JEFFERSON CITY — A St. Louis Post-Dispatch reporter will not be charged after reporting a weakness in a state computer database, the Cole County prosecutor said Friday.
Prosecutor Locke Thompson released a statement to television station KRCG on Friday, saying he appreciated Gov. Mike Parson for raising his concerns, but would not press charges.
The decision came nearly seven weeks after Thompson’s office received a report of the incident from the Missouri Highway Patrol, which was tasked with the investigation by the governor last year.
Thompson did not respond to multiple attempts to reach him on Friday. A secretary in his office in the capital said she was authorized to tell the Post-Dispatch “no comment” on his behalf.
Parson, who had suggested lawsuits were imminent throughout the investigation, released a statement saying Thompson’s office believed the decision “was properly considered.”
People also read…
“The state did its part by investigating and presenting its findings to the Cole County District Attorney, who chose not to press charges, as is his prerogative,” spokeswoman Kelli Jones said.
Post-Dispatch editor Ian Caso said in a statement Friday, “We are pleased that the prosecutor has acknowledged that there is no lawful basis for charges against the St. Louis Post-Dispatch or our journalist. While an investigation into how the state granted access to this information was appropriate, the charges against our reporter were unfounded and made to deflect embarrassment from state failures and for political purposes.
The district attorney’s statement said there was an argument to be made that there had been a violation of the law.
“However, upon review of the record, the issues at the heart of the investigation have been resolved through non-legal means,” Thompson said. “As such, it is not in the best interests of the citizens of Cole County to use the significant resources and taxpayer dollars that would be required to pursue criminal misdemeanor charges in this matter.”
As recently as December 29, Parson had expressed vehement confidence that a case would be brought.
The Post-Dispatch reported on Oct. 13 that more than 100,000 social security numbers of Missouri educators had been exposed on a Missouri Department of Elementary-Secondary Education website. Post-Dispatch reporter Josh Renaud discovered that teachers’ social security numbers were accessible in the HTML source code of some publicly available DESE web pages.
The newspaper notified DESE of the breach and delayed publishing a report until the department could take steps to protect the privacy of individuals in the database.
While DESE originally planned to thank the Post-Dispatch for finding the loophole, Parson instead held a press conference where he answered no questions and alleged that Renaud had “hacked into” the computer system of the State.
The governor cited a state law that says a person tampers with computer data if they “without authorization or without reasonable grounds to believe they have such authorization” access a computer system and “intentionally examine information on another person”.
Renaud said in a statement on Friday: “This decision is a relief. But it does not repair the harm done to me and my family. My actions were entirely legal and in accordance with established journalistic principles.
No permission is required to review public websites, but some researchers say overbroad hacking laws in many jurisdictions allow embarrassed institutions to launch hacking allegations against good Samaritans who attempt to report vulnerabilities. before they are exploited.
Emails obtained by the Post-Dispatch revealed that the FBI had told state cybersecurity officials that there was “no actual network intrusion” and that the database of state was “misconfigured”.
Records showed that Angie Robinson, a cybersecurity specialist for the state, emailed Department of Public Safety Director Sandra Karsten to inform her that she had forwarded emails from the Post-Dispatch to the FBI’s Kyle Storm in St. Louis. Robinson said the FBI agent indicated there was no “network intrusion.”
The emails also revealed that DESE had originally planned to thank the newspaper for alerting it to the issue.
“We are grateful to the member of the media who brought this to the attention of the state” was the proposed quote attributed to Education Commissioner Margie Vandeven.
The state eventually called Renaud a “hacker”.
Caso, the publisher of Post-Dispatch, said, “This matter should never have gone beyond the state’s intended initial response, which was to thank the reporter for the responsible manner in which he handled the situation. Instead, too much taxpayer money was wasted on a politically motivated investigation.
Parson has often tangled with news outlets over stories he doesn’t like.
A political action committee supporting Parson ran an ad attacking the newspaper over the computer incident, saying the governor was “standing up to fake media.”