• On The Insider: Bruno Film Edited Due to Jackson's Death
August 14, 2008 2:25 PM PDT

Massachusetts: MIT students deserve 'no First Amendment protection'

by Declan McCullagh

The state of Massachusetts is showing no signs of abandoning its fight to keep a restraining order in place against three MIT students who discovered subway card vulnerabilities. In fact, the state transit agency is escalating its rhetoric.

In a legal brief filed Thursday, the Massachusetts Bay Transportation Authority went so far as to claim that the three "defendants enjoy no protections under the First Amendment."

The document was filed around the same time that U.S. District Judge George O'Toole Jr. held a hearing in the case in his Boston courtroom. O'Toole denied a request from the students' attorneys to lift the gag order--and instead ordered the students to divulge to the transit agency by Friday more information about what they've done.

MBTA has demanded copies of documents including correspondence with the Defcon conference, a paper prepared for an MIT class, software, physical equipment, modified MBTA farecards, notes from meetings, and so on. MBTA wants to conduct a four-hour deposition of computer science major Zack Anderson at 9 a.m. ET Friday at their attorney's offices at 10 St. James Avenue, followed by a two-hour deposition of MIT professor Ron Rivest at 2:30 p.m ET. (The other student defendants are Alessandro Chiesa and R.J. Ryan.)

MBTA has asked O'Toole to convert the temporary restraining order, which automatically expires on Tuesday, to a longer-lasting preliminary injunction. To buttress its case, it has highlighted news coverage quoting PGP creator Phil Zimmermann as saying traditionally researchers give vendors a month's notice before they disclose a vulnerability in a system--which amounts to an implicit criticism of the MIT defendants and ammunition for the plaintiffs.

Also on Thursday, the Boston Globe published an editorial saying O'Toole "ought to lift" the gag order and that security concerns "should not trump First Amendment rights."

Here's an excerpt from the MBTA's 14-page brief, submitted by Ieuan Gael Mahony, a partner at the Holland & Knight law firm:

First Amendment protection does not extend to speech that advocates a violation of law, where the advocacy "is directed to inciting or producing imminent lawless action and is likely to incite or produce such action." The Individual Defendants' conduct falls squarely within this well established zone of no protection.

First, unless restrained, the Individual Defendants would have given their Presentation, and related materials (which have not yet been made available) to one of the world's largest hacker conferences. Advocacy in favor of illegal behavior, in this context, is likely to incite or produce illegal behavior. Second, the Presentation, and likely the related code and materials, unequivocally constitute advocacy in favor of a violation of law.... the Individual Defendants are vigorously and energetically advocating illegal activity, and this advocacy, in the context of the DEFCON Conference, is both directed to inciting or producing imminent lawless action, and likely to produce such action. Therefore, the Individual Defendants enjoy no protections under the First Amendment.

The Individual Defendants' DEFCON presentation constitutes commercial speech. Commercial speech is any "speech that proposes a commercial transaction." Here, the Presentation is full of marketing, and self-promotional statements. It is not a research paper. As commercial speech advertising illegal activity, it receives no First Amendment protection.

The problem with the MBTA's arguments on this point is that the MIT students weren't proposing any commercial transaction--the MBTA is citing precedent relating to commercial advertising that aren't applicable to a student presentation at a security conference.

The students were going to give the talk at Defcon for free, were planning on giving the code away for free, and were offering to sell precisely nothing. If the mere existence of self-promotional statements and related puffery eliminated First Amendment protections, then every politician could be subject to court-imposed gag orders too.

MBTA also seems to argue that even if the students are engaging in noncommercial speech, they should nevertheless be gagged because it's (a) advocating illegal behavior and (b) likely to convince others to violate the law.

Advocating illegal behavior generally is legal; otherwise distributing step-by-step instructions on how to grow marijuana at home would be a criminal offense.

The exception to that general rule, according to the U.S. Supreme Court in the 1969 Brandenburg v. Ohio case, is this: "Constitutional guarantees of free speech and free press do not permit a state to forbid or proscribe advocacy of the use of force or of law violation except where such advocacy is directed to inciting or producing imminent lawless action and is likely to incite or produce such action."

"Producing imminent lawless action?" That sure doesn't seem to describe a sober, critical, and probably slightly geekish talk at the Defcon conference. Another Supreme Court case says imminent lawless action by definition does not include "advocacy of illegal action at some indefinite future time."

But Judge O'Toole seems to favor MBTA's arguments. On Thursday, he chose not to modify the gag order to make it apply only to "nonpublic" information, even though the MBTA had been the party that suggested the change in the first place. For EFF and its clients, that can't be a good sign.

Declan McCullagh, CNET News' chief political correspondent, chronicles the intersection of politics and technology. He has covered politics, technology, and Washington, D.C., for more than a decade, which has turned him into an iconoclast and a skeptic of anyone who says, "We oughta have a new federal law against this." E-mail Declan.
advertisement
Click here!
Recent posts from Security
Users upset after CA anti-virus detects Windows system file as virus
DirectX targeted in Microsoft security updates
What will Google's Chrome OS watch you do?
Does Google's OS decrease or increase security risks?
Shortened URLs spike in e-mail spam
Security expert blesses Google Native Client technology
FAQ: How to vanquish mobile spam
Report: Social Security numbers can be predicted
Add a Comment (Log in or register) Showing 1 of 2 pages (40 Comments)
by protagonistic August 14, 2008 2:56 PM PDT
Another over educated judge who appears to have no real grasp of the legal system. It must be mandatory that you leave your common sense in the chambers when you head out to sit on your bench. This judge is an idiot.
Reply to this comment
by gggg sssss August 14, 2008 3:01 PM PDT
as the mixed metaphore, don't **** on superman's cape. No different than the timamen square protest - here they will just get tasered if they speak.
Reply to this comment
by DWic2000 August 14, 2008 3:03 PM PDT
My question is this... if I were to publish a recipe for Sarin gas using household items, would that be illegal? I mean, this is instruction to kill hundreds of people, not jump a turnstile. It would be distasteful, but not illegal. Creating Sarin gas is illegal, a video of the act would be accessory, but publishing a recipe is covered by the First amendment.
Reply to this comment
by digitalshaman August 14, 2008 3:16 PM PDT
now if this were regarding insecure voting machines with trade secret source code ... or even say a copyright owner being allowed to see massive numbers of individual on-line accounts without regards to the privacy of the individuals ... oh, where art thou, I say to myself - these are already issues that are before the courts ... and we can leave warrantless wiretapping alone here ... of course

it is certainly no surprise that once again guv'ment by the people and for the people now sue the people trying to make sure taxpayers are not left holding the bag because of faulty decision-making & lack of accountability in how these flaws went unchecked - counterfeit transit passes - literally a big bag of "free rides" - are no joke ... similar issues with phone cards and any number of ID/transactional cards have gone through similar attacks, all over the world

why go to such lengths at ignoring how society has changed - specifically how fundamentally a networked information society requires vigorous and open debate on data security. it appears too often the status quo gets the real "free passes" without any attention paid to the actual threat.

as a side note, does the partner cited above have any clue what the defcon presentation proves? what happens when the "bad guys" do this to infiltrate the transport system, is that "commercial speech"? what is the harm? truth? under what theory, defcon literature? does it not matter that public tax-funded systems can be undermined - now that would be real commercial speech - by the thieves! (except they certainly would not be speaking)

"the best disinfectant (for pretty much anything) is sunshine" to paraphrase a sup ct justice & true patriot

thanks, declan, for the coverage
Reply to this comment
by mpherdeg August 14, 2008 3:19 PM PDT
Just as a heads-up, the judge ruled that the students should be required to submit certain information by Friday. But he ignored or denied the MBTA's request for depositions; the court order does not require a deposition of either Rivest or Anderson.
Reply to this comment
by yard80197 August 14, 2008 4:16 PM PDT
The law must be different in Ohio. The president of the Ohio based firm that developed the software for voting machines stated clearly in 2004 that he would do everything possible to ensure a Bush victory..(.and he did). In light of the difference between exit polls and actual numbers, one would start developing a true distrust of the electronic voting process, especially since this and other companies who develop electronic voting machines refuse to make public their source code. It sounds like the legal system has a lot to learn about the 21st century... We could be seeing the truth in the Stalinism....."those who vote decide nothing, those who count the votes decide everything."
Reply to this comment
by uilysses August 18, 2008 6:45 AM PDT
Although the crap about the voting machines and the "help" to get Bush elected is indeed heinous and very tgroublesome, I do not recall if any charges were ever placed against this guy. If not, then until this happens...we live with this.

If yes, then the outcome decides what action to be taken.

Unfortunately, our cowardly and frightened legislators have shown how useless they are and because of their inaction, complicit in the "new" anti-American people interpretation of the constitution.

We live with it until the next election--but this is our democaracy and no matter how imperfect it is, and it is even more so, it still is better than most . Not an excuse but a reality.
by yard80197 August 14, 2008 4:17 PM PDT
The law must be different in Ohio. The president of the Ohio based firm that developed the software for voting machines stated clearly in 2004 that he would do everything possible to ensure a Bush victory..(.and he did). In light of the difference between exit polls and actual numbers, one would start developing a true distrust of the electronic voting process, especially since this and other companies who develop electronic voting machines refuse to make public their source code. It sounds like the legal system has a lot to learn about the 21st century... We could be seeing the truth in the Stalinism....."those who vote decide nothing, those who count the votes decide everything."
Reply to this comment
by The_Decider August 14, 2008 4:24 PM PDT
Instead of pursing these kids, MBTA needs to look over the findings and close the many, many problems they found.

I have a copy of the presentation, and there is enough information to replicate the technical attacks in a reasonable amount of time.

I was unable to attend DefCon, yet I still have the information. So what good is a gag order? If MBTA thinks they can avoid embarrassment or responsibility from this gag order, they are dreaming.
Reply to this comment
by PaintedImp August 14, 2008 5:37 PM PDT
The gag order does not apply to you - perhaps a Blog quoting the presentation (with appropriate citations so as not to infringe the copyright) would be in order.
by The_Decider August 14, 2008 6:31 PM PDT
Um, the point is what is there to gag?
by uilysses August 18, 2008 6:47 AM PDT
You are right but to those who wish to maintain power and hide what is wrong, that is not the way they will go.
For to fix what is wrong may require correcting other wrong things which may be beneficial to favored cows...*wink**wink*
by Freiheit13 August 14, 2008 4:37 PM PDT
(quote) First Amendment protection does not extend to speech that advocates a violation of law, where the advocacy "is directed to inciting or producing imminent lawless action and is likely to incite or produce such action." (end quote)

Well, actually it does, because there would be no First Amendment without such advocacy of lawless behavior -- we would still be under British rule if our Founding Fathers had shut up and played by the rules. Instead we are (supposedly) free country. And just because researchers "traditionally" give a one month notice does not mean that it must be that way in perpetuity. We "traditionally" rode on horse and buggy, but today we have automobiles, and I'm sure some buggy and whip makers in 1900 were pretty peeved about that change, too. Is everyone willing to give up their cars and go back to the "traditional" ways?
Reply to this comment
by Pete Bardo August 14, 2008 4:46 PM PDT
Maybe I'm not paying enough attention, but it was my impression from the coverage that these students never provided the presentation content to MBTA. And exactly how is providing information about any activity interpreted as advocacy? Ok, "Press the gas pedal to the floor for long enough and you will be speeding." Now you know how to speed, but have I just advocated violating the law? I don't think so. You read the instructions--are you going to run right out and speed in conscious violation of the law? Not likely, unless you are already a habitual speeder--but, then you already knew how to do that, didn't you.

Lawyers suck. The best lawyers become judges, so they must suck the most! I'm with Shakespeare, kill 'em all. Oh, there I go again, advocating commission of an illegal act.
Reply to this comment
by declan00 August 14, 2008 6:30 PM PDT
Just one data point: The students via EFF provided the presentation materials to MBTA early Saturday morning. They had no legal obligation to do so, as MBTA had already filed a lawsuit and was a hostile party.

MBTA could have just sent someone to Defcon, registered, and obtained the conference packet with the CD with the presentations. They didn't. To be fair, they may not known it was going to be distributed in this manner.
by Michichael August 14, 2008 4:59 PM PDT
Absolutely disgraceful. Once again the US is demonstrating how far behind it is on human rights in comparison to some of the European nations...
Reply to this comment
by Al57 August 14, 2008 5:05 PM PDT
No surprise. We're dealing with Modern Liberals. Modern Liberals (think of the New Left) don't like Freedom of Speech. Political Correctness is just one example.

Hate Crimes are another. I used to think that "liberals" were "toughening up" on crime until someone pointed out that these crimes are already crimes! The only reason to make something a "hate crime" is to criminalize the speech about it.

The days of old time liberals saying "I may disagree with you but I'll die for you to have the right to say it" are gone.

We need to be intolerant of Modern Liberals.
Reply to this comment
by The_Decider August 15, 2008 8:17 PM PDT
We need to be intolerant of people who post mindless crap like you just did.
by magicmaster August 14, 2008 6:32 PM PDT
Have MBTA taken any action to fix those problems? Nope.
Have MBTA apologized for leaving so many vulnerability? Nope.

In memory of MBTA's rogueness, I would keep a copy of the powerpoint presentation to show them who is the fool.
Reply to this comment
by Deefburger August 14, 2008 6:33 PM PDT
Let's not forget here that the idiots that wrote those words quoted in the article are the same idiot attorneys that filed the restraining order WITH the documentation that they wanted to remain out of the public eye, thus, in one fell swoop, negating thier attempt at protecting the interests of their client!!!!

They, the attorneys who filed this request for restraint with the court, made public, the very information that they wanted to protect. Idiocy. MIT and the young gentelmen would have been giving a talk on information that the MBTA lawyers had already entered into the public record!!

I got a copy of it before the Defcon talk thanks to the public filing! It's the contractors who set the stupid system up and the MBTA lawyers that are at fault here, not MIT et. al.
Reply to this comment
by wollytech August 14, 2008 6:46 PM PDT
A couple things...

1) These MIT students are smart! The only mistake they made is being honest and for sharing the flaws in the "secure" subway card system.

2) Instead of asking these students or security experts for advices to fix their flaw system, they decided it's best to slapped a gag order? Where's the logic and action on actually addressing their flawed subway security?

3) The irony is why aren't the company/groups of people whom sold the flaw system to Boston in question?
Reply to this comment
by bluemist9999 August 15, 2008 9:38 AM PDT
According to the book "Hard Drive," Bill Gates did a lot of things that caused C cubed's mainframes to crash.

Instead of suing him and threatening him, C cubed did the smart thing. They hired him (with free computer time) to fix the security flaws.

If it were to happen today, Bill Gates would probably be thrown in jail for violating the DMCA (I'm surprised the MBTA lawyers didn't latch onto that one quickly).
by Deefburger August 14, 2008 7:26 PM PDT
I'd like to know that too! But why are we discussing the MIT guys when the Lawyers for the MBTA are the ones who made the info public when they filed the restraining order?

MBTA should be firing the lawyers, and the ticket system contractors, and appologizing to MIT and the students, and then hiring them, at very good pay, to fix the problem!

Here is page2 of the report the Lawyers filed:

http://www.tgdaily.com/images/slideshows/200808092/2.jpg
Reply to this comment
by chucks1girl August 19, 2008 6:01 AM PDT
I didn't see anything suggesting that someone SHOULD do these things, only that they COULD do these things. I COULD walk outside and get hit by falling debris, but I doubt anyone in their right mind would get paranoid about it!
by BryanJS01 August 14, 2008 7:58 PM PDT
Let us not forget that if this is upheld it threatens the entire security community, not just hackers. It also will carry the weight of legal precedence that will give local and federal governments the ability to prevent the types of speech that lead to the Civil Rights Demonstrations.

While the advocacy of illegal activity may not have been exactly what the Founding Fathers had in mind for the First Amendment protection, there is difinitively a basis for the claim that they did have it in mind to an extent to enable the citizenry to react against laws that it finds unacceptable (like taxation without representation and the promotion of open rebellion anyone?)

But then again, I often forget that that I live in America now, not the United States.
Reply to this comment
by ferricoxide August 14, 2008 8:07 PM PDT
Perhaps that's *why* this was allowed to happen (and to stand). Perhaps it's paving the way for future tramplings? After all, particularly in the past eight years, we've seen a *lot* of chipping away at the first 10 Amendments....
by Maccess August 14, 2008 9:33 PM PDT
Why not just fix the vulnerability so the hacking information becomes worthless?
Reply to this comment
by The_Decider August 14, 2008 9:42 PM PDT
Makes perfect sense, but we are living in a tech world where people think that if something remains in a black box it has to be secure.

Tragic, but people seriously think that. Of course those people have no business being in tech.
by fdunn3 August 16, 2008 5:23 PM PDT
Since when it is a states choice to pick and choose which constitutional rights it "allows?
Reply to this comment
by steve0701 August 18, 2008 4:04 AM PDT
What do you expect from a state whose supreme court sentenced a driver to jail for recording a cop during a traffic stop.? Obviously Massachusettes thinks its law is above the U.S. Constitution. see article http://jalopnik.com/400498/secretly-recording-a-traffic-stop-in-massachusetts-will-land-you-in-the-slammer
Reply to this comment
Showing 1 of 2 pages (40 Comments)
advertisement

Can RIM get its mojo back?

The new BlackBerry Tour, carried by Verizon and Sprint, arrives Sunday, even as RIM seems to be losing sales to exclusive devices like the iPhone and Pre.

With Chrome, Google reignites the OS wars

roundup Google Chrome OS, due in 2010, underscores the Web giant's cloud-computing ambitions and opens new competition with Microsoft.
• What Chrome OS has on Windows that Linux doesn't

About Security

Online security is threatened by more than hacking and phishing attempts. Check here for the latest updates on software vulnerabilities, data leaks, and rapidly spreading viruses--and learn how to protect your systems.

Add this feed to your online news reader

Security topics

advertisement
advertisement

Inside CNET News

Scroll Left Scroll Right