JEFFERSON CITY, Mo. — A St. Louis Post-Dispatch journalist will not be charged after pointing out a weakness in a state computer database, the prosecuting attorney for Cole County said Friday.
Prosecutor Locke Thompson issued a statement to television station KRCG Friday, saying he appreciated Gov. Mike Parson for forwarding his concerns but would not be filing charges.
The decision was reached almost seven weeks after Thompson’s office received a report on the incident from the Missouri Highway Patrol, which had been tasked with the probe by the governor last year.
Thompson did not respond to multiple attempts to reach him on Friday. A secretary at his office in the capital city said she was authorized to tell the Post-Dispatch “no comment” on his behalf.
Parson, who had suggested prosecution was imminent throughout the probe, issued a statement saying Thompson's office believed the decision "was properly addressed."
"The state did its part by investigating and presenting its findings to the Cole County prosecutor, who has elected not to press charges, as is his prerogative," spokeswoman Kelli Jones said.
Post-Dispatch Publisher Ian Caso said in a statement Friday: "We are pleased the prosecutor recognized there was no legitimate basis for any charges against the St. Louis Post-Dispatch or our reporter. While an investigation of how the state allowed this information to be accessible was appropriate, the accusations against our reporter were unfounded and made to deflect embarrassment for the state’s failures and for political purposes."
The Republican prosecutor's statement said there was an argument to be made that there was a violation of law.
“However, upon review of the case file, the issues at the heart of the investigation have been resolved through non-legal means,” Thompson said. “As such, it is not in the best interest of Cole County citizens to utilize the significant resources and taxpayer dollars that would be necessary to pursue misdemeanor criminal charges in this case.”
As late as Dec. 29, Parson had expressed vehement confidence that a case would be brought.
The Post-Dispatch reported Oct. 13 that more than 100,000 Social Security numbers of Missouri educators had been vulnerable on a Missouri Department of Elementary and Secondary Education website. Post-Dispatch journalist Josh Renaud found teachers’ Social Security numbers were accessible in the HTML source code of some publicly available DESE web pages.
The newspaper informed DESE of the flaw and delayed publication of a report until the department could take action to protect the privacy of individuals in the database.
While DESE had initially planned to thank the Post-Dispatch for finding the flaw, Parson instead held a news conference where he took no questions and alleged Renaud had been “hacking” the state’s computer system.
The governor cited a state statute that says someone tampers with computer data if he or she “without authorization or without reasonable grounds to believe that he has such authorization” accesses a computer system and “intentionally examines information about another person.”
Renaud said in a statement on Friday: "This decision is a relief. But it does not repair the harm done to me and my family. My actions were entirely legal and consistent with established journalistic principles."
There is no authorization required to examine public websites, but some researchers say overly broad hacking laws in many jurisdictions let embarrassed institutions lob hacking allegations against good Samaritans who try to flag vulnerabilities before they’re exploited.
Emails obtained by the Post-Dispatch found that the FBI told state cybersecurity officials that there was “not an actual network intrusion” and the state database was “misconfigured.”
The records showed that Angie Robinson, cybersecurity specialist for the state, emailed Department of Public Safety Director Sandra Karsten to inform her that she had forwarded emails from the Post-Dispatch to Kyle Storm with the FBI in St. Louis. Robinson said the FBI agent indicated there was no “network intrusion.”
The emails also revealed that DESE initially planned to thank the newspaper for alerting them to the problem.
“We are grateful to the member of the media who brought this to the state’s attention” was the proposed quote attributed to Education Commissioner Margie Vandeven.
The state eventually described Renaud as a “hacker.”
Caso, the Post-Dispatch publisher, said, "This matter should have never gone beyond the state’s initial, intended response, which was to thank the reporter for the responsible way he handled the situation. Instead, too much taxpayer money has been wasted in a politically-motivated investigation."
Parson has often tangled with news outlets over reports he doesn’t like.
A political action committee supporting Parson ran an ad attacking the newspaper over the computer incident, saying the governor was “standing up to the fake news media.”
-------
