First, they were told to be quiet. Now, they are being ordered to squeal. Zack Anderson, Alessandro Chiesa, and R.J. Ryan, three MIT students, were ordered yesterday by a U.S. District Court judge to turn over a paper they wrote for a class in which they described how to hack the Boston subway system. Last week another judge stopped the students from presenting their results at Defcon 16, a hacker’s convention in Las Vegas, the Boston Globe reports.
The trio exploited some vulnerabilities in the computer-chip and magnetic-strip systems used to pay fares on the Boston subway and showed how to get a free ride, according to the Electronic Frontier Foundation, which is providing a lawyer for the students. The students and the EFF say the work was done to show the flaws in the system so they could be fixed before a malicious attacker used them. (The paper got an “A” in an MIT computer-science class, the EFF says.) But the Boston transit system sued to stop the students from talking about the research at Defcon, citing a federal law against computer crime. Their argument was that simply talking about the code publicly was illegal transmission of a computer program intended to do harm, and a judge issued a restraining order.
The students, and their EFF lawyer, argue that the trio’s First Amendment rights are being violated and that this is a clear case of prior restraint. They also note that most of the information about the security flaw is already publicly available.
Yesterday a judge ordered the students to turn over the paper and related documents so he could determine whether the students had really broken a law or whether their rights to free speech were being infringed upon. The court set a hearing on the matter for next Tuesday. —Josh Fischman
