A federal judge Thursday refused to lift the gag order imposed on three students at the Massachusetts Institute of Technology barring them from disseminating information about the security flaws they identified with Boston’s “T” mass transportation system.
The temporary restraining order had been granted by another judge on Saturday after the Massachusetts Bay Transit Authority found out that the students planned to present their findings at the Defcon hacker conference in Las Vegas. Another hearing is scheduled for Tuesday, when the original temporary restraining order will expire. MBTA is seeking to convert the restraining order into a preliminary injunction of indefinite duration.
As part of his order Thursday, Judge George O’Toole Jr. ordered the students and their professor to turn over any additional documents relating to their research into security holes and ways to crack security on the system’s CharlieCards.
The students have already produced a five-page memo and a 30-page report, but the MBTA requested that they produce additional documents. While there other documents, such as the students’ class paper, the code they had planned to distribute, and e-mail correspondence, they provide no additional information on how to exploit the CharlieCard’s weaknesses, said Rebecca Jeschke, an Electronic Frontier Foundation spokesperson, in a telephone interview.
In arguing that the restraining order should be removed, EFF attorney Jennifer Granick said the court was violating the students’ First Amendment rights. Jeschke added, “The gag order is an unconstitutional prior restraint on the students’ right to speak.”
The case raises to a new level a long-simmering conflict between security researchers and the agencies that fear an onslaught of malicious hackers. “The students did the right thing,” Jeschke said. “They informed MBTA of their findings; they were planning to withhold information that would allow people to exploit the system.”
Major media sentiment veered toward the…