Readit News logoReadit News
dang · 4 years ago
Recent and related:

Governor vows criminal prosecution of reporter who found flaw in state website - https://news.ycombinator.com/item?id=28866805 - Oct 2021 (678 comments)

jonathanwallace · 4 years ago
I served in the Georgia legislature during a portion of a similar story. Without a doubt, the calculations throughout the story were political not technical.

In the Georgia version, the technical details of the exposed information in the Secretary of State's office were facepalmingly simple (misconfigured apache directives) yet the story dragged on politically for years.

Quickly, a hired security researcher for a corporate client found all registered voters info and instructional pdfs with credentials for the elections system publicly indexed by google. They responsibly disclosed. The apache configuration was updated to "use encryption" (moved from http to https) but still left the info indexed by google over https vs. http. Eventually, this information became public.

The state attempted to prosecute the security researcher but found no state statutes they could use. They then used this incident as a base to create a bill to criminalize the security researcher's actions.

As a state rep, I worked very hard to push back on a bad bill spawned by the incident that would've criminalized responsible disclosure.

Only due to bi-partisan efforts from technically versed people were we able to get the Governor at the time to veto the bill.

https://www.snopes.com/ap/2017/06/15/researcher-finds-georgi...

https://www.ajc.com/news/state--regional-govt--politics/comp...

sour-taste · 4 years ago
That's insane, thank you for your work.

It reminds me of this story in Iowa, where pentesters were arrested and charged with felonies for breaking into a courthouse they were hired to infiltrate:

https://darknetdiaries.com/episode/59/

tweetle_beetle · 4 years ago
I'm not an expert in this area, but was interested in that story when it happened. Reading commentary from others in the industry suggested that they were, at best, naive in their handling of that contract. Yes charging them was a political act to save face, but they put themselves in that position through ignorance. Quite a different situation from a reporter and responsible disclosure in my opinion.
TheCondor · 4 years ago
Thank you for your service.

The other giant thread here made it more directly partisan, this just sounds crazy though. On what rational grounds do you attempt to prosecute or make such things illegal? Is it simply trying to save immediate expenditure of money in a myopic fashion? Or is it more akin to they don't believe it's the state's responsibility to put that data online in the first place so f-it-all-to-hell and everything around it? My constituents don't understand this so I'm just going to oppose my opponents actions, regardless?

In your opinion, is there a way to fix this sort of thing? It feels like we're watching it writ large with the January 6 committee.

jonathanwallace · 4 years ago
I'll take your biggest question first.

> In your opinion, is there a way to fix this sort of thing?

Yes, it requires patient, reasonable, intelligent people operating in good faith to sacrifice personal comfort, etc. and get involved in politics.

Politics is literally a zero-sum game when it comes to voting as it is currently structured in most of the United States.*

But when people with the above characteristics get involved, it literally moderates the extremism that we decry. No matter the level (local, state, or federal), whether you decide to run for office, helps others run for office, get involved with a party, or find a particular issue, being involved makes a difference. You may not be able to easily quantify, but it does make an impact. You may also be bringing a critical perspective in short supply to the political process too.

> On what rational grounds do you attempt to prosecute or make such things illegal?

I heard four reasons for the 2017-2018 SB 315 bill.

1. To ensure the next time someone shared a vulnerability that made the state look bad, that a D.A. would have the choice to bring a criminal case (which would obviously color perception of the story). 2. To bring the law into parity with Federal criminal statutes. 3. To give the Attorney General a "tough on cyber crime" campaign plank. 4. The banks were asking for help prosecuting criminals.

Here's the final text of the bill that passed the legislature, https://www.legis.ga.gov/api/legislation/document/20172018/1.... The most relevant text are lines 12-14 and the subsection carve outs on line 16-20.

For further context, voter rolls were already public information and can be acquired via a request to the SoS office.

The larger red flags were the default usernames and passwords in the instructional pdfs for the election systems.

Both of these symptoms (and more) spoke to a woefully underfunded or poorly run office w/r/t to IT.

Getting more funds to have properly, well-secured systems takes political capital and there's not a lot of return of that type of political capital expenditure.

The current SoS has an engineering background and I've been seeing much better public facing systems put in place during their tenure.

*. Please, please, please can we get approval based voting?

opwieurposiu · 4 years ago
Wow that is a great story. I am glad there was at least one rep (you) who understood apache configuration.
jonathanwallace · 4 years ago
Heh, understanding apache configuration files just made me facepalm harder and wasn't really critical to seeing the impact on the cybersecurity industry if people aren't able to responsibly disclose.

The important thing was to take the time, speak to the bill's author, speak to my colleagues, build a coalition of lobbyists from industry (big companies, startups, etc.), and not stop fighting the bill even after it passed the legislature.

Acutulus · 4 years ago
I find the article title kind of curious, given that it states Parson has "doubled down" which suggests that the video the article references is an active effort on Parson's part. It then goes on to state that the video was produced by a PAC Parson created but doesn't give direct input to. Comes off as unnecessarily inflammatory to me I suppose.

Having said that, this situation in particular really tests my willingness to assume good faith on the part of the governor and his body of advisors. Is he legitimately without a single person close to him that could inform him of how misguided this line of aggression is, and how fortunate it was that the individual who identified the security problem acted in such a helpful manner? On top of that he assigned the Missouri State Highway Patrol to investigate, because given his perceived severity of the situation that's the best agency at his disposal? It all just seems bananas.

I try not to assume that totally inane actions from elected officials are exclusively the result of political calculus, and I suppose I don't have any evidence to assume that's the case here either. But I'm at a loss as to how this situation could blossom into something so ridiculous.

nrmitchi · 4 years ago
This situation is keeping his name in the spotlight, and people will, in general, be more likely to vote for names that they recognize.

I don't believe that there is any other reason here.

TheOtherHobbes · 4 years ago
I would assume this is pure politics.

He knows perfectly well who is to blame, but he's using the situation opportunistically to further his own career.

The issue isn't just that he's objectively and morally wrong, it's that most voters don't see through the grandstanding.

All they see - and all they want to see - is a rich old white dude punching down at some college-educated kid who thinks he's clever enough to have an opinion.

It's not obvious a jury will parse this any differently.

Although I'd hope someone like the EFF would turn up with some heavy hitter experts to add some friction to the self-serving bad take.

This is why it's hard to do politics. While everyone is fact-checking and getting outraged about the reality the political game is being played on a different level with different rules - by people who are often quite good at winning it.

_fat_santa · 4 years ago
I have a strong feeling this will backfire spectacularly.

To any technical or even semi-technical person, the facts of this case are laughable. The Governor thinks that he can steamroll this case through, and is betting that most will not understand the underlying technical details and give into the fear mongering "hacking" narrative.

But the thing is, as soon as this goes to court, there is a 100% chance the EFF or another organization is going to step in. Once the defense can explain the layperson exactly what happened here, the governor is going to go from "protecting the people from hackers" to "dumbass trying to cover his own ass".

The Governor and his cabinet clearly think they have this one in the bag, but I think the EFF or another org is going to step in and hand his ass to him in court.

xboxnolifes · 4 years ago
This argument, which I at least partially agree is probably true, always bothered me. If they just want to have their name out in the public often, they just need to to strongly push for any solution. Here, he could have been loud and vocal about how the security of these sites is unacceptable and started handing out public awards to the person (people?) that found the issue.

The fact that one approach was chosen over the other suggests where is more to the reason.

adrr · 4 years ago
Its standard GOP politics we've seen for the last 4 years. Use the legal system to bully people not to make you look incompetent. This is unique because he's using the criminal system and not the civil courts. How many people did Obama sue in office? Compare that to Trump who's gone after family members, the media, etc.
mcguire · 4 years ago
And it discredits the press to have them remembered as 'hackers'.

Deleted Comment

notreallyserio · 4 years ago
It sounds like he’s part of the Strong Man party and cannot be allowed to be wrong. I don’t think it’s purely political, some people just can’t be reasoned with.
inetknght · 4 years ago
> some people just can’t be reasoned with.

It's been eye opening to see and recognize such people on the internet over the past 10 years or so. It's been a lot more scary to be able to recognize the same character flaw in real people I'm physically around.

Animats · 4 years ago
"The Führer is always right".[1] Robert_Ley, 1941.

History has seen this before. It doesn't end well.

[1] https://en.wikipedia.org/wiki/F%C3%BChrerprinzip

UncleOxidant · 4 years ago
> is he legitimately without a single person close to him that could inform him of how misguided this line of aggression is

I would not be surprised if that is the case. Or if he does have such a person he is only hearing what he wants to hear.

3wolf · 4 years ago
> a PAC Parson created but doesn't give direct input to

That's newspaper-covering-their-ass-speak. No serious person believes there's no coordination, however indirect, between candidates and their PACs.

EamonnMR · 4 years ago
Holding people responsible for the acts of PACs they create seems reasonable to me. Reputation laundering should be discouraged.
intunderflow · 4 years ago
> This situation in particular really tests my willingness to assume good faith on the part of the governor and his body of advisors

I think by this point it's very clear he's acting in bad-faith to try and cover himself from the fallout.

HeckFeck · 4 years ago
His strong stance will deter all 'hackers' and like scoundrel from touching any government website! When would-be data breachers see how he treats anyone trying to be his friend, they'll dare not make an enemy of him.

This Governor has the DOMINANCE!

jbeales · 4 years ago
I feel like there have to be actual hackers out there thinking "You think that's hacking? I'll show you hacking!"
jimt1234 · 4 years ago
Politically speaking, this can only be a victory for the governor. In conservative political theater, any association with "standing up to the liberal media" is valuable. Furthermore, if/when this whole thing fails in the courts, either conservative voters will never know about it, or the legal defeat will only contribute to the "standing up to the liberal media" narrative.

At this point, it's all about getting on Trump's radar in order to secure his VP nomination in 2024. I totally believe that's what's going on here - political posturing.

cratermoon · 4 years ago
> Is he legitimately without a single person close to him that could inform him of how misguided this line of aggression is,

I've said it elsewhere and I'll repeat it here. People like Parsons who climb to positions of power think of security in terms of power, not technology. It's a sort of security-because-I-say-so mindset, which is more like what technologists would probably call "classified information". For a person of that mindset, calling it "secure" means that accessing it at all is a security violation, unless that person has clearance.

From the point of view of a person who sees security as "it's sensitive information because someone says so" accessing it without clearance is punishable, and I think that's where Parson and his ilk are working.

Even if Parson has someone close enough to him to explain the difference between security by technical means and security by declaration, the governor could still conclude, from his mindset, that a violation occurred because of the sensitive nature of the information.

As far as I know, neither Missouri nor any other state has anything like US federal-level information classification laws, for which a person can be found in violation and prosecuted even if they didn't have to overcome any technical security measures to access the information. But that doesn't seem to deter Parson from acting like there's an actual breach of law, according to his understanding. But someone could, possibly, reach the governor through explaining that there's no state law about sensitive information, and perhaps he would back down, although it might motivate him to push for laws that would look more like security clearance regulations.

andrewflnr · 4 years ago
Interesting interpretation. However, what the reporter did is pretty analogous to finding a classified document on the ground, looking at the first couple pages to see if they were legit, then informing the correct authorities before writing a news story. Which is still something you want to encourage, and is insane to prosecute.
pianoben · 4 years ago
The background with Parson is that he is overtly hostile to the "blue" cities of St. Louis and Kansas City, and favors the more rural parts of the state. He has an especially hostile relationship with the press in those cities.

It doesn't surprise me that he'd want to make hay with this - he can promote himself, damage his political enemies, and look tough to his base, which (generally speaking) doesn't consist of professional technologists.

(if you want evidence of his antipathy to Missouri's cities, look no further than covid vaccine distribution - St. Louis had maybe one single site, but rural areas had more vaccines than they could use. My elderly parents had to drive for hours to get to one of those underused sites because there simply weren't any vaccines to be found in the metro area.)

vkou · 4 years ago
I'm not saying you are wrong in this particular case (As I know nothing about the particulars of vaccine distribution in your state), but this has been the case across the entire country, red and blue. At a rough approximation, vaccines were distributed more or less equally across rural and urban areas, but due to high demand in urban areas, there were long wait lists in them.
_ktx2 · 4 years ago
> (if you want evidence of his antipathy to Missouri's cities, look no further than covid vaccine distribution - St. Louis had maybe one single site, but rural areas had more vaccines than they could use. My elderly parents had to drive for hours to get to one of those underused sites because there simply weren't any vaccines to be found in the metro area.)

I lived in SoCal at the time and had to do the same thing. I drove about an hour and a half into the desert to get it when my name came up, and I lived in the city of San Diego.

Dead Comment

ClumsyPilot · 4 years ago
Damn, how could such prosecution actually go ahead, this sound like tinpot dictatorship news
goostavos · 4 years ago
He "decoded the html"! C'mon, man! That's hacking!
munificent · 4 years ago
The trick is the realize that US politics today is essentially two groups of people who live in almost entirely separate realities that happen to spatially overlap. Public officials are in the odd state of being observed by members of both realities, but only acting and affected by one of them. The result is that their behavior looks super fucking weird to the other.

It's like watching someone navigate a glass maze that you can't see. The whole time you're wondering why they're taking such a circuitous path. They look like a crazy person to you, but it's because they're avoiding obstacles you can't see.

The reason we have two separate realities is that most of "reality" at the political level comes to voters by way of media. Almost none of us have directly witnessed, say George Floyd protests, abortions, industrial pollution, inner city gang violence, etc. Instead, we learn of these things through the news and social media.

But those in the US have become increasingly polarized. The picture of the world you get from watching Fox News or your Facebook feed if you have conservative friends shows an entirely different world than what someone watching CNN and the politics subreddit sees.

For politicians, winning elections is central. It is the source of all of their power. They know that the way to win elections is to get people on their side to show up and vote. Losing votes from the other side is essentially irrelevant — they weren't going to vote for them anyway. Politicians are fighting apathy, not the opposing party.

So almost all of their public behavior serves to make them appear good to their camp when viewed through that camp's media lens. The way it appears to the other side doesn't matter one bit because it won't significantly affect elections.

Once you understand this, Parson's behavior makes perfect sense. He got caught looking like a dumbass leaking SSNs so he has to do ("do" in the sense of some visible political behavior, not in the sense of solving the actual problem) something. If he frames it as the liberal press are evil hackers, then Fox News is happy to carry that narrative for him. His voters will see that narrative, be satisfied that it fits their worldview, and continue to support him.

The fact that his narrative is nonsense doesn't matter. No one likely to vote for him will ever see that, and those that do see it weren't going to vote for him either. Actually fixing the problem also isn't particularly relevant. Conservative media just wants him to win so won't run bad press if he doesn't fix it, so there's little incentive.

Every year, the US looks more like China Mieville's "The City and the City".

mdp2021 · 4 years ago
> For politicians, winning elections is central. It is the source of all of their power. They know that the way to win elections is to get people on their side to show up and vote. Losing votes from the other side is essentially irrelevant — they weren't going to vote for them anyway. Politicians are fighting apathy, not the opposing party.

This is called "perversion".

> Once you understand this, ...'s behavior makes [it]

an accomplice and an entity of abysmal value.

--

Back to the elephant in the room: journalism was there to determine facts, reality. Outside narratives, facts exist, sometimes clear. It's like in judicial matters: advocatus dei and advocatus diaboli are there to attain to truth in a dialectic manner, proposed and implemented to exhaust the thinkable reasons involved - never there you meet the lunacy of "serving the client's interest". The disconnection to facts you indicate would be a horrible disease.

snarf21 · 4 years ago
This is a "no such thing as bad publicity" political tact. If the case doesn't go forward because, you know, the actual 1st amendment, then the next response will be how he is being cancelled by the liberal media. This is mostly signaling to his base that he is out there fighting for them but the other side isn't playing fair.
sam0x17 · 4 years ago
I think it's more of a "screw gamers/intellectuals/scientists/researchers because my base hates them" tact.
say_it_as_it_is · 4 years ago
You don't have a personal PAC that isn't beyond your influence. It wouldn't be a personal PAC, then.
tyingq · 4 years ago
I'd be very surprised that the PAC he helped create is doing something he isn't good with.

Deleted Comment

cryptoz · 4 years ago
> But I'm at a loss as to how this situation could blossom into something so ridiculous.

This is one of the least ridiculous things Republicans have done in the last few years.

zschuessler · 4 years ago
This kind of politics makes my heart hurt. Parson wants to control the situation and is doing everything he can to do that, no matter the cost to the tax payers of my home state, or lives he impacts. I'm genuinely sad people like this are in power.

The disclosure by the reporter was fair. The reporter waited to disclose the story until the department of education reviewed the matter. I don't see a court convicting from that fact, this is all for show on reelection.

What I'd like to see is Parson respond to community questions in a townhall and be held accountable for his words. Namely, can we see the line item breakdown of how we got to $50 million? That is _five_ times the cost it took to build Missouri's great Arch..

atty · 4 years ago
This feels like the reaction of a child who was embarrassed in front of their friends on the playground, too upset to understand that doubling down just makes it look worse. Sad to see that sort of behavior coming from one of the ~100 most powerful elected individuals in the country. Bad look for Missouri.

I also am incapable of understanding how this could be twisted into even vaguely being described as hacking. That’s like if I called myself a hacker for opening up the dev tools in my browser.

bcrosby95 · 4 years ago
Unfortunately society generally seems to think its okay for adults to act like children, but it's not okay for children to act like children.
erulabs · 4 years ago
It's a strange and very Double-Speak response to frame this as a political attack by the newspaper who found the flaw - and in particular the individual journalist.

The idea that a journalist is "attacking" by finding an issue worth bringing up _must_ be cognitive dissonance, right? Otherwise all investigation would be a form of assault? Either someone with an IQ below 80 became governor or this is purely a strategic response.

Strategy being? This prosecution will never hold up in court, and we all think the governor is an idiot. So the accomplished goal seems clear: Everyone is now saying this governors name.

elliekelly · 4 years ago
It also has a chilling effect on journalism (and free speech generally). Even the threat of prosecution for a non-crime serves to discourage others from publicly discussing his administration’s errors.

This situation is arguably the reason we have the first amendment: so the government can’t bully you into silence and submission when you’ve embarrassed them. When they’ve embarrassed themselves, really.

erulabs · 4 years ago
I hear what you're saying, but since there is such a zero chance this results in the journalist going to prison - I'm not entirely sure it has any effect - honestly if I was trying to become well-known as a journalist, I'd very much want to be in this spotlight - I'd be trying to find another mess up on Missouri's part to become part of this story. It very possibly has the opposite effect (the "Streisand effect").

The only _known_ effect is that this becomes a hot story and we're all outraged one way or the other.

tdhz77 · 4 years ago
When I lived in Missouri 10 years ago it would never have elected such an idiot. A state that brought decent thinking people like Thomas Hart Benton, President Truman, Roy Blunt and Claire McCaskill. There was a saying what goes Missouri so goes the nation.. this will never be true again. Thinking is secondary to outrage in this state. They have been outraged since Obama was elected.
ascendantlogic · 4 years ago
Electing a black president permanently enraged a lot of hateful people across the country. We're going to be dealing with the fallout for a long time. To be clear I'm not saying we shouldn't have, but I think we underestimated just how many people in this country would react very badly to that from a political standpoint.
hindsightbias · 4 years ago
> There was a saying what goes Missouri so goes the nation.. this will never be true again.

Actually, that might explain a lot of things.

indig0g0 · 4 years ago
> There was a saying what goes Missouri so goes the nation. That should scare every American. I can hop on a plane and be back in my country in about 5 hours, but what are you going to do if the whole country keeps trending the way that state is?
bogwog · 4 years ago
This is like perfect viral content for our demographic. It's in the "rage" category (the most engaging type of content), and it is a black-and-white situation with no gray area whatsoever.
EamonnMR · 4 years ago
Many of us probably have stories like this from school days - admins overreacting to their lax policies.
panzagl · 4 years ago
Young(ish) people can shake fists at clouds too!