencing because our laws were written by people who fundamentally don't understand technology. It will probably take a few generations to fix that. Common sense won out in the case, but it certainly helped that the target was a reporter instead of a security researcher or ordinary citizen.
  - night862 5y ago
    No, I think GP is correct in saying that the case would be laughed out of court. Persuing this case would have been a gift to the Post-Dispatch and Ian would have been a hero. Not only is this whole thing over literally right-clicking html, but this is a Reporter working for a local newspaper. Imagine for a moment that this story was about a regular person who is not employed as reporter with credentials and a portfolio. Depending on that individuals circumstances, it could easily be a life-ruiner. I could think of a few people.
  - TigeriusKirk 5y ago
    My impression from previously looking into this case is that there probably was a violation of the law here, but that it would be absurd to prosecute it. The mistake here would be to assume that officials always correctly avoid absurd prosecutions.
    - Someone1234 5y ago
joe5150 5y ago
“There is an argument to be made that there was a violation of law.” I mean, not really, but I guess that could mean anything.
- ceejayoz 5y ago
  I think that translates roughly as "I'm not allowed to say 'this was fucking stupid' because it involved the Governor".
  - DoneWithAllThat 5y ago
    It’s the verbal equivalent of drawing on a hurricane map with a sharpie.
    - CRConrad 5y ago
      The governor's argument was. The DA magnanimously acknowledging that the governor can make that argument wasn't; it was as diplomatically suave as a White House official saying the President can do what he wants with government sharpies.
- encryptluks2 5y ago
- thinkharderdev 5y ago
  The thing is though, I think this is basically correct. They probably could prosecute the reporter if they really, really wanted to. Not that I think they could actually convict someone who was obviously acting in good faith to report a security vulnerability, but security research of this kind seems like such a gray area legally speaking. In general we wouldn't treat an obvious flaw in physical security as a mitigating factor for theft. That is, if I drop my wallet in a public place it is still probably theft for someone to pick it up and take the cash inside. To be clear, this is in NO WAY a defense of the way the government acted in this case which was both insane and harmful, but just to say that a lot of what makes things illegal is subjective judgements about intent. This is why professional pen testers (the careful ones at least) generally specify in very clear terms what the scope of their engagement is (and still sometimes end up getting arrested). I can only imagine that doing independent security research is a mine field.
ratsmack 5y ago
>Cole County Prosecutor Locke Thompson released a statement Friday saying there is an argument to be made that there was a violation of law, and that the issues at the heart of the investigation have been resolved through non-legal means, the St. Louis Post-Dispatch. That sounds more like that "we would have prosecuted the reporter" if they hadn't discovered that the "state education commissioner initially planned to thank the newspaper for finding the problem". They should have profusely thanked him and also given him an award.
- MBCook 5y ago
  I read it as more of “he did nothing wrong but I can’t make the governor look bad so I’ll imply it was obvious he was guilty but we’re being magnanimous about it.”
  - ziml77 5y ago
    That seems to be exactly what he's saying. People here seem to want to make the DA out to be as stupid as the governor or as a malicious person, but based on this statement he didn't actually think he had a case. Saying that something could be argued means that you're coming in with an argument that could be accepted if you overlook all sorts of details and context.
    - shadowgovt 5y ago
      Yep. The right way to read this is that if a persecutor thinks there's a case, they'll prosecute. Not prosecuting means they don't think they can possibly win. Anything that comes out of their mouths after is window dressing.
    - mannykannot 5y ago
      I also feel MBCook is probably right. In this particular case, however, there does not appear to be any argument for prosecution that does not immediately look preposterous as soon as you give it any thought. If this is so, then, by equivocating - for political expediency or any other reason - the DA is inviting doubts about his competence or integrity. I'm hoping that "the issues at the heart of the investigation have been resolved through non-legal means" is a paraphrase for saying that the DA pointed out to the governor, directly or through his aides, that any attempt to prosecute would fail and bring down a heap of public ridicule.
indigodaddy 5y ago
And now he should sue both the law enforcement department and Parson. Make them pay for this bullshit and also a precedent should be laid down like a marker in the sand. Not sure what that marker is exactly, but at the least it will be ‘don’t be batshit crazy like Mike Parson.’
- giantg2 5y ago
  While many wear the badge of hacker with pride, it seems that the government officials calling him a hacker is clearly defamatory and potentially injurious to his journalism career in this situation.
- tshaddox 5y ago
  > Not sure what that marker is exactly How about making it illegal for a state official to explicitly make credible threats to use unjustified state violence against someone? Similar to how it’s illegal for anyone to make credible threats of unjustified violence against anyone else.
  - datavirtue 5y ago
    That is a solid take. It's also the reason we have the second amendment.
    - datavirtue 5y ago
      Downvoted fact? Cool.
      - wbsss4412 5y ago
        Not really factual.
  - Forlien 5y ago
    Even if it became illegal, qualified immunity would protect the offical who made the threats, so officials will likely never be personally impacted by breaking the law and so it'll keep being broken.
2OEH8eoCRo0 5y ago
Was the reporter authorized to access those things? Y/n?
- Nextgrid 5y ago
  The sensitive data was sent to him in the HTML as part of legitimate usage, so I'd say yes?
- Someone1234 5y ago
  Yes. It was a public webpage. They sent a normal request and received a normal response. That response just so happen to contain Base64 encoded SSNs in the page state. There's no actual legal merit to any argument that this was unauthorized computer access. Suggesting that decoding base64 is somehow "hacking" is nonsense.
- ceejayoz 5y ago
  As authorized as you were to publish this comment, yes.
dang 5y ago
Related past threads: The governor of Missouri still doesn’t know how websites work - https://news.ycombinator.com/item?id=29752259 https://news.ycombinator.com/item?id=29752259 - Dec 2021 (21 comments) Reporter may be prosecuted for using “view source” - https://news.ycombinator.com/item?id=29737412 https://news.ycombinator.com/item?id=29737412 - Dec 2021 (163 comments) Reporter who told Missouri officials of website flaw did 'nothing out of line' - https://news.ycombinator.com/item?id=29098289 https://news.ycombinator.com/item?id=29098289 - Nov 2021 (190 comments) Gov. Parson releases video attacking newspaper for viewing HTML - https://news.ycombinator.com/item?id=28980855 https://news.ycombinator.com/item?id=28980855 - Oct 2021 (26 comments) Gov Parson pushes to prosecute reporter who found security flaw in state site - https://news.ycombinator.com/item?id=28946392 https://news.ycombinator.com/item?id=28946392 - Oct 2021 (525 comments) Governor vows criminal prosecution of reporter who found flaw in state website - https://news.ycombinator.com/item?id=28866805 https://news.ycombinator.com/item?id=28866805 - Oct 2021 (678 comments)
ajdude 5y ago
For those interested you can read the reporter’s full statement here: https://joshrenaud.com/pd/josh-renaud-personal-statement.pdf https://joshrenaud.com/pd/josh-renaud-personal-statement.pdf
betwixthewires 5y ago
I like how all the statements from government employees imply "we are being nice." Like no, you're incompetent and this person did you a favor and you got butthurt that you look stupid and decided to jeopardize someone's life to throw a hissyfit and now you're backing off because you look even more stupid and refusing to admit it and so look even more childish than that. That's what happened. You didn't "decline to prosecute as is your prerogative." Just admit you were wrong, you might salvage some respect.
- CRConrad 5y ago
  > You didn't "decline to prosecute as is your prerogative." Those were the governor's words, not the prosecutor's. > Just admit you were wrong, As I read it the prosecutor did; only the governor didn't. > you might salvage some respect. So to me, again: The prosecutor did, the governor didn't.
- avs733 5y ago
  this is exactly the roll our judicial branch should play and so rarely does. Step by step in America, the judicial branch has become more and more deferential to the executive branch when it comes to law enforcement. The reality is that I (and you) should have zero expectation that they will protect you from bad state actors at this point. It is something everyone involved with the judiciary should be embarrassed about.
amitp 5y ago
BTW the accused reporter is an occasional HN user who maintains a blog[1] and wiki[2] about BBS software. He started that site after seeing that Wikipedia was deleting pages about BBS software[3]. [1] https://breakintochat.com/blog/ https://breakintochat.com/blog/ [2] https://breakintochat.com/wiki/ https://breakintochat.com/wiki/ [3] Jason Scott's blog post http://ascii.textfiles.com/archives/3826 http://ascii.textfiles.com/archives/3826
stakkur 5y ago
The prosecutor’s statement is just normal posturing. It’s common language; a prosecutor will never state ‘the charges were baseless and are a waste of our time’. But that’s essentially what their statement means.

264 points by ro_bit 5y ago

In the paraphrased words of Hackers... View Source - the only crime is curiosity. https://www.cyberdelianyc.com/posts/view-source-the-only-crime-is-curiosity-missouri-governor-html-hackers https://www.cyberdelianyc.com/posts/view-source-the-only-cri...

idiocrat 5y ago

Instead, the reporter should get a Medal of Honor for the Public Service.

slater 5y ago
Rebelgecko 5y ago
Only members of the armed forces are eligible for the MOH, and IMO the reporter's actions don't really merit changing the rules

justinclift 5y ago

Seems to be a duplicate of: https://apnews.com/article/technology-missouri-81295aa71a574b93e0fdadda8414b94a https://apnews.com/article/technology-missouri-81295aa71a574...

mdp2021 5y ago
I cannot offer you details, but many articles get redistributed as an exact copy in dozens of other sites. Either it is a network, or there is legal legitimacy to copy, or the article is proposed to many...
- hoppyhoppy2 5y ago
  It's part of how the Associated Press operates; it's why you can read about a big Missouri news story in a newspaper in California (or wherever) without the Los Angeles Times (or whoever) needing to send their own journalist to Missouri to cover it. (And likewise, a newspaper in Missouri can cover the big local news out of California even if they don't have the budget to fly their own journalists across the country on a regular basis.) >As part of their cooperative agreement with the AP, most member news organizations grant automatic permission for the AP to distribute their local news reports. https://en.wikipedia.org/wiki/Associated_Press https://en.wikipedia.org/wiki/Associated_Press

rmbyrro 5y ago

This fact tells how much the Judicial system needs improvement. The fact it depends on who's sitting on a chair to determine whether a journalist should be charged for helping the public. Unbelievable...

toss1 5y ago
You have pointed out a weakness, but it seems in this case that it is working. The judiciary, legislative, and executive branches of govt., as well as the other independent institutions of civil society, such as academia and the press, all must be strongly independent of each other for a democracy to survive. In an autocracy, all of the institutions are coerced to bend to the will of the executive. In this case, the executive (governor) made it very clear that he wanted this journalist prosecuted, a blatant attempt to bend the press to his will. In this case, it wasn't even the judiciary, but the prosecution, which is still in the executive branch, so nominally under the governor, who basically told the gov to go pound sand. So, whenever you see executives undermining the independence of other branches or institutions, be VERY suspicious; it's a dead giveaway that they are interested in only their own power and not working to benefit the citizens they serve.
thr0wawayf00 5y ago
Agreed, but this issue goes far beyond the judicial system. The way the governor handled this situation really showed how much of a liability he feared this story would be to him and his party politically. Instead of examining the underlying conditions of the state agency responsible for the data breach, he chose to go after the messenger. Given that every single time a company gets caught like this, the first thing we all point to is how stingy they are when it comes to security. A conservative governor doesn't want to be in a position where the solution to the problem is to spend money, so he went after the journalist instead.
- encryptluks2 5y ago
  I would campaign on this alone. Say how the opposing party wants people to be insecure, exposed and that they will try prosecuting you for doing the right thing cause they have such fragile egos.

unnouinceput 5y ago

Quote: ""The state did its part by investigating and presenting its findings to the Cole County prosecutor, who has elected not to press charges, as is his prerogative," spokeswoman Kelli Jones said." If they would've continued, then the prosecutor would've been laughed out off the court by the judge. The lawyer defending the journalist would've called this the easiest case of his/her career. This statement is made to look official to save face. Plain truth is that the state simply fucked up badly, starting from the head all the way down to the tail.

sjansen 5y ago
Unfortunately that's not necessarily true. There are plenty of examples of prosecutorial over reach and unfair sentencing because our laws were written by people who fundamentally don't understand technology. It will probably take a few generations to fix that. Common sense won out in the case, but it certainly helped that the target was a reporter instead of a security researcher or ordinary citizen.
- night862 5y ago
  No, I think GP is correct in saying that the case would be laughed out of court. Persuing this case would have been a gift to the Post-Dispatch and Ian would have been a hero. Not only is this whole thing over literally right-clicking html, but this is a Reporter working for a local newspaper. Imagine for a moment that this story was about a regular person who is not employed as reporter with credentials and a portfolio. Depending on that individuals circumstances, it could easily be a life-ruiner. I could think of a few people.
- TigeriusKirk 5y ago
  My impression from previously looking into this case is that there probably was a violation of the law here, but that it would be absurd to prosecute it. The mistake here would be to assume that officials always correctly avoid absurd prosecutions.
  - Someone1234 5y ago

joe5150 5y ago

“There is an argument to be made that there was a violation of law.” I mean, not really, but I guess that could mean anything.

ceejayoz 5y ago
I think that translates roughly as "I'm not allowed to say 'this was fucking stupid' because it involved the Governor".
- DoneWithAllThat 5y ago
  It’s the verbal equivalent of drawing on a hurricane map with a sharpie.
  - CRConrad 5y ago
    The governor's argument was. The DA magnanimously acknowledging that the governor can make that argument wasn't; it was as diplomatically suave as a White House official saying the President can do what he wants with government sharpies.
encryptluks2 5y ago
thinkharderdev 5y ago
The thing is though, I think this is basically correct. They probably could prosecute the reporter if they really, really wanted to. Not that I think they could actually convict someone who was obviously acting in good faith to report a security vulnerability, but security research of this kind seems like such a gray area legally speaking. In general we wouldn't treat an obvious flaw in physical security as a mitigating factor for theft. That is, if I drop my wallet in a public place it is still probably theft for someone to pick it up and take the cash inside. To be clear, this is in NO WAY a defense of the way the government acted in this case which was both insane and harmful, but just to say that a lot of what makes things illegal is subjective judgements about intent. This is why professional pen testers (the careful ones at least) generally specify in very clear terms what the scope of their engagement is (and still sometimes end up getting arrested). I can only imagine that doing independent security research is a mine field.

ratsmack 5y ago

>Cole County Prosecutor Locke Thompson released a statement Friday saying there is an argument to be made that there was a violation of law, and that the issues at the heart of the investigation have been resolved through non-legal means, the St. Louis Post-Dispatch. That sounds more like that "we would have prosecuted the reporter" if they hadn't discovered that the "state education commissioner initially planned to thank the newspaper for finding the problem". They should have profusely thanked him and also given him an award.

MBCook 5y ago
I read it as more of “he did nothing wrong but I can’t make the governor look bad so I’ll imply it was obvious he was guilty but we’re being magnanimous about it.”
- ziml77 5y ago
  That seems to be exactly what he's saying. People here seem to want to make the DA out to be as stupid as the governor or as a malicious person, but based on this statement he didn't actually think he had a case. Saying that something could be argued means that you're coming in with an argument that could be accepted if you overlook all sorts of details and context.
  - shadowgovt 5y ago
    Yep. The right way to read this is that if a persecutor thinks there's a case, they'll prosecute. Not prosecuting means they don't think they can possibly win. Anything that comes out of their mouths after is window dressing.
  - mannykannot 5y ago
    I also feel MBCook is probably right. In this particular case, however, there does not appear to be any argument for prosecution that does not immediately look preposterous as soon as you give it any thought. If this is so, then, by equivocating - for political expediency or any other reason - the DA is inviting doubts about his competence or integrity. I'm hoping that "the issues at the heart of the investigation have been resolved through non-legal means" is a paraphrase for saying that the DA pointed out to the governor, directly or through his aides, that any attempt to prosecute would fail and bring down a heap of public ridicule.

indigodaddy 5y ago

And now he should sue both the law enforcement department and Parson. Make them pay for this bullshit and also a precedent should be laid down like a marker in the sand. Not sure what that marker is exactly, but at the least it will be ‘don’t be batshit crazy like Mike Parson.’

giantg2 5y ago
While many wear the badge of hacker with pride, it seems that the government officials calling him a hacker is clearly defamatory and potentially injurious to his journalism career in this situation.
tshaddox 5y ago
> Not sure what that marker is exactly How about making it illegal for a state official to explicitly make credible threats to use unjustified state violence against someone? Similar to how it’s illegal for anyone to make credible threats of unjustified violence against anyone else.
- datavirtue 5y ago
  That is a solid take. It's also the reason we have the second amendment.
  - datavirtue 5y ago
    Downvoted fact? Cool.
    - wbsss4412 5y ago
      Not really factual.
- Forlien 5y ago
  Even if it became illegal, qualified immunity would protect the offical who made the threats, so officials will likely never be personally impacted by breaking the law and so it'll keep being broken.

2OEH8eoCRo0 5y ago

Was the reporter authorized to access those things? Y/n?

Nextgrid 5y ago
The sensitive data was sent to him in the HTML as part of legitimate usage, so I'd say yes?
Someone1234 5y ago
Yes. It was a public webpage. They sent a normal request and received a normal response. That response just so happen to contain Base64 encoded SSNs in the page state. There's no actual legal merit to any argument that this was unauthorized computer access. Suggesting that decoding base64 is somehow "hacking" is nonsense.
ceejayoz 5y ago
As authorized as you were to publish this comment, yes.

dang 5y ago

Related past threads: The governor of Missouri still doesn’t know how websites work - https://news.ycombinator.com/item?id=29752259 https://news.ycombinator.com/item?id=29752259 - Dec 2021 (21 comments) Reporter may be prosecuted for using “view source” - https://news.ycombinator.com/item?id=29737412 https://news.ycombinator.com/item?id=29737412 - Dec 2021 (163 comments) Reporter who told Missouri officials of website flaw did 'nothing out of line' - https://news.ycombinator.com/item?id=29098289 https://news.ycombinator.com/item?id=29098289 - Nov 2021 (190 comments) Gov. Parson releases video attacking newspaper for viewing HTML - https://news.ycombinator.com/item?id=28980855 https://news.ycombinator.com/item?id=28980855 - Oct 2021 (26 comments) Gov Parson pushes to prosecute reporter who found security flaw in state site - https://news.ycombinator.com/item?id=28946392 https://news.ycombinator.com/item?id=28946392 - Oct 2021 (525 comments) Governor vows criminal prosecution of reporter who found flaw in state website - https://news.ycombinator.com/item?id=28866805 https://news.ycombinator.com/item?id=28866805 - Oct 2021 (678 comments)

ajdude 5y ago

For those interested you can read the reporter’s full statement here: https://joshrenaud.com/pd/josh-renaud-personal-statement.pdf https://joshrenaud.com/pd/josh-renaud-personal-statement.pdf

betwixthewires 5y ago

I like how all the statements from government employees imply "we are being nice." Like no, you're incompetent and this person did you a favor and you got butthurt that you look stupid and decided to jeopardize someone's life to throw a hissyfit and now you're backing off because you look even more stupid and refusing to admit it and so look even more childish than that. That's what happened. You didn't "decline to prosecute as is your prerogative." Just admit you were wrong, you might salvage some respect.

CRConrad 5y ago
> You didn't "decline to prosecute as is your prerogative." Those were the governor's words, not the prosecutor's. > Just admit you were wrong, As I read it the prosecutor did; only the governor didn't. > you might salvage some respect. So to me, again: The prosecutor did, the governor didn't.
avs733 5y ago
this is exactly the roll our judicial branch should play and so rarely does. Step by step in America, the judicial branch has become more and more deferential to the executive branch when it comes to law enforcement. The reality is that I (and you) should have zero expectation that they will protect you from bad state actors at this point. It is something everyone involved with the judiciary should be embarrassed about.

amitp 5y ago

BTW the accused reporter is an occasional HN user who maintains a blog[1] and wiki[2] about BBS software. He started that site after seeing that Wikipedia was deleting pages about BBS software[3]. [1] https://breakintochat.com/blog/ https://breakintochat.com/blog/ [2] https://breakintochat.com/wiki/ https://breakintochat.com/wiki/ [3] Jason Scott's blog post http://ascii.textfiles.com/archives/3826 http://ascii.textfiles.com/archives/3826

stakkur 5y ago

The prosecutor’s statement is just normal posturing. It’s common language; a prosecutor will never state ‘the charges were baseless and are a waste of our time’. But that’s essentially what their statement means.