[Infowarrior] - Boston judge tosses MIT students' gag order

[Richard Forno]

Federal Judge Throws Out Gag Order Against Boston Students in Subway  
Case
By Kim Zetter
August 19, 2008 | 1:07:19 PMCategories: DefCon, Hacks and Cracks, The  
Courts

http://blog.wired.com/27bstroke6/2008/08/federal-judge-t.html

A federal judge in Boston this morning threw out a temporary gag order  
against three MIT students who were prevented from presenting a talk  
on security vulnerabilities in the Boston subway's fare tickets and  
cards.

U.S. District Judge George A. O'Toole, Jr., vacated the temporary 10- 
day restraining order that another judge had instituted last Saturday  
against the students and which was scheduled to expire today. District  
Judge O'Toole also threw out a request by the Massachusetts Bay  
Transportation Authority to obtain a preliminary injunction against  
the students to expand the restraining order beyond the original 10  
days.

"It's great news for the free speech rights for these students," said  
Rebecca Jesche, a spokeswoman for the Electronic Frontier Foundation,  
which represented the students. "Although it's extremely unfortunate  
that the students were not allowed to give their talk at DefCon."

District Judge O'Toole, in making his decision, ruled against using  
the Computer Fraud and Abuse Act to invoke the restraining order,  
saying that the anti-hacking statute, which applies to code  
transmitted to computer systems, does not apply to speech. A weekend  
judge who had heard the case last Saturday and had granted the  
restraining order on behalf of the Massachusetts Bay Transportation  
Authority, had invoked the Computer Fraud and Abuse Act in his  
decision, implying that speech about how a system was vulnerable to  
hacking was equivalent to someone actually hacking the system -- or at  
least aided that illegal hacking activity.

"It was definitely unfair to use that statute to silence the  
students," Jesche said. "We certainly hope the next time that people  
are allowed to present their important research instead of being  
silenced by bogus lawsuits."

Zach Anderson, one of the students sued in the case, was elated by the  
judge's decision today.

"We're glad the court actually saw things as they should be," he told  
Threat Level. "We're glad the court read the law correctly."

Although the restraining order has gone away, it doesn't mean the  
students are completely in the clear. Still standing is a lawsuit the  
MBTA has filed against them, accusing them of hacking its system and  
causing damages.

Anderson said the students regret that they weren't allowed to give  
their presentation last Sunday but have no intention of giving the  
talk anymore.

"All the material we were going to talk about has been made  
public . . . and more," he said, referring to the fact that their  
presentation slides as well as a confidential report describing  
vulnerabilities with the Boston system were posted online after the  
judge granted the restraining order.

Anderson maintains that the students never planned to present key  
information that would have allowed someone to defraud the MBTA system  
and says they still stand by that.

"Despite what's happened, and the animosity the MBTA has brought  
toward us," he said, "we don't want people to defraud them."

When asked if he and the other students ever created bogus MBTA cards  
and used them to get free rides on Boston's T subway, Anderson  
declined to respond.

"I can't really comment on the actual means that we used," he said.  
"It's probably not a good idea to comment on that. We certainly did  
not get free fare. We had to spend several hundred dollars on buying  
tickets to look at the data structure. Far more than we ever would  
have used."