JEFFERSON CITY, Mo. — There will be no charges against a St. Louis Post-Dispatch reporter accused of "hacking" by Missouri Gov. Mike Parson.
The investigation related to a report by the newspaper that found personal information of teachers across Missouri was stored on the website of the state’s Department of Elementary and Secondary Education (DESE), leaving it vulnerable.
The Post-Dispatch alerted state officials about the issue, which they said was “in a web application that allowed the public to search teacher certifications and credentials.” State officials took down the pages involved after it was brought to their attention. State officials were alerted before the paper published the story.
Cole County prosecuting attorney Locke Thompson released a statement on Friday about the decision to not prosecute reporter Josh Renaud.
"Protecting the personal information of state employees, many of whom are my constituents, is a top priority for both myself and the governor, and I want to thank him for forwarding the concerns of a data breach of the DESE website on to the Missouri State Highway for review. Any report of a potential data breach should be fully investigated, and I would like to thank the Highway Patrol for conducting a thorough and complete investigation into these claims.
"There is an argument to be made that there was a violation of law. However, upon a review of the case file, the issues at the heart of the investigation have been resolved through non-legal means. As such, it is not in the best interest of Cole County citizens to utilize the significant resources and taxpayer dollars that would be necessary to pursue misdemeanor criminal charges in this case. The investigation is now closed, and the Cole County Prosecutor’s Office will have no further comment on the matter.
"I wish to make clear that this office maintains a zero-tolerance policy for the unauthorized taking and using of the personal information of any person, and violators will be prosecuted to the fullest extent of the law. Any person who believes his or her personal information has been compromised is encouraged to contact their local law enforcement agency.”
Renaud released his own statement on Friday night about the decision:
"Today, the Cole County prosecutor declined to file charges against me over my discovery of a flaw in a public website run by the Missouri Department of Education and Secondary Education that exposed thousands of teachers’ sensitive information.
"This decision is a relief. But it does not repair the harm done to me and my family.
"My actions were entirely legal and consistent with established journalistic principles.
"Yet Gov. Mike Parson falsely accused me of being a 'hacker' in a televised press conference, in press releases sent to every teacher across the state, and in attack ads aired by his political action committee. He ordered the Highway Patrol to begin a criminal investigation, forcing me to keep silent for four anxious months.
"This was a political persecution of a journalist, plain and simple.
"Despite this, I am proud that my reporting exposed a critical issue, and that it caused the state to take steps to better safeguard teachers’ private data.
"At the same time, I am concerned that the governor’s actions have left the state more vulnerable to future bad actors. His high-profile threats of legal retribution against me and the Post-Dispatch likely will have a chilling effect, deterring people from reporting security or privacy flaws in Missouri, and decreasing the chance those flaws get fixed.
"This has been one of the most difficult seasons of my nearly 20-year career in journalism. But I have found strength in the prayers and support of my family and friends and so many others across the country.
"I’m thankful for the Post-Dispatch, which never wavered in its commitment to me.
"And I’m thankful for my colleagues, who stood up for me and kept digging into this story. They found the state’s cybersecurity issues went farther than we knew.
"My deepest desire is that somehow this situation might be redeemed. And I believe it can be.
"Last week, I read with sadness about the state Senate’s treatment of Gov. Parson’s nominee to lead the health department. The governor decried it as 'disgraceful, unquestionably wrong, and an embarrassment to this state and the people we serve.'
"The governor lamented that 'more care was given to political gain than the harm caused to a man and his family.'
"Every word Gov. Parson wrote applies equally to the way he treated me.
"I agree with the governor’s prayer that “honor, integrity, and order” be returned to state government.
"Since my ordeal began, I have tried to follow Jesus’ command in Matthew 5:44 to 'bless those who curse you” and to “pray for those who spitefully use you and persecute you.' It hasn’t been easy.
"But the investigation has run its course. So now I pray Gov. Parson’s eyes will be opened, that he will see the harm he did to me and my family, that he will apologize, and that he will show Missourians a better way."
Attorney Elad Gross, who's representing Shaji Khan, a cybersecurity professor cited in the Post-Dispatch report, said Locke "was correct not to press charges" against Renaud and hopes he also decides not to press charges against Khan.
A spokeswoman for Parson said the "hacking of Missouri teachers' personally identifiable information is a clear violation of Section 569.095, RSMo, which the state takes seriously."
"The state did its part by investigating and presenting its findings to the Cole County prosecutor, who has elected not to press charges," said spokeswoman Kelli Jones, adding, "the state will continue to work to ensure safeguards are in place to protect state data and prevent unauthorized hacks."
Related Stories