Monday, August 11, 2008

Court restrains MIT students from showing off MBTA hacks

By Mass High Tech Staff

A federal court ordered three MIT students and the school to cancel a presentation on Saturday about hacking the Charlie Card system at the DEFCON security conference in Las Vegas.

The trio — Zack Anderson, RJ Ryan and Alessandro Chiesa — had planned a presentation about vulnerabilities in the Massachusetts Bay Transportation Authority’s fare payment system, which uses what the MBTA calls Charlie Tickets and Charlie Cards, according to the Electronic Frontier Foundation, a nonprofit organization advocating for free speech, privacy, innovation and consumer rights in the digital realm. The students had found the vulnerabilities while doing MIT classwork, for which they received an A.

Judge Douglas Woodlock of the U.S. District Court District of Massachusetts on Saturday issued a temporary restraining order requiring the students not to disclose for ten days any information that could be used by others to get free subway rides.

The MBTA sued the students on Friday, saying they had violated the Computer Fraud and Abuse Act by disseminating information that could be used to defraud the MBTA of fare revenue. 

The students say they wanted to share their academic work while withholding enough information to prevent subway fraud. The EFF calls the ruling unconstitutional, saying the court has violated the students’ first amendment right to free speech.