Doors Close on Student Hackers at Las Vegas Conference

[WSJ Law Blog]

What happens in Vegas. . . can apparently be enjoined by a judge in Massachusetts. We learned that much on Sunday when a group of MIT students were prohibited from giving a talk at a computer-hacker’s conference, called Defcon, in Las Vegas. In the talk, the students planned to expose security flaws in the automated fare system used by the subway system in Beantown, and describe how to get free rides.

But the Massachusetts Bay Transit Authority seems to have gotten wind of the students’ Vegas plans and filed a motion for a preliminary injunction on Friday, which was granted by a Massachusetts federal judge Douglas Woodlock. Here’s the AP story.

In court documents, Gary Foster, chief technology officer for the transit system said the presentation would “inflict significant damage” if the Massachusetts Bay Transportation Authority did not have a chance to correct the flaws. “It is extremely important to maintain the security and integrity of the Fare Media systems,” Foster said in a court declaration. “With an insecure, compromised system, even basic revenue controls, to name one example, become significantly challenging.”

Jennifer Granick, the civil liberties director for the Electronic Frontier Foundation, lawyers for the MIT students, told the AP that the students were simply trying to share their research and planned to omit key information that would make things easier for anyone who actually wanted to hack the payment system.

“We believe that it’s an illegal prior restraint on speech and a violation of the First Amendment, the EFF’s Kurt Opsahl told the Law Blog on Monday. “It’s also a misunderstanding of the Computer Fraud and Abuse Act.”