The public prosecutor in Missouri has decided not to press charges against a journalist suspected of criminal hacking for disclosing security flaws on a state government website. The news brought “relief” to St. Louis Post-Dispatch reporter Josh Renaud. Still, he warned the claims leveled against him by Missouri Governor Mike Parson in October 2021 might have a “chilling effect” on good journalism of security issues.
Renaud was accused of discovering a flaw in a domain operated by the Missouri Department of Elementary and Secondary Education (DESE) that might have exposed over 100,000 Social Security numbers (SSNs) belonging to teachers and other school personnel. The St. Louis Post-Dispatch stated in an October 13 piece that it had told DESE of the vulnerability and that the discoveries had been withheld to allow the agency time to safeguard the exposed data. According to many cybersecurity professionals at the time, this approach to vulnerability disclosure was consistent with how professional security researchers frequently warn firms about security issues.
Renaud’s activities, according to critics, did not even qualify as ‘hacking’ because he just browsed the site’s HTML source code, which was leaking sensitive data – something that can be done with ease using web browsers’ built-in capability. Despite this, Governor Parson branded Renaud a “hacker,” alleging that he had broken state computer crime statutes, and forwarded the case to the Missouri State Highway Patrol, who investigated the incident and reported its findings to Cole County prosecutor Locke Thompson. However, four months later, on Friday (February 11), Thompson revealed to the news station KRCG that he would not be bringing charges.
Renaud said in a statement that this statement could be considered a relief, but it doesn’t repair the harm caused to him and his family. “My actions were entirely legal and consistent with established journalistic principles. Yet Gov. Mike Parson falsely accused me of being a ‘hacker’ in a televised press conference, in press releases sent to every teacher across the state, and in attack ads aired by his political action committee. He ordered the Highway Patrol to begin a criminal investigation, forcing me to keep silent for four anxious months.”
Renaud went on to say that this was a clear case of political persecution of a journalist. Despite this, he is glad that his reporting uncovered a serious problem and prompted the state to protect teachers’ personal information in a better way. Mike Parson’s spokesperson Kelli Jones said, “the state did its part by investigating and presenting its findings to the Cole County Prosecutor, who has elected not to press charges, as is his prerogative,” as per the Kansas City Star.
Renaud also cautioned that the decision might stifle the reporting of other security flaws. Meanwhile, Gov. Mike Parson’s administration has been asked to comment further on the prosecutor’s decision not to press charges. As soon as a response is received, an update will be provided.
