Minnesota Public Radio Reporter Faces Hacking Charges For Reporting On Data Leak

from the federal-shield-law? dept

We were just noting how the Computer Fraud and Abuse Act is regularly abused to bring “hacking” charges where none are really warranted. And here we have yet another example. Alex Howard points out that a Minnesota Public Radio reporter, Sasha Aslanian, is potentially facing “hacking” charges from a Texas company called Lookout Services. Lookout creates employment/compliance software for large organizations, and Aslanian was reporting on a supposed data vulnerability in the software used to verify employment eligibility that could potentially reveal private info. Aslanian’s report noted that she was able to see info from the state of Minnesota, and the state was now directing agencies to stop using Lookout. The details are not entirely clear, but from what’s written at the MinnPost link above, it sounds like there were some vulnerabilities, poor security, and a bungled demonstration which revealed a vulnerability — all of which Lookout admits — and from those vulnerabilities (which Lookout claims it closed), someone was able to adjust the URL to find private data.

So, basically, the company admits to a series of vulnerabilities, which exposed info that allowed the reporter to eventually see some private data… but still claims that the reporter was “hacking” and is now looking to sue under the same Computer Fraud and Abuse Act, which could lead to 5 years in prison. Because our federal government still hasn’t passed a journalism shield law, the reporter is potentially liable, though, as the MinnPost reporter notes, Lookout seems particularly shortsighted in bringing this lawsuit in the first place. All it does is call more attention to its own vulnerabilities and failings. And the CEO of Lookout basically responds that she doesn’t care:

While the legality and severity of Lookout’s security breach remains to be adjudicated, there’s no doubt Aslanian was trying to serve the public interest — something a prosecutor might consider. As Dalglish says, “The state of Minnesota should be grateful MPR exposed what’s going on. It seemed like a pretty good story.”

I asked Morley if she realized, by filing a high-profile suit, how hapless her timeline made Lookout look. After all, there’s the webinar screwup, letting clients pick lame IDs/passwords and caching security credentials in such a way that rendered them useless.

“Yup,” she admitted. “It was a perfect storm that came together. Our communication with the state really broke down — in our contract, we had 60 days to fix any problem. But there was still an unauthorized intrusion, and that was wrong.”

So, even though this will publicize not just Lookout’s failings, but also how it responds to people who notice and report on vulnerabilities, the company still thinks it needs to bring a lawsuit because exposing those vulnerabilities “was wrong”? I would argue that the company’s reaction to this gives many more reasons never to do business with Lookout — more than any discovered vulnerabilities. Vulnerabilities in software happen — and it’s more telling how a company reacts when they’re exposed. Suing those who expose them isn’t what you want to see. Update: Lots of good points in the comments, pointing out (of course) that Lookout cannot bring criminal charges against the woman, only prosecutors could do that, and it seems unlikely they would do so in this case.

Filed Under: , , , , ,
Companies: lookout

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Minnesota Public Radio Reporter Faces Hacking Charges For Reporting On Data Leak”

Subscribe: RSS Leave a comment
Jake (user link) says:

Lookout are claiming that Aslanian guessed someone else’s user ID and password to get some of this data. That’s going a bit too far; a lack of a minimum username/password length or other restrictions is undoubtedly a major security weak-point, but it wasn’t necessary to perform an actual dictionary attack and gain access to some poor sap’s personal data to prove the point.

btr1701 (profile) says:

> but still claims that the reporter was “hacking” and is now looking
> to sue under the same Computer Fraud and Abuse Act, which could
> lead to 5 years in prison. Lookout seems particularly shortsighted in
> bringing this lawsuit in the first place.

There’s a lot about this that doesn’t make sense. A private company can’t sue someone into prison. They can sue for monetary damages, but only the state can press criminal charges and lock people up.

> Because our federal government still hasn’t passed a journalism
> shield law, the reporter is potentially liable

This also doesn’t make sense. Even if the feds passed the journalism shield law, it wouldn’t protect a journalist from charges of computer intrusion. It would merely allow a journalist to “shield” his/her source from discovery and prevent judges from holding them in contempt for refusing to reveal them.

Anonymous Coward says:

New Laws

Biden has passed a law yesterday in the secret session with the stakeholders that allows corporations with a net worth of greater than 1 billion dollars (And that contribute more than $1M annually to his campaign fund) to investigate, arrest, try and convict private parties or small businesses for any offense they deem suitable. This bill allows a hybrid criminal/civil conviction. It was done to protect the corn farmers.

Just knowing this is a offense of the new law. Sorry

Cynyr (profile) says:

My 0.02USD take it or leave it


if they had a legitimate login to the system, no hacking. legit in this case being a source telling them their ID/password(assumming the source claimed that it was their auth), or the journalists own account on the system.

If the initial login was not legit(blank passwords and exposed UIDs not being counted here, especially if they were handed out at a demo. You have no excuse for letting demo accounts having full access) then yes it was a crime, but not because they viewed other data than the account contained, but because they gained access to the system in the first place.

IMO putting things on the internet without security/password is like putting a big “FREE STUFF, HAUL AT YOUR OWN EXPENSE” sign on it. no complaining that it then was viewed/copied/played with/etc.

During the internal tests of the software no one thought of trying to change the or even using greasemonkey to modify fields in the form. REPEAT AFTER ME “ALL USER SUBMITTED DATA SHOULD BE TREATED AS HOSTILE, UNTIL PROVEN OTHERWISE AND SANITIZED”, that includes data that you sent them, no guarantee that it didn’t have bits flipped while moving across the internet, or that someone in the middle isn’t trying to play games. What amazes me more is that this was contracted out to a third party to be hosted on their hardware in their building with god only knows what physical security. WHat happens when you call a random extension at this place and then act confused and say you have this number as tech support for using the system, and that you are just trying to verify some data but it isn’t showing up, and ask if they could try there? Also electronic access to computer systems is not the same as physical access to a card catalog, or warehouse of boxes with this info in it, the rules need to be different.

Michael (profile) says:

Re: Hacking

Perhaps, but in this particular instance, there is no intent to do any harm. In fact, the company really had a favor done – someone exposed a security flaw AND TOLD THEM ABOUT IT. This, at least, gave them a chance to fix it.

It seems unlikely that there will be a prosecution without this intent, but the law should be clearer about what is hacking and when it should be a crime.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...