Apple has halted all sales of its products in Russia as a response to the country’s invasion of Ukraine, the company announced this afternoon. Online sales were halted immediately, while the company says it stopped shipping products into Russian retail channels at some point last week.

Apple has also made changes to some of its services in response to the invasion; Russian state-controlled media companies RT and Sputnik have both had their apps removed from Apple’s App Stores in all territories outside Russia, and the company has stopped providing traffic and live incidents data for Ukraine within Apple Maps “as a safety and precautionary measure for Ukrainian citizens.” The Apple Pay service has also been “limited”—the company didn’t elaborate, but transactions are no longer supported through a number of Russian banks that have been hit by sanctions.

In an internal email (via MacRumors), Apple CEO Tim Cook said that the company was “donating to humanitarian relief efforts and providing aid for the unfolding refugee crisis.” Apple would also match employee donations to “eligible organizations” 2-to-1.

Apple joins many other tech companies—including but not limited to Microsoft, Google, and Meta—in delisting and deprioritizing Russian state-controlled media outlets on its platforms. Microsoft has removed RT and Sputnik’s apps from the Windows Store and limited their presence on its Bing search engine, while YouTube has blocked RT and Sputnik content in Europe and demonetized their content elsewhere. Meta has been taking down bot networks on Facebook and Instagram as well as providing tools to safeguard the accounts and personal data of Ukrainian and Russian citizens. The US and other countries have also blocked exports of chips, telecom equipment, and other hardware into Russia as a result of the Ukraine invasion.

“We will continue to evaluate the situation and are in communication with relevant governments on the actions we are taking,” Apple said in a statement.

https://arstechnica.com/?p=1837526

Microsoft has been pushing harder to increase the baseline security features of Windows PCs for a couple of years now—the “secured-core PC” initiative launched back in 2019 was meant to guard against firmware-level attacks, and Windows 11’s system requirements mandate support for many supported-but-optional security features from Windows 10. Microsoft justified these new requirements in part by pointing to the NotPetya data-wiping malware, which has widely been attributed to Russian hackers.

Regarding similar cyberattacks, a recent post from Microsoft President & Vice Chair Brad Smith details more about how the company is responding to the Russian invasion of Ukraine. According to the post, Microsoft was able to identify new wiper malware (dubbed “FoxBlade”) and provided both mitigation strategies and updated Microsoft Defender definitions to the Ukrainian government “within three hours” of discovering it.

Reporting from The New York Times provides additional details of how Microsoft worked with US government agencies to distribute the FoxBlade fixes with other European countries to limit or prevent its potential spread. “I’ve never seen it work quite this way, or nearly this fast,” Microsoft security VP Tom Burt told the Times of FoxBlade’s mitigation efforts. “We are doing in hours now what, even a few years ago, would have taken weeks or months.”

Beyond malware detection and mitigation, Microsoft is also combatting “state-sponsored disinformation” by removing content from Russian state media (including RT and Sputnik) from MSN.com and other Microsoft Start-powered services like Windows 11’s Widgets menu. RT’s apps have been removed from the Windows Store, and RT (formerly Russia Today) and Sputnik content is also being deprioritized in Bing search results. RT and Sputnik now only appear when users make a specific effort to search for them.

Microsoft says it will continue working with US and European government officials and updating its malware definitions to address new threats as it detects them.

“All this builds on our work in recent weeks and months to address escalating cyber activity against Ukrainian targets, including new forms of destructive malware that we previously have discussed publicly,” writes Smith. “We will continue to share more detailed information publicly when we identify new malware that needs to be shared with the global security community.”

Companies aren’t the only nonstate actors involved in the Ukrainian invasion. Independent hackers have also taken down a series of Russian and Belarusian websites following calls for a formation of an “IT Army” by Ukraine’s vice prime minister.

https://arstechnica.com/?p=1837306

Google said today that YouTube is blocking RT (formerly Russia Today) and Sputnik throughout Europe. “Due to the ongoing war in Ukraine, we’re blocking YouTube channels connected to RT and Sputnik across Europe, effective immediately,” Google Europe announced on Twitter. “It’ll take time for our systems to fully ramp up. Our teams continue to monitor the situation around the clock to take swift action.”

Russia’s government has been cracking down on news coverage of its invasion of Ukraine, telling media outlets not to call it “an attack,” “invasion,” or “declaration of war.” The US government has called RT and Sputnik “critical elements in Russia’s disinformation and propaganda ecosystem.”

YouTube’s move follows European Union officials saying they are “banning Russia Today and Sputnik from broadcasting” in the EU. “The state-owned Russia Today and Sputnik, as well as their subsidiaries, will no longer be able to spread their lies to justify Putin’s war and to sow division in our Union,” EU President Ursula von der Leyen said on Sunday.

It’s not clear how the ban will be enforced, as an EU spokesperson told reporters yesterday that “we’re looking for the best legal way to ensure we can achieve our objectives,” according to Politico. EU officials reportedly want the ban to apply to online platforms as well. An EU spokesperson told TechCrunch the ban is “expected to cover all means of distribution or transmission, including Internet video sharing platforms and applications.”

Facebook, Twitter, and TikTok take action

YouTube and other online platforms are taking action in the meantime. Facebook and Instagram owner Meta yesterday said it is blocking RT and Sputnik across Europe. A Meta official said the move came after “requests from a number of governments and the EU to take further steps in relation to Russian state-controlled media.”

In an update today, Meta said it is “demoting content from Facebook pages and Instagram accounts from Russian state-controlled media outlets, and we are making them harder to find across our platforms.” This change reportedly affects the accounts worldwide, not just in Europe.

Twitter said it is “adding labels to Tweets that share links to Russian state-affiliated media websites and… taking steps to significantly reduce the circulation of this content on Twitter.” The labels say “This tweet links to a Russia state-affiliated media website” and provide a link for more information.

“Since the invasion, we’ve seen more than 45,000 Tweets a day sharing links to Russian state-affiliated media outlets. While we’ve labeled the accounts of hundreds of global state media outlets for years, Tweets sharing their content lacked visible context,” Twitter Head of Site Integrity Yoel Roth wrote yesterday.

Russia’s Foreign Ministry today claimed that Meta and Google should be held accountable for “inciting war,” according to Reuters.

DirecTV said it is dropping RT from its channel lineup, saying, “We are accelerating this year’s contract expiration timeline and will no longer offer their programming effective immediately.”

TikTok said it blocked RT and Sputnik in the European Union. TikTok, which is owned by Chinese company ByteDance, has faced scrutiny from US lawmakers about whether it gives information on users to the Chinese government.

https://arstechnica.com/?p=1837380

Shell announced today that it would be pulling out of the stalled Nord Stream 2 pipeline and looking to sell its stakes in various oil and gas projects in Russia as President Vladimir Putin’s invasion of Ukrainian grinds on.

The decision to exit the Nord Stream 2 investment comes days after German Chancellor Olaf Scholz effectively killed the project by suspending its certification. The Dutch company split about half the cost of the pipeline with four other European energy companies. Gazprom, the gas company controlled by the Russian government, covered the other half. Shell also owns significant stakes in two other oil and gas projects in Russia.

Together, the moves could cost Gazprom billions of dollars if the company can’t find buyers or has to take a significant write-down. Given international sentiment at the moment, the latter seems more likely. Altogether, the oil and gas projects represent about 5 percent of the company’s annual production, according to the Financial Times.

“We are shocked by the loss of life in Ukraine, which we deplore, resulting from a senseless act of military aggression which threatens European security,” Shell CEO Ben van Beurden said in a statement.

Shell announced the decision a day after BP said that it would be exiting its 19.75 percent stake in Rosneft, the oil company controlled by the Russian government. The British supermajor’s write down will be much costlier since its shares in Rosneft are worth around $14 billion. Shell said it wouldn’t find a buyer—the company was simply walking away.

In a statement Sunday, Helge Lund, BP’s chair, said:

Russia’s attack on Ukraine is an act of aggression which is having tragic consequences across the region. BP has operated in Russia for over 30 years, working with brilliant Russian colleagues. However, this military action represents a fundamental change. It has led the BP board to conclude, after a thorough process, that our involvement with Rosneft, a state-owned enterprise, simply cannot continue.

Norway’s Equinor also said that it would be exiting its Russian ventures, which are valued at $1.2 billion. Other companies, from semiconductor manufacturers to social media platforms, are either complying with sanctions or being forced to decide whether to continue pursuing the Russian market.

The moves by BP, Shell, and Equinor increase pressure on other companies to get out of Russia, including France’s Total and the US’s ExxonMobil, which started working in Russia in 1996, just five years after the collapse of the Soviet Union.

While Western sanctions have hit the Russian economy hard, they have so far avoided the energy sector. Russia is one of the world’s largest oil and gas producers and supplies 40 percent of Europe’s natural gas. Western officials have said the decision was made to prevent price spikes for oil and gas, which would help offset any trading losses Russia might experience from energy-related sanctions.

Last year, Russian oil and gas revenues accounted for $119 billion and contributed 40 percent of the country’s federal budget.

https://arstechnica.com/?p=1837199

Over Zoom, Australia’s communications minister, Paul Fletcher, has the air of a man in the middle of a victory speech. He credits his team and the country’s competition regulator for succeeding where others had failed: forcing tech giants to pay for news. “There were a lot of people saying you can’t really succeed in taking on the global digital giants,” he says, sitting beneath strip lighting in his Sydney constituency office. But Fletcher and Australia’s federal treasurer, Josh Frydenberg, persevered. In 2020, when the Australian government asked the competition regulator to develop a law that would force tech giants to pay for the news that appears on their feeds, Fletcher was aware of the stories others used as warnings. When Germany’s biggest news publisher, Axel Springer, tried to block Google from running snippets of its articles in 2014, it backtracked after just two weeks once traffic plunged. When Spain tried to force Google to pay for news in 2014, the search giant just left—blocking Google News in the country for seven years.

Google threatened Australia with even more drastic action. In January 2021, the tech giant suggested Australians could lose access to its entire search engine if Fletcher and Frydenberg’s “news media bargaining code,” which would force platforms to pay news publishers for links, came into force. Facebook also lobbied hard against the code, arguing that news makes up less than 4 percentof the content people see in their news feed. On February 17, Australians woke up to discover that all news links had been wiped off the platform, leaving the Facebook pages of the country’s biggest media companies completely blank. Traffic to news websites sank 13 percent, illustrating exactly what the government said it was worried about. Facebook’s actions “confirm for all Australians [the] immense market power of these media digital giants,” Frydenberg said at the time.

Still, the government did not back down. According to Fletcher, the code was Australia’s answer to a problem that was first and foremost about competition. The argument was simple—Australia’s news industry should be compensated for helping Google and Facebook attract eyeballs. “What we’re trying to do is replicate the ordinary commercial dealings that would occur in a market where there wasn’t a huge imbalance of bargaining power,” he says.

But others suspect the code was really an attempt to subsidize the media industry, which was suffering from intense online competition for advertising. Out of every 100 Australian dollars spent on advertising in 2019, AD$53 ($38) went to Google, AD$28 to Facebook, and AD$19 to all other websites including media outlets, according to Australia’s competition watchdog. If this was the reason for the code, Bloomberg editors described it as a misdiagnosis in an op-ed. “Journalism’s business model wasn’t broken by digital platforms,” they said, “[the internet] offered consumers a wealth of free news and opinion and gave advertisers options and audiences that traditional publishers haven’t been able to match.”

Australians experienced this standoff through their Facebook feeds. For eight days, the site featured no news. Then, at 1 am on February 26, 2021, news content started to reappear, reversing users’ feeds to how they always looked. But behind the scenes, tech’s relationship with the media had permanently shifted.

Google and Facebook did not leave; they paid up, striking deals with news organizations to pay for the content they display on their sites for the first time. The code was formally approved on March 2, 2021, writing into law that tech platforms had to negotiate a price to pay news publishers for their content. If they didn’t, an arbiter would step in not only to force the platforms to pay but also to set the price. One year after the media code was introduced, Google has 19 content deals with news organizations and Facebook has 11, according to Fletcher.

Now countries around the world are looking at Australia’s code as a blueprint of how to subsidize the news and stop the spread of “news deserts”—communities that no longer have a local newspaper. Canada is expected to propose its own version in March. Media associations in both the US and New Zealand are calling for similar policies. Reports suggest the UK culture secretary, Nadine Dorries, is also planning to require platforms to strike cash-for-content deals.

https://arstechnica.com/?p=1836640

In response to Russia’s invasion of Ukraine, the US and allies are imposing sanctions that “will cut off more than half of Russia’s high-tech imports, restricting Russia’s access to vital technological inputs, atrophying its industrial base, and undercutting Russia’s strategic ambitions to exert influence on the world stage,” the White House said on Thursday. The sanctions are a “response to Putin’s war of choice against Ukraine” and “impose severe costs on Russia’s largest financial institutions,” the White House said.

For exports to Russia, “US companies must now obtain licenses to sell computers, sensors, lasers, navigation tools, and telecommunications, aerospace, and marine equipment. The United States will deny almost all requests,” a Reuters article explained. “The new rules also force companies making tech products overseas with US tools to seek a US license before shipping to Russia,” Reuters wrote, noting that similar restrictions were previously applied to Chinese tech giant Huawei.

According to the White House announcement, “countries that adopt substantially similar export restrictions are exempted from new US licensing requirements for items produced in their countries.” The European Union, Australia, Japan, Canada, New Zealand, and the United Kingdom are imposing similar sanctions.

Tech-specific export restrictions

Tech-specific sanctions target chips, telecom, security, and more, the White House said:

Russia-wide restrictions to choke off Russia’s import of technological goods critical to a diversified economy and Putin’s ability to project power. This includes Russia-wide denial of exports of sensitive technology, primarily targeting the Russian defense, aviation, and maritime sectors to cut off Russia’s access to cutting-edge technology. In addition to sweeping restrictions on the Russian-defense sector, the United States government will impose Russia-wide restrictions on sensitive US technologies produced in foreign countries using US-origin software, technology, or equipment. This includes Russia-wide restrictions on semiconductors, telecommunication, encryption security, lasers, sensors, navigation, avionics and maritime technologies. These severe and sustained controls will cut off Russia’s access to cutting edge technology.

Regarding military-specific restrictions, the White House said that “Exports of nearly all US items and items produced in foreign countries using certain US-origin software, technology, or equipment will be restricted to targeted military end users. These comprehensive restrictions apply to the Russian Ministry of Defense, including the Armed Forces of Russia, wherever located.”

A Commerce Department fact sheet on the license rules said the US is imposing “a policy of denial” for license applications but will conduct case-by-case reviews for “applications related to safety of flight, maritime safety, humanitarian needs, government space cooperation, civil telecommunications infrastructure, government-to-government activities, and to support limited operations of partner country companies in Russia.”

Tough sanctions on Russian banks

The Biden administration said it is “cutting off Russia’s largest bank from the US financial system” and imposing “full blocking sanctions on Russia’s second largest bank—freezing any of its assets touching the US financial system.” There are also “full blocking sanctions” on three other major Russian financial institutions and certain “Russian elites… who have enriched themselves at the expense of the Russian state, and have elevated their family members into some of the highest position of powers in the country.”

The US Treasury Department posted more details on the financial sanctions here.

Meanwhile, Russia’s invasion of Ukraine could cause problems for chip manufacturing. “Ukraine is a major producer of neon gas critical for lasers used in chipmaking and supplies more than 90 percent of US semiconductor-grade neon, according to estimates from research firm Techcet,” Reuters reported. “About 35 percent of palladium, a rare metal also used for semiconductors, is sourced from Russia. A full-scale conflict disrupting exports of these elements might hit players like Intel, which gets about 50 percent of its neon from Eastern Europe according to JPMorgan.”

https://arstechnica.com/?p=1836718

The Securities and Exchange Commission is investigating whether Tesla CEO Elon Musk and his brother, Kimbal Musk, violated insider-trading rules with recent stock sales, The Wall Street Journal reported yesterday.

“The SEC’s investigation began last year after Kimbal Musk sold shares of Tesla valued at $108 million, one day before the Tesla chief polled Twitter users asking whether he should unload 10 percent of his stake in the electric-car maker and pledging to abide by the vote’s results,” the Journal wrote.

Separately, a US judge yesterday denied Tesla and Musk’s various requests related to their claim that the SEC is “harassing” the company and its CEO. (More on that later in this article.)

Musk’s Twitter poll in November 2021 received 3.5 million votes, with nearly 58 percent of respondents agreeing that Musk should sell 10 percent of his Tesla stock. Musk’s poll question said, “Much is made lately of unrealized gains being a means of tax avoidance, so I propose selling 10 percent of my Tesla stock. Do you support this?”

The results indicated that Musk’s “tweet was viewed as negative news,” and Tesla “shares fell sharply in the wake of Mr. Musk’s poll,” the Journal noted. Elon Musk both sold and bought large amounts of Tesla stock over the ensuing weeks.

Musk denied passing information to brother

Kimbal Musk serves on Tesla’s board of directors, and his “trading could violate rules that generally prohibit employees and board members from trading on material nonpublic information,” yesterday’s Journal report said. SEC regulators could look into “whether Mr. Musk told his brother about his upcoming tweet or about the timing of his sales before Kimbal Musk traded on November 5—or if Kimbal Musk otherwise learned of the poll and then traded.”

Whether this constitutes illegal insider trading “would be a hard-fought question in court,” University of Michigan law professor Adam Pritchard told the Journal.

Elon Musk denied passing along advance information about the poll to his brother. “Kimbal had no idea I was going to do a Twitter poll,” Musk told the Financial Times in an email. Musk also told the news organization that Tesla lawyers were “aware” of his plan to conduct the Twitter poll.

“The idea that I would care about whether my brother might sell shares for a few million dollars less when my Twitter poll caused my own share sale to be over a billion dollars less is utterly absurd,” Musk said, according to the FT report. Musk also claimed the SEC investigation is “simply more evidence of Stevie grinding his very tiny axe yet again,” a reference to SEC official Steven Buchholz, an assistant regional director for enforcement.

“I didn’t start the fight, but I will finish it,” Musk wrote on Twitter on Wednesday in reference to the Tesla/SEC battle.

https://arstechnica.com/?p=1836625

Three men yesterday pleaded guilty to conspiracy to provide material support to terrorists for their roles in a white supremacist plot to attack US power grids.

“These three defendants admitted to engaging in a disturbing plot, in furtherance of white supremacist ideology, to attack energy facilities in order to damage the economy and stoke division in our country,” Assistant Attorney General for National Security Matthew Olsen said in a Department of Justice announcement.

The defendants are Christopher Brenner Cook, 20, of Columbus, Ohio; Jonathan Allen Frost, 24, of West Lafayette, Indiana, and of Katy, Texas; and Jackson Matthew Sawall, 22, of Oshkosh, Wisconsin. They were charged in US District Court for the Southern District of Ohio and face maximum prison sentences of 15 years. The plea agreements recommend post-prison supervised release of 30 years with computer monitoring and a ban on the use of “online encrypted communication platforms.”

“As part of the conspiracy, each defendant was assigned a substation in a different region of the United States,” the Justice Department said. “The plan was to attack the substations, or power grids, with powerful rifles. The defendants believed their plan would cost the government millions of dollars and cause unrest for Americans in the region.” 

Hope for a “race war”

A statement of facts the defendants admitted to in their plea agreements described their hope to ignite a “race war”:

In addition, the defendants believed that time associated with replacing the substations would cause confusion and unrest for Americans in the region. There were also conversations about how the possibility of the power being out for many months could cause some serious change or straight out war, even a race war; additionally, that without power across the country, it could cause the next Great Depression, people wouldn’t show up to work, the economy could crash and there would be a ripe opportunity for potential (white) leaders to rise up. One theme of the group discussions centered around the need to create disorder to bring the system down, which would cause people to doubt the system and create a true revolutionary force against the system.

Planning for the attacks happened between October 2019 and March 2020, according to the statement of facts. Frost and Cook met in an online chat group in which Frost “shared the idea of attacking a power grid, a perceived vulnerable target,” and “provided Cook with information that he had gathered about possible power grids as targets,” the document said. The defendants planned to use “powerful rifles that would penetrate the transformers.”

The men proceeded, with Frost focusing on logistics and Cook handling recruitment:

As part of the recruitment process, Cook often asked a lot of literary questions; Cook even circulated a book list of suggested, if not required, reading that promoted the ideology of white supremacy and Neo-Nazism, including such titles as “A Squire’s Trial” and “Siege.” “Siege” places an emphasis on gaining power through violence as opposed to political means. Cook also sought out recruits that were younger, believing it was less likely the individuals were members of law enforcement.

Cook’s recruitment efforts focused primarily on juveniles, the document said.

https://arstechnica.com/?p=1836428

Twitter said it had mistakenly suspended the accounts of open source intelligence reporters posting about Russia’s military build-up around Ukraine, leading to many of them accusing the Russian state of launching a “bot” campaign against them.

Based on publicly available satellite imagery, open source reporters have used social media to supply a steady commentary on the activities of Russian forces near the Ukrainian border, providing a valuable alternative source of information to Western intelligence reports.

The people behind the suspended accounts said they believed they had been the target of an attack by Russian bots—computers that mimic the activity of human users—that had mass-reported their content as being suspicious. This led their content to be removed automatically by Twitter’s moderation technology.

“It is an attack on journalism and people who rely on these accounts to post the facts over other news outlets,” Kyle Glen, co-founder of @Conflicts, which has 337,000 followers, said.

“Twitter has… a responsibility to ensure its own reporting systems aren’t being misused by individuals or nations.”

Twitter told the Financial Times that there was no evidence of a coordinated bot campaign but admitted the company had taken action “in error,” suspending around a dozen accounts that had been flagged as containing manipulated or misleading media.

It said it was “expeditiously reviewing these actions” and had reinstated many of the affected accounts.

The suspensions took place at around the same time as several Ukrainian government websites and banks were temporarily shut down after a series of cyber attacks—Ukraine’s third since the beginning of the year. Kyiv has blamed the two prior attacks on Russia.

That the Twitter accounts were suspended almost simultaneously fed suspicions that a Russian operation may have been behind the moves. Russia often uses proxy groups in its cyber operations so it can deny knowledge of any attack, even though the groups are believed by Western officials and cyber experts to act for Moscow.

“A number of… individuals saw their accounts locked at exactly 11:51 UTC last night,” said @Osinttechnical, who has 83,000 followers and whose identity the FT has independently verified.

“The pattern of the account lockings indicates that the automatic features Twitter installed to handle account reports were triggered. In effect, a number of ‘people’ bombarded these accounts with reports at the same time, activating the Twitter blocks,” he added.

The Twitter account of Ukrainian civil activist Serhii Sternenko was also suspended.

Although open source intelligence has provided some startlingly detailed images of military movements, analysts say it only shows a fraction of what is going on. Their reports, often on Twitter, have independently corroborated the publicly released Western intelligence briefings and lent credibility to them.

“Western governments have learned a lot about the information warfare space… from [the] open intelligence space,” Sir Alex Younger, former head of the UK’s secret service, said.

“It’s been a much better performance this time round and one of the reasons why is that there has been open source [intelligence] to check on what they are saying, which has raised their credibility,” he told an FT forum on Wednesday.

© 2022 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1836394

A newly released police report thoroughly debunks Missouri Gov. Mike Parson’s baffling claim that a journalist who helped the state identify and fix a website security flaw was a “hacker” and criminal.

Parson demanded the investigation in October and called for criminal charges against St. Louis Post-Dispatch reporter Josh Renaud. “It is unlawful to access encoded data and systems in order to examine other people’s personal information, and we are coordinating state resources to respond and utilize all legal methods available,” Parson said at the time. The Republican governor claimed that Renaud was “acting against a state agency to compromise teachers’ personal information in an attempt to embarrass the state and sell headlines for their news outlet” and said his administration “will not let this crime against Missouri teachers go unpunished.”

But the resulting police report confirms in detail that Renaud did exactly what he said from the beginning: He identified a security flaw by viewing publicly available HTML code on a misconfigured state website and delayed publishing an article on his findings until after the state closed the security hole.

The police report also revealed that the security flaw had existed since 2011. The mistake exposed teachers’ Social Security numbers on a Department of Elementary and Secondary Education (DESE) website that allowed anyone to search for information about teachers. Up to 576,000 teachers’ Social Security numbers may have been exposed because the data goes back to 2005, the report said.

The Missouri State Highway Patrol police report was posted yesterday by the Post-Dispatch along with an article about the report. “The highway patrol said it spent about 175 hours on the investigation. Three officers assisted in the probe. No cost estimate was provided,” the Post-Dispatch wrote.

Prosecutor closed investigation without charges

The police report was provided to Cole County Prosecutor Locke Thompson about two months ago. Thompson announced on February 11 that he closed the investigation without charges and that “the issues at the heart of the investigation have been resolved through non-legal means.”

The police report paraphrases interviews conducted in October with state employees, Renaud, and Shaji Khan, a cybersecurity professor at the University of Missouri-St. Louis who helped Renaud verify the security vulnerability. The report lists Renaud as a “suspect” but listed the case as closed on October 29.

The report “show[s] that state officials knew both that no crime had been committed and that they should never have maintained a public website with such a major and elementary security flaw,” Khan’s attorney, Elad Gross, told Ars in a statement yesterday. The report “clearly shows that state officials committed all of the wrongdoing here,” he said.

Reporter “only accessed open public data”

Mallory McGowin, chief communications officer for DESE, told police that the problem identified by Renaud “was an error or oversight when ITSD [Information Technology Services Division] developed the application” and “stated the vulnerability would have been there since 2011, when the application was implemented.”

McGowin confirmed that Renaud only accessed publicly available data. “She stated from what she has observed, Mr. Renaud did not access anything that was not publicly available, nor was he in a place he should not have been. She said Josh Renaud appears [to] have only accessed open public data,” the police report said.

Thompson told the Missouri Independent that the investigation didn’t find “any criminal intent,” though he said it “may have technically been a crime” because a state law on tampering with computer data “does appear to be so vague that it basically describes someone using a computer to look up someone’s information.” The law bans accessing a computer system to intentionally examine information about another person, but specifies that it’s a crime only “if he or she [does so] knowingly and without authorization or without reasonable grounds to believe that he has such authorization.”

While the Post-Dispatch reported in October that the flaw exposed 100,000 Social Security numbers, it was apparently a lot more. “I asked Mrs. McGowin how many teachers were in the database, and she stated the data would have dated back to 2005, and the total number would be approximately 576,000,” Corporal Kyle Seabaugh wrote in the police report. Renaud told police the initial estimate of 100,000 was based on the current year, “and he said he observed information indicating other years of information and possibly retirees’ Social Security numbers were in the database.”

McGowin also “said the database—like other state computer services—is actually overseen by Parson’s Office of Administration, which the governor controls,” the Post-Dispatch said in its report yesterday.

https://arstechnica.com/?p=1835915