EFF to appeal court order halting subway hacker talk

The Electronic Frontier Foundation plans to appeal a U.S. District Court order imposing a temporary injunction on a Defcon presentation that would have detailed flaws in the Massachusetts Bay Transportation Authority's (MBTA) electronic ticketing system.

"The court ultimately came to a very, very wrong conclusion," EFF senior staff attorney Kurt Opsahl said during an EFF discussion at Defcon a few hours after Judge Douglas Woodlock of the U.S. District Court for the District of Massachusetts issued a court order halting the planned talk about the transit-system security flaws.

The MBTA filed a lawsuit Friday seeking to stop three MIT students from giving the talk. The lawsuit also named the university as a defendant. The Boston-area transportation authority argued that the presentation would cause "significant damage to the MBTA's transit system," according to an online posting of the lawsuit.

MIT students Zack Anderson, Russell "RJ" Ryan and Alessandro Chiesa, had been scheduled to talk about "The Anatomy of a Subway Hack: Breaking Crypto RFIDs & Magstripes of Ticketing Systems" at the Defcon conference Sunday. They received an "A" grade on the project in an MIT class, Opsahl said.

"The first notice that the MBTA provided that they were going to the court was after they had gone to the court," Opsahl said at the EFF session. The judge cited a computer-intrusion statute in issuing the order, he said.

"The statute, on its face, appears to be discussing sending code programs or similar type of information to a computer and does not appear to contemplate somebody who is giving a talk to humans," Opsahl said. "Nevertheless, the court disagreed with that interpretation."

The court order seems to say that a magnetic strip on a paper card or a smart card counts as a computer, and the EFF disagrees with that interpretation, he said.

The temporary restraining order "reflects the court's view that they believe that the [MBTA] was likely to succeed on the merits -- we think that's actually not the case," Opsahl said.

Some of the material in the students' talk regarding security problems with the MBTA's electronic ticketing system had been previously reported in The Boston Globe and Boston Herald newspapers, Opsahl said.

"Courts have found that the First Amendment covers these things," Opsahl said. "We believe that this is a protected speech activity. When you discuss security issues, if you are telling the truth, that is something that should be protected."

Though the students are barred by court order from providing information that would have helped others circumvent the talk, their presentation slides had already been included in a conference CD given to Defcon attendees. The MBTA itself put some details in the public record by filing a confidential assessment of its security system with the court.

In the Defcon presentation slides, the students described a variety of techniques that could be used to gain free access to Boston's transit system, some of which they acknowledged are illegal. They said that the point of the talk was to show the results of a penetration test of the MBTA system, but they were clearly aware that it could have caused legal problems. One slide simply reads, "What this talk is not: evidence in court (hopefully)."

The passage in the Defcon show guide describing their talk began, "Want free subway rides for life?" That line was removed from the description of the talk posted at the Defcon Web site.

The students discussed physical security problems they found with the system, such as unlocked gates and unattended surveillance booths. They said they were able to access fiber switches connecting fare-vending machines to the unlocked network, and they described techniques to clone and reverse-engineer the MBTA's CharlieTicket magnetic-stripe tickets and CharlieCard smart cards.

In court filings, the MBTA said that 68% of its riders use the CharlieCard, which brings in about $475,000 to the transit authority each weekday.

An MBTA vendor tipped off the authority on July 30 that the talk was scheduled, the court filing states. According to Opsahl, the students met with MBTA officials on Monday, and it was their understanding after that meeting that the situation had been resolved.

An MBTA lawyer has not returned messages Saturday seeking comment for stories about the matter.

The CharlieCard is based on the same Mifare Classic RFID (radio frequency identification) technology used by many other transit systems around the world. Earlier this year, Mifare's producer, NXP Semiconductors USA Inc., sued to prevent researchers from presenting research on how to crack this technology. A Dutch court rejected NXP's claims last month.

With an average weekday ridership of 1.4 million commuters, the MBTA is the nation's fifth-largest transit system, according to the lawsuit.

Lawsuits involving Defcon presentations have also occurred in the past. Security researcher Mike Lynn was sued in 2005 after he gave a controversial presentation disclosing flaws in Cisco Systems Inc.'s routers. In response, the EFF this year started a drop-in service, providing Defcon presenters free legal advice on how to respond to threats of legal action.

Copyright © 2008 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon