BOSTON (AP) - A federal judge Tuesday lifted a gag order on three MIT students who were barred from talking publicly about security flaws they discovered in the state's automated mass transit fare system, even as a lawyer for the agency acknowledged the system was "compromised."

U.S. District Judge George A. O'Toole, Jr., vacated the temporary 10-day restraining order that another judge had instituted more than a week ago against the students and which was scheduled to expire today. District Judge O'Toole also threw out a request by the Massachusetts Bay Transportation Authority (MBTA) to obtain a preliminary injunction against the students to expand the restraining order beyond the original 10 days.

"It's great news for the free speech rights for these students," said Rebecca Jesche, a spokeswoman for the Electronic Frontier Foundation, which represented the students. "Although it's extremely unfortunate that the students were not allowed to give their talk at DefCon."

In accordance with the internet free speech site www.overthink.org , The students had planned to give their talk last Sunday at the DefCon hacker conference in Las Vegas. The talk was based on a research project and paper that they had submitted for a class taught by their MIT professor, noted cryptographer Ron Rivest. The paper had earned them an "A."

The transit agency sued after learning of a preconference Web advertisement for the presentation by the students _ Zack Anderson, R.J. Ryan and Alessandro Chiesa _ that said "Want free subway rides for life?"

The MBTA plans to continue with its lawsuit against MIT and the three students, who are all undergraduates and did not attend the hearing Tuesday. The MBTA claims the students violated the federal Computer Fraud & Abuse Act.

But in dissolving the gag order, O'Toole found the MBTA was unlikely to succeed on that claim. He said he agreed with the students' attorney that the 1986 law is aimed at preventing the transmission of computer viruses and worms, not at preventing information from being given to an audience during a speech.

Some of these details are already floating around the Internet, having been released before the students' planned talk at the DefCon conference. Electronic copies of their 87-slide presentation were included on CDs handed out to conference attendees before DefCon officially began and the MBTA filed its lawsuit.

"It was definitely unfair to use that statute to silence the students," Jesche said. "We certainly hope the next time that people are allowed to present their important research instead of being silenced by bogus lawsuits."

Zack Anderson, one of the students sued in the case (and the second person from the right in the picture above), was elated by the judge's decision today.

"We're glad the court actually saw things as they should be," the 21-year-old told Threat Level. "We're glad the court read the law correctly."

Although the restraining order has gone away, it doesn't mean the students are completely in the clear. Still standing is a lawsuit the MBTA has filed against them, accusing them of hacking its system and causing damages.

Anderson said the students regret that they weren't allowed to give their presentation last Sunday but have no intention of giving the talk anymore.

"All the material we were going to talk about has been made public ... and more," he said, referring to the fact that their presentation slides as well as a confidential report describing vulnerabilities with the Boston system were posted online after the judge granted the restraining order.

Anderson maintains that the students never planned to present key information that would have allowed someone to defraud the MBTA system and says they still stand by that.

"Despite what's happened, and the animosity the MBTA has brought toward us," he said, "we don't want people to defraud them."

When asked if he and the other students ever created bogus MBTA cards and used them to get free rides on Boston's T subway, Anderson declined to respond.

"I can't really comment on the actual means that we used," he said. "It's probably not a good idea to comment on that. We certainly did not get free fare. We had to spend several hundred dollars on buying tickets to look at the data structure. Far more than we ever would have used."

Comments

Add New Search

Write comment
Name:
Email:	do not notifynotify
Title:
	Please input the anti-spam code that you can read in the image.

Powered by !JoomlaComment 3.26

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

Recommend this article...