Massachusetts Bay Transportation Authority v. Anderson
| Company type | Public agency |
|---|---|
| Industry | Public transportation |
| Founded | August 1, 1964 |
| Headquarters | Boston, Massachusetts , United States |
Area served | Greater Boston area |
| Products | Public transit services |
Massachusetts Bay Transportation Authority v. Anderson, et al. (Civil Action No. 08-11364) involved a legal dispute initiated by the Massachusetts Bay Transportation Authority (MBTA) aimed at stopping three students from the Massachusetts Institute of Technology (MIT) from publicly revealing a security vulnerability discovered in the MBTA’s CharlieCard automated fare collection system. The core issue was whether exposing a computer security flaw is safeguarded as free speech under the First Amendment.
The MBTA claimed that the students breached the Computer Fraud and Abuse Act (CFAA) and secured a temporary restraining order (TRO) on August 9, 2008, to prevent them from sharing details at the DEFCON conference that could facilitate fare evasion. Conversely, the students maintained that mandating government approval prior to disclosure constituted an unconstitutional prior restraint on speech.
The case gained extensive media coverage, further intensified by the Streisand effect, since the students’ presentation materials had already been distributed to conference organizers and were accidentally made available on the court’s public website.
On August 19, the presiding judge refused to prolong the injunction, thereby permitting the students to deliver their presentation and upholding their free speech rights in this scenario.
Background
In December 2007, Karsten Nohl and Henryk Plotz independently issued alerts regarding vulnerabilities and weak encryption in NXP’s MIFARE chip technology and contactless card system. By March 2008, these security weaknesses were widely reported in both mainstream media and industry publications. Separately, researchers at Radboud University Nijmegen demonstrated how cryptographic keys could be extracted from MIFARE Classic cards without costly equipment. Following responsible disclosure practices, the university released their results six months later. NXP sought to prevent this publication through a preliminary injunction; however, a Dutch court ruled that disseminating scientific research falls under protected freedom of expression.
In May 2008, MIT students Zack Anderson, Russell J. Ryan, Alessandro Chiesa, and Samuel G. McVeety published a paper exposing flaws in the MBTA’s automated fare collection system. They pinpointed several critical vulnerabilities: value stored directly on the card rather than a secure backend database, data that could be easily read and altered, absence of cryptographic signatures to prevent counterfeiting, and no centralized verification mechanism. Subsequently, Anderson, Ryan, and Chiesa presented "Anatomy of a Subway Hack" at DEF CON, showcasing reverse engineering of magnetic stripe data, attacks on MIFARE-based Charlie Cards, and brute force techniques using FPGAs.
Prior to any formal complaint in August 2008, security specialist Bruce Schneier observed that although publishing these attacks might have financial consequences for NXP and its clients, it ultimately promotes improved security by compelling companies to enhance designs through informed consumer pressure.
Litigation
On August 8, 2008, the MBTA initiated legal action seeking a temporary restraining order to bar the students from presenting or discussing their research until vendors had an opportunity to address the identified vulnerabilities; they also pursued monetary damages. Judge Douglas P. Woodlock granted this motion on August 9. Although the students attended the conference, they refrained from presenting due to the injunction. This legal action paradoxically increased attention and led to broader circulation of sensitive information because of prior distribution and accidental posting on the court’s public portal.
Represented by Holland & Knight, the MBTA contended that under accepted responsible disclosure protocols, the students failed to provide sufficient notice for remediation before publicizing the flaw. They alleged violations of the Computer Fraud and Abuse Act (CFAA), accusing the students of transmitting harmful code causing over $5,000 in damages with potential risks to public safety. Additional claims included conversion, trespass to chattels, illicit profit from unauthorized activities, and negligence by MIT in supervising its students.
The students were defended by the Electronic Frontier Foundation alongside Fish & Richardson, arguing that "transmission" within the CFAA should not be interpreted expansively and that issuing a restraining order infringed upon their First Amendment right to free expression concerning academic research. Support from eleven leading computer scientists emphasized that such gag orders could suppress critical research efforts and undermine academic security initiatives vital for advancing industrial technology.
On August 19, the judge declined to extend the restraining order, thereby enabling the students to openly share their discoveries thereafter.
See also
Further reading
Court documents
- Complaint: MBTA v. Anderson, et al.
- Temporary restraining order: Restraining order dated August 9
- Response: MIT Students’ reply and Motion to Amend
- Exhibit: Correspondence from Computer Science Professors and Scientists
Additional resources
- Articles with short description
- Cryptography case law
- United States District Court for the District of Massachusetts cases
- United States Internet case law
- United States Free Speech Clause case law
- Electronic Frontier Foundation litigation
- Massachusetts Bay Transportation Authority
- 2008 in United States case law
- 2008 in rail transport
- United States railway case law