Arkansas Governor Frames Programmer Who Discovered PUA Data Breach As Acting Illegally (arktimes.com) 158
theodp writes: Arkansas Governor Asa Hutchinson had an odd way of showing his appreciation for the unemployed computer programmer who pointed out a vulnerability in Arkansas's Pandemic Unemployment Assistance website, framing the programmer's actions as illegal.
The Arkansas Times' Lindsey Millar explains: "Beginning on Saturday at a news conference and continuing Monday, Hutchinson has framed the applicant who sounded the alarm as acting illegally. He announced Monday that the FBI was investigating the matter. He said he understood personal information had been 'exploited.' 'We don't believe that the data was manipulated,' Hutchinson said. 'In other words, where someone would go in and change a bank account number, which is what criminals would do. When you say 'exploited,' I believe that is a technical term of art that includes visual seeing of someone else's data. That is a concern to us and that is what constitutes a breach.' Asked about his rationale for framing the programmer's actions as illegal, the governor said, 'When you go in and manipulate a system in order to gain an access that you're not allowed to have permission to access, that is a violation of the security that we want to have in place in these systems, and it would be a violation of the law as well, I would think (video).'"
Hutchinson is a member of Governors for CS (and a founding co-chair), who "share best practices for computer science and advocate for federal policies to expand computer science instruction" in partnership with tech-backed Code.org. Andrew Morris, a cybersecurity expert with more than a decade of experience and the founder of GreyNoise Intelligence in Washington, D.C., said the governor's framing of the programmer as acting illegally was "the wrongest way" to handle the situation.
"They're shooting the messenger," he said. "There are so many reasons why that is bad. It creates a culture where they're punishing people for doing the right thing and trying to report the vulnerabilities and get them fixed. This person didn't have to say anything."
The Arkansas Times' Lindsey Millar explains: "Beginning on Saturday at a news conference and continuing Monday, Hutchinson has framed the applicant who sounded the alarm as acting illegally. He announced Monday that the FBI was investigating the matter. He said he understood personal information had been 'exploited.' 'We don't believe that the data was manipulated,' Hutchinson said. 'In other words, where someone would go in and change a bank account number, which is what criminals would do. When you say 'exploited,' I believe that is a technical term of art that includes visual seeing of someone else's data. That is a concern to us and that is what constitutes a breach.' Asked about his rationale for framing the programmer's actions as illegal, the governor said, 'When you go in and manipulate a system in order to gain an access that you're not allowed to have permission to access, that is a violation of the security that we want to have in place in these systems, and it would be a violation of the law as well, I would think (video).'"
Hutchinson is a member of Governors for CS (and a founding co-chair), who "share best practices for computer science and advocate for federal policies to expand computer science instruction" in partnership with tech-backed Code.org. Andrew Morris, a cybersecurity expert with more than a decade of experience and the founder of GreyNoise Intelligence in Washington, D.C., said the governor's framing of the programmer as acting illegally was "the wrongest way" to handle the situation.
"They're shooting the messenger," he said. "There are so many reasons why that is bad. It creates a culture where they're punishing people for doing the right thing and trying to report the vulnerabilities and get them fixed. This person didn't have to say anything."
Pick up artist data breach... (Score:1)
At first I thought this was related to a data breach at a pick up artists website or something...I'm so disappointed now that I realize that this is just taxpayer dollars at work?
While we're on the subject FL fired a scientist (Score:2, Insightful)
Which raises the question, Florida has a scientist?!
Seriously though, the 1% don't want to pay our unemployment benefits while we shelter in place, and this disease is only gonna kill about 2-3% of the population anyway. Maybe 10% if things really get out of hand. Acceptable loses. And they're safe on private islands.
My favorite example of this was a Fox News Segment of 8 or so talking heads all
Re: (Score:2, Informative)
It's actually the opposite - you really should stop just swallowing whatever your masters tell you. She was caught changing numbers in the system to fit her opinion instead of the data that was collected by the states medical professionals. It also turns out that she was already under criminal investigation following felony arrests for sex crimes and shouldn't have been in that position in the first place. The media jumped on a story told by a disgruntled former employee because it fit a pre-constructed
Re: (Score:2, Informative)
No, she was accurately correcting data her superiors wanted to disregard to show statistics improving. It doesn't take more than a 2 minute search to find this. The criminal investigation shows the incompetence of the administration as it was from over a year ago and would have shown-up in any background search.
Re: (Score:2)
That's her version, told to the reporter after falsely claiming to be a PhD and before falsely claiming to have built the site. All of those things were reported with zero fact-checking. Her degree is in Communications too, not anything science-related as was also implied in all the coverage.
According to the state epidemiologist she was asked to pause the dashboard while a data error was being corrected. She refused and entered her own interpretation of false data instead.
Re: (Score:2)
who refused to cook the numbers so their governor could re-open more even though it's clearly not safe.
Wait, what?
The non-scientist "Communications Officer" was fired for ignoring the epidemiologist and falsely entering her own data.
In brief, the scientist wasn't fired, the data-entry clerk was.
Do you even read the news? Or only the headlines?
Re: (Score:2)
The data portal she helped create was praised by many including VP Pence and Dr Brix.
She did not enter her own data.
She complied with the direction to remove data about when symptoms first appeared and when positive tests were taken and leave only the data of when the results were announced, but complained about it.
She was let go the next day.
Florida has been making changes to the data presented since she was fired.
Re: (Score:2)
She is a GIS scientist.
So, not the epidemiologist then? The map person? As far as anyone can tell, she was basically the data entry clerk, her field of study did not prepare her to use or understand epidemiology data. I've no doubt that if you needed to perform a survey of rock formations she'd be your girl, but that's not what they were doing.
The data portal she helped create was praised by many including VP Pence and Dr Brix.
That's meaningless. It was a reskin of COTS software. Everyone is using it, there's nothing that special about setting it up.
She did not enter her own data. She complied with the direction to remove data about when symptoms first appeared and when positive tests were taken and leave only the data of when the results were announced, but complained about it.
"Complied with the direction"? You make it sound like she was be
Re: (Score:2)
They're "scientists" working for the state of Florida, competence is not actually part of the hiring criteria there. I have my doubts about the reliability of anyone's story on this one.
Arkansas has now a big red & white target (Score:3)
This is beyond stupid - now anything Arkansas related will be a target for hackers, which will gleefully attack in retaliation - oh, and those guys won't be as nice and let them know what vulnerabilities they found.
Re: (Score:3)
No, I have a hunch that they'll let the world know what they found. Not necessary the vulnerabilities, more along the "data wants to be free" lines.
I'm fairly confident we'll see a lot of dirty Arkansas laundry being aired pretty soon.
Re: (Score:2)
...more along the "data wants to be free" lines.
I'm thinking it's going to be more along the, "data wants to be unencrypted for a fee" lines.
Hopefully someone will hack the governer (Score:3)
and rip his head off. Figuratively speaking.
Didn't see this coming (Score:4, Informative)
Didn't see this coming... not. Completely unsurprised by this. To say otherwise is to acknowledge they screwed up and take responsibility. Better to blame it on the security researcher and take no responsibility.
If I were that programmer (Score:5, Insightful)
Re: (Score:2)
Obviously responsible disclosure is not the way Arkansas government wants it handled. Maybe the programmer's mistake was to let them know, rather than sue them (maybe a class action) for potentially exposing his and other people's data.
Re:If I were that programmer (Score:5, Informative)
Here, have a piece of the summary from the original story:
Alarmed, the computer programmer called the Arkansas Division of Workforce Services Friday morning and was told by an operator that there was no one available who could talk to him. He then tried someone at the Arkansas State Police Criminal Investigation Division, who told the programmer he would find the person he needed to talk with to fix the situation. The programmer later called the Arkansas Times for advice on whom to call. The Times alerted the Division of Workforce Services to the issue at 4:30 p.m. Soon after a message appeared on the website that said, "The site is currently under maintenance...."
He ran out of ideas on who to call when no one took it seriously, so he called a newspaper to ask them who THEY would call because he wanted it fixed sooner rather than later.
Re:If I were that programmer (Score:4, Informative)
He tried that. Twice. They ignored him.
Re: (Score:2)
Re: (Score:2)
Get some more details. He tried to contact the government. Then he tried the police, only then he went to the papers after running out of ideas. The proper response from the governor should have been "thank you, and we are now setting up a hotline to report any future security vulnerabilities, listing its number of all government websites".
something something something ... on the Internet (Score:5, Insightful)
"You dropped your wallet."
"Thief!"
Re:something something something ... on the Intern (Score:4, Insightful)
Yup. Or "hey, you left your door unlocked" "Thief!" "Trespasser!" "Voyeur!"
Re: (Score:2)
finding a vulnerability and reporting it is very different to exploiting it and seeing how deep the hole goes.
Re: (Score:2)
It's more like, you're in a public building and you walk around a corner and notice an open door. So you walk in to see, then realize they have a bunch of private information laying around on the tables. You realize this is a bad situation, so you try to contact the manager of the building. You don't get a response, so you call the police. They say they'll get back to you, but don't. So you call a reporter, knowing they will know who to contact, which they do.
Re: (Score:2)
Yeah... that's not what most of these things are like AT ALL. Its like finding a wallet at the end of the driveway, checking the driver's license to find who to return it to. Most of the time, it is more work finding the right house. And when you do, the owner is pissed at you for looking into his wallet and trespassing on their property and touching their door bell.
Recent "exploits" have been equivalent to putting a file icon on the google homepage. And then getting pissed at the guy telling you it con
Re: (Score:2)
What if your technical understanding is slightly weak, and it more like an uncompleted shop in a mall, with the door left open, and somebody saw that it was open, and stepped inside and looked around to find the person in charge, and didn't find anybody so they reported unsafe conditions to the mall security.
And the mall owner got mad, because a problem was reported.
Re: (Score:2)
Gov is a dweeb, but (Score:2)
Just my 2 cents
"How DARE you embarass us publicly!" (Score:5, Insightful)
Re: (Score:2)
In all seriousness, the people involved from the development company to the approvers should be tried for gross negligence and barred from ever touching any IT system with personal information. This is one of those "can't fix stupid" items. I mean, effectively, not only did you leave the admin console open to everyone, but also left a bread crumb trail to get to it. You could have created a sharepoint list in 5 min to achieve the same.
Re: (Score:2)
Don't get involved. (Score:1)
Re:Don't get involved. (Score:5, Insightful)
Seriously? Holy crap, your dad sounds like an asshole, it's too bad you follow in his footsteps.
Re: (Score:3)
Show some respect -- that's "it's too bad you follow in his footsteps, Mr. President."
Re: (Score:3)
Seriously? Holy crap, your dad sounds like an asshole, it's too bad you follow in his footsteps.
Or maybe his dad has been pulled over for DWB enough times to know it doesn't pay for certain people to interact with the police any more than necessary.
Re: (Score:2, Insightful)
Re: (Score:2)
Wow (Score:3)
Someone called it (Score:5, Insightful)
Security by "we didn't want you to" (Score:5, Insightful)
When you go in and manipulate a system in order to gain an access that you're not allowed to have permission to access, that is a violation of the security that we want to have in place in these systems
So basically, the security they want to have in place is "you weren't supposed to <shakes finger>". No wonder arseholes like him thinks there can be backdoors for the good guys. Because the bad guys aren't allowed to hack into things for the good guys.
Re: (Score:2)
So basically, the security they want to have in place is "you weren't supposed to ". No wonder arseholes like him thinks there can be backdoors for the good guys. Because the bad guys aren't allowed to hack into things for the good guys.
They're politicians. That's how they think you stop bad people doing bad things. First you make a rule/law and then when bad people do bad things, even inadvertently, you send the police and call them criminals. Legislative solutions cost less and make more money from fines in the long run.
It's not hard to see why this particular shit stain just kept doing what he always does. Nobody's going to vote him out for pointing out that he was responsible for punishing an "evil criminal" and keeping everyone's data
Re: (Score:2)
He'll back flip as soon as the retaliation hits his Swiss cheese security and suddenly a lot of very unpleasant information about him becomes available on Pastebin. You think that this is going to sit well with certain people?
Re: (Score:2)
This is what you get when democracy overrides meritocracy, and it's funny ho
Simple Tactic (Score:3)
This sort of bullshit is used the world over to deflect focus from the fact that X screwed up and all the blame is pushed onto Y or Z instead.
If the programmer truly had nefarious intentions in mind, he wouldn't have said anything and simply offered what he found up for sale to the highest bidder.
If I've learned nothing else about this dumpster fire called life, I've learned this:
Doing the right thing rarely turns out well at all for those who try.
Re: (Score:1)
My advice is, if you find yourself in this position, just delete it all. Tell no one and leave no traces. It won't teach them the lesson they so desperately need to learn but at least it will actually protect the people you were trying to protect in the first place.
Re: (Score:2)
No, it won't. Because if isn't fixed, it will be found and used by someone with not-so-innocent motives; they won't need you pointing the way. What can be found once can and will be found again.
Re: (Score:2)
Because he reported it. Someone looking to profit from a security hole doesn't want to see reported and fixed.
"visual seeing" vs "did not inhale" vs "thank you" (Score:2)
The Governor needs to just say "thank you"
Or does he want the "Did not inhale" [time.com] excuse to spread to the non-politician class as well?
"While accessing data, I had my eyes tightly closed. I can touch type you see!"
The real issue is that it probably was illegal (Score:3)
The governor is just highlighting the real issue here. Many jurisdictions have laws that make unauthorised access to computer systems illegal and a total lack of security on those systems is no excuse. That's what needs to change; you don't want the governor's attitude to your actions to be the only thing protecting you from being convicted when all you did was expose lax or broken IT security.
Re: (Score:2)
The governor is just highlighting the real issue here. Many jurisdictions have laws that make unauthorised access to computer systems illegal ...
The governor is only highlighting his stupidity. He is too dumb or too lazy to interpret the law within the context. He is deliberately ignoring the circumstances. With such a simple mindset can one make killing in self-defence into murder, make witnesses into associates, etc..
Then let's not forget who the governor's boss is... In times where idiots rules will some people try to walk in the footsteps of those idiots.
I wasn't aware that Pick-Up Artists had an ... (Score:2)
... official database in the State of Arkansas. ...
Oh. Errm, nevermind.
Let's get it on! (Score:2)
Criminal negligence web site administration (Score:2)
At what point does installing an insecure.... (Score:3)
I mean, if you release a system to the public where, without doing any hacking at all, a person can mentally create a conjecture about how it might be vulnerable and THEN if that conjecture is followed, it would turn out to be exactly right, it honestly looks to me like trying to charge the person who reported this vulnerability with hacking would really be running afoul of entrapment laws.
I think a fair argument can be made that they had created a situation where all it was going to take was the right kind of observant person to notice something wrong and be curious enough to poke at it. The fact that they are pressing charges against a person who happened to be unlucky enough to be in that position really incriminates them quite heavily in this regard, if you ask me.
Screw the governor (Score:2)
This reminds me of the disgruntled lover, who accuses their ex-partner of rape only to get even after a breakup...
Some people are just plain wicked and in a governor's case one has to wonder who else he screwed over throughout his political career. It's probably everyone...
who built the website (Score:2)
Good Samaritan IT vulnerability (Score:2)
Dumb crimiinals? (Score:2)
'In other words, where someone would go in and change a bank account number, which is what criminals would do.
Why would a criminal CHANGE a bank account number in a record? Wouldn't they COPY the bank account number and use it for criminal purposes?
Re: (Score:1)
Particularly if the data breach was intentional and they have to figure out another was to "accidentally" give the data to their buddies
Re: (Score:1)
BINGO. This, right here. Their plan was stupid, but the stupidest part of the plan was just that it hinged on them pretending to be even stupider.
Re:Shooting the Messenger (Score:4, Insightful)
Or how about if there's a connection between the Governor and the company who made the code in the first place.
Must look pretty bad for the company who made the product in the first place. Especially if people find out they were big donors to the Governor's re-election campaign.
Re: (Score:2)
Or how about if there's a connection between the Governor and the company who made the code in the first place.
Is that true? If so can you link some info?
Re:Shooting the Messenger (Score:5, Insightful)
Re: (Score:2)
And, regardless of party, administrations that do this perpetually forget about the landslide of bad press that comes along with such a faulty decision.
Re: Shooting the Messenger (Score:1)
Re:Shooting the Messenger (Score:5, Informative)
Re: (Score:2)
Anecdotally, it seems OLDER politicians say more stupid things about tech.
There, fixed it for you. People who don't understand things tend to say stupid things when asked about it.
Re: (Score:2)
The media doesn't lambast Democrats when they mutter completely idiotic shit, but they'll go on for days if a Republican does the same. For instance, have you heard Rahm Immanuel recently saying that we could send people to school for 6 months to make the coders? That was an idiotic trope the first time it went around, and he's out there still repeating it.
And remember, Democrats chose Hillary Clinton as their leader, and have now chosen Joe Biden, so if you want to talk the inability to think things thro
Re:Shooting the Messenger (Score:5, Insightful)
He was responding to someone who said "it's the Republican way". Pointing out that Democrats respond equally badly to it isn't suggesting it's a good thing whatsoever. How do you even misinterpret something that badly? He even spelled it out - "being a Republican has very little to do with this". It indicates that *politicians* can respond to it equally badly (to quote - "pretty badly"), regardless of political alignment. I'm not a fan of Republican politics either, but I can read. Work on that before spouting asinine drivel.
Re:Shooting the Messenger (Score:5, Insightful)
Hell, it's not even politicians that have responded badly to this sort of thing. It's less common these days, since this has been beaten out of most corporate thinking these days, but there have been plenty of instances of companies that have attacked individuals for pointing out security vulnerabilities.
As far as we know, this programmer did everything correctly, trying to contact the people responsible so they could fix this issue. For a programmer, this is like seeing a bank vault left unlocked, notifying the bank, then getting a visit from the police on suspicion of plotting to rob a bank. It's beyond asinine, and I really hope this goes away quickly for this poor programmer.
So, yeah, stupid, but I attribute this more to someone who doesn't understand computer security (understandable, as very few people do) and has been given terrible advise (not so understandable - he's the damned governor). I don't view this as some sort of partisan thing. I mean, it's not like Democrats haven't had their share of tech-related fuckups too, but I don't think that's because they were from the Democratic Party.
Re: (Score:2, Insightful)
So it seems. Typical GOP garbage
If you see something, say something (Score:2)
Re: (Score:2)
Re: Fuck You and the, "Researchers" (Score:3)
Their should be a stop for this sort of thing, for example if said kid tells you, you left a window open. That doesnt make him an enemy...
Re: (Score:2)
What if the kid tells you that you left a window open, he went inside, rummaged through all your belongings and then shows you pictures he took of your most private stuff just to reinforce how bad it is that you left your window open? Is that your friend?
Re: (Score:3)
I see what you're getting at....
This might be an edge case =)
Re: Fuck You and the, "Researchers" (Score:5, Insightful)
Re: (Score:2)
If you don't have legal authorisation to do it then it is FUCKING ILLEGAL, end of story.
Accessibility IS authorization, end of story. There is no way for anyone to read your mind. The presumption is that I'm allowed to read what is published. It's published, therefore I'm allowed to read it. If you didn't intend to publish it, you shouldn't have published it. If I can browse things you don't want me to browse but are making available to me to browse, it's your fucking fault. No fault adheres to me, to bots, or to anyone but YOU for YOUR FUCKUP. You may have intended to published credit
Re: Fuck You and the, "Researchers" (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
So it's more like charging him with voyeurism for looking at his wife sunbathing naked in the front yard, rather than breaking and entering.
Re: (Score:2)
What if the kid tells you that you left a window open, he went inside, rummaged through all your belongings and then shows you pictures he took of your most private stuff just to reinforce how bad it is that you left your window open? Is that your friend?
You make a very, VERY valid point. It brings something else to mind, though, in the normal process of political.. er.. Human behavior.
Person: "I have found that there are vulnerabilities that allow an attacker to change data and possible extract information from your site."
Politician: "Bullshit, it's secure. Just another attention-seeker."
Person: "Um, I'm not seeking attention. You can leave me anonymous for all I care. It's real. Here's how you do it [tell steps here]."
Politician: "More bullcrap. Squ
Re: (Score:2)
Person: "I have found that there are vulnerabilities that allow an attacker to change data and possible extract information from your site." ...
Politician: "Bullshit, it's secure. Just another attention-seeker."
Fascinating. Also unrelated to any of the facts of this case. He tried to alert authorities but was met with what you'd expect... beauracracy. He then alerted a media outlet, who AFAICT didn't take it public, but did have line to bypass the beauracracy... and the site was shut down.
https://arktimes.com/arkansas-... [arktimes.com]
Re: (Score:2)
Thank you for the good information!
Re: (Score:2)
That's not what happend in this case, AFAICT.
Alarmed, the computer programmer called the Arkansas Division of Workforce Services Friday morning and was told by an operator that there was no one available who could talk to him. He then tried someone at the Arkansas State Police Criminal Investigation Division, who told the programmer he would find the person he needed to talk with to fix the situation. The programmer later called the Arkansas Times for advice on whom to call. The Times alerted the Division of Workforce Services to the issue at 4:30 p.m. Soon after a message appeared on the website that said, “The site is currently under maintenance.”
So he never went public with it.
Re:Fuck You and the, "Researchers" (Score:5, Interesting)
Now, to put this into terms you can understand, if someone knocks on your door and the door swings open because you didn't put the latch on and they call out "HEY! Umm.....Hello? I think there's something wrong with your door...", and you call the cops on them, you're a fuckwit.
Re: (Score:3)
Except of course in this case the kid didn't just call out, he walked in and started looking around to see what he could get access to inside the house.
Modifying a URL is not the equivalent to walking into a house. A better analogy for what happened would be the state putting out a notebook and pen on a stand out on the street for people to jot down their application into when the office is closed; and someone noticing that you can in fact turn the pages and see other people's information.
Re: (Score:2)
Re: (Score:2)
Seriously? I had left a port open on my router by mistake (forgot to go back and close it when I was done). Hacker on 4Chan opens my notepad while I'm playing solitaire and tells me I left the equivalent of my front door open on my router. Oops. Thanked the guy for letting me know rather than pw0ning my ass. Fixed the setting and double checked that he didn't leave me a 'present' on my system (he didn't). I'd much prefer being informed the way I was instead of the many ways my ass could have been pw0n
Re: (Score:2)
Apparently, you only read the first two sentences of my post. I said I checked if he left anything.
Re: (Score:2)
Why should you have to "checked if he left anything".
Do I need to check if some kid who found my door unlocked left a camera or listening device in the home?
"Oh, shit!, I left the door unlock so now I have to sweep the house for surveillance devices!"
Re: (Score:2)
You don't have to, and probably shouldn't, trust that the person reporting the vulnerability did anything or nothing at all. You can check.
Re: (Score:2)
Why should you have to "checked if he left anything".
Do I need to check if some kid who found my door unlocked left a camera or listening device in the home?
"Oh, shit!, I left the door unlock so now I have to sweep the house for surveillance devices!"
What should he do? Thank the guy for telling him, then burn his house down to make sure everything is secure, then start a new life with the loads of money he has in his pocket just for this purpose? WTFH?
Re:Fuck You and the, "Researchers" (Score:4, Insightful)
What you ignore here is the message this sends. If I get punished either way, why do the right thing? If I'm in for trespassing whether I warn you or whether I steal everything, why not steal everything?
It's the same logic as to why you don't send people to the chair for rape. If I get the chair for raping someone, it's only logical to also kill them to reduce the chance of being caught. You can't up the punishment anyway, so the sensible thing to do is to reduce the attack surface. In this case, if the punishment is the same whether I warn you or whether I steal everything, why should I not increase my gain since the risk already is the same?
Re: (Score:2)
if the punishment is the same whether I warn you or whether I steal everything, why should I not increase my gain since the risk already is the same?
Because you had parents that weren't degenerate losers and managed to instil some sense of right and wrong in you?
Re: (Score:2)
You'll never be the CEO of a Fortune 500 corporation, I see.
Re: (Score:2)
Yes, but in this case, he tries to apply the same kind of punishment as if he cleaned out the house and vanished into the night. That's exactly the problem.
Re:Fuck You and the, "Researchers" (Score:4, Insightful)
Re: (Score:2)
We could crank out a complete battleship in a month while the Germans were having supply disruptions.