Massachusetts Bay Transportation Authority v. Anderson et al

Filing 18

EXHIBIT re 16 MOTION to Modify Terms But Not Duration of Temporary Restraining Order by Massachusetts Bay Transportation Authority. (Attachments: # 1 Exhibit 1, # 2 Exhibit 2, # 3 Exhibit 3, # 4 Exhibit 4, # 5 Exhibit 5)(Mahony, Ieuan-Gael)

Exhibit 3

From: Mahony, leuan (BOS - X75835) Sent: Sunday, August 10, 2008 3:18 PM To: 'Jennifer Granick' Cc: Cindy Cohn; Kurt Opsahl; Marcia Hofmann; William Mitchell; 'Scott Darling'; Mahony, leuan (BOS - X75835) Subject: RE: CRITICAL INFORMATION: MBTA v Anderson et al Dear Jennifer: Let me address your email and phone call from yesterday, and also return to earlier discussions over a "movingforward" relationship between the parties. (A) Your Email First, we want to thank you for your concern. Second, as I indicated earlier today, the MBTA, along with a system vendor, has completed its review of your email, and re-reviewed the three page summary report attached as Exhibit 1 to Scott Henderson's Declaration (the "Report"). This review does not alter the original assessment of the Report, provided by Mr. Henderson in his declaration. Yet it is the case that (a) the quantity and quality of information provided by the three page Report, standing alone, is less than (b) the quantity and quality of the information provided by the Report read in combination with the Students' 87 page presentation entitled "Anatomy of a Subway Hack" (the "Presentation"). If the MBTA had been given the Presentation when first requested (or even at the time when the Presentation , we understand, was made available to DEFCON attendees), the "(b)" circumstance might have been avoided. In any event, the MBTA's evaluators do not assess the risk of this information at the level you set in your email. The MBTA, with vendor support, has begun work on internal responses to the potential security risks at issue. It is our view that an internal, technical and personnel response is the best long-term solution. Accordingly, we do not share your view that legal "emergency measures" are required. We do not think that seeking court relief on this issue and at this point is appropriate. Again, thank you for your concern. (B) Moving-Forward Relationships We can see from your clients' statements in the press, and the EFF's public statements, that the lawsuit generally, and Temporary Restraining Order in particular, do not from your perspectives represent a fair or balanced situation. From my first conversations with Marcia and Kurt, and then later with you, Jennifer, I stated my view that parties, acting reasonably, will invariably develop and implement a resolution of a dispute that is substantially better tailored to their interests than a resolution imposed on them by an external authority. We think we should continue discussions, to see if we can find a solution that is better tailored to all parties' interests. In my view, Judge Woodlock, in his findings and rulings, directed the parties to work toward a solution perhaps more "creative" and "outside the box" than the standard "keep fighting in court over abstract issues while life goes by". The goal would be to shift from an adversarial mode to a cooperative, discussion mode, if possible. We respect your clients' continued statements that their goal remains to provide solutions to security risks. We propose formal mediation as the process for seeking a more optimal going-forward solution. We think we should reserve a full day, or perhaps two. We suggest that the mediation take place in Boston. Other issues, such as mediator costs, whether formal "written submissions" are exchanged, and the like we can discuss. Let us know your thoughts. 8/11/2008

Thanks leuan

From: Mahony, leuan (BOS - X75835) Sent: Sunday, August 10, 2008 9:27 AM To: 'Jennifer Granick' Cc: Cindy Cohn; Kurt Opsahl; Marcia Hofmann; Mahony, leuan (BOS - X75835) Subject: RE: CRITICAL INFORMATION: MBTA v Anderson et al Jennifer: The MBTA and one of its vendors have completed review per your email, below. I'll have results to you later today. I'll continue to keep you informed. Thanks leuan

From: Jennifer Granick [mailto:[e-mail]] Sent: Saturday, August 09, 2008 5:14 PM To: Mahony, leuan (BOS - X75835) Cc: Cindy Cohn; Kurt Opsahl; Marcia Hofmann Subject: CRITICAL INFORMATION: MBTA v Anderson et al

Dear Mr. Mahony: This email is to follow up on my phone call to you of just a few minutes ago. As you know, Mr. Anderson, Mr. Ryan and Mr. Chiesa provided your client MBTA with a confidential three page summary of their research and recommendations for securing the fare collection system. It has just come to our attention through third parties at the Defcon conference that plaintiffs have made this report publicly available on the court's pacer website by filing the document as an exhibit. This confidential document contains the checksum information without which an attacker can not create a forged card. This information is highly sensitive, which is why my clients planned to withhold it from their presentation. We strongly urge you to take emergency measures to have it removed expeditiously. Best wishes, Jennifer Granick

Civil Liberties Director Electronic Frontier Foundation 454 Shotwell Street San Francisco, CA 94110 415.436.9333x134 fax [phone] [e-mail]

8/11/2008