Massachusetts Bay Transportation Authority v. Anderson et al

Filing 37

DECLARATION Supplemental Declaration of Richard Sullivan by Massachusetts Bay Transportation Authority. (Mahony, Ieuan-Gael)

Massachusetts Bay Transportation Authority v. Anderson et al

Doc. 37

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

MASSACHUSETTS BAY TRANSPORTATION AUTHORITY Plaintiff
v.

Civil Action No. 08-11364-GAO ZACK ANDERSON, RJ RYAN, ALESSANDRO CHIESA, RONALD L. RIVEST, and the MASSACHUSETTS INSTITUTE OF TECHNOLOGY Defendants

SUPPLEMENTAL DECLARATION OF RICHARD SULLIVAN 1. I am a Sergeant Detective in the Transit Police of the plaintiff, Massachusetts Bay

Transportation Authority ("MBTA"). I am the Transit Police liaison to the Federal Bureau of Investigation (the "FBI"). I make this declaration as a supplement to my first declaration, which I incorporate herein by reference, and to further describe my meeting with the MIT Undergrads that I referenced in my previous declaration. 2. As an initial matter, in preparing for this supplemental declaration I realized that

the meeting actually took place on August 4, 2008 and not, as I stated in my first declaration, on August 5, 2008. 3. At the beginning of the meeting I told those in attendance, including the MIT

Undergrads and Professor Rivest, that I was there as an agent of the MBTA. I told them that I was there because of claims that were posted on the DEFCON website and to mitigate any harm

Dockets.Justia.com

to the MBTA. I informed them that I was there to protect the MBTA from economic and other harm. 4. I asked about the presentation that they were planning on giving in Las Vegas.

They told me that they were building on information that was already available and that they wanted to take it further. They told me several times during the meeting that they did not hack into the MBTA's computer system while doing research for their presentation and that they did not attempt to defraud the MBTA by making counterfeit cards. 5. The MIT Undergrads assured me that their presentation was on the MIFARE

system and the Magstripe system only, and that they would withhold key elements that would allow others to exploit the vulnerabilities that they claimed to have discovered in the MBTA's CharlieCard System. 6. During the meeting, FBI Agent Jacob Shaver explained to them that enabling

others to hack into the MBTA's computer system would be the same as if they hacked into the system themselves. The MIT Undergrads reiterated that they did not exploit the supposed vulnerabilities that they had identified in the MBTA's computer system, they promised that they would not do so in the future, and they promised that they would not teach others how to. 7. I asked the students to prepare a written summary of every vulnerability that they

claimed to have discovered and how to fix these vulnerabilities. The MIT Undergrads agreed to provide me with such a paper within two weeks. In addition, their professor thought that it was a good idea and confirmed with the MIT Undergrads during the meeting that they would write this summary. I did not request any other documents from the MIT Undergrads, and they did not offer to provide me with any other documents.

8.

I told the MIT Undergrads that, based on their statements that they did not hack

into the MBTA's computer system, defraud the MBTA, or would teach others how to do so, that they would not be subject to criminal prosecution. 9. On August 6, 2008, both myself and Agent Shafer personally met with Joseph

Kelley and others to discuss the meeting that had taken place. I conveyed to all in attendance that we were confident that the students did not violate any state or federal criminal statues. Moreover, I conveyed that we were both comfortable and confident that the students would honor their declaration to us that they would not disclose any information that would enable others to harm the MBTA. After that meeting, I contacted Professor Rivest to let him know that Mr. Kelley may be reaching out to him. Signed under the penalties of perjury this 15th day of August, 2008.

Richard Sullivan MBTA Transit Police
# 5 5 4 2 4 7 0 v4