Missouri governor demands prosecution of reporter for 'decoding HTML source code' and reporting a data breach A Missouri politician has been relentlessly mocked on Twitter after demanding the prosecution of a journalist who found and responsibly reported a vulnerability in a state website. Mike Parson, governor of Missouri, described reporters for local newspaper the St Louis Post Dispatch (SLPD) as "hackers" after they discovered a …
> He justified his bizarre outburst by saying the SLPD was "attempting to embarrass the state and sell headlines for their news outlet."
Isn't that pretty much the entire purpose of the news media? Revealing events and things that should be corrected and raising public awareness of important issues?
He'll be complaining that sports people shout and cheer when they succeed, or that actors strut their stuff on stages next.
He'd better not read The Register, either.
> He'd better not read The Register, either.
Do not worry, he doesn't.
This is The Right Honorable And Most Excellent Governor Parson's Wikipedia page:
https://en.wikipedia.org/wiki/Mike_Parson
Hard-core Trumper.
Is that a cop stache or a porn stache? I can't quite tell.
He needs to forfeit his "Trump Card" then. Chances are he's only a Trump supporter to motivate the base to re-elect him. As another person said, "Typical politician".
On a related note, would you have had EQUAL kinds of criticism if he had been a DEMOCRAT?
(knee jerk reactions and manipulative gaslighting are their specialty, even MORE so than Republicans)
(Too many examples of this kind of arrogance+ignorance throughout government for too many years, frm DMCA to this current fear-based idiocy)
> On a related note, would you have had EQUAL kinds of criticism if he had been a DEMOCRAT?
Yes, if you can show me one Democratic Governor who wants to prosecute a journalist for selecting "Page Info" from the Tools drop-down menu in Firefox / Waterfox. Or Tools -> Web Developer -> Inspector from the same.
(I know there are equivalents in Chrome / Chromium but I can't be bothered right now to remember what those are).
I can offer you John Podesta - Hillary Clinton's campaign Chairman in 2016 - who decided to ignore the FBI's repeated warnings about the DNC's network having been successfully attacked. He is right up there with Governor Parson. Cambridge Analytica, Russiagate, The Pee Dossier and that whole entire sordid spectacle that ensued.
Or Robby Mook - Hillary's Campaign Manager - whose brilliant statistical modeling and forecasting had her winning in 2016 by an insurmountable margin.
Not to mention Hillary herself and her idiotic email server located in the basement of her house, running some unpatched version of Windows Server 2013. While being US Secretary Of State. Totally secure.
But, when it comes to tech idiocy, Trumpers are by far the most entertaining of the bunch.
Hillary and her crew were not entertaining. Not by a long shot.
Remember Rudy Giuliani - Trump's White House Cyber Security Czar? Who locked up his iPhone after entering the same wrong password 10 times in a row?
If the same wrong password fails 9 times in a row, there's something wrong with the iPhone, not the password. So, enter it a 10th time.
Not a governor, but neither mainstream US party is immune from using "hacking" laws to go after whistleblowers, journalists, etc. It's much more about whether you're in the establishment or out than Rep/Dem.
Top Google results:
http://silencedfilm.com/press/ <--- highly reccomended
https://www.motherjones.com/politics/2012/06/obamas-whistleblowers-stuxnet-leaks-drones/
https://www.commondreams.org/views/2010/04/16/what-whistleblower-prosecution-says-about-obama-doj
https://www.aclu.org/blog/free-speech/employee-speech-and-whistleblowers/leak-prosecutions-obama-takes-it-11-or-should-we
Because Republicans go the extra mile in order to be award winningly stupid - https://www.washingtonpost.com/opinions/2021/10/04/gop-proud-of-its-own-stupidity/
Not just politicians, remember British Telecom, the Dan Cuthbert case?
BT ran a charity website for Tsunami donations, he made a donation, noticed he was redirected to an insecure page with payment details on it (as I recall it had a "secret" folder that was actually public), so he simply tried other URLs and found all the other payment details for other doners.
He reported it to BT, who covered their ass by seeking his conviction and labelling him a "hacker" under the "Computer Misuse Act"... and he was convicted.
Found it:
https://www.theregister.com/2005/10/06/tsunami_hacker_convicted/
So, yes the guys clearly deflecting, but it doesn't mean he won't get what he wants.
@AC "He reported it to BT, who covered their ass by seeking his conviction and labelling him a "hacker" under the "Computer Misuse Act"... and he was convicted."
Not quite how I remember it. He ran his tests because he had not receive a confirmation of his payment. As far as I can remember he did not report anything to BT. His tests set off BT intruder alarms and BT called the police.
When he was questioned he lied about what he had done which made it harder for BT to find out what had happened which added costs to BT's and the police's investigation.
He got convicted because he had lied. The Judge even said he would have been inclined to dismiss the case if he had not lied.
At the time I thought the conviction was harsh but if he had not lied chances are the case would have been dismissed.
I've just rechecked, and it seems the story is worse than thought. His directory traversal *failed*, it was a claimed *attempted* hack, even despite the substantive evidence.
https://www.scl.org/articles/821-computer-misuse-prosecutions
He donated money, i.e. he gave the site his verifiable name and address prior to the thing that was claimed as a hack, so right off the bat, it's a fail for the scenario of "hack".
So BT there, knowing it could not be a hack, and knowing that dotdot is valid in a URL (and thus consented) went ahead anyway.
"He got convicted because he had lied."
He was not convicted of lying to the police, he was convicted of a computer crime. That's misleading, as if the whim of the prosecutor changes the substantive.
"When he was questioned he lied about what he had done which made it harder for BT to find out what had happened which added costs to BT's and the police's investigation."
No, BT defined a legal URL as a crime, and made a malicious prosecution. Any cost their occured were their malicious prosecution.
I beg to differ. Looking at the source is prohibited by the page license. It clearly states that any and all information is property of the state and you are not allowed to use or analyze the content, nor are you allowed to inform third parties of any knowledge you may or may not have gained.
Using your eyes to look at the page source is therefore premeditated hacking and punishable by life imprisonment. How dare you inform yourself!
You can't present the terms of a contract after those terms have already been fulfilled.
Let's review what's happening here.
Step 1: The javascript and HTML and what-not are delivered to your computer.
Step 2: The page, as rendered, forbids you from looking at code that renders the page.
It's like saying "By reading this sentence, you are under contract not to read this sentence."
Whoever wrote those words knows full well that it's not a legal restriction. It's a con -- and therefore the act of a scoundrel.
Whoever wrote those words knows full well that it's not a legal restriction. It's a con -- and therefore the act of a scoundrel.
Nah, I think it is more like the output of a non-legal person trying to pretend they know what they're doing by writing fake legalese. I see this sort of bollocks in contracts almost every time I get sent them. If you ever do managed to get to talk to a lawyer at the company to discuss things you can almost hear them banging their head on the desk.
Sadly, there are some people who would see those as worrying criminal tools. I know if I'm ever investigated for some crime, I'm going to get a lot of blame for having a tool called Wireshark installed on my computer. It's even got that scary name and talks about packet capture, so I must be evil. Wget doesn't have the same cool name credential, but by not being a full word, they'll give it extra points for ubertechnical hacking tool so we're probably even. Unless they have a forensic investigator review my hard drive and find that I've got wget too. Then we will be assumed to be acting in concert, which will be very fun if we're in different countries so we can be called "an international cybercrime organization".
In a former role, I got a snot-o-gram from on high when a system scan tool (aka Corporate Malware found subversive hacking tools like netcat, nmap and wireshark on my corporate PC.
My role description at the time included the words "software", "engineer" and "security".
Didn't happen again after disabling a few services and blocking a few ports.
Re. having a C compiler:
One of the older Windows antivirus or antimalware tools, some years ago, used to produce "Hack tool" alerts for some common compilers or IDEs (I can't remember the exact details now).
The authors of those "malware" signatures would likely have got one well with certain politicians!
Whilst wireshark and its ilk may not be necessary for most users, it would be helpful if more people knew they were freely available and what could be done with them. They might be surprised to learn just how much metadata is broadcast unencrypted around the LAN and even wider, just so that they can spaff their personal details on twatter.
Which should be the only reason for any Highway Patrol to actually have a Digital Forensic Unit
Seems all states have these state police forces. They just call them different names. In Missouri's case, who knows. When I lived there it was real effort to figure out what agency did what to who.
University. Start of term after the summer break. Help-desk flooded with calls from academics who, having been warned constantly to report anything out of the ordinary, are screaming "have I been hacked?" because their desktop PC has been updated over the summer, maybe a new OS, maybe a new corporate wallpaper, maybe just some desktop icons changed because they got a new version of Office or something.
You don;t have to be stupid to not understand computers. You just have to be uneducated in that field. Of course, you should probably not go public with your fears without consulting your help-desk first. THAT is stupid.
elp-desk flooded with calls from academics who, having been warned constantly to report anything out of the ordinary, are screaming "have I been hacked?"As an IT professional, I would have done exactly the same thing (reported the out of the ordinary behaviour).
Why?
Garbage-in, garbage-out. Make stupid directives, instill a culture of fear, wear the results.
It's like the after-9/11 scare campaigns, "report anything suspicious". WTF is suspicious? Meaningless twaddle.
"You don;t have to be stupid to not understand computers. You just have to be uneducated in that field."
I would argue that remaining uneducated in that field is a clear indicator of stupidity. I don't expect everyone to become a sysadmin, but computers are ubiquitous tools required for nearly all jobs and arguably used even more outside work by most people. Learning at least the basics takes very little time or effort; remaining ignorant is a deliberate choice.
Cars make a good analogy, since they often seem to be offered up as a defence for not understanding computers because people drive without understanding cars as well. But you don't need to know how to build a car yourself to have some basic understanding. If I turn the headlights on but things still seem strangely dark, I don't immediately rush to Twitter to tell everyone my car has been hacked. I simply check the bulb. If that doesn't work, maybe have a look at the fuse as well. I can't do much more than that myself, but if I really need someone's help, I'm at least able to give some basic information about what the problem is, what I've tried so far, and anything else that might be useful like flashy lights on the dashboard or whatever. Even the least competent driver should be able to point to the general area of the problem and do at least a bit better than "car not work" when calling for help.
Computers seem to be weirdly unique in having people not just make a deliberate effort to avoid knowing anything about them, but then being actually proud about how little they know. Even people who claim to know nothing about cars would at least have to admit that they could diagnose a flat tire. Refusing to gain even that level of competence with computers is a choice people make, and it's not one that reflects well on them.
I would argue that remaining uneducated in that field is a clear indicator of stupidity
I remember a contract I had in 1999 (replacing computers with an old version of OS/2 witth a y2k compliant version - we'd pitch up at the office at about 4pm, prep everything then, when the staff leave, we'd swap out their boxes for updated ones).
One woman, (about 5 years older than me) was very proud that she'd never used a computer and never would. To which my reply was "in 5 years you'll be unemployable then"..
>Even the least competent driver should be able to point to the general area of the problem and do at least a bit better than "car not work" when calling for help.
Competence as a driver has nothing to do with it. Some people have an affinity for machines and their ailments, other people do not. A person of engineering bent will notice a car making a funny noise or behaving differently when they do something, such as accelerate or brake or turn a corner. Others would not notice anything going wrong, until the car just stops.
Republicans don't really exist. It's all part of Hillary Clinton's vast left-wing conspiracy in coordination with the complicit fake-news media that only pretends that Republicans are out there as a scare tactic. I can't believe so many people really believe Trump is an actual living person. A friend of my uncle knows the actor who was hired to play him...
This sort of thing is happening all over the place here in the US, this incident is only making the Reg because its 'kinda technical'. We're in the rather awkward situation over here that one of our main political parties has gone openly Fascist. (This didn't happen overnight, its been tacking in this direction for a decade or more, but we're now at the "we don't need to disguise it any more" stage so threats, intimidation and even outright violence is becoming a normal way of carrying on politics.)
And that's bad enough. But what makes it worse is the state of the other party.
The UK has a similar problem, though at lower intensity. Instead of fascists it has a party of clowns, who keep getting elected because the other party has no idea what it even means any more.
"Instead of fascists it has a party of clowns"
Nope, the clown act is a facade. They are little proto fascists, already cracking down on your rights to protest (even "peacefully") and blaming immigration for all our woes, real or imagined. There are no empty shelves, dont believe the evidence of your eyes....
when Demo[n,c]rats do these things, I bet you say NOTHING. (my opinion this guy needs to hand in his Republican card and and exchange it for a HYPOCRISY card)
They are politicians, (allegedly) manipulative gaslighting dishonest ignoramuses, who's primary occupation is to get a bunch of people to [re]elect them every few years, and NOT do what is best for anyone EXCEPT themselves.
The chips on the shoulders of the Drumpf and Repooplican supporters must *really* weigh heavy on their shoulders.
I mean, can you imagine what it is like to be "picked on" by every human being on the planet with a functioning brain cell, while you can only regurgitate tweets and quotes without grasping their meaning?
The Republicans have a history of authoritarianism despite always loudly championing freedom. Its all very well documented. Up to the Gringrich era (early 90s) it was kept in check by the party establishment but in recent years it has become more open as the party moved to the fringes in order to remain in power despite demographic changes in the country as a whole. (Again, well documented.) The Trump era might have been a watershed but it is thought to be a manifestation of the changes rather than being primarily an agent of change itself.
The Democrats are really the party of "everyone else". Its loudly lambasted as 'extreme socialist' by the usual talking heads but its policies would not be out of place among Heath era Conservatives in the UK.
The argument about 'saying nothing' and usual -- and frequently lame -- attempts to corrupt names and so on are the products of AM talk radio aided by social media (and for all I know seeded by professionals).
(Anybody read "It can't happen here" by Sinclair Lewis?)
It could be worse. It could be Mississippi. There has to be a state which places last in various statistics, and usually that’s Mississippi. (Missouri is usually in the bottom five.)
And, oh, Missouri famously voted for a dead man rather than let John Asscroft (I deliberately speled it that way) in. Asscroft went on to be Boy George Bush’s Attorney General. How bad do you have to be for the voters to pick a dead guy over you?
The problem with politics is that the parties get to choose who the population can vote for and there is no way to effectively protest the offerings. If you choose none of them then the one with the money gets in, if you choose the one you dislike the least then you will hate whoever gets in.
To get public confidence back in elections you need to have a 'none of the above' option and if that gets the most votes then there is no winner and they have to try again after a set period (a year? a decade?)
Good idea, bit who runs things until then? The people you want to vote out but can't as none of the others are any better?
Every state and the federal government has a slightly different way of handling it, but all have rules for what to do if a person is elected but dies before taking office, use those rules. Sometimes a governor appoints a pro tem officeholder and calls a special election, sometimes a legislating body elects one, sometimes the previous officeholder continues until another election can be held.
Oooh, you're stretching there. That would mean he knows how to install an app on a smartphone.
I'm betting he's barely capable of punching in a phone number. He's probably got a secretary to deal with all the technical details of inputting a phone number, and she (because of course it's a she, he's an alpha male, dammit) passes him the phone when the call is being made.
After all, he can't burden his two functional neurons with such mundane matters . . .
"He's probably got a secretary to also print out Web pages for him"
That's what an IT director for a (now defunct) high street retailer used to do with emails - his PA would print them out, he would dictate a response and she would then compose an email reply....
Amateurs! Pfft!
The Governor should have hire someone who knows "a lot", like Trump's Cyber czar Rudy Giuliani.
> It's not like politicians in other countries are more intelligent.
..and there lies the problem. Just imagine the kind of mess we'd be in if it turns out that other countries -- countries that we've taken to labelling 'adversaries' -- have leaders who do have a clue. They'd be able to play us like fiddles.
It's not him that's stupid, it's his constituents -- and he's working it. He doesn't care how it looks to the opposition or the wider public, he just cares that his voters see the message media == evil hackers. Any actual prosecution doesn't have to result in conviction as long as it performs the intended double-duty of harassing the media and keeping the message front and center for the voting public.
What's so incredible about the manipulated voters is they have no theory of mind. (Even some animals have a rudimentary theory of mind.) They should be asking the question, "If this politician is using this particular falsehood to manipulate me, what do they think about my intellect?" And the followup question, "Should I really be voting for someone who thinks I'm such an idiot?"
But they do vote for the politician, thus proving the assessment correct.
and, to expand (briefly): my in-depth evaluation applies equally to all voters for any political entity/party who display identical lack (as in = 0) of critical thinking re. 'their man' (woman, man, whatever)
very appropriate quip on part of TheReg regarding "Salus populi suprema lex esto" which actually IS Missouri's state motto on their State Seal(https://en.wikipedia.org/wiki/Salus_populi_suprema_lex_esto). And as expected, epic-level hypocrisy from a GQP Liar,.. i mean Politician.
Finally, an opportunity to tell my similarish story. Not as interesting, and certainly doesn't involve the idiotic exposure of people's social security numbers, but anyway.
I used to run the main fan-founded website of my local ice hockey team. One of the sources of news I used was, of course, the official website. They'd recently had their site rebuilt and the developers had decided on a URL structure for news articles along the lines of article.php?id=1, clearly using an auto-increment primary key as the ID for stories.
Well, it didn't take a Herculean amount of curiosity to work out that I could increment the number myself and see if there were any stories primed to appear in the near future, and score a scoop for my own site.
Cheeky? Sure. Illegal? Obviously not. That didn't stop the team going to the local paper and threatening to sue this "hacker". (They claimed my early scoop had nearly cost them a player signing.) The writ never arrived, which was a shame, as I'd have enjoyed my day in court explaining to them how the internet, and URLs, work, and why guessable URLs are not the best place for non-public information.
I no longer run the website.
I believe SwiftonSecurity offered the most concise response to this nonsense.
What?, a Trump republican basically just making up a pseudo-conflict out of thin air and then riding it around to further cement his support by many others who also have no clue whatsoever?? Never seen that before..;>)
In fact, the fact that he is ridiculed by experts has no bearing on his behavior - he is not addressing any experts, just his own constituency - these are the same people who agree there is no need to vaccinate, wear a mask, the election was stolen, etc, etc....who cares about any actual facts??
His post currently has 1100 likes... On Friday he only had a few dozen likes. So all of the press coverage saying how utterly dumb this was has only _increased_ the number of people openly agreeing with him. Talk about playing to the crowd!
He is not interested in the 6800 negative comments - they wouldn't vote for him anyway
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
