MIT students ordered to release more information on T security flaws

One of the pictures included in the presentation the students planned to give.

By Maddie Hanna, Globe Staff

A federal judge today ordered three MIT students to release more information on what they know about security flaws in the MBTA's electronic toll collection system.

In a hearing in a lawsuit brought by the MBTA, Jennifer Granick, an attorney for the students, told US District Judge George O'Toole that the students had already provided the court with the "entire universe of information" the students had developed about the system.

But Ieuan G. Mahony, an attorney for the MBTA, said, "There's still a good deal of information out there."

The students filed a 30-page sealed document with the court Wednesday detailing what they know. But the MBTA is seeking emails the students wrote to organizers of a hackers' conference last weekend in Las Vegas, as well as a copy of a paper they prepared for an MIT professor.

Granick, who works for the Electronic Frontier Foundation, said it would be difficult to produce the documents by a 4 p.m. deadline Friday, but O'Toole asked her to make all reasonable efforts to obtain them.

US District Judge Douglas Woodlock granted the transit authority a temporary restraining order on Saturday blocking the trio from publicly discussing their findings on the possible security flaws at a presentation at last weekend's DEFCON convention.

Granick argued that the "gag order" should be rescinded. O'Toole listened to the arguments but didn't make a ruling, scheduling another hearing for next Tuesday.

The suit names Zack Anderson, R. J. Ryan, and Alessandro Chiesa as defendants, along with MIT. The T has argued in its lawsuit that unmasking potential security flaws in the CharlieCard and CharlieTicket systems would cause "significant damage to the transit system."

The Electronic Frontier Foundation has called the restraining order a dangerous precedent for security researchers that could discourage the investigation and improvement of computer systems across the country.