Legal expert questions state investigation of reporter’s discovery
COLUMBIA, Mo. (KMIZ)
A legal expert believes state investigators may be applying a state law too broadly in pursuing a case against a reporter that discovered a privacy issue in a state website.
David Roland of the Freedom Center of Missouri said it would be overzealous to charge a St. Louis Post-Dispatch reporter for tampering with computer data, as Gov. Mike Parson has suggested happen. Roland said the facts available right now don't seem to show the reporter did anything wrong.
Parson said Thursday that he asked the Missouri State Highway Patrol to look into the reporter that notified state education leaders of a data security issue on its website. The newspaper reported on Wednesday that it discovered Social Security numbers of teachers viewable within the source code of a web page on the Department of Elementary and Secondary Education site. The state said it fixed the problem when notified of it, but blamed the reporter of acting as a "hacker" to obtain the information.
"I would be very disappointed if the government decides that it's going to pursue any sort of criminal action against the journalist that uncovered this security issue, and in fact, I think the proper response would be to say thank you," Roland said.
The source code of any given web page is easily viewable with just a few clicks or the press of a button. That code shows the elements that give a certain page its look or how it functions. Roland said he saw nothing nefarious about accessing the source code of a state website and looking at what it contains.
"I have a very difficult time imagining that there's anything certainly morally wrong, and I would suspect not legally wrong with simply observing what the government has made available through its own website," Roland said.
State law makes it a class A misdemeanor for someone that "[a]ccesses a computer, a computer system, or a computer network, and intentionally examines information about another person." Parson said the reporter went through extra steps to find the numbers rather than simply viewing the source code.
Roland said applying that law to this case may be too broad.
"If one was going to apply the statute that broadly, then simply Googling somebody could arguably constitute accessing a computer and intentionally examining information about another person," Roland said.
Matt Michelson, education policy director at the Missouri State Teachers Association, said it heard from DESE on Wednesday night about the issue. The Post-Dispatch reported the Social Security numbers were visible on a page showing teachers' certifications in the state. Michelson said he hoped the state works to keep personally identifiable information more secure.
"I think we expect that any of that public data that goes beyond that commonly accepted data that's released should be protected," Michelson.
The highway patrol did not say how long its investigation might take.
