MBTA warns workers to be vigilant

Court extends deadline for hacking data

In a confidential e-mail, the MBTA told employees yesterday to be "vigilant about security" - a warning given amid a lawsuit filed after three MIT students claimed that they hacked into the T's automated ticketing system.

The e-mail, sent yesterday afternoon and obtained by the Globe, warned MBTA computer users to "be aware of the possibility of malicious activity aimed at MBTA Information Technology (IT) assets and resources."

Gary S. Foster, MBTA chief technology officer, also told employees in the e-mail to be especially careful with "suspicious e-mail received on MBTA computers and networks" in an online environment that is "characterized by a general increase in data theft and data loss."

Also yesterday, a federal judge extended an order until 8 tonight for the three students to provide the court with more information about the alleged security flaws in the MBTA's system.

US District Judge George A. O'Toole Jr. ordered Zack Anderson, Alessandro Chiesa, and R.J. Ryan to turn in a paper the students wrote and correspondence they had with the organizers of a Las Vegas hacker convention.

Lydia Rivera, an MBTA spokeswoman, said, "It is incumbent upon the MBTA to ensure that these MIT students do not have any additional information that may be used to compromise the MBTA's Charlie Card system."

Rivera declined to comment about the e-mail.

The deadline extension was sought because the students are not in Boston, Jennifer Granick, a San Francisco attorney who represents the three, has said.

Granick, the civil liberties director of the Electronic Frontier Foundation, said in court on Thursday that the students had provided "the entire universe of information" in a 30-page sealed document that included material the students did not intend to release about security flaws.

Rebecca Jeschke, a spokesman for the foundation, which is assisting the students, added, "Of course we don't think they should have to hand over these documents."

Judge O'Toole said on Thursday that he needed additional information to "make a sounder decision about the facts of the case." After the students were originally ordered to turn in the information by 4 p.m. yesterday, the court granted an extension until 8 p.m. yesterday, and then until 8 p.m. today.

The judge said he will hold another hearing on Tuesday about whether to dismiss or extend the 10-day restraining order issued last Saturday.

On Thursday, a federal judge refused to lift an order prohibiting the three MIT students from publicly discussing how they allegedly hacked into the T's network.

The order banned the students from speaking last Sunday at DEFCON, the hacker convention held in Las Vegas, about the security flaws they allegedly discovered.

"The temporary restraining order is unconstitutional, a prior restraint of free speech," Jeschke said.

The MBTA filed suit against the three students for alleged trespassing and computer fraud and the Massachusetts Institute of Technology for alleged negligence after a vendor saw promises of "free subway rides for life" on a website advertising the students' presentation.

Ieuan G. Mahony, a Boston lawyer representing the T, did not return calls yesterday seeking comment.