Massachusetts Bay Transportation Authority v. Anderson et al

Filing 28

MOTION for Hearing Plaintiff's Request For Rule 16 Scheduling Conference and Interim Discovery Order by Massachusetts Bay Transportation Authority. (Attachments: # 1 Exhibit 1, # 2 Exhibit 2, # 3 Exhibit 3, # 4 Exhibit 4)(Mahony, Ieuan-Gael)

EXHIBIT 1

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS MASSACHUSETTS BAY TRANSPORTATION AUTHORITY Plaintiff v. Civil Action No. 08-11364-GAO ZACK ANDERSON, RJ RYAN, ALESSANDRO CHIESA, and the MASSACHUSETTS INSTITUTE OF TECHNOLOGY Defendants PLAINTIFF'S REQUEST TO DEFENDANTS ZACK ANDERSON, RJ RYAN, AND ALESSANDRO CHIESA FOR EXPEDITED PRODUCTION OF DOCUMENTS AND THINGS FOR PURPOSES OF PRELIMINARY INJUNCTION HEARING Introduction Pursuant to Fed. R. Civ. P. 26 and 34, the plaintiff, Massachusetts Bay Transportation Authority ("MBTA") hereby requests that the defendants Zack Anderson, RJ Ryan, and Alessandro Chiesa (the "MIT Undergrads") produce for inspection and copying at the offices of Holland & Knight LLP, 10 St. James Avenue, Boston, Massachusetts, all of the documents and things described below which are within the MIT Undergrad's possession, custody or control and to respond in writing to this request on an expedited basis, for purposes of the Preliminary Injunction Hearing, on or before Thursday, August 14, at 5:00 PM eastern. Definitions The definitions of Local Rule 26.5 are incorporated in these Requests, with the additional definitions, and modifications, below. Further terms are defined in context:

1

"And" as well as "or" shall be construed either conjunctively or disjunctively so as to bring within the scope of the request any documents that might otherwise be considered outside the scope of the request. "Communication" or "communication" shall mean any oral or written transmittal of information or request for information made from one person to another person whether made in person, by telephone, by voicemail, by email, or by any other means; or documents made for the purpose of recording a communication, an idea, statement, opinion or belief. "Complaint" shall refer to the Complaint filed by MBTA in this lawsuit against the MIT Undergrads, and all allegations therein. "Concerning" or "concerning" shall mean referring to, describing, evidencing or constituting. "Correspondence" or "correspondence" shall mean any letter, telegram, telex, email message, voicemail message, notice, memorandum, or other written communication or transcription or notes of a communication. "DEFCON Conference" means the 2008 DEFCON 16 Conference, held at the Riviera Hotel & Casino in Las Vegas, Nevada, during the period August 8-10, 2008. See https://www.defcon.org/ "DEFCON" means the entity organizing and hosting the DEFCON Conference. "Document" or "document" shall mean the original and each copy that is not identical with the original or that contains any commentary or notation that does not appear on the original of any written, printed, digital, recorded, or graphic matter, including but not limited to correspondence, emails, minutes of meetings, reports, records, lists, memoranda, manuals, schedules, calendars, diaries, voicemails, notes of telephone conversations, notebooks, audio or

2

video recordings, advertisements, press releases, and/or opinions or reports of consultants, whether stored in tangible, electronic, mechanical or electric form or representation of any kind (including (i) digital materials on or in network storage, laptop or desktop storage, computer tapes, disks, and other memory devices or media, and (ii) backup copies and `deleted' files on a computer or computer storage device or media), wherever located. "MBTA" or "plaintiff" shall refer to the plaintiff in this lawsuit, Massachusetts Bay Transportation Authority, and its employees, agents, trustees and representatives. "MIT Undergrads," "Individual Defendants" or "you" shall mean the individual defendants in this lawsuit, Zack Anderson, RJ Ryan, and Alessandro Chiesa, individually, collectively, and in any combination, as well as their agents, representatives, or anyone acting on their behalf or for their benefit. "Person" or "person" shall mean any natural person, individual, proprietorship, partnership, corporation, association, organization, trust, or other entity. "Presentation" means the 87 page set of PowerPoint slides prepared by the MIT Undergrads and entitled "Anatomy of a Subway Hack." A copy of the Presentation is attached as Exhibit 7 to the Supplemental Affidavit of Ieuan G. Mahony. "Report" means the five page document entitled "Fare Collection Vulnerability Assessment Report: Analysis and Recommendations," dated as of Friday, August 8, 2008. A copy of the Report is attached as Exhibit 1 to the Declaration of Scott Henderson. "Tangible things" or "things" is defined to be synonymous in meaning and equal in scope to the usage of this term in Fed. R. Civ. P. 34(a)(1)(B), and shall include but not be limited to (i) objects that embody human compiled or generated information, including computers, laptops, hard drives, storage media, and other devices from which information can be obtained or which,

3

if necessary, can be translated into reasonably usable forms; (ii) transit system fare media; (iii) equipment to modify, evaluate, copy, or derive information from transit system fare media; and (iv) equipment to modify, evaluate, copy, or derive information from fare media systems employed for public transit purposes. Document Requests 1. DEFCON relationship. Please provide documents that evidence, discuss, or relate to your relationship with DEFCON concerning the DEFCON 16 Conference. Please include in your response: 1.1. 1.2. 1.3. 2. Permissions, waivers, and other agreements between the MIT Undergrads and DEFCON concerning submission of the Presentation. Written communications (including email) between the MIT Undergrads and DEFCON Documents that evidence, discuss, or relate to the date(s) on which the MIT Undergrads submitted the Presentation to DEFCON.

Class Paper. Please provide documents that evidence, discuss, or relate to the paper the MIT Undergrads submitted for Professor Rivest's class concerning MBTA security system(s) (the "Class Paper"). Please include in your response: 2.1. 2.2. 2.3. A copy of the Class Paper. Drafts, notes, and other materials used or consulted by the MIT Undergrads in connection with the preparation of the Class Paper. Copies of any comments, critiques, or evaluations by Professor Rivest (i) of the Class Paper, (ii) of any outlines underlying or summaries of the Class Paper, and (iii) of any of its drafts. Copies of any comments, critiques, or evaluations by anyone other than Professor Rivest or an MIT Undergrad (i) of the Class Paper, (ii) of any outlines underlying or summaries of the Class Paper, and (iii) of any of its drafts.

2.4.

3.

Transit Police and FBI Meeting. Please provide documents that evidence, discuss, or relate to the face-to-face meeting that included (a) the MIT Undergrads, (b) the MBTA Transit Police, and (c) the FBI (the "August Law Enforcement Meeting"). Please include in your response: 3.1. Documents that evidence, discuss, or relate to the date on which August Law Enforcement Meeting took place.

4

3.2.

Copies of any documents provided to the MBTA Transit Police or the FBI by the MIT Undergrads, Professor Rivest, or MIT Counsel at the August Law Enforcement Meeting. Notes or transcriptions of any discussions that occurred during the August Law Enforcement Meeting. Documents that evidence, discuss, or relate to communications between the MIT Undergrads and the MBTA concerning the August Law Enforcement Meeting, including concerning any discussions that took place during the August Law Enforcement Meeting. Copies of any information in written form that the MIT Undergrads had prepared, as of the August Law Enforcement Meeting, to assist or aid the MBTA with respect to correct security vulnerabilities perceived by the MIT Undergrads ("Assistive Materials"). Documents that evidence, discuss, or relate to the date(s) on which the MIT Undergrads (a) began preparation of the Assistive Materials; and (b) provided Assistive Materials to the MBTA.

3.3. 3.4.

3.5.

3.6.

4.

Fare Media. Please provide documents and things that constitute, evidence, discuss, or relate to any physical MBTA fare media that the MBTA Undergrads altered, manipulated, or created (collectively, "Altered MBTA Fare Media"). Please include in your response: 4.1. All physical MBTA fare media that the MBTA Undergrads altered, manipulated, or created (collectively, "Altered MBTA Fare Media"). Include in this response (a) all Altered MBTA Fare Media employed for purposes of the Class Paper; (b) all Altered MBTA Fare Media employed for purposes of the Presentation; and (c) all Altered MBTA Fare Media employed for any other purpose. Documents and things that evidence, discuss, or relate to any individuals other than the MIT Undergrads who received Altered MBTA Fare Media created by the MIT Undergrads. All physical equipment and software used by the MIT Undergrads in connection with analyzing CharlieTickets and CharlieCards. All physical equipment and software used by the MIT Undergrads in connection with analyzing MBTA systems that process, manage, deliver, or otherwise interact with CharlieTickets and CharlieCards. All physical equipment and software used by the MIT Undergrads in connection with creating Altered MBTA Fare Media.

4.2.

4.3. 4.4.

4.5.

5

4.6.

Documents that evidence, discuss, or relate to any use of Altered MBTA Fare Media on MBTA equipment, including use (a) on Fare Gates; and (b) on Fare Vending Machines.

5.

The Presentation. Please provide documents and things that constitute, evidence, discuss, or relate to the Presentation. Please include in your response: 5.1. Documents that evidence, discuss, or relate to the date(s) on which the MIT Undergrads (a) began preparation of the Presentation; and (b) completed preparation of the Presentation. Drafts, notes, and other materials used or consulted by the MIT Undergrads in connection with the preparation of the Presentation. Copies of any comments, critiques, or evaluations by anyone other than an MIT Undergrad (i) of the Presentation, (ii) of any outlines underlying or summaries of the Presentation, and (iii) of any of its drafts. Provide copies of all software tools, software modules, lines of code, and software applications the MIT Undergrads intended to distribute or demonstrate at DEFCON (collectively, "DEFCON-related Software Tools"). Provide copies of all materials, other than (a) the Presentation, and (b) the DEFCON-related Software Tools, that the MIT Undergrads intended to distribute or demonstrate at DEFCON ("Additional DEFCON Materials"). Documents that evidence, discuss, or relate to any requests by the MBTA for copies of materials that the MIT Undergrads planned to present at DEFCON. Documents that evidence, discuss, or relate to any requests by the MBTA for discussions with the MIT Undergrads, after completion of the August Law Enforcement Meeting, concerning DEFCON or perceived security vulnerabilities. Documents that evidence, discuss, or relate to the date(s) on which the MIT Undergrads (a) provided the Presentation to the MBTA; (b) provided DEFCONrelated Software Tools to the MBTA; and (c) provided Additional DEFCON Materials to the MBTA.

5.2. 5.3.

5.4.

5.5.

5.6. 5.7.

5.8.

6.

The Report. Please provide documents and things that constitute, evidence, discuss, or relate to the Report. Please include in your response: 6.1. 6.2. Documents that evidence, discuss, or relate to the date on which the MIT Undergrads began preparation of the Report. Drafts, notes, and other materials used or consulted by the MIT Undergrads in connection with the preparation of the Report.

6

7.

Responsible Disclosure. Please provide documents and things that constitute, evidence, discuss, or relate to the MIT Undergrads' their understanding of the concept of "responsible disclosure" (the "Documented MIT Undergrad-Defined Responsible Disclosure"). Please include in your response: 7.1. 7.2. Copies of documents (if any) upon which the MIT Undergrads rely to define or support the Documented MIT Undergrad-Defined Responsible Disclosure. Documents that evidence, discuss, or relate to the MIT Undergrads' compliance with Documented MIT Undergrad-Defined Responsible Disclosure. MASSACHUSETTS BAY TRANSPORTATION AUTHORITY By its attorneys, /s/ Ieuan G. Mahony____________________ Ieuan G. Mahony (BBO #552349) Maximillian J. Bodoin (BBO # 667240) HOLLAND & KNIGHT LLP 10 St. James Avenue Boston, MA 02116 [phone] /s/ Thomas F.S. Darling III_______________ Thomas F.S. Darling III (BBO #558848) MASSACHUSETTS BAY TRANSPORTATION AUTHORITY State Transportation Building 7th Floor 10 Park Plaza Boston, MA 02116 [phone]

Dated: August 13, 2008 Boston, Massachusetts

7

CERTIFICATE OF SERVICE I, Ieuan G. Mahony, Attorney for the Massachusetts Bay Transportation Authority in connection with the above-captioned proceeding, hereby certify that on this 13th day of August, 2008, I served the foregoing Request For Production of Documents by hand delivery and by email upon the following interested parties: Party Counsel

Zack Anderson, RJ Ryan, Emily Berger, Esquire and Alessandro Chiesa Lowrie, Lando & Anastasi, LLP (the "MIT Undergrads") One Main Street Cambridge, MA 02142 E-mail: [e-mail] Massachusetts Institute of Technology ("MIT") Jeffrey Swope, Esquire Edwards Angell Palmer & Dodge LLP 111 Huntington Avenue Boston, Massachusetts 02199 USA Email: [e-mail]

/s/ Ieuan G. Mahony____________________

# 5530567_v1

8