MIT Students' Gag Order Lifted 160
mytrip and several other readers let us know that a judge in Boston has lifted the gag order — actually let it expire — against three MIT students who discovered flaws in the security of the local transit system, the MBTA. We've discussed the case over the last 10 days. "Judge O'Toole said he disagreed with the basic premise of the MBTA's argument: That the students' presentation was a likely violation of the Computer Fraud and Abuse Act, a 1986 federal law meant to protect computers from malicious attacks such as worms and viruses. Many had expected Tuesday's hearing to hinge on First Amendment issues and what amounts to responsible disclosure on the part of computer security researchers. Instead, O'Toole based his ruling on the narrow grounds of what constitutes a violation of the CFAA. On that basis, he said MBTA lawyers failed to convince him on two points: The students' presentation was meant to be delivered to people, and was not a computer-to-computer 'transmission.' Second, the MBTA couldn't prove the students had caused at least $5,000 damage to the transit system."
They never signed a non disclosure contract (Score:5, Insightful)
Why would exposing the MBTA's secrets be against the law? Realistically, that's all they've done, they put together a presentation on flaws in their system, security firms do this all the time. Nice to see a judge make the right decision.
Good Call (Score:5, Insightful)
It looks like the judge made a pretty good call in this case. What he really rejected was the MTBA lawyers' assertion that it was an act prohibited by the law, and not exposing the agency's incompetence.
Really, bugs aren't fixed by just hiding them.
FTA:
MBTA said in documents filed with the court said that fixing the security flaws would take five months. ("Students have the ability to cause significant harm to the CharlieTicket system, during the roughly five-month window that remedial actions will require.")
Actually, the fact that they implemented a seriously flawed system is the problem, and the students' bringing it to light may suck for MBTA. The proper solution is for them to fix their system and, if necessary, sue the vendor for the costs.
Re:They can't hold their talk now, can they? (Score:5, Insightful)
No clue. Litigation tends to be the last refuge of the incompetent.
Re:They never signed a non disclosure contract (Score:4, Insightful)
Not doing anything about the problem is the most likely course of action at this point. Nice to see that a judge won't be giving out a gag order so easily on someone based on the fact that someone else is not going to do its job (or do it correctly).
Re:Good Call (Score:3, Insightful)
And the judge before him quite plainly made a bad call. A gag order in this situation is quite plainly unconstitutional, yet there's no recourse for the victims of that ruling. This is a fundamental problem with our system.
$5000 worth of damages? (Score:5, Insightful)
That's an interesting argument...
Does a mechanic cause $5000 worth of damage when he points out that your axle is broken and needs replacement?
Can you cause damage to a system that has intrinsic vulnerabilities?
Obviously people taking advantage of disclosed vulnerabilities should be punished under applicable laws (as with simple copyright violation) for whatever damages they caused, but I tend to agree that you can't really pin damages on the discloser.
Now some other b.s. charge about reckless endangerment or speech issues, but probably not damages.
--Robert
Re:Working As Intended (Score:5, Insightful)
agreed on the streisand effect.
i even heard a well written and clearly informed piece on NPR, that discussed the potential constitutional issues and the chilling effect this would have on any security research.
granted NPR doesnt have the distribution of fox or cnn, but its still more mainstream than /.
Re:Win the battle but lose the war! (Score:3, Insightful)
I'd say that this is more the other way around: Lose the battle, but win the war.
Re:They never signed a non disclosure contract (Score:5, Insightful)
Re:Win the battle but lose the war! (Score:3, Insightful)
If only there was some way to disseminate information to a technical audience across long distances electronically...
Re:They can't hold their talk now, can they? (Score:4, Insightful)
Here is evidence that a low UID does not insure a clear mind.
Maybe you should have said "frivolous" litigation is the last refuge of the incompetent"?
Litigation is one of pillars which holds up a Rule of Law and provides some path to fairness and justice in a free society. Considering the startling consolidation of social power in the hands of corporate ownership and authoritarian fanatics, you may yet see what it's like to live in a society without litigation. I guarantee you're not gonna like it, Ukab.
Re:Good Call (Score:3, Insightful)
Prior restraint is a violation of the first amendment protection of free speech.
Re:$5000 worth of damages? (Score:3, Insightful)
His analogy may be flawed, but yours is too!
If your mechanic said your axle was broken and you refused to fix it, in PA, he would refuse to give you an inspection sticker - thus telling everyone in the public that you're too much of a tool to fix your broken stuff. Same principal.
Should Doctors Not Talk About Medicine? (Score:5, Insightful)
You actually make a really good point; what about poison? If one were to discover a poison or pathogen that might kill a human, were it to be utilized or delivered, along with the reasons why and the possible delivery methods, no one would object to sharing that information with doctors.
Further, no one would claim that you were doing something illegal by spreading that information. Ironically, nor would anyone blame the human body for having that weakness; it wasn't planned for, developed around, whatever.
The fact of the matter is that the system is there, it's vulnerable, and we know how it's vulnerable. There is no convincing reason to try and quash that knowledge - if that is even possible. It is immaterial that it took bright people to figure it out. It is immaterial that without a fix money might be lost. What is material is recognizing things for what they are and reacting to the truth of the situation, not trying to maintain a status quo.
And that is why it's perceived that the MBTA is in error here; they're trying to live in a world where the exploit doesn't exist. But that world itself does not exist.
Incredibly dumb (Score:4, Insightful)
The general tone here seems to be that the only security that is worth anything is unbreakable and it is the responsibility of the implementer to make sure any system is secure against attacks. Well, sorry but your front door lock is clearly defective by those standards. As is every single door lock the world over.
See, the security really only needs to be "good enough". What is that? Well, for a front door lock it is enough to keep homeless people out of your house. A determined thief might be able to defeat it in less than a minute but it isn't intended for that - the really determined thief might use a chainsaw to get in just as easily.
The transit system was designed to validate cards and the so-called "security" is probably more of a validation measure rather than a defense against attacks. The idea that attacking the transit system should not be done and should be illegal seems to have gotten lost. What has happened is now the door is open for anyone to duplicate this work and ride free.
So what is the transit system supposed to do? Revamp the entire system at a cost in the millions? Ignore it and hope nobody ever uses this information? I suspect neither is going to happen, but the most sensible outcome would be to replace automation with human ticket agents. Unlikely to happen. I'd guess that millions of dollars will be spent to implement an utterly new, slightly more secure, different system that requires every single piece of hardware and software to be replaced. Which will then be "cracked" within a few months and the details made available to everyone that wants to ride free. The endgame is probably closing the transit system because by its nature it cannot be made completely secure.
I doubt there is an attack-proof and cost-effective solution to the "problem" that is user-friendly and reasonable for a transit system. Why are we so hell-bent on breaking down society that we can't have people just use and pay for a transit system?
Re:Incredibly dumb (Score:4, Insightful)
Guess what? If you give a presentation about how vulnerable standard front door locks are, and exactly how you can defeat them, nobody is going to put a gag order on you.
You are entirely within your rights to deploy an insecure system. But other people are entirely within their rights to talk about just how insecure your system is, and what its vulnerabilities are.
You don't get better locks by burying the information about how bad the existing ones are.
without the gag order i'd never seen it (Score:3, Insightful)
The funny thing is, without the gag order, it might not have appeared on /., the presentation might not have been posted in the comments and i would have never read it. So this kind of "gag" orders are fine with me, as long as it's "no talking" only. I can read myself :-)
Re:Win the battle but lose the war! (Score:1, Insightful)
I'd say they were subject to the Streisand Effect.
Their goal of keeping the information out of the mainstream 'publics' eye, backfired.
Actually, I'd like to thank the MBTA for the amount of press this has garnered, and the added curiosity it's given me. I probably would have only skimmed over the information before, instead of going to great lengths to review the much more in depth background of the subject.
Thank again, MBTA!
Re:Speak Anyway (Score:4, Insightful)
So you essentially have no freedom at all. Great.
This is why the courts should never be allowed to hear aspects of cases which hinge around the extents of the court's authority.
What's the objective difference between an unlawful order and one which is based upon shakey facts which are later found to be untrue?
To put it another way:
There must be 'facts', and there must be a law which allows an injunction given those 'facts'. What's the difference between an order which is issued without any basis in law, and one which is issued wrongly because the 'facts' were wrong.
If judges are free to issue orders which are in defiance of the law, and have higher courts uphold contempt judgements against people for disobeying those orders, there is no rule of law. Just petty tyrants with essentially unlimited power.
An example. A judge orders you to stop breathing. This is clearly not a lawful order. You appeal to a higher court, and 24 hours later sucessfully overturn it. In the mean time (let's assume that you don't choose to asphyxiate yourself), you've breathed many hundreds of times. The first judge finds you in contempt. The higher court supports the contempt ruling because you must obey an injunction until it's overturned and you go to prison. Either you're wrong, or the system is very broken. I hope it's the former (nothing personal).
Re:They never signed a non disclosure contract (Score:4, Insightful)
MBTA never contracted them to figure this stuff out neither did DHS provide them a waiver to violate the law. This is no different than any other hacker delivering a list of discovered security flaws to a corporation or government entity. There might be a large crowd of people here on /. (myself included) that believe we have a moral obligation to report vulnerabilities to security. However, the powers that be have deemed that looking is equivalent to exploiting, and/or being accessory to exploiting. This particular incident shouldn't come as a surprise to you.
Re:They never signed a non disclosure contract (Score:4, Insightful)
So the rational response is to simply take away the option of the agency's weak response in similar situations. Set up a system whereby such information can aggressively and anonymously be made public for anyone that is interested, and leak it anonymously to the parties in control of the situation with enough advance for them to reasonably address the issues at hand.
I think this kind of system would be best for several reasons. (1) We already have the technology required to make it happen (thanks EFF!). (2) If it was discovered by benevolent actors willing to give the authorities a heads-up, it's only a matter of time before bad actors discover it for themselves, and this system encourages swift but not unreasonable response times while trucking no BS. (3) If BS ensues anyway and agency-in-question remains paralyzed and unable to cope, the public is made aware of what is now a public safety concern stemming from a systemically broken agency, which requires a solution to deeper issues that the initial security concern.
Part 3 is really the key to making the whole system work—if the people pay government to do a job, and the government screws it up, then this is the part that holds the government accountable to the people. And not in a way that requires people to be proactive...all they have to do is respond rationally by noticing the ridiculous lapse of responsibility and taking action such as not using the compromised system, which will eventually, and organically, snowball into the problem being fixed. And hopefully with enough hullabaloo that we don't allow the new solution to degrade as completely as what it replaced.
Re:Speak Anyway (Score:2, Insightful)
I don't have an answer to the first question, but it's plain common sense that a person who has a vested interest in a decision going one particular direction should not be allowed to make that decision.
A judge may ask that question first, but there have been numerous examples where any objective observer will quickly conclude 'no', but the judge has decided 'yes' instead.
I never said that they should be free to disregard them because they think they're unlawful, I say they should be free to disregardthem because they are unlawful. I agree that to allow someone to stand up and say "I didn't obey the order because I didn't think it was lawful" and have the appeal judge reply "oh, well, if you thought it was unlawful that's ok then" would be a nonsense. But for someone to be able to stand up and say "I didn't obey the order because it was unlawul, here's why..." and have the appeal judge reply "you're right, that was unlawful, no charge to answer" is plain common sense.
Order -> ignore -> appeal -> lose -> prison
The rule of law is fine.
Order -> ignore -> appeal -> win -> *nothing*
The rule of law is fine
Order -> ignore -> appeal -> win -> prison
Rule of law is broken, and the system entirely ass-backwards.
Order -> obey -> appeal -> lose -> *nothing*
The rule of law is fine
Order -> obey -> appeal -> win -> restitution
The rule of law is fine
Order -> obey -> appeal -> win -> *nothing*
Rule of law is broken
Law ought to be as robust as physics - if your theory can't handle any input parameters between the boundaries of reality then it isn't very good. If you have a theory which applies at high temperatures only (say), you don't waltz in and try to apply it to a low temperature system anyway so that you can make a complete hash of it and blame the input data.
My example is extreme, it's not silly. There's nothing to stop a judge putting pen to paper and writing "the defendant, Smith, is enjoined not the breathe. It is so ordered. Signed, Judge Bloggs". In the model that that defendants must obey all orders until they are overturned, Smith will be dead before he can even lodge an appeal.
That is either not an accurate depiction of the model at hand, or it is and the model is broken.
When you get an implausible situation, does the person applying the law accept that the law as written isn't meant for this situation? or just blithely go in an apply it badly anyway?
I wasn't trying to argue that was in any sense a lawful order. Constitutional issues could get it overturned, but if defendant Smith is still bound to follow it until it's overturned, he's still going to prison or the morgue.
Of course, if it's a general premise, not a law (oh, the irony), then the whole discussion is largely moot.
An appeal judge that hypocritical (or that incapable of cognitive reasoning) should not be in charge of watching the rock which keeps tigers away, let alone a court of law. And that is why (returning to my point at the top), the validity of idea that the courts should be assumed to be right until proved wrong (and should be allowed to punish people for not obeying them when they were wrong, but hadn't been proved to be so at the time) is not a decision which should be left up the courts.
Re:Speak Anyway (Score:5, Insightful)
A judge has no vested interest in a decision going one particular direction or another. They're not paid by the case. If they find they don't have jurisdiction, they'll deny the application for the restraining order and move on to the next case.
I never said that they should be free to disregard them because they think they're unlawful, I say they should be free to disregardthem because they are unlawful. I agree that to allow someone to stand up and say "I didn't obey the order because I didn't think it was lawful" and have the appeal judge reply "oh, well, if you thought it was unlawful that's ok then" would be a nonsense. But for someone to be able to stand up and say "I didn't obey the order because it was unlawul, here's why..." and have the appeal judge reply "you're right, that was unlawful, no charge to answer" is plain common sense.
The Supreme Court addressed that issue in Walker v. City of Birmingham, holding that "in the fair administration of justice, no man can be judge in his own case, however exalted his station, however righteous his motives, and irrespective of his race, color, politics, or religion. This Court cannot hold that the petitioners were constitutionally free to ignore all the procedures of the law and carry their battle to the streets. One may sympathize with the petitioners' impatient commitment to their cause. But respect for judicial process is a small price to pay for the civilizing hand of law, which alone can give abiding meaning to constitutional freedom." In Howat v. Kansas the Court held "An injunction issued by a court of general jurisdiction and equity powers upon proper pleadings and served upon parties within the jurisdiction must be obeyed, even if erroneous and based upon an invalid statute, until set aside by orderly review."
And the law of the land, whether you agree with it or not, is that gag orders aren't automatically unconstitutional. You're always going to be able to come up with arguments as to why the injunction is invalid; it's up to the trial judge to decide how convincing those arguments are, and he or she is the one issuing the injunction. If you think you
It's a question of balancing; is it more important to promote the rule of law by requiring people to obey court orders until they're vacated, or is it more important to ensure that absolutely, positively nobody is ever imprisoned for a wrongful contempt charge. The courts pick the former, and I have to say I agree with them. You obviously believe in the latter, which is your right, and if you feel that strongly about it you should petition your representative to pass a law to fix the problem.
And though it may offend your sense of physics-like consistency, in City of Birmingham the Court implicitly recognized that where an injunction on its face is completely and transparently invalid (like your enjoined-from-breathing example), then you don't have to follow it.
I wasn't trying to argue that was in any sense a lawful order. Constitutional issues could get it overturned, but if defendant Smith is still bound to follow it until it's overturned, he's still going to prison or the morgue.
Or, far more likely, suffer a few fines. I think a Court is far more likely to find civil contempt in this case. And I'm not sure where you're getting the morgue from. But yes, in the end, it IS possible that someone may be briefly imprisoned due to the wrongful acts of an overbearing judge. Just like you may be briefly imprisoned due to the wrongful acts of an overbearing police officer. It's not a sign of a broken system unless you have no way to get out of jail. Fortunately, there are safeguards built into the system that will help you, for example habeas corpus writs. If you are enjoined from breathing, you may be