Thread by @mattblaze

Don’t encode SSNs of people in the HTML of publicly available webpages. And if you do, don’t call the cops if someone notices and (quite responsibly) warns you.

https://twitter.com/govparsonmo/status/1448697768311132160

Also, don’t tweet stuff that makes you look like an idiot.

I tweeted this through a multi-step process, by the way.

The whole thread is just full of terrifying wrongness that should send anyone who understands computers running for the state line.

https://twitter.com/govparsonmo/status/1448697775068229635

I should probably congratulate the governor for not working in references to HIPAA, RICO, or CDA 230.

Governor continues to double down, apparently on the theory that the combination of “complex behavior”and “noticing something you didn’t intend for people to notice” plus “being a newspaper the governor dislikes” constitutes “unauthorized access” under Missouri law.

https://twitter.com/govparsonmo/status/1448750833458372616

I’d be surprised if this particular case actually results in criminal charges, but that’s not the only harm. The state’s highest official is using the authority of his office to discourage good faith reporting of serious security vulnerabilities, a terrible message to be sending.

October is “cybersecurity awareness month”, except in Missouri, where it’s evidently “shoot the messenger month”.