Major Journalism Controversy and Government Threats in Missouri - It Happened in RI

Major Journalism Controversy and Government Threats in Missouri - It Happened in RI

Republican Missouri Governor Mike Parson this week demanded a criminal investigation into a journalist who found social security numbers exposed on a state website.

Parson is characterizing the paper's actions as hacking and is threatening that the state will investigate. He said it could cost taxpayers $50 million.

Business Insider reports that it is a “reaction that cybersecurity experts say makes no sense.”

GET THE LATEST BREAKING NEWS HERE -- SIGN UP FOR GOLOCAL FREE DAILY EBLAST

Nearly a decade ago, something similar happened in Rhode Island.

It happened in 2012 when GoLocal was sent a spreadsheet by the City of Providence and when the reporter increased the size of the document, it exposed the social security numbers of retirees in a column that was supposed to be locked, but was not due to the error of a city lawyer.

And like Missouri, the City of Providence fought back against the press for its own mistake, trying to prohibit GoLocal from even writing about the oversight.

In Rhode Island, who was the elected official that wanted to scapegoat the media for the government's blunder?

It was then-Mayor of Providence Angel Taveras, Democrat, who may be best remembered for closing down the Davey Lopes swimming pool in one of the poorest neighborhoods in the city after a political spat.

 

Missouri vs. RI

In Missouri, St. Louis Post-Dispatch reporter Josh Renaud published a story revealing that the state's education department website exposed the SSNs of over 100,000 employees including teachers and administrators. All Renaud had to do to view the SSNs was open "inspect element" to view the page's source code, which anyone can do with two clicks of a mouse.

Renaud first disclosed the exposure to the state on Tuesday and waited until the issue was fixed before publishing his story.

Once the newspaper's story went live, however, Parson held a press conference Thursday calling Renaud a "hacker" -- and called on state prosecutors to conduct a criminal investigation into his report.

“’Hitting F12 in a browser is not hacking,’ SocialProof Security CEO Rachel Tobac said in a tweet. ‘Fix your website.’ Another cybersecurity researcher, Matt Blaze, admonished Parson for moving to ‘call the cops’ on someone who ‘quite responsibly’ disclosed the vulnerability,” reported Business Insider.  

Ian Caso, president and publisher of the Post-Dispatch, said in a statement that was shared with CNN Business that the newspaper stands by its reporting and its reporter, "who did everything right."

"It's regrettable the governor has chosen to deflect blame onto the journalists who uncovered the website's problem and brought it to the Department of Elementary and Secondary Education's attention," Caso said.

In Rhode Island in 2012, the City of Providence accidentally released the Social Security numbers of nearly 3,000 former employees in response to a public records request by GoLocal's Stephen Beale to obtain information about pension recipients in the capital city. 

The City of Providence's legal team responded by e-mailing a .pdf file that listed every retiree, their retirement date, the date they began receiving a cost-of-living-adjustment (COLA), and the amount they receive each month.

The list also included columns for Social Security numbers and employee identification numbers that appeared to be redacted, but when the document was enlarged, the numbers were clearly on display. A closer review revealed that the city had only altered the “highlight” color of the document and that a change to the color revealed every retiree’s most personal information.

Once GoLocal's Beale discovered the issue, GoLocal destroyed the files and called the city, and alerted them to the issue, in case they had sent the file to anyone else.

No good deed goes unpunished.

 

The City’s Response, Under then-Mayor Angel Taveras? 

A lawyer for the City of Providence, at the order of Taveras, ran to Superior Court seeking injunctions including that GoLocal could not even write about what transpired. 

The city, however, failed in its motion in court. 

As GoLocal reported in 2012:

A city spokesman was informed of the mistake shortly before 1 p.m. and said he would provide a statement after consulting with city lawyers. Instead, the city filed for a restraining order in an attempt to prevent a story from being written.

Despite GoLocalProv explaining to the city both over the phone and through e-mail that it never intended to post any retiree’s Social Security numbers, the city requested that all records be destroyed and asked that the website refrain from publishing anything regarding the document.

In court, Assistant City Solicitor Kevin F. McHugh argued that the numbers posed potentially "irreparable damage," to the city's retirees, especially in a "9/11" world.

GoLocalProv agreed that all documents should be deleted, but Judge Sarah Taft-Carter said she did not see sufficient justification to bar publication of a story--so long as no sensitive personal information was disclosed.

"I know it's embarrassing for the city," Taft-Carter said. “But I'm not sure if that's the standard."