A newspaper reporter targeted by Gov. Mike Parson for uncovering a security flaw in a state-run website won’t face criminal charges.
The decision comes after the governor spent months publicly labeling the St. Louis Post-Dispatch reporter a “hacker” for discovering the flaw and notifying the state about it. Parson asked the state highway patrol to investigate and repeatedly said the reporter had committed a crime.
In a statement released on Twitter Friday evening, Post-Dispatch reporter Josh Renaud confirmed the Cole County prosecutor had declined to file charges.
“This decision is a relief. But it does not repair the harm done to me and my family,” Renaud said in his statement.
Cole County Prosecutor Locke Thompson did not respond to a request for comment Friday evening, though he released a statement to local media in Jefferson City confirming charges would not be filed.
In early October, Renaud discovered that Social Security numbers for teachers, administrators and counselors were visible in the HTML code of a publicly accessible site operated by the state education department. HTML code is the programming that tells the computer how to display a web page.
Emails obtained by The Independent show Renaud informed the state of the issue and promised to withhold publishing any story about it until the problem was fixed and the Social Security numbers were no longer exposed. He also laid out to state officials in an email the steps he’d taken to find and confirm the security flaw. That included contacting three teachers to verify that the information in the HTML code was their Social Security numbers.
Yet despite the fact that officials within the Missouri Department of Elementary and Secondary Education initially wanted to thank Renaud for uncovering the flaw, and that an FBI agent told the department the incident “is not an actual network intrusion,” Parson labeled the reporter a hacker and called for criminal prosecution.
Renaud said his actions were “entirely legal and consistent with established journalistic principles.”
“This was a political persecution of a journalist,” Renaud said, “plain and simple.”
Elad Gross, an attorney representing Shaji Khan, a cybersecurity professor who helped confirm the security flaw for the Post-Dispatch, released a statement saying the “malicious prosecution pushed by the governor terrorized and silenced Mr. Renaud, Dr. Khan and their families for months.”
“No government in America should have the power to silence the press or its citizens through sham prosecutions and investigations,” Gross said.
Renaud said he worried the governor’s threats against him would deter people from reporting security or privacy flaws in Missouri government websites in the future, decreasing the chance those flaws would get fixed.
Now that the investigation has run its course, “I pray Gov. Parson’s eyes will be opened, that he will see the harm he did to me and my family,” Renaud said, “that he will apologize and that he will show Missourians a better way.”
“We are pleased the prosecutor recognized there was no legitimate basis for any charges against the St. Louis Post-Dispatch or our reporter,” Post-Dispatch Publisher Ian Caso said in a statement. “While an investigation of how the state allowed this information to be accessible was appropriate, the accusations against our reporter were unfounded and made to deflect embarrassment for the state’s failures and for political purposes.”
Parson’s spokeswoman, Kelli Jones, released a statement Friday night that continued to call the reporter a hacker.
Thompson, a Republican elected in 2018, said that while there was an argument to be made that there was a violation of law, “the issues at the heart of the investigation have been resolved through non-legal means.”
He didn’t respond to a request to clarify what he meant by “non-legal means.”
This article by Jason Hancock is published through a Creative Commons license from The Missouri Independent. The Associated Press contributed additional information.