In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.”
In reality, the Post-Dispatch discovered the vulnerability and confirmed that the nine-digit numbers were indeed Social Security numbers. The paper then told the department that it had confirmed the vulnerability with three educators and a cybersecurity expert.
But in the press release, DESE called the person who discovered the vulnerability a “hacker” and said that individual “took the records of at least three educators” — instead of acknowledging that more than 100,000 numbers had been at risk, and that they had been available to anyone through DESE’s own search engine.
It’s ridiculous, and yet Parson keeps doubling down.
This data was not freely available, and by the actors own admission, the data had to be taken through eight separate steps in order to generate a SSN. (2/3)
— Governor Mike Parson (@GovParsonMO) October 14, 2021
Why, yes, that is the same governor who just pardoned gun nuts Mark and Patricia McCloskey for waving guns at racial justice protestors walking down the street. Because that’s not a “real” crime.
But noticing that the state is cavalierly exposing its own employees to identity theft? LOCK HER UP.
Missouri teachers’ Social Security numbers at risk on state agency’s website [St. Louis Post-Dispatch]
Elizabeth Dye lives in Baltimore where she writes about law and politics.