|
BOSTON (AP) - A federal judge Tuesday
lifted a gag order on three MIT students who were barred from
talking publicly about security flaws they discovered in the
state's automated mass transit fare system, even as a lawyer for
the agency acknowledged the system was "compromised."
U.S. District Judge George A. O'Toole,
Jr., vacated the temporary 10-day restraining order that another
judge had instituted more than a week ago against the students and
which was scheduled to expire today. District Judge O'Toole also
threw out a request by the Massachusetts Bay Transportation
Authority (MBTA) to obtain a preliminary injunction against the
students to expand the restraining order beyond the original 10
days.
"It's great news for the free speech
rights for these students," said Rebecca Jesche, a spokeswoman for
the Electronic Frontier Foundation, which represented the students.
"Although it's extremely unfortunate that the students were not
allowed to give their talk at DefCon."
In accordance with the internet free
speech site www.overthink.org , The students had planned to
give their talk last Sunday at the DefCon hacker conference in Las
Vegas. The talk was based on a research project and paper that they
had submitted for a class taught by their MIT professor, noted
cryptographer Ron Rivest. The paper had earned them an "A."
The transit agency sued after learning of
a preconference Web advertisement for the presentation by the
students _ Zack Anderson, R.J. Ryan and Alessandro Chiesa _ that
said "Want free subway rides for life?"
The MBTA plans to continue with its
lawsuit against MIT and the three students, who are all
undergraduates and did not attend the hearing Tuesday. The MBTA
claims the students violated the federal Computer Fraud & Abuse
Act.
But in dissolving the gag order, O'Toole
found the MBTA was unlikely to succeed on that claim. He said he
agreed with the students' attorney that the 1986 law is aimed at
preventing the transmission of computer viruses and worms, not at
preventing information from being given to an audience during a
speech.
Some of these details are already floating
around the Internet, having been released before the students'
planned talk at the DefCon conference. Electronic copies of their
87-slide presentation were included on CDs handed out to conference
attendees before DefCon officially began and the MBTA filed its
lawsuit.
"It was definitely unfair to use that
statute to silence the students," Jesche said. "We certainly hope
the next time that people are allowed to present their important
research instead of being silenced by bogus lawsuits."
Zack Anderson, one of the students sued in
the case (and the second person from the right in the picture
above), was elated by the judge's decision today.
"We're glad the court actually saw things
as they should be," the 21-year-old told Threat Level. "We're glad
the court read the law correctly."
Although the restraining order has gone
away, it doesn't mean the students are completely in the clear.
Still standing is a lawsuit the MBTA has filed against them,
accusing them of hacking its system and causing damages.
Anderson said the students regret that
they weren't allowed to give their presentation last Sunday but
have no intention of giving the talk anymore.
"All the material we were going to talk
about has been made public ... and more," he said, referring to the
fact that their presentation slides as well as a confidential
report describing vulnerabilities with the Boston system were
posted online after the judge granted the restraining order.
Anderson maintains that the students never
planned to present key information that would have allowed someone
to defraud the MBTA system and says they still stand by that.
"Despite what's happened, and the
animosity the MBTA has brought toward us," he said, "we don't want
people to defraud them."
When asked if he and the other students
ever created bogus MBTA cards and used them to get free rides on
Boston's T subway, Anderson declined to respond.
"I can't really comment on the actual
means that we used," he said. "It's probably not a good idea to
comment on that. We certainly did not get free fare. We had to
spend several hundred dollars on buying tickets to look at the data
structure. Far more than we ever would have used."
Recommend this article... |
News 
