The news media is often called the Fourth Estate. It is not an official part of government, but it is an important element of our country’s system of checks and balances. The Founding Fathers knew this well enough to provide protection for a free press in the First Amendment.
Which makes it all the more galling that a state government would seek to prosecute a journalist for alerting it to a mistake a government agency had made.
In October 2021, Josh Renaud at the St. Louis Post-Dispatch found that a Missouri Department of Elementary and Secondary Education website was “misconfigured,” as an FBI agent later said, so that the Social Security numbers of 100,000 educators were visible in the site’s HTML, or source coding. The reporter called three of the educators and confirmed that the nine-digit numbers were indeed Social Security numbers.
HTML is a coding language used to build and design websites. Virtually all web browsers (Chrome, Firefox, Safari, Edge) have an option to allow the browser’s user to see the source code for a website. It took us only three clicks in Firefox to see the source coding for the Monongalia County Schools staff directory. (Don’t worry. We didn’t see anything that looked like sensitive personal information in the code.)
Most reports of the incident refer to Renaud as a reporter. While he does write for the St. Louis Post-Dispatch, he is also a developer and news designer for the Missouri paper. We don’t know Renaud personally, but given his specialty, we imagine it’s as natural for him to take a look at a site’s coding as it is for a car enthusiast to examine a vintage car.
After Renaud found the security flaw, he reported it to the state and even held his story until after the problem had been fixed. Instead of thanking him for pointing out the defect — as emails from the DESE suggested the agency was prepared to do — Missouri’s Gov. Mike Parson attacked Renaud as a “hacker” and instructed Missouri State Highway Patrol (interesting choice for a possible cyber security threat) to investigate Renaud and the Post-Dispatch for criminal activity. As mentioned earlier, an FBI analysis of the situation determined it “is not an actual network intrusion.”
If Renaud and the Post-Dispatch had not found the HTML vulnerability and alerted the DESE, would the problem ever have been fixed? If they hadn’t published the story, would Parson’s administration ever have told educators that their personal information had been exposed?
As late as December, Parson was doubling down on his accusations of hacking, and this month, he asked Missouri legislators to introduce policy that would charge exorbitant fees for accessing government documents through the Freedom of Information Act.
Though this fight over journalistic freedom and integrity is taking place halfway across the country, what happens in Missouri could set precedent for other battles between government and media throughout the U.S.
Where government can successfully accuse and prosecute the media for uncovering and revealing government malfeasance or ineptitude, the government creates an environment where it can get away with regularly duping and defrauding its constituents.
