Texas company lays out ‘hacking’ case against Minnesota Public Radio

Do Minnesota Public Radio and reporter Sasha Aslanian realistically face civil and criminal penalties after uncovering a Texas firm’s security breaches involving state of Minnesota job-seeker data?

Lookout Services — which acknowledges an October security breach and subsequent security weaknesses — claimed in a Dec. 14 statement that their data was “illegally compromised.” The company — which notes “only the Minnesota Public Radio reporter viewed” some data and wants MPR to disclose what was viewed — will “aggressively seek prosecution for this egregious act,” according to the statement.

In a Dec. 11 report, Aslanian said she was able to see “employee names, birth dates, Social Security numbers and hire dates” on Lookout’s web site “without using a password or encryption software.”

Lookout CEO Elaine Morley says that’s not the whole truth. She contends Aslanian did use a password and ID to penetrate Lookout’s security — and told Morley so during a Dec. 7 phone call. Later, Morley asserts, Aslanian used information from that penetration to view the state data, even though she didn’t need a password or encryption that time.

As you might expect, MPR isn’t willing to debate Lookout’s assertions. News director Mike Edgerly’s two-sentence statement: “We are aware of Lookout Services allegations concerning an investigative report by MPR’s Sasha Aslanian. Sasha’s story exemplified good, solid reporting and we stand by it.”

A three-step path
So for now, we only have Lookout’s extended version of the story. Here’s a quick and dirty on how the company thinks things went down:

During an October product demonstration, a Lookout employee showed a web address that mistakenly displayed privileged data. Someone copied the web address and later tried to use it.

Morley says Lookout shut down that vulnerability, which didn’t involve state of Minnesota data. But later, someone from a state computer (identifiable by an IP address) tried altering the October address in various ways to gain access. Those attempts didn’t work.

But the outsider found another way in. Morley says clients could make their passwords and IDs as complex or simple as they chose. At least one client — not the state of Minnesota — chose an extremely simple combo.

(MPR’s Bob Collins, writing on his News Cut blog, has wondered why the state employee would need to guess at credentials if the state is a customer. Morley says it’s because the state worker didn’t have the state’s credentials.)

Morley says she’s sure Aslanian used a password and ID because the reporter said as much during a Dec. 7 phone call. “She told me ‘I am in your company’s database,’” Morley says. “I told her, ‘In my opinion, your source is hacking, and this is an unauthorized intrusion.’”

Morley says Lookout closed that vulnerability. However, the successful penetration exposed a new web address on which to model future attempts. Morley acknowledges Lookout screwed up by caching credentials on several web pages, rendering that security method effectively useless. The CEO says state and MPR computers added and subtracted things from the web address, finally getting through to the state info.

Not a bullshit claim’
To Lookout’s Minnesota attorney, Gregory Abbott, all this constitutes “hacking.”

“This is not as if this information was sitting on the web to surf over to it — some affirmative things had to happen,” Abbott says. “This is not like someone picking up $100 on a sidewalk.”

In a “demand letter” to MPR asking for an accounting of what was viewed, Abbott cited the federal Computer Fraud and Abuse Act, which penalizes anyone who “intentionally accesses a computer without authorization or exceeds authorized access and thereby obtains information from any protected computer.”

Criminal liability in such cases? “A fine or imprisonment for not more than 5 years, or both.”

Of course, that assumes MPR did what Lookout alleges it did, a prosecutor decides it’s worth prosecuting, and a court finds guilt. The act also has provisions for civil liability.

James Quinn — a technology lawyer with Bloomington-based Larkin Hoffman who is not involved in the case — calls Lookout’s assertions “not a bullshit claim.”

Quinn says, “Most cases in federal court revolve around the two-word phrase ‘without authorization,’ which is ill-defined in federal law.”

Quinn’s colleague Michael Fleming says some judges rely on the database owner’s view of authorization. But a company’s intent doesn’t always sway the day. “If it’s an openly accessible http address without harder security, there’s usually implicit authorization,” Fleming notes.

Still, he adds, if “this entrance required more than a simple URL (manipulated or not) then it certainly raises serious questions about whether the implicit authority concept would apply here. The circumstances you relay … at least raise the specter that the entrant might have reasonably known she was going past the line of authority of the owner.”

Working without a shield
So far, Lookout has only filed suit in its home base of Harris County, Texas. The state of Minnesota is the only named defendant, and the suit is for breach of contract. Morley says grounds include a state computer used for the unauthorized intrusions, plus the state worker’s onpassing of information to a third party, MPR.

She says a lawsuit against MPR has not been filed, and Lookout is “contemplating” where to file it.  Abbott says one option is to file in federal court in Minnesota, which could also adjudicate the Texas claims.

There would be a good reason for MPR to fight a similar move. There is no federal reporter shield law protecting sources and methods, notes Lucy Dalglish, executive director for the Virginia-based Reporter’s Committee for Freedom of the Press, leaving MPR just as vulnerable to the Computer Fraud and Abuse Act as anyone else.

“A journalist does not have any special exemption,” says Dalglish, a former Pioneer Press reporter and editor. “Any law of general applicability applies to journalists as well as the person on the street. You don’t get to rob a bank, steal something, or trespass in pursuit of a story.

“If [MPR] did the same thing anyone would be able to do without any specific skill, something readily available and figured out without being any kind of a computer hacker, they didn’t breach the law.”

Dalglish says MPR would have “a lot easier time in state court” because “Minnesota has a good shield law.” Congress is debating a federal version, but like health care reform, it remains bottled up in Senate negotiations.

Dalglish offered contrasting examples of what works and what doesn’t. The Cincinnati Enquirer had to pay millions after a reporter hacked into a password-protected Chiquita Brands voicemail system for a 1998 story. But a recent ABC report on a Transportation Safety Administration security protocol was good to go because the agency accidentally posted it online for anyone to see.

While the legality and severity of Lookout’s security breach remains to be adjudicated, there’s no doubt Aslanian was trying to serve the public interest — something a prosecutor might consider. As Dalglish says, “The state of Minnesota should be grateful MPR exposed what’s going on. It seemed like a pretty good story.”

I asked Morley if she realized, by filing a high-profile suit, how hapless her timeline made Lookout look. After all, there’s the webinar screwup, letting clients pick lame IDs/passwords and caching security credentials in such a way that rendered them useless.

“Yup,” she admitted. “It was a perfect storm that came together. Our communication with the state really broke down — in our contract, we had 60 days to fix any problem. But there was still an unauthorized intrusion, and that was wrong.”

You can also learn about all our free newsletter options.

Comments (7)

  1. Submitted by Paul Udstrand on 12/15/2009 - 11:58 am.

    This is kind of interesting. Last year when an independent online journalist exposed Norm Coleman’s donor list, and published a redacted screen capture Collins got into it and complained about the way it was handled. At the time, people tried to explain why it was handled that way, and why the data, although redacted needed to be posted, but Collins would have none of it. Now MPR’s had a chance to cover the story “thier” way, we’ll see how it goes.

  2. Submitted by Adam Platt on 12/15/2009 - 12:24 pm.

    What a pathetic sight, this unapologetic company, incompetent and negligent in the extreme trying to change the subject. This could prompt me to send MPR money for the first time in years. The community needs to speak out in Aslanian’s defense.

  3. Submitted by Mark Gisleson on 12/15/2009 - 07:15 pm.

    If the Texas company has a case, it’s only because we have such crappy intellectual property laws. Guessing your way into a database is NOT hacking.

    I’m very disappointed everyone keeps using that word when it’s obvious that hardly anyone understands what it means. Guessing at passwords isn’t hacking, and using equipment to make lots of guesses isn’t hacking either.


  4. Submitted by George Roy on 12/15/2009 - 07:32 pm.

    Sounds petty to me. These organizations sound pissed because the “hole” in their security was publicly mentioned. It appears finding a lack of security is against the law. This is odd to me as in order to find a hole in security some one has to report it. So from what I can tell if you find a hole in a company’s public system, don’t report it as they may consider your actions “ID Theft Like”. Let the real thieves do it so you can avoid breaking the law and the company will get what it deserves. The best part of all… the Computer Fraud and Abuse Act is yet another failed piece of paper allowing negligent companies to form a worthless excuse for their negligence. The Act seems to target those who report their findings and activity as a public service, the real thieves/hackers will not report any finding and cover their trails. So what good is the Computer Fraud and Abuse Act other than discouraging publicly announcing a company’s inability to keep your personal data safe.

  5. Submitted by Steve Brown on 12/16/2009 - 12:57 am.

    Interesting to read about “During an October product demonstration, a Lookout employee showed a web address that mistakenly displayed privileged data.”

    This seems unrelated to the incident with MPR and the state of MN and seems to involve a different customer/entity. I’d be curious if that client knows their data has been compromised.

    Also, is that the first time that vulnerability was exploited, or just the first time the company was aware of it.

  6. Submitted by Paul Udstrand on 12/16/2009 - 09:34 am.

    There all kinds of questions here. For one thing, MN state law governs any state data, anywhere, those laws apply to anyone to handles MN state data. Lookout may have violated state data practices simply by putting that data on a website to begin with, and the data itself should never have been displayed to anyone as a demonstration or otherwise. Why would they even put that data on a web site to begin with? You don’t need to do that in order to run the background checks they were contracted to do. Another issue is this idea that the state somehow violated the contract because someone using a state computer accessed or attempted to access the data. If the contract has such a clause in it, the State screwed up because that’s how you conduct security audits, and any client should be entitled to audit the contractor. You can’t rely on the contractors self audits, obviously as this case illustrates. So the question is whether or not someone in Pawlenty administration agreed to a funky contract that prohibited the state from auditing Lookout’s security. And no, guessing at passwords and web addresses is NOT hacking, that’s why the data should never have been on a non-protected website to begin with.

  7. Submitted by Gary Lee on 12/16/2009 - 10:13 am.

    The company suggests that the fault for the weak ID and password combination which they claim was used along the way was somehow a customer’s fault, not their own. The revelation of the URL was some sort of dastardly plot by state employees conspiring with MPR. And the initial penetration “revealed” other internal web addresses.

    There are simple, well established and widely used techniques to enforce strong passwords. There is a simple technique for avoiding the release of confidential data during demonstrations, in which you make up some fake data and put it on a separate copy of the system for demonstrations. That also solves the problem of revealing sensitive web addresses during demonstrations, as your demo system can have a different base address. And there is readily available security software to obfuscate web addresses when you are in a live production system to prevent “guessing” an address by modifying another address.

    What do all of these techniques have in common? First, that they are obvious and well known to every competent professional in the industry, and commonly used to protect confidential data. Second, that you have to think ahead, and you have to spend some time, effort, and in some cases money to implement them.

    So when Lookout files their suit they can take their pick of labeling themselves incompetent, lazy, cheap, or all of the above. I previously thought the State might have some liability here, but as more details come out it becomes more clear that Lookout is the sole problem here.

Leave a Reply