KANSAS CITY, Mo. — Missouri Gov. Mike Parson said Thursday morning he is asking state investigators to look into the actions of the St. Louis Post-Dispatch that revealed the state’s computer system made accessing social security numbers of teachers readily available.
On Wednesday, the newspaper notified the Missouri Department of Elementary and Secondary Education that the social security numbers of 100,000 Missouri educators were vulnerable to public exposure.
The newspaper said it discovered the vulnerability on DESE’s website Tuesday when it viewed the source code of the page. Within the source code, the newspaper found nine-digit numbers, which it confirmed represented social security numbers.
The newspaper said it withheld publishing its story until DESE had been notified and had removed the affected pages from its website.
A news release to media outlets on Wednesday night from DESE described the Post-Dispatch’s actions as representing those of a hacker.
During his remarks Thursday morning, Gov. Parson doubled down on DESE’s characterization of the incident, and called the actions of the newspaper “pathetic.”
An attorney representing the newspaper said the newspaper reporter did the responsible thing by notifying the state agency of the vulnerabilities of their website.
“A hacker is someone who subverts computer security with malicious or criminal intent,” Post-Dispatch attorney Joseph Martineau said. “Here, there was no breach of any firewall or security and certainly no malicious intent.”
“For DESE to deflect its failures by referring to this as ‘hacking’ is unfounded,” Martineau continued.
The newspaper reported it wasn’t immediately clear how long the vulnerability existed on DESE’s website.
Parson sees the issue differently.
He said Thursday his administration has already reached out to the Cole County, Missouri, Prosecutor’s Office and investigators with the Missouri State Highway Patrol to investigate what he deemed as an attempt to “steal” state information.
“The state is committing to bring to justice anyone who hacked our system and anyone who aided or encouraged them to do so,” Parson said, who indicated the state would also pursue potential civil recourse.
The governor further described the newspaper’s report as an “attempt to embarrass the state and sell headlines for their news outlet.”
Missouri House of Representatives Minority Leader Crystal Quade (D - Springfield) called the governor's anger misplaced.
“In the finest tradition of public interest journalism, the Post-Dispatch discovered a problem – one publicly discernable to anyone who bothered to look; it verified the problem with experts; and it brought the problem to the attention of state officials for remedial action," Quade said in the statement. "The governor should direct his anger towards the failure of state government to keep its technology secure and up to date and to work to fix the problem, not threaten journalists with prosecution for uncovering those failures”
