EFF to appeal court order halting subway hacker talk
IDG News Service - The Electronic Frontier Foundation plans to appeal a U.S. District Court order imposing a temporary injunction on a Defcon presentation that would have detailed flaws in the Massachusetts Bay Transportation Authority's (MBTA) electronic ticketing system.
"The court ultimately came to a very, very wrong conclusion," EFF senior staff attorney Kurt Opsahl said during an EFF discussion at Defcon a few hours after Judge Douglas Woodlock of the U.S. District Court for the District of Massachusetts issued a court order halting the planned talk about the transit-system security flaws.
The MBTA filed a lawsuit Friday seeking to stop three MIT students from giving the talk. The lawsuit also named the university as a defendant. The Boston-area transportation authority argued that the presentation would cause "significant damage to the MBTA's transit system," according to an online posting of the lawsuit.
MIT students Zack Anderson, Russell "RJ" Ryan and Alessandro Chiesa, had been scheduled to talk about "The Anatomy of a Subway Hack: Breaking Crypto RFIDs & Magstripes of Ticketing Systems" at the Defcon conference Sunday. They received an "A" grade on the project in an MIT class, Opsahl said.
"The first notice that the MBTA provided that they were going to the court was after they had gone to the court," Opsahl said at the EFF session. The judge cited a computer-intrusion statute in issuing the order, he said.
"The statute, on its face, appears to be discussing sending code programs or similar type of information to a computer and does not appear to contemplate somebody who is giving a talk to humans," Opsahl said. "Nevertheless, the court disagreed with that interpretation."
The court order seems to say that a magnetic strip on a paper card or a smart card counts as a computer, and the EFF disagrees with that interpretation, he said.
The temporary restraining order "reflects the court's view that they believe that the [MBTA] was likely to succeed on the merits -- we think that's actually not the case," Opsahl said.
Some of the material in the students' talk regarding security problems with the MBTA's electronic ticketing system had been previously reported in The Boston Globe and Boston Herald newspapers, Opsahl said.
"Courts have found that the First Amendment covers these things," Opsahl said. "We believe that this is a protected speech activity. When you discuss security issues, if you are telling the truth, that is something that should be protected."
Though the students are barred by court order from providing information that would have helped others circumvent the talk, their presentation slides had already been included in a conference CD given to Defcon attendees. The MBTA itself put some details in the public record by filing a confidential assessment of its security system with the court.
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- Preparing Your Infrastructure for the Hyperconvergence Era From cloud computing and virtualization to mobility and unified communications, an array of innovative technologies is transforming today's data centers.
- How WAN Optimization Helps Enterprises Reduce Costs If you wanted to break down innovation into a tidy equation, it might go something like this: Technology + Connectivity = Productivity. Productivity...
- Redefine Your IT Operations: Remote Office IT Has Never Been Simpler Join us to see why PC Pro named Dell PowerEdge VRTX the "2013 Server of the Year." PowerEdge VRTX may be just what...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources... All Hardware White Papers | Webcasts
Our new weekly Consumerization of IT newsletter covers a wide range of trends including BYOD, smartphones, tablets, MDM, cloud, social and what it all means for IT. Subscribe now and stay up to date!