A newly released police report thoroughly debunks Missouri Gov. Mike Parson’s baffling claim that a journalist who helped the state identify and fix a website security flaw was a “hacker” and criminal.
Parson demanded the investigation in October and called for criminal charges against St. Louis Post-Dispatch reporter Josh Renaud. “It is unlawful to access encoded data and systems in order to examine other people’s personal information, and we are coordinating state resources to respond and utilize all legal methods available,” Parson said at the time. The Republican governor claimed that Renaud was “acting against a state agency to compromise teachers’ personal information in an attempt to embarrass the state and sell headlines for their news outlet” and said his administration “will not let this crime against Missouri teachers go unpunished.”
But the resulting police report confirms in detail that Renaud did exactly what he said from the beginning: He identified a security flaw by viewing publicly available HTML code on a misconfigured state website and delayed publishing an article on his findings until after the state closed the security hole.