A court order put a stop to a planned presentation at the Defcon hackers convention by three MIT students who found security flaws in the electronic ticketing system used by the mass transit authority in Boston. But the ruling reopened the schism in the IT security community over the issue of how vulnerabilities should be publicly disclosed.
Critics of the temporary restraining order issued last Saturday by a federal judge in Boston have labeled it an infringement of the students’ First Amendment rights and an example of “prior restraint” on free speech. Many said such actions leave vulnerable systems open to attackers and put a chill on security research, driving legitimate researchers underground.
Others, though, see the case involving the students and the Massachusetts Bay Transportation Authority (MBTA) as another example of publicity-hungry security researchers driven more by ego and the desire for fame than by any sincere interest in improving security.
The always-simmering disclosure debate boiled over again after the MBTA obtained the 10-day gag order barring the MIT undergrads — Zack Anderson, Russell “RJ” Ryan and Alessandro Chiesa — from publicly disclosing information about the flaws in its e-ticketing system. The order was handed down the day before a scheduled Defcon session in which the students planned to detail the holes, which they say they found during independent penetration testing.
In an affidavit, the MBTA claimed that the students didn’t give it sufficient information about the vulnerabilities beforehand. The transit authority added that it wasn’t trying to permanently gag the students and that it just wanted some time to determine the validity and seriousness of the flaws and a course of action for addressing them.
But the Electronic Frontier Foundation (EFF), a high-tech civil rights group that is representing the three students in court, contended that the gag order was unconstitutional and wholly unnecessary. Some of the material that the students planned to present had been previously published elsewhere, the EFF noted. And, it said, the students hadtold the MBTA that they wouldn’t release technical details that hackers could use to take advantage of the flaws.
Bruce Schneier, chief security technology officer at BT Group PLC, joined 10 computer science professors and researchers in signing a letter opposing the restraining order that the EFF included as part of a motion to reconsider the decision (download PDF). Schneier said this week that publicly disclosing vulnerabilities is often the only way to prod businesses to address them.
“Companies won’t make [their systems] better by themselves,” Schneier said. MBTA officials, he claimed, “are counting on the legal system to protect their shoddy work” on IT security.
Schneier agreed that it’s good practice in general to give organizations some advance notice before publicly disclosing flaws in their systems. But, he said, it’s often hard to determine exactly what might be construed as “reasonable disclosure” and what might not be.
Steven Bellovin, a computer science professor at Columbia University who also signed the letter, said it’s a fallacy to assume that a security problem goes away or remains hidden from view “simply because you don’t talk about it” in public.
“I’m not saying the first thing you do when you find a vulnerability is to post it on your blog,” Bellovin said. “But getting injunctions against people is like saying [to them], ‘If you didn’t find it, this problem wouldn’t exist.'”
As long as the students didn’t plan to use what they had discovered for malicious purposes, they had every right to talk about it, asserted Jim Kirby, a senior network engineer at DataWare Services, an IT services firm in Sioux Falls, S.D. “Anyone who says otherwise is invited to read the Constitution,” Kirby said, adding that the restraining order was an effort “to enforce security by obscurity.”