The Boston Trio and the MBTA

How the transport bods silenced security researchers

Securing Web Applications Made Simple and Scalable

Security Research as a crime?

In their efforts to get a court to keep the MIT students from disclosing the results of their research, lawyers for the MBTA argued (pdf) not simply that the release of this information would harm the mass transit system, but also that the actions of the undergrads was criminal. Yet, everybody seems to have acknowledged that the information was not obtained by the undergraduates unlawfully - that is, they didn't steal it, and didn't violate trade secrets to get it.

Did they ever return,
No they never returned
And their ultimate fates still unlearn'd
They may try forever
In the courts of Boston
They're the kids who never returned.

So what was the MIT students' crime? Apparently nothing more than telling people about the vulnerabilities.

When the first US federal computer crime statute was written, it punished things like computer trespass and theft of electronic services or information. After the Cornell Internet Worm case in 1988, Congress added a provision to explicitly criminalize computer viruses. This provision made it a crime to:

Knowingly cause the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; which causes or would have caused loss of more than $5,000.

When Congress was considering this provision, at least one influential member of Congress made it clear that "transmission does not refer [to] speech or other forms of communication to human beings" (pdf).

From the subway system's perspective, the MIT students learned information about vulnerabilities in the system's computers - whether these "computers" are the MBTA's system, the machines that process the subway fare cards, or even the stored value RFID fare cards themselves. When they tell the public about this vulnerability - by describing the flaw, describing an exploit, or releasing code - they have "transmitted information". If, as a result of this transmission of information someone then causes damage or might cause damage to the computer which might cause economic loss, then the person who transmitted the information is liable.

The evidence that the students intended to cause damage to the MBTA's computers is contained in the fact that they promoted their presentation by telling people that they had found a way to get free subway rides. Indeed, the MBTA alleged that the students had already committed a crime based upon audit evidence that the students may have tested one of their modified or cloned fare cards.

The MBTA next argues that, by transmitting this information at DEFCON, a hacker conference, the student's actions are "directed at and likely to incite imminent lawless action". By telling others - or threatening to tell others - about the vulnerabilities, the students are, according to the mass transit system, aiding and abetting potential crimes which might be later committed by these others. The MBTA finally argues that even showing a picture of an MBTA switch with a mention of the network analyzer tool Wireshark is the felonious encouragement of criminal activity.

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story


Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.