Judge awaits students' research paper

A First Amendment battle three MIT students are waging against the MBTA could intensify tomorrow if they have not provided a federal judge with a research paper that outlines flaws in the transit agency's fare-reading apparatus and computer software they created to beat the system.

An MBTA lawyer told the Globe that the students rejected US District Judge George A. O'Toole Jr.'s order to secretly provide the class paper and computer code they had planned to share at a hackers' conference in Las Vegas earlier this month. The attorney, Ieuan G. Mahony, said the students submitted only correspondence they had with conference organizers, which was part of the judge's order, in time for a Saturday deadline.

"We need to review the legal basis for not producing the paper," Mahony said Saturday.

A spokeswoman for a legal advocacy group representing the students declined to specify yesterday what was provided to the judge, other than to say they responded to the order.

"Basically what the judge asked for in asking that these documents be handed over was . . . prepublication review by a government agency of these students' speech," said Rebecca Jeschke, a spokeswoman for the California-based Electronic Frontier Foundation. "It's the kind of prior restraint that the First Amendment was designed to abolish."

The students are under a 10-day gag order that prevents them from going public with system security flaws within the MBTA system. That Aug. 10 order, which prevented the students from making their presentation to the DEFCON hacker convention, expires tomorrow, and the judge said he needed the additional materials to rule on the MBTA's request for a preliminary injunction against dissemination of the information. A hearing is scheduled tomorrow on the preliminary injunction request.

On Thursday, O'Toole ordered MIT undergraduates Zack Anderson, Alessandro Chiesa, and R. J. Ryan to turn over the materials or provide a response to the order by Friday, a deadline that was later extended to 8 p.m. Saturday.

Mahony said Saturday that the Massachusetts Bay Transportation Authority wants the judge to continue to ban the students from discussing the flaws in the agency's internal security, and the method they derived for beating the system until officials have fixed the problem.

The MBTA had asked the judge to require the students to turn over even more documents, including early drafts of their class paper, notes and research materials they used in writing, fare cards and devices they altered or created in their research, and documents identifying any other people who may have had access to the altered fare cards or devices. The judge's order represented a small slice of what the MBTA wants to see.

Mahony said MBTA lawyers requested the documents because officials want to compare them to the 30-page sealed paper the students gave the court last week. He said he, MBTA officials, and encryption specialists have read the document, but he did not comment on what it contained. He said the paper was more robust than the four-page vulnerability report the students had provided the MBTA earlier.

"It really does start at the beginning and moves through," he said. But, he added, "we don't know if it moves all the way through."

During Thursday's hearing, Jennifer Granick, civil liberties director of the Electronic Frontier Foundation, said the 30-page document contained "the entire universe of information."

Much of the students' research also is available on an 87-page slide presentation prepared for the DEFCON conference that was distributed before the MBTA filed suit on Aug. 8.

Mahony said the MBTA is not convinced that the students have shared everything.

Globe correspondents Maddie Hanna and Caitlin Castello contributed to this report. John Drake can be reached at jdrake@globe.com.