The Boston Trio and the MBTA

Security Research as a crime?

In their efforts to get a court to keep the MIT students from disclosing the results of their research, lawyers for the MBTA argued (pdf) not simply that the release of this information would harm the mass transit system, but also that the actions of the undergrads was criminal. Yet, everybody seems to have acknowledged that the information was not obtained by the undergraduates unlawfully - that is, they didn't steal it, and didn't violate trade secrets to get it.

Did they ever return,
No they never returned
And their ultimate fates still unlearn'd
They may try forever
In the courts of Boston
They're the kids who never returned.

So what was the MIT students' crime? Apparently nothing more than telling people about the vulnerabilities.

When the first US federal computer crime statute was written, it punished things like computer trespass and theft of electronic services or information. After the Cornell Internet Worm case in 1988, Congress added a provision to explicitly criminalize computer viruses. This provision made it a crime to:

Knowingly cause the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; which causes or would have caused loss of more than $5,000.

When Congress was considering this provision, at least one influential member of Congress made it clear that "transmission does not refer [to] speech or other forms of communication to human beings" (pdf).

From the subway system's perspective, the MIT students learned information about vulnerabilities in the system's computers - whether these "computers" are the MBTA's system, the machines that process the subway fare cards, or even the stored value RFID fare cards themselves. When they tell the public about this vulnerability - by describing the flaw, describing an exploit, or releasing code - they have "transmitted information". If, as a result of this transmission of information someone then causes damage or might cause damage to the computer which might cause economic loss, then the person who transmitted the information is liable.

The evidence that the students intended to cause damage to the MBTA's computers is contained in the fact that they promoted their presentation by telling people that they had found a way to get free subway rides. Indeed, the MBTA alleged that the students had already committed a crime based upon audit evidence that the students may have tested one of their modified or cloned fare cards.

The MBTA next argues that, by transmitting this information at DEFCON, a hacker conference, the student's actions are "directed at and likely to incite imminent lawless action". By telling others - or threatening to tell others - about the vulnerabilities, the students are, according to the mass transit system, aiding and abetting potential crimes which might be later committed by these others. The MBTA finally argues that even showing a picture of an MBTA switch with a mention of the network analyzer tool Wireshark is the felonious encouragement of criminal activity.