Missouri Governor Goes After Reporter Who Found Teachers' Social Security Info Was at Risk

Missouri Governor Mike Parson went after a reporter who discovered that Social Security information of teachers and school administrators was at risk of being publicly exposed on a state agency website.

The St. Louis-Dispatch on Wednesday reported that it found the "vulnerability in a web application that allowed the public to search teacher certifications and credentials."

The newspaper notified the state's Department of Elementary and Secondary Education of the issue before publishing the story, and the affected pages were removed from the website.

"Based on state pay records and other data, more than 100,000 Social Security numbers were vulnerable," the St. Louis-Dispatch reported.

The private information wasn't clearly shown or searchable on the site, according to the newspaper, but Social Security numbers were in the HTML source code of the web pages. The St. Louis-Dispatch said it confirmed the vulnerability with three educators as well as a cybersecurity expert.

Parson, a Republican, responded to the story in a news conference Thursday, in which he referred to the reporter as a "hacker" and the actions of the newspaper "pathetic."

The governor announced he referred the matter to the Cole County Prosecutor and has asked the Missouri State Highway Patrol to investigate. The probe could cost taxpayers as much as $50 million, according to Parson.

"This administration is standing up against any and all perpetrators who attempt to steal personal information and harm Missourians," the governor said. "It is unlawful to access encoded data and systems in order to examine other people's personal information."

Parson said nothing on the state website giving the reporter permission to access teacher data.

"This individual is not a victim," Parson said. "They were acting against the state agency to compromise teachers in an attempt to embarrass the state and sell headlines for their news outlet."

Gov. Parson Goes After Dispatch Reporter
Missouri Governor Mike Parson went after a reporter who discovered a vulnerability of Social Security data on a state agency website. In this photo, Parson listens to a media question during a press conference on May 29, 2019 in Jefferson City. Jacob Moscovitch/Getty Images

The governor also vowed to go after those who "aided and abetted" the reporter and the media corporation they work for.

Joe Martineau, an attorney for the newspaper, said in a statement that the reporter "did the responsible thing by reporting his findings to the Department of Elementary and Secondary Education (DESE) so that the state could act to prevent disclosure and misuse."

"A hacker is someone who subverts computer security with malicious or criminal intent. Here, there was no breach of any firewall or security and certainly no malicious intent. For DESE to deflect its failures by referring to this as 'hacking' is unfounded. Thankfully, these failures were discovered," Martineau said.

State Representative Crystal Quade, the Democratic Minority Leader, said Thursday Parson should be thanking the newspaper, not condemning it.

"The governor should direct his anger towards the failure of state governments to keep its technology secure and up to date and work to fix the problem, not threaten journalists with prosecution for uncovering those failures," Quade said in a statement.

Parson said Thursday that the state is working to "strengthen our security" so that the incident doesn't happen again.

Update 10/14/2021, 1:15 p.m. ET: This story has been updated to include comment from Joe Martineau, the attorney for the St. Louis-Dispatch.