In court today, Judge George O'Toole refused the Massachussetts Bay Transit Authority's request to impose an additional five-month gag order against five students the MBTA had accused of violating Computer Fraud and Abuse Act (CFAA). Prior to this point, the students had been subject to a 10-day gag order which prevented them from presenting a paper on the flaws within the MBTA's transit system at DEF CON earlier this month.
The Electronic Frontier Foundation (EFF) had argued that refusing the student's permission to speak constituted a violation of their First Amendment rights, but the judge chose not to address First Amendment concerns at all. Instead, O'Toole focused on whether or not the students had violated the CFAA, and found that they had not. First, the student's presentation (had it been given), did not constitute a computer-to-computer transmission. Second, the MBTA presented no evidence that the students had caused at least $5,000 worth of damage in the course of their research.
Judge O'Toole's decision to lift the gag order against the students does not constitute a dismissal of the case, though the MBTA has yet to announce whether or not it will appeal O'Toole's ruling. After reviewing a confidential 30-page report on the MIT group's findings, the Transit Authority has confirmed that they did not, in fact, break the paper Charlie Card payment system, but had only uncovered a theoretical method for breaking the Charlie Card. The MBTA maintains that it had no interest in violating the young security researchers' rights, but only wished to prevent information on how to hack the transit system from escaping into the wild. The students have maintained that they had no plans to ever disseminate enough of their findings to allow for such hacks to take place, and that the MBTA was aware of this from the beginning.
