MIT Students' Gag Order Lifted

mytrip and several other readers let us know that a judge in Boston has lifted the gag order — actually let it expire — against three MIT students who discovered flaws in the security of the local transit system, the MBTA. We've discussed the case over the last 10 days. "Judge O'Toole said he disagreed with the basic premise of the MBTA's argument: That the students' presentation was a likely violation of the Computer Fraud and Abuse Act, a 1986 federal law meant to protect computers from malicious attacks such as worms and viruses. Many had expected Tuesday's hearing to hinge on First Amendment issues and what amounts to responsible disclosure on the part of computer security researchers. Instead, O'Toole based his ruling on the narrow grounds of what constitutes a violation of the CFAA. On that basis, he said MBTA lawyers failed to convince him on two points: The students' presentation was meant to be delivered to people, and was not a computer-to-computer 'transmission.' Second, the MBTA couldn't prove the students had caused at least $5,000 damage to the transit system."

Comments

They never signed a non disclosure contract

[neoform]

Why would exposing the MBTA's secrets be against the law? Realistically, that's all they've done, they put together a presentation on flaws in their system, security firms do this all the time. Nice to see a judge make the right decision.

Re:They never signed a non disclosure contract

[geogob]

I think the idea was that the information will create prejudice and loss of income for the MBTA. And that hypothesis will probably turn out to be true if they don't don anything about the problem.

Not doing anything about the problem is the most likely course of action at this point. Nice to see that a judge won't be giving out a gag order so easily on someone based on the fact that someone else is not going to do its job (or do it correctly).

Re:They never signed a non disclosure contract

[macdaddy]

Because it's embarrassing to somebody in power. Simple as that.

Re:They never signed a non disclosure contract

[fishbowl]

>Because it's embarrassing to somebody in power. Simple as that.

Somebody without sufficient power to persuade the government agency he works for to become embroiled in a First Amendment case that would take years and cost millions of dollars.

Re:They never signed a non disclosure contract

[Nethemas the Great]

MBTA never contracted them to figure this stuff out neither did DHS provide them a waiver to violate the law. This is no different than any other hacker delivering a list of discovered security flaws to a corporation or government entity. There might be a large crowd of people here on /. (myself included) that believe we have a moral obligation to report vulnerabilities to security. However, the powers that be have deemed that looking is equivalent to exploiting, and/or being accessory to exploiting. This particular incident shouldn't come as a surprise to you.

Re:They never signed a non disclosure contract

[severoon]

So the rational response is to simply take away the option of the agency's weak response in similar situations. Set up a system whereby such information can aggressively and anonymously be made public for anyone that is interested, and leak it anonymously to the parties in control of the situation with enough advance for them to reasonably address the issues at hand.

I think this kind of system would be best for several reasons. (1) We already have the technology required to make it happen (thanks EFF!). (2) If it was discovered by benevolent actors willing to give the authorities a heads-up, it's only a matter of time before bad actors discover it for themselves, and this system encourages swift but not unreasonable response times while trucking no BS. (3) If BS ensues anyway and agency-in-question remains paralyzed and unable to cope, the public is made aware of what is now a public safety concern stemming from a systemically broken agency, which requires a solution to deeper issues that the initial security concern.

Part 3 is really the key to making the whole system work—if the people pay government to do a job, and the government screws it up, then this is the part that holds the government accountable to the people. And not in a way that requires people to be proactive...all they have to do is respond rationally by noticing the ridiculous lapse of responsibility and taking action such as not using the compromised system, which will eventually, and organically, snowball into the problem being fixed. And hopefully with enough hullabaloo that we don't allow the new solution to degrade as completely as what it replaced.

Re:They never signed a non disclosure contract

[jonwil]

The question is, is there any way to fix the broken system that does not involve replacing the cards and/or equipment (which would be big $$$).

Re:They never signed a non disclosure contract

[geogob]

Fully correcting the problem is, as you point out, most likely difficult with the systems already in place. On the other hand a lot of corrective measures can be implemented to improve the current systems as well. Many ideas and suggestions were given to the MBTA administrators by the group of MIT students.

Simple things to improve physical security require only minimal investment (things like making sure employees lock the doors as they should). That was an important point of their presentation: It's not all about hacking the card system or equipment.

Re:They never signed a non disclosure contract

[douglaid]

Because it advertises flaws to hackers? I am sure that hackers keep a close watch on such antics.

What MIT did was to silence whistle-blowers, exactly as in the Texas credit card case.

Re:They never signed a non disclosure contract

[hesaigo999ca]

I think its great that this happened, now we have a precedent that when one of us (hak0rs)
wants to point out a flaw to the firm in question to force their patch or fix of it, this will help protect those people who would want to see better systems in place.

Now where is my credit card, i think I will want to show my cc company that it is very easy to commit fraud on their cards.....maybe Ill make it into a power point presentation too!

Re:They never signed a non disclosure contract

[rcw-work]

"Most truths are so naked that people feel sorry for them and cover them up, at least a little bit."
-- Edward R. Murrow

They can't hold their talk now, can they?

[Anonymous Coward]

How is the MBTA going to correct that mistake?

Re:They can't hold their talk now, can they?

[Ukab the Great]

No clue. Litigation tends to be the last refuge of the incompetent.

Re:They can't hold their talk now, can they?

[pilgrim23]

Query: What exactly was the flaw under dicussion?

Re:They can't hold their talk now, can they?

[Anonymous Coward]

Query: What exactly was the flaw under dicussion?

Question: Why do you prefix your questions with query?
Statement : I find it sorta redundant.

Re:They can't hold their talk now, can they?

[Anonymous Coward]

Both the magnetic stripe card and the chip card used for electronic payment of public transport fares in Boston are flawed and allow several types of attacks which result in free rides. The hack of the chip card is an implementation of an older, less exploitative hack of the Mifare classic chip which is used in many public transport systems and other prepaid applications all over the world.

Re:They can't hold their talk now, can they?

[Anonymous Coward]

I find people saying "Can I ask you a question?" is worse.

My response is often "You just did."

And of course they immediately say "Can I ask you another question?" to which you reply "You just did."

Finally they say "Can I ask you 2 questions?"

And having already identified yourself as a jerk you say "No."

Re:They can't hold their talk now, can they?

[Anonymous Coward]

It's just another way of saying, "Can I pick your brain?" or "Do you have time to discuss something?"

Re:They can't hold their talk now, can they?

[pilgrim23]

Thank You.
Media contained much hullabaloo about the flaw, but no clear explanation of what was the nature of the flaw...till now.
And to the other posters: I considered my way of phrasing the interrogative clear and unmistakable English. If it was not, then I apologize for any confusion.

Re:They can't hold their talk now, can they?

[PopeRatzo]

Litigation tends to be the last refuge of the incompetent.

Here is evidence that a low UID does not insure a clear mind.

Maybe you should have said "frivolous" litigation is the last refuge of the incompetent"?

Litigation is one of pillars which holds up a Rule of Law and provides some path to fairness and justice in a free society. Considering the startling consolidation of social power in the hands of corporate ownership and authoritarian fanatics, you may yet see what it's like to live in a society without litigation. I guarantee you're not gonna like it, Ukab.

Re:They can't hold their talk now, can they?

[Anonymous Coward]

In Spanish, they use the upside down question mark for this purpose.

Re:They can't hold their talk now, can they?

[geobeck]

Litigation is one of pillars which holds up a Rule of Law and provides some path to fairness and justice in a free society... Considering the startling consolidation of social power in the hands of corporate ownership and authoritarian fanatics, you may yet see what it's like to live in a society without litigation.

Protracted litigation is only possible with enough money. And who has that kind of money besides corporate owners and authoritarian fanatics?

Re:They can't hold their talk now, can they?

[Tenebrousedge]

Your English is both clear and unmistakable. That may have been your problem. Next time, consider adding in an inane meme, such as:

"Imagine a beowulf cluster of MBTAs!"

or

"The MBTA is not a big truck. It's a series of tubes!"

Also, consider to add several speling and/or grammatical error. This will lend to the impression that you are either a caffeine-soaked systems engineer who has been sitting in front of a terminal for eighty straight hours, or a semi-literate American of the species cellarcola nerdus, both of which are held in high regard here.

Accordingly, the dialect best suited to effective communication on slashdot is lolspeak.

Re:They can't hold their talk now, can they?

[Anonymous Coward]

Maybe he's been playing too much KOTOR:

http://en.wikiquote.org/wiki/HK-47

Re:They can't hold their talk now, can they?

[recharged95]

And that's why Justice is blind. The incompetent actually does have rights! Unfortunately.

Re:They can't hold their talk now, can they?

[Thomas Charron]

That's not a low UID. lol.

Re:They can't hold their talk now, can they?

[Anonymous Coward]

Mine is even lower.

Re:They can't hold their talk now, can they?

[PitaBred]

I tend to do the "You just did, and in doing so you have used up your quota for the day. Try again tomorrow."

I usually don't stick to it, unless they're really annoying.

Re:They can't hold their talk now, can they?

[severoon]

How about: "I am not taking questions at this time, and furthermore, I demand reparations for the query already posed."

Re:They can't hold their talk now, can they?

[elliotm00]

I usually walk right out if I get the "You just did" response. Life is too short for this kind of aggravation.

Question: so what am I doing here?

Re:They can't hold their talk now, can they?

[Anonymous Coward]

I find people saying "Can I ask you a question?" is worse.

My response is often "You just did."

And of course they immediately say "Can I ask you another question?" to which you reply "You just did."

Finally they say "Can I ask you 2 questions?"

And having already identified yourself as a jerk you say "No."

Yes, I have had this game played on me at work. Your last line is incorrect, you must ask, "Can I ask you 4 questions?" This covers the prior two, that question itself, and the *real* question. It can be entertaining when we play this for visitors.

Re:They can't hold their talk now, can they?

[Anonymous Coward]

I always just begin my first question with, "May I ask you another question?"

Re:They can't hold their talk now, can they?

[mrbobjoe]

Litigation tends to be the last refuge of the incompetent.

Maybe you should have said "frivolous" litigation is the last refuge of the incompetent"?

Maybe the competent try it earlier?

Re:They can't hold their talk now, can they?

[IconBasedIdea]

Np, litigation tends to be the FIRST refuge of the incompetent.

good

[dmitrygr]

About time! The whole idea was crazy. If i were them i'd "accidentally" leak it if this did not happen... This sort of information should be freely available to encourage the system being fixed...

Re:good

[Dogun]

Actually, if you had access to PACER, you could read the version of the presentation the students gave to the MBTA, including the secret key and a few other details that the MIT students were intending to leave out of the DEFCON presentation.

IOW, the information is already leaked, and it was the MBTA that leaked it.

I use the past tense above because I don't have access to PACER and I very much hope they got around to censoring that bit of info from the MBTA's submissions.

Re:good

[Ortega-Starfire]

They did not.

http://government.zdnet.com/?p=3942

Re:good

[Anonymous Coward]

They did not.

http://government.zdnet.com/?p=3942

Impressive. Can the MBTA be sued for stupidity (or anything?)?

Working As Intended

[_Sprocket_]

Of course, this is a victory for the MBTA. They've managed to derail the conference presentation. Objective met.

We all know this will effectively bury the information. Bureaucrats understand that communication is impossible outside of face-to-face meetings. There's nothing that could possibly allow dissemination of this potentially damaging (read: embarassing) information now that the conference is over. Situation handled. Bullet dodged.

Re:Working As Intended

[neoform]

I'm not so sure about that. The conference was "derailed", but all the information that was going to be presented was made available to everyone. Not only that, but there was a tremendous Streisand effect.

Re:Working As Intended

[Shadow Wrought]

Yep. They needed this result before the conference. Unfortunately, the Courts work at their own pace, and since the MBTA published everything in court documents already public, they will have only themselves to blame if anything nefarious happens.

Of course if there had been an Ignignokt slide they would've all been shot.

Re:Working As Intended

[rootofevil]

agreed on the streisand effect.

i even heard a well written and clearly informed piece on NPR, that discussed the potential constitutional issues and the chilling effect this would have on any security research.

granted NPR doesnt have the distribution of fox or cnn, but its still more mainstream than /.

Re:Working As Intended

[jacquesm]

*whoosh*...

Re:Working As Intended

[_Sprocket_]

You're not thinking like a bureaucrat.

Re:Working As Intended

[postbigbang]

Umm, actually, NPR is heard in more places in the US and on Earth than Fox and CNN. It can also be streamed easily. NPR is also sent through transulator sites to remote parts of the US that extend the reach where no one else goes, like rural Nevada, California, and so on.

AFR and AFN also carry a lot of NPR, and news feeds also extend to the CBC, BBC, RCI, and other sites/broadcasters as well. The news is out. As it should be.

Re:Working As Intended

[Anonymous Coward]

Of course if there had been an Ignignokt slide they would've all been shot.

Congratulations! You are the first person to make such a joke. I think you are too smart for Slashdot. Have you tried Fark.com?

PS - No, I am not from Boston, so a reply such as "wow I touched a nerve" or some other such nonsense is not applicable.

Re:Working As Intended

[mgblst]

Yes, you are an idiot.

Re:Working As Intended

[rootofevil]

do you mean 'can be heard' or 'has more listeners'?

its distribution may be larger, but i suspect that the tv channels have a larger mindshare.

not being a radio/tv exec, i dont exactly have those numbers laying around.

Re:Working As Intended

[postbigbang]

TV channels don't necessarily have more 'mindshare', but we won't quibble. NPR has a wider reaching audience as it's radio. Fox and CNN aren't strongly into radio markets, rather TV. This major difference is the crux of my remark. Additionally, NPR's audience reach is farther. Demographically, it's also larger, and in terms of international radio broadcasters, it has a large reach largely due to AFN. VoA is somewhat different, of course-- as are its motives.

Re:Working As Intended

[Anonymous Coward]

whoosh

Good Call

[maz2331]

It looks like the judge made a pretty good call in this case. What he really rejected was the MTBA lawyers' assertion that it was an act prohibited by the law, and not exposing the agency's incompetence.

Really, bugs aren't fixed by just hiding them.

FTA:

MBTA said in documents filed with the court said that fixing the security flaws would take five months. ("Students have the ability to cause significant harm to the CharlieTicket system, during the roughly five-month window that remedial actions will require.")

Actually, the fact that they implemented a seriously flawed system is the problem, and the students' bringing it to light may suck for MBTA. The proper solution is for them to fix their system and, if necessary, sue the vendor for the costs.

Re:Good Call

[Hatta]

And the judge before him quite plainly made a bad call. A gag order in this situation is quite plainly unconstitutional, yet there's no recourse for the victims of that ruling. This is a fundamental problem with our system.

Re:Good Call

[dontPanik]

The proper solution is for them to fix their system and, if necessary, sue the vendor for the costs.

But won't a hacker always find some sort of way to get around a security system?
Your solution is very idealist and to ask the MBTA to fix every problem that a hacker finds is asking alot.
Anyways, do you really want companies sueing contractors every time a hacker finds a bug in their system?
I know I don't want to keep fueling our bloated legal system.

Re:Good Call

[_xeno_]

MBTA said in documents filed with the court said that fixing the security flaws would take five months.

I'd love to know how they plan on fixing it. The problem is that, rather than paying for the MIFARE cards with working encryption (3DES or AES) they went with the cheapest system which uses custom 48-bit encryption.

Short of replacing every single CharlieCard in existence, there is no fix.

What the MIT students did that went beyond cracking the MIFARE encryption was to reverse engineer what data was stored on the card.

Which means, knowing the T, that the "solution" will likely be to rearrange the data and continue using the same weak encryption, while lobbying for a new state law that makes reverse engineering illegal.

Re:Good Call

[Lobster Quadrille]

In this case, yes.

The vendor has been selling a flawed system, both in design and implementation. Car manufacturers can't use incompetence as an excuse when their cars explode, and the vendor can't either.

In fact, the vendor has known about the flaws for quite some time, but has not fixed them (nor disclosed them).

It sounds to me like they deserve to be sued for damages.

You're right that we evil hackers are going to find ways around it anyways, but in this case, the vendor is grossly negligent, and the MBTA is trying to blame the people who found the problem, rather than the ones that created it.

Re:Good Call

[Atlantis-Rising]

In what way is it unconstitutional?

Re:Good Call

[Fulcrum of Evil]

I wonder if they'll clue in to the fact that reverse engineering is a fundamental part of their high tech industry.

Nah...

Re:Good Call

[jellomizer]

The real question is how many people will bother getting a magnetic card writer de-encrypt the card, and rewrite their card just to ride the T. Unlike say an internet vulnerability you can get a small group of people causing huge problems, Unless they start selling these things on ebay or whatnot it is rather labor intensive and expensive to be to a dangerous level.

Re:Good Call

[tinkerghost]

First amendment grounds, the problem is that they issued an order that engaged in prior restraint. You can sue someone for something afterwards, but you generally can't require them to not say it at all. This judge issued the TRO so he had time to look at the facts - the MBTA was arguing something novel, when he looked at the facts, he tossed the MBTA's argument out the door. The problem is that the TRO became a defacto RO because the conference is already over.

Re:Good Call

[Hatta]

Prior restraint is a violation of the first amendment protection of free speech.

Re:Good Call

[iminplaya]

For starters it violated the 1st, 9th, and the 14th(section 1) amendments.

Re:Good Call

[PMuse]

It looks like the judge made a pretty good call in this case. What he really rejected was the MTBA lawyers' assertion that it was an act prohibited by the law . . .

Interesting that the judge waited this long. He could have lifted the TRO days ago when the EFF lawyers first appeared in court. The judge really gave MBTA every opportunity to come up with something.

And they had nada.

Re:Good Call

[MarkvW]

The question of constitutionality was NOT ADDRESSED.
The judge held that pleaded statute did not support the injunction.

You can't just walk into court and enjoin somebody from doing something. To get an injunction, you have to establish two things:
(1) The law authorizes the injunction based on the facts you have; and
(2) The constitution does not bar you from getting that injunction.

The MBTA lost because they could not prove the first thing.

Now we'll see if MBTA wants to torture these three students with a full-blown lawsuit.

Re:Good Call

[Anonymous Coward]

No. The judge made the wrong call. DEFCON is now over. The students' audience is gone. MTBA have shut them up for as long as they need to, there's no real reason for them to try and keep the lid on this any longer.

The correct call would have been the settle the question quickly enough that the temporary order would (if appropriate) be lifted in time for the students to still give their presentation to their intended audience. This has played entirely into the MTBAs hands. Now all they have to do is wait until the MIT students organise another appropriate audience, bamboozle another judge into giving them a short-term (but long enough to last until the audience is dispersed) gagging order, rinse & repeat.

It's the whole free-speech-zones thing again, it's just the free-speech-zone is defined in time rather than space. If you can be shut up until the person you actual want to talk to is no longer in a position to listen, you don't have free speech.

Re:Good Call

[geekoid]

The article I read said 6 bit encryption... 64 possibilities.

Re:Good Call

[Hatta]

You can't just walk into court and enjoin somebody from doing something.

Apparently you can, because the MBTA did. DEFCON is over and the damage is done.

To get an injunction, you have to establish two things:
(1) The law authorizes the injunction based on the facts you have; and
(2) The constitution does not bar you from getting that injunction.

Yet the judge issued the injunction without either, and like I said, there's absolutely no recourse against this incompetent judge.

Re:Good Call

[_xeno_]

You were reading about the CharlieTicket, a paper card with a magnetic stripe. The data on them was found to be unencrypted and "protected" by a 6-bit checksum.

The CharlieCard, on the other hand, is a MIFARE Classic card. It uses a shared secret key which the card and reader use to authenticate each other. This key was discovered to be 48 bits long.

Re:Good Call

[Anonymous Coward]

Nonsense, the presentation outlined a number of ways to fix the problem.

Besides, they could immediately limit damages to a reasonable amount simply by corroborating with a central server how much money is stored on a card with ID . They can't catch it the first time it's used without introducing delays in letting people through the turnstiles, but they can certainly use it to catch people that use the cards *twice* by having a blacklist of known hacked cards.

I'm no security expert, but I think that such a simple fix would limit the damage from counterfeit cards to basically zero -- who would be willing to do it after the first person was caught.

Besides which, I suspect the number of people with the technical expertise to hack the cards and who also aren't able to get a job good enough that they need to sweat the all of $1.70 it costs to ride the T anywhere... well, I suspect they aren't in it to save a buck.

Re:Good Call

[Repossessed]

SCOTUS determined prior restraint unconstitutional a long time ago. Given the the case where they determined this involved the workings of a hydrogen bomb, exposing a flawed payment system doesn't even come close to justifying an override. And since MTBA is a government organization, the usual corporate protections don't apply.

That said, the first judge made the right decision, which is a very temporary restraining order to allow time to determine what is really going on. MTBA played the system by waiting till just before Defcon, and hopefully a counter suit will be able to use that to its advantage.

Re:Good Call

[FrankBama]

Maybe not as big an issue as thought -- it seems you'd start with the paper then move on to plastic. From the article:

T officials concluded that the students had, in fact, found a way to break the paper Charlie card system, but had only found theoretical methods for breaking the plastic Charlie card, an RFID smart card that can have T fares electronic added to it.

Re:Good Call

[POTSandPANS]

I don't know the details on this attack, but from what I've read it seems to be a magnetic card, and seems to have no verification. It seems to me that on a system like this, encryption only stops you from really knowing what data the card contains. What would stop you from just making exact duplicates of a loaded card and selling those? If somebody were in this for the money, I'm not sure there would be any need to decrypt anything.

maybe I'm missing something..?

Re:Good Call

[cgenman]

Mod parent up.

While I dislike public money going to a bloated legal system, it's about time we lost the shield of protectionism around companies selling broken products to the government under false promises. A 1 billion dollar project should remain a 1 billion dollar project, not bloat out to 10 billion. A secure card system with fundamental known security flaws should not fall to the public to pay for.

We get milked out of countless dollars due to contractors making unrealistically lowball price quotes, then passing on high profit margins at a much higher price once locked in. Or implementing projects and products they know are flawed without disclosing or fixing them. If you look at the presentation, the paper ticket passes aren't even encrypted, and store value locally!

Re:Good Call

[Anonymous Coward]

In this case, yes.

The vendor has been selling a flawed system, both in design and implementation.

That is impossible to tell without looking at the contracts. Maybe they had the requirement that cards may not cost more than 2c. Or the minimum security was specified in their contract. Or the cards had to work with preexisting systems that could not handle better encryption. Or the MBTA designed and implemented the system themselves, so there's nobody but themselves to blame.

HA!

[AndGodSed]

the basic premise of the MBTA's argument: That the students' presentation was a likely violation of the Computer Fraud and Abuse Act, a 1986 federal law meant to protect computers from malicious attacks such as worms and viruses.

Yeah - real successful law that.

Re:HA!

[snarkh]

That's why we don't have worms and viruses any longer.

Bad Lawyers?

[TheNecromancer]

Lawyers for the MBTA claimed Tuesday they had proof the students had violated the law, but stopped short of specifying what they did.

Wow, I can just see these lawyers:

Lawyer: "They broke the law. We have the proof."
Judge: "What is your proof?"
Lawyer: "Um, they...uh, yeah, they just broke the law."

Re:Bad Lawyers?

[Anonymous Coward]

Not much different from a typical RIAA file-sharing case, then.

Re:Bad Lawyers?

[daveschroeder]

Well, the third slide of their presentation jokes about hoping their talk isn't "evidence in court", and the fifth slide proudly trumpets, "AND THIS IS VERY ILLEGAL!"

I realize that here on slashdot, its fashionable to always err on the side of disclosure in the face of any other concerns, and I can certainly argue myself for the benefits of talking about such issues instead of sweeping them under the rug and pretending they don't exist; the notion that if these students can figure it out, anyone can.* Indeed, many compelling such arguments can be made.

However, there is a balance; namely, that entities, even (especially?) public entities providing infrastructure and transportation services, don't like their vulnerabilities paraded around for all to see. Security through obscurity isn't security on its own, but security through obscurity is a time-tested and reliable component to any system of security, and it is always balanced with cost, difficulty, technical issues, and other concerns.

It's easy to sit here and say that because they were so "cheap", they are getting what they "deserve" by having heroic, bright, geeky MIT students humorously show how they can own them. Has anyone ever considered that public agencies are pulled in n different directions -- including financially and technically -- and sometimes the solution that comes out at the end is simply making the best of what imperfect resources they've got?

When the presenters themselves are not even hiding the questionable legality of what they demonstrate -- even though it's just "talk", like "talking" about how to kill someone with poison, as opposed to doing it -- speech has consequences, and sometimes those consequences will result in things like temporary injunctions, and agencies who serve at the pleasure of the people trying to protect what semblance of security they're able to hold together.

Yes, this is all fun, and clever, and interesting. But why does this seem to be viewed, here, as the MIT students being 100% in the right, and the MBTA being 100% in the wrong?

* This is acually debatable. These are very bright people, and just because they can figure something out, it doesn't at all mean "anyone can". It means people with the means, time, expertise, and will may be able to duplicate what they have done...and will be able to do so a LOT easier when the work has already been done for them.

Re:Bad Lawyers?

[ceejayoz]

Well, the third slide of their presentation jokes about hoping their talk isn't "evidence in court", and the fifth slide proudly trumpets, "AND THIS IS VERY ILLEGAL!"

None of which establishes that they did anything illegal.

"Here's how to grow marijuana - remember, it's illegal!" is VERY different from "I grew marijuana".

Re:Bad Lawyers?

[Fulcrum of Evil]

However, there is a balance; namely, that entities, even (especially?) public entities providing infrastructure and transportation services, don't like their vulnerabilities paraded around for all to see.

Sucks to be them; I don't like paying my mortgage, but I like living in a house.

Has anyone ever considered that public agencies are pulled in n different directions -- including financially and technically -- and sometimes the solution that comes out at the end is simply making the best of what imperfect resources they've got?

It's occurred to me that this is Boston, and they're probably just cheap.

When the presenters themselves are not even hiding the questionable legality of what they demonstrate -- even though it's just "talk", like "talking" about how to kill someone with poison, as opposed to doing it -- speech has consequences, and sometimes those consequences will result in things like temporary injunctions, and agencies who serve at the pleasure of the people trying to protect what semblance of security they're able to hold together.

Why would you grant an injunction (prior restraint) for something trivial like this when publishing bomb plans and advice on how to get away with murder is protected speech?

just because they can figure something out, it doesn't at all mean "anyone can".

Fine, substitute 'any group of 10,000 people has someone who can'. We have 30,000 of those in this country.

Re:Bad Lawyers?

[Mansing]

Lawyer: "They broke the law. We have the proof."
Judge: "What is your proof?"
Lawyer: "Well, thinking about breaking the law is a KIND of proof ...."

Re:Bad Lawyers?

[bob_herrick]

This seems a bit harsh:

It's occurred to me that this is Boston, and they're probably just cheap.

Last I looked, municipalities have limited abilities to raise funds. If they need more money it means spending less somewhere else (which will gore some oxen) or raise taxes and fees (which will gore others). I know I don't vote to approve every bond issue, sales tax increase, or property tax surcharge that gets proposed in my city, and I imagine that might just be true for a majority of voters in Boston.

Everyone works under fiscal constaints, and constraints always mean compromises. While I can understand that the message from the GP post may be unpalatable, it is a legitimate point of view.

Re:Bad Lawyers?

[Fulcrum of Evil]

After the lite brite fiasco, I'm not willing to cut them any slack.

Re:Bad Lawyers?

[Anonymous Coward]

you mean they "pulled a SCO"?

Re:Bad Lawyers?

[MarkvW]

It ALL depends on the context. If I tell somebody how to grow marijuana (even with the silly disclaimer), and I have the intent to help them grow marijuana, then I have committed the crime of growing marijuana under an accomplice theory (assuming that it is a crime).

Another example: If I'm standing in a crowd telling one person how to kill another person, and I intend for the killing to happen, and if the killing does in fact happen, then I committed murder under an accomplice theory. Mob bosses have considerable trouble with this kind of theory all the time. Saying "I told him HOW to kill the victim" instead of "I told him to kill the victim." will NOT shield the speaker if the speaker had the intent to cause the victim to be killed. The speaker is still an accomplice.

So, if I'm standing outside the MBTA and I'm handing out "Here's How to Cheat the MBTA and Get A Free Ride" information and I have the intent to help people cheat the MBTA, then I will be committing the crime of theft (or larceny, and who knows what else) if somebody does actually use my information to steal a free ride.

You ask "how can intent be proven?" The answer is simple: A jury of your peers gets to decide, based on the evidence presented. Intent + Assistance + Commission of the Crime by Another is enough to prove a crime under the law of most states.

The Constitution is the final level of defense for the three students, but that's too much to write about here. Think about the "Hitman" book and the court battles it spawned.

Re:Bad Lawyers?

[PitaBred]

So why aren't the editors of High Times under lock and key? Why do head shops even exist?

There's a limit to how close you can be and still be called an accomplice. There's a reason they didn't disclose the key (or rather, weren't going to in the public presentation). It's the difference between "Here's a lock, and here's how to pick it" and "Here's a lock, here's how to pick it, and here are the tools".

Re:Bad Lawyers?

[PitaBred]

I couldn't afford ethyl alcohol, so I just drank rubbing alcohol.

Sometimes doing the cheap thing is worse than doing nothing, and much worse than doing the correct thing.

Re:Bad Lawyers?

[Nefarious Wheel]

These are very bright people, and just because they can figure something out, it doesn't at all mean "anyone can...

Branch corollary: Just because you can do something, doesn't mean you should.

Re:Bad Lawyers?

[MarkvW]

Constitutional limitations protect High Times and head shops--and I know from personal experience that headshops are often right on the ragged edge of legality.

It is not about 'how close you can be' (whatever that means).

It is about INTENT. If you intend to help somebody else do a crime, and actually encourage or help the other person to commit the crime, and the other person actually does it, then the crime has been committed.

Note that I am not discussing Constitutional limitations on criminal liability.

Re:Bad Lawyers?

[Anonymous Coward]

That kind of things flows down by example from the top. "We know where the WMD are."

Re:the terrorists have won

[Anonymous Coward]

They did win, they hated our freedom, so we limited it. I think you're right, though. Obama will help reverse some of that.

$5000 worth of damages?

[Ramses0]

That's an interesting argument...

Does a mechanic cause $5000 worth of damage when he points out that your axle is broken and needs replacement?

Can you cause damage to a system that has intrinsic vulnerabilities?

Obviously people taking advantage of disclosed vulnerabilities should be punished under applicable laws (as with simple copyright violation) for whatever damages they caused, but I tend to agree that you can't really pin damages on the discloser.

Now some other b.s. charge about reckless endangerment or speech issues, but probably not damages.

--Robert

Re:$5000 worth of damages?

[Anonymous Coward]

Obviously people taking advantage of disclosed vulnerabilities should be punished under applicable laws

Then I guess they should be punished, since the document they distributed admits to defrauding the system. The damages were far less than $5000 from what I saw.

Re:$5000 worth of damages?

[WiredNut]

> Does a mechanic cause $5000 worth of damage when he points out that your axle is broken and needs replacement? Not analogous. How about a mechanic who holds a press conference and explains how to break into your car? Or a locksmith explaining how to break into your house? Not that these situations should be or are illegal, but they are a better analogy if you really want to compare this to consumer product repair or maintenance. Which I don't. But did I guess I did anyway. Damn /.

Re:$5000 worth of damages?

[plutoXL]

Does a mechanic cause $5000 worth of damage when he points out that your axle is broken and needs replacement?

Well, how about if your car had a very bad and insecure locking and starting mechanism, and your mechanic told all your neighbours how to get in and start your car?

Don't get me wrong, I think the gag order was probably stupid - I don't know the whole whole story...

But I do think your analogy is somewhat flawed. :/

Re:$5000 worth of damages?

[cwAllenPoole]

Does a mechanic cause $5000 worth of damage when he points out that your axle is broken and needs replacement?

Only if he hurts your axle's feelings.

Re:$5000 worth of damages?

[Anonymous Coward]

> Does a mechanic cause $5000 worth of damage when he points out that your axle is broken and needs replacement?

SHOOT THE MESSENGER!

Re:$5000 worth of damages?

[multisync]

How about a mechanic who holds a press conference and explains how to break into your car?

I think a better analogy would be writing a book that exposes the reluctance of the auto industry to invest in the safety of their product and their complicity in the deaths of tens of thousands of motorists.

Re:$5000 worth of damages?

[Vegeta99]

His analogy may be flawed, but yours is too!

If your mechanic said your axle was broken and you refused to fix it, in PA, he would refuse to give you an inspection sticker - thus telling everyone in the public that you're too much of a tool to fix your broken stuff. Same principal.

Re:$5000 worth of damages?

[plutoXL]

Well, not the same principle. In his analogy publishing the information tells everyone that you're a tool.
In mine it makes the exploit of your toolnes public knowledge.

The point of the case is not just that those guys pointed to an unfixed security hole, but that they were about to publish a way to abuse that security hole.

Note that I'm not getting into rights and wrongs here. :)

Re:$5000 worth of damages?

[TibbonZero]

You mean like the time I had a cop show me how to use a slimjim and told me where I could buy them?

Win the battle but lose the war!

[Newer Guy]

Even though the judge let the gag order expire, by issuing it in the first place, the MBTA essentially got what rhey wanted-to keep the information from those participating in Defcon.

Win the battle, lose the war

Re:Win the battle but lose the war!

[Lobster Quadrille]

Except the information still got out, through several means, got more press attention that it would have received otherwise, and made them look like morons.

They lost the battle, the war, and a fair amount of blood.

Re:Win the battle but lose the war!

[Sylver Dragon]

Of course, by suing, they have probably created far more interest in the problem than a presentation at Defcon would have. The presentation would have been one of several interesting presentations, but would probably not have gained wide internet fame. Now, there are a bunch of people following it, and when the information hits the internet more people will look at it.
I'd say that this is more the other way around: Lose the battle, but win the war.

Re:Win the battle but lose the war!

[mr_mischief]

If only there was some way to disseminate information to a technical audience across long distances electronically...

Re:Win the battle but lose the war!

[Anonymous Coward]

the MBTA essentially got what rhey wanted-to keep the information from those participating in Defcon.

Win the battle, lose the war

Not really. Those who are interested in the info will still get it. In the end, nothing was accomplished by this legal nonsense.

Re:Win the battle but lose the war!

[geekoid]

too bad those neophytes that go to Defcon have no way to communicate with computers~

Re:Win the battle but lose the war!

[Anonymous Coward]

I'd say they were subject to the Streisand Effect.

Their goal of keeping the information out of the mainstream 'publics' eye, backfired.

Actually, I'd like to thank the MBTA for the amount of press this has garnered, and the added curiosity it's given me. I probably would have only skimmed over the information before, instead of going to great lengths to review the much more in depth background of the subject.

Thank again, MBTA!

Re:Win the battle but lose the war!

[PitaBred]

Hell, they even made it worse with their submission of their own checksums and attached to the court documents, placing them under public purview. That wouldn't have been released if they hadn't used the law as incompetently as they created their systems. It's like the Streisand Effect x2.

I wish criminals were as stupid as our politicians.

Re:Win the battle but lose the war!

[imunfair]

They didn't even get that. A journalist from Europe gave the talk for them, essentially. Apparently systems over there use the same insecure cards, so he gave a pretty detailed presentation about those. Needless to say the crowd at Defcon laughed and applauded when it was announced that he would be giving a talk since the students couldn't.

When did we stop being people?

[howardd21]

I like this from the article:
On that basis, he said MBTA lawyers failed to convince him on two points: The students' presentation was meant to be delivered to people,...

Wasn't this a presentation planned for the DefCon conference, with a lot of /. like geeks?

Re:When did we stop being people?

[eat here_get gas]

yes, but as was pointed out in earlier comment (i didn't RTFA), they were going to leave out the critical details already published by the MBTA....

Re:When did we stop being people?

[gnarlyhotep]

For the love of Aphrodite's heaving bosom, do you read entire sentences?

meant to be delivered to people, and was not a computer-to-computer 'transmission.'

The failed point was that the communicaiton in question was from one person to another, and not from one computer to another.

Card Cost?

[maz2331]

Replacing all of the cards should be a minimal cost compared to, say, paying for one day's worth of fuel or employee health insurance.

Speak Anyway

[autocracy]

I think they should have just gone ahead with the presentation. Contempt of an invalid order doesn't stand, does it?

Re:Speak Anyway

[NeoSkandranon]

If you're willing to gamble that it will later be found invalid...

Re:Speak Anyway

[harlows_monkeys]

It wasn't an invalid order.

Re:Speak Anyway

[nomadic]

Contempt of an invalid order doesn't stand, does it?

The Federal courts have made it quite clear that you must obey an injunction, even if it is ultimately overturned on appeal.

Re:Speak Anyway

[Anonymous Cowpat]

So you essentially have no freedom at all. Great.

This is why the courts should never be allowed to hear aspects of cases which hinge around the extents of the court's authority.

What's the objective difference between an unlawful order and one which is based upon shakey facts which are later found to be untrue?
To put it another way:
There must be 'facts', and there must be a law which allows an injunction given those 'facts'. What's the difference between an order which is issued without any basis in law, and one which is issued wrongly because the 'facts' were wrong.
If judges are free to issue orders which are in defiance of the law, and have higher courts uphold contempt judgements against people for disobeying those orders, there is no rule of law. Just petty tyrants with essentially unlimited power.

An example. A judge orders you to stop breathing. This is clearly not a lawful order. You appeal to a higher court, and 24 hours later sucessfully overturn it. In the mean time (let's assume that you don't choose to asphyxiate yourself), you've breathed many hundreds of times. The first judge finds you in contempt. The higher court supports the contempt ruling because you must obey an injunction until it's overturned and you go to prison. Either you're wrong, or the system is very broken. I hope it's the former (nothing personal).

Re:Speak Anyway

[nomadic]

This is why the courts should never be allowed to hear aspects of cases which hinge around the extents of the court's authority.

Well who else is going to do it? That's the first question a judge asks, "do I have subject matter jurisdiction here?"

If judges are free to issue orders which are in defiance of the law, and have higher courts uphold contempt judgements against people for disobeying those orders, there is no rule of law. Just petty tyrants with essentially unlimited power.

And if people are free to disregard orders because they believe the judges were wrong in issuing them, then there is no rule of law.

An example. A judge orders you to stop breathing. This is clearly not a lawful order. You appeal to a higher court, and 24 hours later sucessfully overturn it. In the mean time (let's assume that you don't choose to asphyxiate yourself), you've breathed many hundreds of times. The first judge finds you in contempt. The higher court supports the contempt ruling because you must obey an injunction until it's overturned and you go to prison. Either you're wrong, or the system is very broken. I hope it's the former (nothing personal).

Well now that's just silly. That's like saying a bridge is "very broken" because it can't handle a weightload of a billion tons. Law isn't physics, it can't make provisions for impossible values of variables, and it's based on handling plausible situations. Besides which, the situation you raise has obvious due process problems, and the Constitution trumps both statutory law and equity.

All I'm saying is that as a general premise you are expected to obey an order until it is vacated or reversed, This doesn't mean that failure to do so means automatic criminal contempt and the appellate court won't overturn it. It just means that you can't lightly disobey court orders because you're second guessing the judge. In fact, speaking as someone who actually works in the field, I can tell you that contempt citations are frequently overturned, so much so that trial courts are hesitant to actually issue them. But you're not going to get too much sympathy from the appellate court by saying "I didn't obey the order because the judge was wrong," even if the appellate court agrees that the judge was wrong.

Re:Speak Anyway

[Anonymous Cowpat]

Well who else is going to do it? That's the first question a judge asks, "do I have subject matter jurisdiction here?"

I don't have an answer to the first question, but it's plain common sense that a person who has a vested interest in a decision going one particular direction should not be allowed to make that decision.
A judge may ask that question first, but there have been numerous examples where any objective observer will quickly conclude 'no', but the judge has decided 'yes' instead.

And if people are free to disregard orders because they believe the judges were wrong in issuing them, then there is no rule of law.

I never said that they should be free to disregard them because they think they're unlawful, I say they should be free to disregardthem because they are unlawful. I agree that to allow someone to stand up and say "I didn't obey the order because I didn't think it was lawful" and have the appeal judge reply "oh, well, if you thought it was unlawful that's ok then" would be a nonsense. But for someone to be able to stand up and say "I didn't obey the order because it was unlawul, here's why..." and have the appeal judge reply "you're right, that was unlawful, no charge to answer" is plain common sense.

Order -> ignore -> appeal -> lose -> prison
The rule of law is fine.

Order -> ignore -> appeal -> win -> *nothing*
The rule of law is fine

Order -> ignore -> appeal -> win -> prison
Rule of law is broken, and the system entirely ass-backwards.

Order -> obey -> appeal -> lose -> *nothing*
The rule of law is fine

Order -> obey -> appeal -> win -> restitution
The rule of law is fine

Order -> obey -> appeal -> win -> *nothing*
Rule of law is broken

Law ought to be as robust as physics - if your theory can't handle any input parameters between the boundaries of reality then it isn't very good. If you have a theory which applies at high temperatures only (say), you don't waltz in and try to apply it to a low temperature system anyway so that you can make a complete hash of it and blame the input data.

My example is extreme, it's not silly. There's nothing to stop a judge putting pen to paper and writing "the defendant, Smith, is enjoined not the breathe. It is so ordered. Signed, Judge Bloggs". In the model that that defendants must obey all orders until they are overturned, Smith will be dead before he can even lodge an appeal.
That is either not an accurate depiction of the model at hand, or it is and the model is broken.
When you get an implausible situation, does the person applying the law accept that the law as written isn't meant for this situation? or just blithely go in an apply it badly anyway?

I wasn't trying to argue that was in any sense a lawful order. Constitutional issues could get it overturned, but if defendant Smith is still bound to follow it until it's overturned, he's still going to prison or the morgue.

Of course, if it's a general premise, not a law (oh, the irony), then the whole discussion is largely moot.

But you're not going to get too much sympathy from the appellate court by saying "I didn't obey the order because the judge was wrong," even if the appellate court agrees that the judge was wrong.

An appeal judge that hypocritical (or that incapable of cognitive reasoning) should not be in charge of watching the rock which keeps tigers away, let alone a court of law. And that is why (returning to my point at the top), the validity of idea that the courts should be assumed to be right until proved wrong (and should be allowed to punish people for not obeying them when they were wrong, but hadn't been proved to be so at the time) is not a decision which should be left up the courts.

Re:Speak Anyway

[nomadic]

I don't have an answer to the first question, but it's plain common sense that a person who has a vested interest in a decision going one particular direction should not be allowed to make that decision.

A judge has no vested interest in a decision going one particular direction or another. They're not paid by the case. If they find they don't have jurisdiction, they'll deny the application for the restraining order and move on to the next case.

I never said that they should be free to disregard them because they think they're unlawful, I say they should be free to disregardthem because they are unlawful. I agree that to allow someone to stand up and say "I didn't obey the order because I didn't think it was lawful" and have the appeal judge reply "oh, well, if you thought it was unlawful that's ok then" would be a nonsense. But for someone to be able to stand up and say "I didn't obey the order because it was unlawul, here's why..." and have the appeal judge reply "you're right, that was unlawful, no charge to answer" is plain common sense.

The Supreme Court addressed that issue in Walker v. City of Birmingham, holding that "in the fair administration of justice, no man can be judge in his own case, however exalted his station, however righteous his motives, and irrespective of his race, color, politics, or religion. This Court cannot hold that the petitioners were constitutionally free to ignore all the procedures of the law and carry their battle to the streets. One may sympathize with the petitioners' impatient commitment to their cause. But respect for judicial process is a small price to pay for the civilizing hand of law, which alone can give abiding meaning to constitutional freedom." In Howat v. Kansas the Court held "An injunction issued by a court of general jurisdiction and equity powers upon proper pleadings and served upon parties within the jurisdiction must be obeyed, even if erroneous and based upon an invalid statute, until set aside by orderly review."

And the law of the land, whether you agree with it or not, is that gag orders aren't automatically unconstitutional. You're always going to be able to come up with arguments as to why the injunction is invalid; it's up to the trial judge to decide how convincing those arguments are, and he or she is the one issuing the injunction. If you think you

It's a question of balancing; is it more important to promote the rule of law by requiring people to obey court orders until they're vacated, or is it more important to ensure that absolutely, positively nobody is ever imprisoned for a wrongful contempt charge. The courts pick the former, and I have to say I agree with them. You obviously believe in the latter, which is your right, and if you feel that strongly about it you should petition your representative to pass a law to fix the problem.

And though it may offend your sense of physics-like consistency, in City of Birmingham the Court implicitly recognized that where an injunction on its face is completely and transparently invalid (like your enjoined-from-breathing example), then you don't have to follow it.

I wasn't trying to argue that was in any sense a lawful order. Constitutional issues could get it overturned, but if defendant Smith is still bound to follow it until it's overturned, he's still going to prison or the morgue.

Or, far more likely, suffer a few fines. I think a Court is far more likely to find civil contempt in this case. And I'm not sure where you're getting the morgue from. But yes, in the end, it IS possible that someone may be briefly imprisoned due to the wrongful acts of an overbearing judge. Just like you may be briefly imprisoned due to the wrongful acts of an overbearing police officer. It's not a sign of a broken system unless you have no way to get out of jail. Fortunately, there are safeguards built into the system that will help you, for example habeas corpus writs. If you are enjoined from breathing, you may be

Re:Speak Anyway

[Anonymous Cowpat]

The judge may not have a personal vested interest in the case, but as a judge; it is always in everyone's interests to grab themselves as much power as they can. (Or, at least, that's how it always ends up. It's just how people (and organisations run by people) are.) He may not have an interest in having jurisdiction over X case of dubious jurisdiction now, but if another case with similar jurisdictional issues comes up that he wants to use to victimise someone, he can now point to this case and say "look, I got jurisdiction in these similar circumstances before".

Why does the fact that the supreme court has found wrongly in the past make them not wrong?
The case you cite is not nearly so clear-cut as you make out. There are 4 dissents, 3 of which were signed by 4 justices (all 4 dissents were signed by the chief justice) - it was 5:4 on three points and 6:3 on one.
What you quote is the opinion of a very slim majority of the supreme court, the slim minority directly attack the language of the majority.
"I dissent because I do not believe that the fundamental protections of the Constitution were meant to be so easily evaded, or that "the civilizing hand of law" would be hampered in the slightest by enforcing the First Amendment in this case."

"I do not believe that giving this Court's seal of approval to such a gross misuse of the judicial process is likely to lead to greater respect for the law any more than it is likely to lead to greater protection for First Amendment freedoms. The ex parte temporary injunction has a long and odious history in this country, and its susceptibility to misuse is all too apparent from the facts of the case. As a weapon against strikes, it proved so effective in the hands of judges friendly to employers that Congress was forced to take the drastic step of removing from federal district courts the jurisdiction to issue injunctions in labor disputes. The labor injunction fell into disrepute largely because it was abused in precisely the same way that the injunctive power was abused in this case. Judges who were not sympathetic to the union cause commonly issued, without notice or hearing, broad restraining orders addressed to large numbers of persons and forbidding them to engage in acts that were either legally permissible or, if illegal, that could better have been left to the regular course of criminal prosecution. The injunctions might later be dissolved, but in the meantime strikes would be crippled because the occasion on which concerted activity might have been effective had passed. Such injunctions, so long discredited as weapons against concerted labor activities, have now been given new life by this Court as weapons against the exercise of First Amendment freedoms. Respect for the courts and for judicial process was not increased by the history of the labor injunction."

"The right to defy an unconstitutional statute is basic in our scheme. Even when an ordinance requires a permit to make a speech, to deliver a sermon, to picket, to parade, or to assemble, it need not be honored when it is invalid on its face. Lovell v. Griffin, 303 U.S. 444, 452-453; Thornhill v. Alabama, 310 U.S. 88, 97; Jones v. Opelika, 316 U.S. 584, 602, adopted per curiam on rehearing, 319 U.S. 103, 104; Cantwell v. Connecticut, 310 U.S. 296, 305-306; Thomas v. Collins, 323 U.S. 516; Staub v. City of Baxley, 355 U.S. 313, 319.

"By like reason, where a permit has been arbitrarily denied, one need not pursue the long and expensive route to this Court to obtain a remedy. The reason is the same in both cases. For if a person must pursue his judicial remedy before he may speak, parade, or assemble, the occasion when protest is desired or needed will have become history and any later speech, parade, or assembly will be futile or pointless."

"Under cover of exhortation that the Negro exercise "respect for judicial process," the Court empties the Supremacy Clause of its primacy by elevating a state rule of judicial administration above the right of free expression guaranteed b

Re:Speak Anyway

[nomadic]

I won't do a full rebuttal, because like you I think there's not too much more to say:

I never said there wasn't a counter-argument to what I said, but the fact still remains that most courts follow what I said. The dissent is the dissent, and pointing to a binding majority decision isn't the fallacy "appealing to authority." That would be like if I said, I'm a lawyer so I know better than you, what I say is true. Which I haven't done.

Also, like I said in my post, the courts do make allowances for transparently invalid injunctions. But I'm still not sure what you're arguing for; should the courts' contempt power just be taken away? Should obeying injunctions just be optional? I made an important distinction between contempt as coercion vs. punishment, though you don't seem to think so. Where a judge finds you in contempt for disobeying his invalid order, once the order is vacated the imprisonment ends. There's no coercive justification anymore. In certain circumstances it's theoretically possible that someone would be enjoined, ignore it, have the order reversed, and then have criminal contempt charges filed against them for ignoring the order. In which case the court will likely look at the order itself and see whether it was transparently invalid or not. If it was obviously wrong under both law and common sense, then no, you probably won't be punished. If it was reversed but just barely; if the appellate panel divided on the issue, or wrote a fifty page opinion analyzing a grey area between legal and illegal, then no, I don't think you should be off the hook just because you guessed right about the legality. The statute may be invalid but if the order was reasonable and done in good faith you shouldn't be able to just disregard it.

Where can I find a copy?

[Anonymous Coward]

Okay, so where can I get a copy of the presentation?

Re:Where can I find a copy?

[multisync]

Okay, so where can I get a copy of the presentation?

I think they should go ahead and give their presentation and include the events of the past week in it. In 2006, Steve Rambam was arrested by the FBI minutes before he was to give his "Privacy is Dead" presentation at the HOPE conference. Of course, the charges were dropped - after the conference was over.

He went ahead and gave his presentation a couple of months later.

I am also reminded of the Russian hacker Dmitri Sklyarov, who was prevented (by way of arrest) from giving a presentation at the 2001 DefCon titled "eBook's Security -- Theory and Practice." According to the Wiki page I linked to, "On December 18, 2002 following a two-week trial in San Jose, California, a jury found that Elcomsoft (the company Sklyarov worked for) had not wilfully violated the U.S. law."

So the tactic seems to be abuse the law in order to suppress speech you don't like, since there are apparently no consequences for doing so.

Another possible example of this tactic occurred last week when the IOC attempted to use the DMCA to force YouTube to take down a video about a Tibetan protest at the Chinese consulate in New York. This one may have been a mistake, as the title of the video was apparently "Beijing Olympics Opening Ceremony." But that would make it Trademark - not copyright - infringement, so the DMCA take-down notice was entirely inappropriate and sure gave the impression that their motive was to prevent embarrassment to China, not protect their brand.

Hope and Change ... Change and Hope!

[Anonymous Coward]

-- Many had expected Tuesday's hearing to hinge on First Amendment issues and what amounts to responsible disclosure on the part of computer security researchers. --

Uhm, I suppose those "many" would be people who have no idea what the First Amendment means and that wear tin foil hats and vote for a vague promise of hope and change.

The bigger issue...

[Asmor]

The bigger issue here is how they're going to determine which Charlie cards are legit and which aren't. They can't exactly tell someone with, say, $20 on a charlie card that their money's gone.

Someone could easily get a bunch of charlie cards, put random amounts of money between, say, $20 and $25 (random so that there's no clear pattern which cards are faked and which legit) and then sell to people on the street. $5 for a charlie card with at least $20 on it.

Heck, it probably wouldn't be that hard to convince the buyers that it was legit. "Hey man, my niece was staying here last week and put too much money on this card... It's got over $20 on it, I'll give it to you for $5."

Re:The bigger issue...

[Free the Cowards]

Selling lots of cards below cost is a good way to attract the attention of the police and get put in jail.

This recently happened in Washington, DC. Some clever people figured out how to replicate fare cards. The way they did it, it would have been essentially impossible to catch them. But they didn't want free travel, they wanted cash, so they started selling the replicated cards. At that point the police caught on to what they were doing and now they're in prison.

Re:The bigger issue...

[mgblst]

Not if you do it right. Find someone in college/schools, approach them to sell the cards for you, and split the difference.

You clearly have not sold drugs before?

Re:The bigger issue...

[EMeta]

Then the college students finger you to plea down and you've got a conspiracy charge too. Less chance of getting caught, but higher liability and better trained law enforcement going after you. No thanks.

Should Doctors Not Talk About Medicine?

[EgoWumpus]

You actually make a really good point; what about poison? If one were to discover a poison or pathogen that might kill a human, were it to be utilized or delivered, along with the reasons why and the possible delivery methods, no one would object to sharing that information with doctors.

Further, no one would claim that you were doing something illegal by spreading that information. Ironically, nor would anyone blame the human body for having that weakness; it wasn't planned for, developed around, whatever.

The fact of the matter is that the system is there, it's vulnerable, and we know how it's vulnerable. There is no convincing reason to try and quash that knowledge - if that is even possible. It is immaterial that it took bright people to figure it out. It is immaterial that without a fix money might be lost. What is material is recognizing things for what they are and reacting to the truth of the situation, not trying to maintain a status quo.

And that is why it's perceived that the MBTA is in error here; they're trying to live in a world where the exploit doesn't exist. But that world itself does not exist.

Courts and the Constitution

[Anonymous Coward]

When you go into any courtroom today the last thing the judge wants to hear about is "the Constitution". If you have a decent argument, can afford to go through the appeals process, get your case heard at the Federal district level, and are lucky enough to get the Supreme Court to agree to hear the case, THEN you get to address the Constitutional issues.

This is ass backwards. The Constitution should be the FIRST thing that's addressed in a case like this. Constitutional considerations should trump every law that's ever been passed. You'd avoid messy "precedents", which governs 90% of what happens in the courts, whereby "since so-and-so violated the Constitution 25 years ago and it was OK then, so it's OK now" are allowed to happen.

Every judge in every courtroom in America should have to memorize the Constitution word-for-word and recite it verbatim every morning on-the-record to the court reporter. If they can't do it they shouldn't be judges.

wicked

[Anonymous Coward]

Judge O'Toole KNOWS his tools! ;D
(they teach law at MIT? if not you got someone to hire)

Incredibly dumb

[cdrguru]

The general tone here seems to be that the only security that is worth anything is unbreakable and it is the responsibility of the implementer to make sure any system is secure against attacks. Well, sorry but your front door lock is clearly defective by those standards. As is every single door lock the world over.

See, the security really only needs to be "good enough". What is that? Well, for a front door lock it is enough to keep homeless people out of your house. A determined thief might be able to defeat it in less than a minute but it isn't intended for that - the really determined thief might use a chainsaw to get in just as easily.

The transit system was designed to validate cards and the so-called "security" is probably more of a validation measure rather than a defense against attacks. The idea that attacking the transit system should not be done and should be illegal seems to have gotten lost. What has happened is now the door is open for anyone to duplicate this work and ride free.

So what is the transit system supposed to do? Revamp the entire system at a cost in the millions? Ignore it and hope nobody ever uses this information? I suspect neither is going to happen, but the most sensible outcome would be to replace automation with human ticket agents. Unlikely to happen. I'd guess that millions of dollars will be spent to implement an utterly new, slightly more secure, different system that requires every single piece of hardware and software to be replaced. Which will then be "cracked" within a few months and the details made available to everyone that wants to ride free. The endgame is probably closing the transit system because by its nature it cannot be made completely secure.

I doubt there is an attack-proof and cost-effective solution to the "problem" that is user-friendly and reasonable for a transit system. Why are we so hell-bent on breaking down society that we can't have people just use and pay for a transit system?

Re:Incredibly dumb

[Free the Cowards]

Guess what? If you give a presentation about how vulnerable standard front door locks are, and exactly how you can defeat them, nobody is going to put a gag order on you.

You are entirely within your rights to deploy an insecure system. But other people are entirely within their rights to talk about just how insecure your system is, and what its vulnerabilities are.

You don't get better locks by burying the information about how bad the existing ones are.

Re:Incredibly dumb

[geekoid]

Stop using the locked door analogy with computers, it doesn't work and shows a serious lack of understanding about computer systems. In short: you look like an idiot to everyone who knows better.

This security is not 'good enough' becasue it can be tried easily and repeatably many times in a night.
To use your own stupid ass analogy:
If a person could rob every house in one night, door security would need to be a hell of a lot tougher.
And if you claimed that the doors you sell where secure, then people should know when there not.

They can add a real layer of encryption on the card. You wouldn't need to replace the whole system for this.

You could go towards a cash despencer. You could go to an ATM card.

Funny thing is, this will probably turn out to be a non issue since most people won't do this, and anybody doing it for cash will get caught eventually. The few people who do it just to get themselves free rides won't amount to much.

The biggest person inconvenienced will be accountants when there books don't balance. Even then they will find an acceptable amount to chalk up to free rides and just apply it at the end of the accounting period.

"Why are we so hell-bent on breaking down society that we can't have people just use and pay for a transit system?"
We're not. What we want is to force corporation to have to take security seriously. This is a design flaw and the company the made it should be stuck with the bill to fix it.

Re:Incredibly dumb

[DeusExMach]

Word.

Re:Incredibly dumb

[justinlee37]

Why are we so hell-bent on breaking down society that we can't have people just use and pay for a transit system?

Some people are too poor to pay for public transportation, like graduate students, and the homeless. They are the ones more likely to turn to this solution. For others, it is easier and less risky just to pay.

Nobody is "hell-bent" on breaking down society. They just behave in the ways that reward them.

You obviously don't think like an economist.

Re:Incredibly dumb

[Anonymous Coward]

Stop using the locked door analogy with computers, it doesn't work and shows a serious lack of understanding about computer systems. In short: you look like an idiot to everyone who knows better.

This security is not 'good enough' becasue it can be tried easily and repeatably many times in a night.

The point of the locked door analogy is that when it is expensive to fix defects we have to live with some, not that the costs of a defective lock are small. Clearly we would be more secure if every time a flaw in a door lock was found, we replaced the lock. And if there is something extremely valuable behind it, maybe we should. If there was a trivial way to break into your encrypted hard drive that requires physical access and the vendor said "It is 'good enough' since you can't break every hard drive in one night." we would all laugh.

The reason the analogy breaks down for computers is that to fix the flaw is cheap. The question is how should we respond when fixing the flaw isn't cheap. Is the widespread knowledge about the flaw (which helps ensure that it is fixed in the next version) worth it if it is expensive to get the next version?

Re:Incredibly dumb

[Foerstner]

Why are we so hell-bent on breaking down society that we can't have people just use and pay for a transit system?

"We" aren't. Most people don't understand the attack involved, are too lazy to learn about it, and are honest (or fearful of prosecution) enough that they wouldn't exploit it even if they could.

What people are upset about is that the transit authority tried to suppress the students from announcing that the emperor had no clothes. If you want to go out naked, fine, but don't get sue-happy when someone calls you on it. Either put some clothes on, or shut up and strut it.

Re:Incredibly dumb

[FrankieBaby1986]

but the most sensible outcome would be to replace automation with human ticket agents. Unlikely to happen.

Dead on! This is what should happen, more jobs for people, less error, less money wasted on repeatedly trying to fix tech.

As a bonus, give the jobs to teenagers only, for minimum wage, and maybe they'll cause less mischief. (Not saying all kids cause mischief, but some do, I'm just trying to state a possible side effect)

Re:Incredibly dumb

[justinlee37]

As a bonus, give the jobs to teenagers only

That's a terrible idea. Homeless adults need jobs more than teenagers. Some teenagers might be troublemakers but they at least have a place to stay, and that makes them less of a threat (they have less incentive to commit serious crimes because it isn't a life-or-death scenario for them).

You're right that it could be a "possible side effect," but it would be more effective to give jobs to people who don't already have a safety net.

Re:Incredibly dumb

[Anonymous Coward]

So what is the transit system supposed to do? Revamp the entire system at a cost in the millions? Ignore it and hope nobody ever uses this information?

What they should have done is not implement a flawed, proprietary solution in the first place. Now that they have made their bed they have to lie in it. Sucks to be them, but maybe next time they will make the correct decision and go for a more secure, peer-reviewed system.

48-bit card also deployed/cracked in Holland

[Anonymous Coward]

Funny this came up. EXACTLY the same debacle has unfolded here in the Netherlands with the card
scheme for the nationwide metro/train/tram system intended to replace the paper ticket system still
in use today. (company NS - www.ns.nl).

Suffering from the universal upper management tendeny toward self-harm through compulsive
obsession with the bottom-line, they ignored whitepapers signed by the senior technical staff
begging them to go with 3DES and AES. A couple of weeks after the (limited) trial roll out the
card was cracked and an infinitely loadable version created and demoed by white/grey hats.

This is somewhat ironic as the Netherlands is one of the world largest suppliers of smart card
technology, and in Europe this is (was?) considered a "specialty" of theirs...

It also doesn't help that the company NS (Nederlandse Spoorweg or "Dutch Platform") is
made of epic fail, but that's a rather long & distinctly boring story.

Sorry for the AC, posting from friend house
can't remember passwd (y i let ffox remeber
it for me v bad i know..)

Free Security Analysis

[kmankmankman2001]

Gee, the MBTA had the students turn over not only their slide deck but a 30 page analysis of the security flaws. Most firms would end up paying something approaching the 6 figure range for a detailed security vulnerability analysis like that, they get it for free. AND sue the students. It's a win-win for incompetent government bureaucracy!

   

without the gag order i'd never seen it

[thc4k]

The funny thing is, without the gag order, it might not have appeared on /., the presentation might not have been posted in the comments and i would have never read it. So this kind of "gag" orders are fine with me, as long as it's "no talking" only. I can read myself :-)

Section 1983 can provide recourse

[vrimj]

There is a way to get the decision reviewed, because the MBTA is a state agency the students can use 1983 to claim that in seeking a protective order under these conditions it deprived them of constitutionally protected rights.

They could counter-claim if the MBTA keeps up its suit or file on their own if it is dismissed.

Sure is it just cash damages (including attorneys fess) but it is recourse

6 bit encryption

[DragonHawk]

The article I read said 6 bit encryption... 64 possibilities.

64 possibilities ought to be enough for anyone.

What?

Surely it's the same as truth in libel cases?

[Anonymous Coward]

In suits for libel, public expression of the truth is a universal defence.

Why is it not so in this case as well? The students publicized a weakness, but it was the plain truth.

The fact that the plaintiff suffers from a public expression of the truth is the plaintiff's problem, not anyone else's. If they suffer financial losses from this then it's only because they were earning profits under a flawed business plan before, namely the use of cheap and cheerful (lousy) encryption.

They deserve the losses, and presumably will pass them on to their supplier by suing them in turn. This is how the system *SHOULD* work (in the disastrous lawyer-ridden US), otherwise crap companies are profiteering by supplying faulty goods.

The students were acting entirely in the public interest.

There's a name for that . . .

[JSBiff]

The Streisand Effect.

Hit Man book information

[Web Goddess]

The book is not Hitman, it is Hit Man, available only on the used market: http://www.amazon.com/Hit-Man-Technical-Independent-Contractors/dp/0873642767/ref=sr_1_6?ie=UTF8&s=books&qid=1219202282&sr=1-6

Advertising-By-Litigation

[IHC Navistar]

Personally, I think that the judge should have commended the students for taking the initiative to test the security of a public sysem thanked them for bringing it to the publics attention. Plus, he should have laid into the MBTA for trying to sweep the whole thing under the rug.

This sort of thing is inevitable: Every time a human designs a system to the best of their abilities, they should always be open to the findings of other humans who test their system. Human systems are ever-evolving technologies that another human will always be able to figure out and outsmart. They should be thankful that someone beat their system AND told them about it. If it was me, I'd have just kept my mouth shut, loaded up a bunch of cards for my buddies, and ridden the subway so much it would count as a job.

Just remember:

Every puzzle can be solved.
Every code can be broken.
Every device can be cheated.

These yuppie clowns are just being pissy because some students outsmarted a bunch of highly-paid managers and executives at their own game. I'd be pissed too, but at least I'd be nice about it and ask "How in the hell did you do that?". This turned into a case of "Advertising-By-Litigation"

Asking "How'd you do that"" it a whole hell of a lot more productinve that saying "Shut the fuck up, kid, or well throw you in jail!".

A word of advice: Never be rude to a guy with a straight razor or a guy who just out-smarted you, because they are equally dangerous.

In fairness, I'm adding a word...

[pjt33]

Question: so what am I doing here?

What you just did.

Forged rail cards in UK $2000 benefit

[Anonymous Coward]

It has always been possible to scan and print a rail card in the UK.

Considering that annual tickets retail for as much as GBP1000 each (long distance ones), there should be much money to be made?

Why does this work? Well, paper cards with a magstripe are crap and stop working while still being valid. Then a nice old man with a hat opens the gate for you if you show him the card. Talk about taking info on face value. As long as you don't sweat and look like a Brazilian, then they shoot you in the face.

Why does nobody do it? Well, when you suddenly set up shop on the (internet) corner selling GBP1000 tickets, then the old Bill will be the first to buy from you.

Most systems can tolerate a small amount of cock up much more cheaply than perfectly fixing it by retroactively fitting, in this case, triple DES (which is unbreakable?)

That is unless the fake cards cannot be distinguished from the valid ones. Then you are FU'd....