A federal court judge ordered three MIT students to cancel their presentation on the vulnerabilities of the Boston T subway system that was scheduled to take place this week at Defcon, the security conference held in Las Vegas.
The students were supposed to show how they reversed engineered data on magstripe card, present several attacks that could break the Charlie card, which is highly used around the world.
The Electronic Frontier Foundation, which represents the three students, Zack Anderson, RJ Ryan and Alessandro Chiesa, says the court order violates their First Amendment rights to discuss their research.
“The court's order is an illegal prior restraint on legitimate academic research in violation of the First Amendment,” said EFF Civil Liberties Director Jennifer Granick, adding that the court order is unconstitutional, putting an equal sign between speaking about vulnerabilities in a public forum and computer intrusion.
According to EFF, it's in the public best interest to benefit from a free flow of ideas and information on vulnerabilities, and not talking about these problems won't stop the attackers from exploiting the vulnerabilities.
"We wanted to share our academic work with the security community and had planned to withhold a key detail of our results so that a malicious attacker could not use our research for fraudulent purposes," one of the MIT students, Zack Anderson, said about their presentation.
The MIT students had planned to discuss practical brutal force attacks using FPGAs and using software-radio to read RFID cards. They were also supposed to demonstrate how such attacks could work, but the court order prevented them from doing so.
The MBTA opposed their presentation and filed a lawsuit to stop them, arguing that it would cause significant damages to the transit system.
But according to Jennifer Granick, keeping information from the public will not stop the attackers, it will just stop the public from knowing that there are vulnerabilities to the system and companies from fixing them.