A federal judge in Boston this morning threw out a temporary gag order against three MIT students who were prevented from presenting a talk on security vulnerabilities in the Boston subway's fare tickets and cards.
U.S. District Judge George A. O'Toole, Jr., vacated the temporary 10-day restraining order that another judge had instituted last Saturday against the students and which was scheduled to expire today. District Judge O'Toole also threw out a request by the Massachusetts Bay Transportation Authority (MBTA) to obtain a preliminary injunction against the students to expand the restraining order beyond the original 10 days.
"It's great news for the free speech rights for these students," said Rebecca Jesche, a spokeswoman for the Electronic Frontier Foundation, which represented the students. "Although it's extremely unfortunate that the students were not allowed to give their talk at DefCon."
The students had planned to give their talk last Sunday at the DefCon hacker conference in Las Vegas. The talk was based on a research project and paper that they had submitted for a class taught by their MIT professor, noted cryptographer Ron Rivest. The paper had earned them an "A."
A week before the scheduled DefCon talk, the students had met with the MBTA to discuss the transit authority's concerns that the students would teach others how to defraud the system. The students reassured the transit authority that they would withhold key information from their talk and would not be teaching someone how to defraud the system. They were under the impression after that meeting that the MBTA was fine with their talk. They were then surprised to learn, two days before their presentation, that the MBTA had filed a suit and a motion for a restraining order. When a different federal judge, District Judge Douglas Woodlock, granted the restraining order, the decision was criticized as an unconstitutional prior restraint of speech.
In granting the restraining order, District Judge Woodlock had invoked the Computer Fraud and Abuse Act, implying that the students' speech about how the MBTA system was vulnerable to hacking was equivalent to someone actually hacking the MBTA system -- or at least aided that illegal hacking activity.
District Judge O'Toole, in vacating the restraining order this morning, essentially ruled that the Computer Fraud and Abuse Act does not apply to speech and that the MBTA had failed to supply sufficient proof to merit other claims with regard to the statute, to merit a restraining order or preliminary injunction.
"It was definitely unfair to use that statute to silence the students," Jesche said. "We certainly hope the next time that people are allowed to present their important research instead of being silenced by bogus lawsuits."
Zack Anderson, one of the students sued in the case (and the second person from the right in the picture above), was elated by the judge's decision today.
"We're glad the court actually saw things as they should be," the 21-year-old told Threat Level. "We're glad the court read the law correctly."
Although the restraining order has gone away, it doesn't mean the students are completely in the clear. Still standing is a lawsuit the MBTA has filed against them, accusing them of hacking its system and causing damages.
----------------------
I am happy to see this result, but I fear the MBTA won the battle (even tho they lose the war).
They were successful in keeping the students from giving their talk @ Defcon - which should not have been the case.
Lets look back. The MBTA ended up releasing more information than the students ever intended to make public...so why did the MBTA do it?
I can only guess it was an attempt to save face in front of an informed public (i.e. Defcon).
But this is a battle, they clearly lost as well.
No comments:
Post a Comment