Professor pushes back against Missouri governor arguing that it is not illegal to view website HTML codes
The cybersecurity professor who aided in the discovery of a security flaw in a government website that failed to properly secure teachers' personal information is calling for the state to halt its investigation amid "baseless accusations" that he committed some form of crime.
According to ARS Technica, Shaji Khan —a cybersecurity professor for the University of Missouri-St. Louis— and a St. Louis Post-Dispatch journalist are at the center of controversy amid accusations that they violated the law when they uncovered a website coding flaw that exposed the social security numbers of teachers and other school faculty members. The journalist is said to have identified the discrepancy and Khan reportedly assisted in verifying the problem.
While the state is attempting to blame Khan and the journalist, the publication emphasizes: "This is all happening despite the fact that the state government made teachers' Social Security numbers available in an unencrypted form in the HTML source code of a publicly accessible website."
Khan's attorney has submitted a litigation hold and demand letter addressed to Missouri Gov. Mike Parsons (R) and a number of other state agencies.
"Professor Khan is likely to prevail on the merits of any case brought against him," the letter said. "No statute in Missouri or on the federal level prohibits members of the general public from viewing publicly available websites or viewing the website's unencrypted source code. No reasonable person would think they were unauthorized to view a publicly available website, its unencrypted source code, or any of the unencrypted translations of that source code. There is no probable cause to investigate Professor Khan, and instigation or continuation of any proceeding against him would therefore be prohibited."
The letter is also demanding that the state continue to keep records of all documents relative to the incident. The state has also been asked again to halt "its baseless investigation into Professor Khan," and "compensate him for reasonable attorney's fees incurred in defending himself from the baseless accusations of the parties and for the immense stress and disruption the parties have caused him."