Do Minnesota Public Radio and reporter Sasha Aslanian realistically face civil and criminal penalties after uncovering a Texas firm’s security breaches involving state of Minnesota job-seeker data?

Lookout Services — which acknowledges an October security breach and subsequent security weaknesses — claimed in a Dec. 14 statement that their data was “illegally compromised.” The company — which notes “only the Minnesota Public Radio reporter viewed” some data and wants MPR to disclose what was viewed — will “aggressively seek prosecution for this egregious act,” according to the statement.

In a Dec. 11 report, Aslanian said she was able to see “employee names, birth dates, Social Security numbers and hire dates” on Lookout’s web site “without using a password or encryption software.”

Lookout CEO Elaine Morley says that’s not the whole truth. She contends Aslanian did use a password and ID to penetrate Lookout’s security — and told Morley so during a Dec. 7 phone call. Later, Morley asserts, Aslanian used information from that penetration to view the state data, even though she didn’t need a password or encryption that time.

As you might expect, MPR isn’t willing to debate Lookout’s assertions. News director Mike Edgerly’s two-sentence statement: “We are aware of Lookout Services allegations concerning an investigative report by MPR’s Sasha Aslanian. Sasha’s story exemplified good, solid reporting and we stand by it.”

A three-step path
So for now, we only have Lookout’s extended version of the story. Here’s a quick and dirty on how the company thinks things went down:

During an October product demonstration, a Lookout employee showed a web address that mistakenly displayed privileged data. Someone copied the web address and later tried to use it.

Morley says Lookout shut down that vulnerability, which didn’t involve state of Minnesota data. But later, someone from a state computer (identifiable by an IP address) tried altering the October address in various ways to gain access. Those attempts didn’t work.

But the outsider found another way in. Morley says clients could make their passwords and IDs as complex or simple as they chose. At least one client — not the state of Minnesota — chose an extremely simple combo.

(MPR’s Bob Collins, writing on his News Cut blog, has wondered why the state employee would need to guess at credentials if the state is a customer. Morley says it’s because the state worker didn’t have the state’s credentials.)

Morley says she’s sure Aslanian used a password and ID because the reporter said as much during a Dec. 7 phone call. “She told me ‘I am in your company’s database,’” Morley says. “I told her, ‘In my opinion, your source is hacking, and this is an unauthorized intrusion.’”

Morley says Lookout closed that vulnerability. However, the successful penetration exposed a new web address on which to model future attempts. Morley acknowledges Lookout screwed up by caching credentials on several web pages, rendering that security method effectively useless. The CEO says state and MPR computers added and subtracted things from the web address, finally getting through to the state info.

‘Not a bullshit claim’
To Lookout’s Minnesota attorney, Gregory Abbott, all this constitutes “hacking.”

“This is not as if this information was sitting on the web to surf over to it — some affirmative things had to happen,” Abbott says. “This is not like someone picking up $100 on a sidewalk.”

In a “demand letter” to MPR asking for an accounting of what was viewed, Abbott cited the federal Computer Fraud and Abuse Act, which penalizes anyone who “intentionally accesses a computer without authorization or exceeds authorized access and thereby obtains information from any protected computer.”

Criminal liability in such cases? “A fine or imprisonment for not more than 5 years, or both.”

Of course, that assumes MPR did what Lookout alleges it did, a prosecutor decides it’s worth prosecuting, and a court finds guilt. The act also has provisions for civil liability.

James Quinn — a technology lawyer with Bloomington-based Larkin Hoffman who is not involved in the case — calls Lookout’s assertions “not a bullshit claim.”

Quinn says, “Most cases in federal court revolve around the two-word phrase ‘without authorization,’ which is ill-defined in federal law.”

Quinn’s colleague Michael Fleming says some judges rely on the database owner’s view of authorization. But a company’s intent doesn’t always sway the day. “If it’s an openly accessible http address without harder security, there’s usually implicit authorization,” Fleming notes.

Still, he adds, if “this entrance required more than a simple URL (manipulated or not) then it certainly raises serious questions about whether the implicit authority concept would apply here. The circumstances you relay … at least raise the specter that the entrant might have reasonably known she was going past the line of authority of the owner.”

Working without a shield
So far, Lookout has only filed suit in its home base of Harris County, Texas. The state of Minnesota is the only named defendant, and the suit is for breach of contract. Morley says grounds include a state computer used for the unauthorized intrusions, plus the state worker’s onpassing of information to a third party, MPR.

She says a lawsuit against MPR has not been filed, and Lookout is “contemplating” where to file it.  Abbott says one option is to file in federal court in Minnesota, which could also adjudicate the Texas claims.

There would be a good reason for MPR to fight a similar move. There is no federal reporter shield law protecting sources and methods, notes Lucy Dalglish, executive director for the Virginia-based Reporter’s Committee for Freedom of the Press, leaving MPR just as vulnerable to the Computer Fraud and Abuse Act as anyone else.

“A journalist does not have any special exemption,” says Dalglish, a former Pioneer Press reporter and editor. “Any law of general applicability applies to journalists as well as the person on the street. You don’t get to rob a bank, steal something, or trespass in pursuit of a story.

“If [MPR] did the same thing anyone would be able to do without any specific skill, something readily available and figured out without being any kind of a computer hacker, they didn’t breach the law.”

Dalglish says MPR would have “a lot easier time in state court” because “Minnesota has a good shield law.” Congress is debating a federal version, but like health care reform, it remains bottled up in Senate negotiations.

Dalglish offered contrasting examples of what works and what doesn’t. The Cincinnati Enquirer had to pay millions after a reporter hacked into a password-protected Chiquita Brands voicemail system for a 1998 story. But a recent ABC report on a Transportation Safety Administration security protocol was good to go because the agency accidentally posted it online for anyone to see.

While the legality and severity of Lookout’s security breach remains to be adjudicated, there’s no doubt Aslanian was trying to serve the public interest — something a prosecutor might consider. As Dalglish says, “The state of Minnesota should be grateful MPR exposed what’s going on. It seemed like a pretty good story.”

I asked Morley if she realized, by filing a high-profile suit, how hapless her timeline made Lookout look. After all, there’s the webinar screwup, letting clients pick lame IDs/passwords and caching security credentials in such a way that rendered them useless.

“Yup,” she admitted. “It was a perfect storm that came together. Our communication with the state really broke down — in our contract, we had 60 days to fix any problem. But there was still an unauthorized intrusion, and that was wrong.”