I wouldn't be surprised if the governor acted more because he sensed an opportunity than out of fear of the story. By playing the story this way, he gets to act out the feelings of a constituency that feels judged by educated urbanites and unable to keep up with a changing world. He is standing up for the honor of Missouri against the sneering condescension of the fancy city reporter. From that point of view, he isn't dealing with a threat so much as feasting on a political opportunity.

It's kind of weird. After all, it's not like the governor is directly responsible for the flaw. Even if his opposition could have indirectly linked his administration to the flaw, his response has certainly done far more damage to his reputation than that ever could.

Most likely voters don't understand how computers work. I'm not sure it'll matter much.

I’m fairly sure he doesn’t understand. Language used makes it sounds he has no clue how html works.

Back in 90s, I was constantly being accused of hacking things just for knowing how to build a website. This was also the era of when the news would run phone polls on whether the Internet should be allowed or not.

I learn to keep my mouth shut about what I could do unless I was sure it was a tech savvy crowd.

This dude brings back a lot of those memories

> This was also the era of when the news would run phone polls on whether the Internet should be allowed or not.

Given the way things are going, perhaps we should revisit this decision. It seems that there's a population that isn't quite ready for this level of access to [mis]information.

> This was also the era of when the news would run phone polls on whether the Internet should be allowed or not.

Clearly, people answered those polls incorrectly.

It should definitely not be allowed.

I agree. Only elites should be allowed to use stuff like LSD, computers and the internet. This can be arranged simply by criminalising it; along with a social convention that elites don't get prosecuted. /s

No, no, no. More LSD. Less Internet.

For more complex cases this could be an issue, but this one is dead simple: you could do "view source" and see teachers' social security numbers. If they go to trial this case will be laughed out of court.

I still think the governor can be seen as indirectly responsible, since this is a result of insufficient security auditing.

The underlying issue here is that there is no national legal standard for responsible disclosure. ...and with all the news of foreign ransomeware gang causing havoc, prosecutors and politicians are HUNGRY to prosecute "hackers".

My advice to a client would be not to disclose any vulnerability on a government system, due to the unfortunate legal liability. ...and if they did feel the need to disclose (which I admire), to do so anonymously to a 3rd party security researcher with the history and reputation for that sort of work (ie a reputation that even an old IT-clueless judge cannot deny).

Don't put yourself in the cross-hairs of some overzealous prosecutor who wants to show his boss/party/public that he's the one prosecutor that busted a bunch of evil hackers.

Right, or allegedly trying to extort the government of Ukraine to end an investigation against the official's relatives. Corruption on all sides unfortunately.

which would also be bad! however, my example actually happened.

Yes, as did mine (allegedly.) See <https://www.washingtonpost.com/politics/2020/10/14/hunter-bi...>

It seems that in both cases the accused was acquitted or the investigation against them was closed. That's hardly a reasonable indicator of innocence though, as just like you said above, powerful people can often make up excuses to get away with crimes and corruption scot-free. You might be entirely right that one example really happened and the other didn't.