Feeds

The Boston Trio and the MBTA

How the transport bods silenced security researchers

High performance access to file storage

Security Research as a crime?

In their efforts to get a court to keep the MIT students from disclosing the results of their research, lawyers for the MBTA argued (pdf) not simply that the release of this information would harm the mass transit system, but also that the actions of the undergrads was criminal. Yet, everybody seems to have acknowledged that the information was not obtained by the undergraduates unlawfully - that is, they didn't steal it, and didn't violate trade secrets to get it.

Did they ever return,
No they never returned
And their ultimate fates still unlearn'd
They may try forever
In the courts of Boston
They're the kids who never returned.

So what was the MIT students' crime? Apparently nothing more than telling people about the vulnerabilities.

When the first US federal computer crime statute was written, it punished things like computer trespass and theft of electronic services or information. After the Cornell Internet Worm case in 1988, Congress added a provision to explicitly criminalize computer viruses. This provision made it a crime to:

Knowingly cause the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; which causes or would have caused loss of more than $5,000.

When Congress was considering this provision, at least one influential member of Congress made it clear that "transmission does not refer [to] speech or other forms of communication to human beings" (pdf).

From the subway system's perspective, the MIT students learned information about vulnerabilities in the system's computers - whether these "computers" are the MBTA's system, the machines that process the subway fare cards, or even the stored value RFID fare cards themselves. When they tell the public about this vulnerability - by describing the flaw, describing an exploit, or releasing code - they have "transmitted information". If, as a result of this transmission of information someone then causes damage or might cause damage to the computer which might cause economic loss, then the person who transmitted the information is liable.

The evidence that the students intended to cause damage to the MBTA's computers is contained in the fact that they promoted their presentation by telling people that they had found a way to get free subway rides. Indeed, the MBTA alleged that the students had already committed a crime based upon audit evidence that the students may have tested one of their modified or cloned fare cards.

The MBTA next argues that, by transmitting this information at DEFCON, a hacker conference, the student's actions are "directed at and likely to incite imminent lawless action". By telling others - or threatening to tell others - about the vulnerabilities, the students are, according to the mass transit system, aiding and abetting potential crimes which might be later committed by these others. The MBTA finally argues that even showing a picture of an MBTA switch with a mention of the network analyzer tool Wireshark is the felonious encouragement of criminal activity.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.