Massachusetts Bay Transportation Authority v. Anderson et al

Filing 47

REPLY to Response to 26 MOTION for Reconsideration re 12 Order on Motion for TRO filed by Zack Anderson, RJ Ryan, Alessandro Chiesa. (Kessel, Adam)

Massachusetts Bay Transportation Authority v. Anderson et al

Doc. 47

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS MASSACHUSETTS BAY TRANSPORTATION AUTHORITY, Plaintiff, v. ZACK ANDERSON, RJ RYAN, ALESSANDRO CHIESA, and the MASSACHUSETTS INSTITUTE OF TECHNOLOGY, Defendants. REPLY TO OPPOSITION TO MOTION FOR RECONSIDERATION OF TEMPORARY RESTRAINING ORDER On Tuesday, August 19, 2008, this Court will be asked to decide whether to allow the Temporary Restraining Order ("TRO") in this matter to lapse, or to convert it into a preliminary injunction. This Court should allow the TRO to lapse. The Massachusetts Bay Transportation Authority ("MBTA") has failed to state a claim upon which any relief can be granted. The MBTA has failed to identify how the MIT Students' speech could itself be illegal in any way. The MBTA has failed to meet the standard for a preliminary injunction, never mind a prior restraint on speech. Finally, any preliminary injunction enjoining the MIT Students from engaging in core political speech about a quasi-governmental agency's conduct in a matter of significant public interest is unconstitutional. The MBTA's Opposition to the MIT Students' Motion for Reconsideration of the Temporary Restraining Order ("MBTA Opp.") errs on two crucial points of law upon which this Motion (and indeed, this entire case) can be decided without the need to resolve any factual issues. Contrary to the MBTA's view: Civil Action No. 08-11364-GAO

Dockets.Justia.com

(1) The Computer Fraud and Abuse Act ("CFAA") does not regulate pure speech. On its face, it prohibits the act of accessing without authorization and causing damage to protected computers. It also prohibits the transmission of viruses, worms and the like with the intent to cause damage to a protected computer. The statute does not prohibit talking about such intrusions, and the MBTA has failed to explain how the MIT Students could violate the law merely by speaking about the security flaws they discovered. The MBTA has not cited a single case that supports its attempt to apply the CFAA to speech. Nor are we aware of any such cases. For this reason alone, the MBTA has failed to state a claim upon which relief can be granted, and thus both the TRO and the Complaint should be dismissed. (2) Prior restraints on speech are nearly always unconstitutional. Even where the threatened disclosure implicated national security, the Supreme Court held a prior restraint unconstitutional, see New York Times Co. v. United States, 403 U.S. 713 (1971). The prohibition on prior restraint is so strong that the First Circuit has vacated a district court's contempt sanction against a party who willfully violated a temporary restraining order, finding that unlawful prior restraints fell within the narrow range of exceptions to the "collateral bar" rule which ordinarily prohibits the violation of a wrongly-issued court order. In re Providence Journal Co., 820 F.2d 1342, 1344 (1st Cir. 1986). As discussed below, the MBTA's allegations do not even meet the general standard for injunctive relief, much less the extraordinary standard of imposing a prior restraint on speech. The Court need go no further than either of these two points to grant the MIT Students' Motion, dissolve the TRO, and refuse to issue a preliminary injunction. ADDITIONAL FACTS While the pleadings of the parties to date address most of the factual background, we submit a brief discussion of new developments since the Thursday hearing below. On Friday, August 15, the MBTA filed without comment a Supplemental Declaration of MBTA Transit Police Office Richard Sullivan. (Docket #37 ("Supp. Sullivan Decl.").) This declaration undermines the MBTA's basic factual allegations. The MBTA's rush to the 2

courthouse was premised on its claim that the students refused repeated requests by the MBTA to provide them with additional information prior to the DEFCON presentation and that based on these failures, and the DEFCON presentation materials, they felt certain that the students were intending to teach others how to avoid paying subway fares. (See e.g. Temporary Restraining Order Request at ii; MBTA Opp. at 6-7.)1 The Supplemental Sullivan Declaration belies these assertions. Mr. Sullivan was the only MBTA representative to have spoken with the students prior to the MBTA's seeking of the TRO, and prior to doing so he had reviewed the DEFCON materials that promoted the MIT Students' presentation. Mr. Sullivan refutes the MBTA's claim that it asked the students for their slides and other materials. He says that all he asked of the students was that they prepare a "summary" of their work within two weeks, making it due on August 18, 2008. He continues: "I did not request any other documents from the MIT Undergrads, and they did not offer to provide any other documents." (Supp. Sullivan Decl. ¶ 7.) Moreover, contrary to the MBTA's representations to the Court, Mr. Sullivan states that, well after he and FBI Agent Jacob Shaver both read the Announcement (Complaint ¶ 34) and met with the MIT Students, they told MBTA General Manager for Systemwide Modernization Joseph Kelley that "we were both comfortable and confident that the students would honor their declaration to us that they would not disclose any information that would enable others to harm the MBTA." (Id. ¶ 9.) Strangely, Mr. Kelley does not mention Mr. Sullivan's August 6th report to him in his August 8th declaration. More importantly, Mr. Kelley's declaration admits that he never communicated with the students directly; instead he states that he asked Professor Rivest to ask them for their slides and report. There is no indication that this request, if it was made, was ever conveyed to the students as Mr. Kelley seems to suggest.
1

In its Opposition, the MBTA even provides a chart, purportedly demonstrating how the students refused to provide them with promised information. Id. at 6.

3

Given this new information, which the MBTA must have known at the time it filed the first declaration from Mr. Sullivan omitting this exculpatory language and the declaration of Mr. Kelley, it is difficult to imagine how the MBTA could have brought this action, and sought an emergency gag order, in good faith, two days after receiving Mr. Sullivan and Special Agent Shaver's report. Indeed, in filing Mr. Sullivan's declaration, the MBTA made no attempt to explain why the information was not included in Mr. Sullivan's first declaration, or in Mr. Kelley's declaration, or indeed what changed between the time Mr. Sullivan made his assessment on Monday and the time the MBTA decided to file suit and seek emergency relief on Friday without any further communication with the students. On this new factual basis alone, the TRO should be dissolved and no injunction should issue. The MBTA has also repeatedly complained that the MIT Students have yet to submit an affidavit in this case. (See e.g., MBTA Opp. at 3 fn. 2 and 4.) No affidavits are needed to decide any relevant issue, since the MBTA's claim fails on its face, even accepting all allegations in its Complaint as true. However, this Court has indicated that further exposition of the facts would assist in its resolution of the legal issues that are the basis for deciding the validity of any restraining order. For that purpose, we have provided additional details in the Declaration of Zack Anderson ("Anderson Decl.") submitted as Exhibit 1 in support of this motion, and we identify the MBTA's misstatements and inaccuracies here. Anderson, Ryan, and Chiesa take their academic studies at MIT seriously. (Anderson Decl. ¶¶ 3-7.) They have also acted responsibly with regard to the vulnerabilities they identified in the MBTA CharlieTicket and CharlieCard system. (Id. ¶ 10.) The students initiated contact with the MBTA through their professor Ronald Rivest. (Id. ¶¶ 15-16.) The students always planned to limit the information they would publicly convey about their findings so as to avoid inadvertently teaching others how to modify or counterfeit cards or tickets. (Id. ¶ 20.) The students voluntarily met with the MBTA and with the FBI. (Id. ¶ 17.) The students agreed to provide and timely provided a confidential vulnerability report to assist the MBTA in identifying

4

and repairing vulnerabilities in its system. (Id. ¶¶ 18, 22.) The students voluntarily provided a longer and more comprehensive security report, filed under seal in this matter at Docket #32. ARGUMENT As stated above and in the MIT Students' Motion for Reconsideration of the Temporary Restraining Order, the TRO should be vacated because (1) the MBTA has no cause of action and any future speech by the MIT Students about fare card vulnerabilities is legal and (2) the TRO is an unconstitutional prior restraint on speech involving the conduct of a quasi-governmental agency in a matter of great public interest. Such speech is entitled to the highest level of protection under the First Amendment. The MBTA's Opposition to this Motion offers several responses to the MIT Students' arguments, all without merit. As an initial matter, the Order must be dissolved because the MBTA has failed to show that any future violation of law is imminent, as required by controlling case law. To the contrary, the Supplemental Sullivan Declaration indicates that the MBTA had no reason to believe that any violation of law by the MIT Students was ever imminent. Moreover, the MBTA's interpretation of the CFAA as controlling speech rather than damaging conduct is contrary to the plain text of the statute and unsupported by any case law. The MBTA's self-serving definition of "responsible disclosure" amounts to nothing more than a bald and unsupported assertion controverted by the description of the issue offered by eleven preeminent computer scientists and security researchers. In any event, to the extent that some computer security professionals might agree with the MBTA, the term "responsible disclosure" carries no legal weight. Finally, the MBTA wrongly characterizes the MIT Students' accused speech as "commercial." Encouraging other researchers to attend even a self-promotional talk is not "commercial" speech, which is defined as speech that merely proposes an economic commercial transaction.

5

I.

The Temporary Restraining Order Must Be Dissolved Because the MBTA Has Not Shown Any Violation of Law Is "Imminent." The MBTA speculates that but for the Temporary Restraining Order, the MIT Students

"would have knowingly transmitted information that defendants knew would cause damage to protected computers." (MBTA Opp. at 7) (emphasis added). This assertion appears to be directly contrary to the only relevant record evidence. Specifically, the evaluation of the only MBTA official to actually meet with the students, Mr. Sullivan, does not support the MBTA's view. (Sullivan Decl. ¶ 9.) Moreover, the MBTA's unfounded assertion is irrelevant to the continued validity of the Order.2 Injunctions are valid only if harm is "imminent" and there is a danger of "recurrent violation." United States v. W.T. Grant Co., 345 U.S. 629, 633 (1953) ("An injunction issues only if there is some showing that defendant has violated, or imminently will violate, some provision of statutory or common law"); accord Hibernia Sav. Bank v. Ballarino, 891 F.2d 370 (1st Cir. 1989) (affirming denial of injunctive relief where no danger of recurrent violation was shown).3 Under First Circuit law, a plaintiff seeking an injunction must demonstrate the likelihood of substantial and immediate irreparable injury, and the inadequacy of remedies at law. . . . It is not enough for a plaintiff to assert that she `could be' subjected in the future to the effects of an unlawful policy or illegal conduct by a defendant-the prospect of harm must have an `immediacy and reality.' Steir v. Girl Scouts of the USA, 383 F.3d 7, 16 (1st Cir. 2004) (citations omitted). The Third Circuit has echoed this point, emphasizing that "more than a risk of irreparable harm must be demonstrated. The requisite for injunctive relief has been characterized as a `clear showing of
2

Nor do these allegations state a valid claim. The MBTA must allege an actual violation of the CFAA. It has no right of civil action for either an attempted violation, or for aiding an abetting another in violating the law. 18 U.S.C. § 1030(g). Of course, the MIT Students neither attempted to violate the CFAA nor attempted to aid and abet another to do so. W.T. Grant Co. and Hibernia Sav. Bank discuss the standard for injunctive relief generally. They do not apply the even higher standard for injunctive relief that constitutes a prior restraint on speech. As shown here, the MBTA has not even met the general standard for injunctive relief, much less the heightened showing needed to enjoin speech.

3

6

immediate irreparable injury.'" Ammond v. McGahn, 532 F.2d 325, 329 (3d Cir. 1976) (internal citations omitted). The MBTA must meet a high standard for demonstrating the likelihood of future harm to justify a continued injunction.4 The MBTA must show "there exists some cognizable danger of recurrent violation, something more than a mere possibility which serves to keep the case alive." W.T. Grant, 345 U.S. at 633. "The purpose of an injunction is to prevent future violations." Id. Thus, the MBTA's reliance on what "would have" or "might have" happened at the DEFCON conference is irrelevant to whether an injunction should issue. The conference is over, and the MIT Students have no plans or intentions to give a similar presentation in the future. Ryan Declaration in Support of Motion for Reconsideration of Discovery Order ¶ 8; Attached Anderson Decl. attached as Exhibit 1 ¶ 30. Although the MBTA might claim that despite the assessment of its own official and the FBI it remains fearful about what might have happened or what could have happened at the DEFCON conference, such fear does not support the continuation of an injunction, particularly since the MIT Students have now repeatedly demonstrated their willingness to support the MBTA in improving its security system. (Id. ¶ 24.) As the Third Circuit has emphasized, "[i]njunctions will not be issued merely to allay the fears and apprehensions or to soothe the anxieties of the parties. Nor will an injunction be issued `to restrain one from doing what he is not attempting and does not intend to do.'" Continental Group, Inc. v. Amoco Chemicals Corp., 614 F.2d 351 (3rd Cir. 1980). 5 The standard is even higher when the injunction sought restricts
4

There has been no past violation--the MIT Students gave no presentation at the DEFCON conference. The MBTA improperly turns the test for injunctive relief on its head. The MBTA suggests continued application of the Temporary Restraining Order will cause no harm to the students, because "the TRO language does not prohibit the Individual Defendants from engaging in any conduct they originally planned." (MBTA Opp. at 10-11.) The MBTA gets the law backwards. Because the MIT Students have no intention of disclosing key information, the MBTA does not even have a colorable basis for an injunction.

5

7

speech. See Lawson v. Murray, 515 U.S. 1110, 1114 (1995) ("Precedent shows that a speechrestricting `injunction' that is not issued as a remedy for an adjudicated or impending violation of law is also a prior restraint in the condemnatory sense, that is, a prior restraint of the sort prohibited by the First Amendment") (emphasis added). The situation here is analogous to Continental Group. In that case, a former employee of the plaintiff testified that he did not intend to disclose damaging information, but the district court nonetheless entered an injunction after attempting to "ascertain the possibility of irreparable harm ... from the risk of inadvertent disclosure." Continental Group, 614 F.2d at 358. The appeals court reversed, holding that the "risk of harm if information is inadvertently disclosed is not sufficient to satisfy the standards for granting a preliminary injunction." Id. In this case, the MIT Students have repeatedly stated that they did not intend to disclose at the DEFCON conference critical information necessary to compromise the MBTA Fare Cards, nor do they intend to do so in the future. Supp. Sullivan Decl. ¶ 5 (the MIT Students "would withhold key elements that would allow others to exploit the vulnerabilities"); Declaration of Scott Henderson (Docket #10) ¶ 11 ("We are absolutely are not disclosing everything we found in this report"); July 31 email from Zack Anderson to Nikita Caine (Anderson Decl. ¶ 19, Ex. 1) ("We left out a couple of key details from the slides"). Further, the MBTA asserts that the information provided publicly so far is not sensitive. (Docket #30 at 5-6.) Even were such disclosure unlawful, which it is not, there is no imminent risk that it will occur. II. The CFAA Regulates Attacks on Protected Computers, Not Speech. The MIT Students' Motion for Reconsideration provides a comprehensive discussion of the legislative history and case law interpreting the CFAA. (See Docket #23, Mot. at 9-12.) In response, the MBTA claims the MIT Students' interpretation of the CFAA is "illogical" but fails to cite even a single statutory provision, court opinion, or item from the legislative record that supports its interpretation. (See MBTA Opp. at 8-10.)

8

The MBTA relies only on Webster's New World Dictionary for the definition of "transmit," claiming that "transmission...to a protected computer" under the CFAA must include "verbal acts" as well as actual electronic transmission of code. In every opinion of which we are aware that involves a claim made, as here, under 18 U.S.C. § 1030 Section (a)(5)(A)(i), "transmission" involves the transfer of code from one computer to another computer, not the verbal act of talking about such transmission. Every case, including those that take the most liberal view of what is required to state a claim under section (a)(5)(A) of the CFAA, require that code be transmitted to a computer. See, e.g., Arience Builders, Inc. v. Baltes, 2008 WL 2580166 (N.D. Ill. June 17, 2008) (defendant deleted confidential and proprietary business data, information and trade secrets as well as data that would have revealed his improper conduct); U.S. v. Pok Seong Kwong, 237 Fed. Appx. 966 (5th Cir. 2007) (defendant installed harmful programs on the plaintiff's computer system); International Airport Centers, L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006) (plaintiff sufficiently alleged "transmission" by claiming defendant downloaded a program designed to permanently erase computer files); Four Seasons Hotels and Resorts B.V. v. Consorcio Barr, S.A., 267 F. Supp. 2d 1268 (S.D. Fla. 2003) (accessing VPN and spoofing computers constitutes transmission). The issue raised by the MBTA of what constitutes a "transmission" was specifically addressed in International Airport Centers and Arience Builders, Inc. In International Airport Centers, the court determined that the statute was satisfied when a program was "transmitted to the computer electronically." 448 F.3d at 419 (emphasis added). The Seventh Circuit expressed a concern about stretching the understanding of "transmission" beyond the electronic context. Judge Posner, writing for the court, noted: Pressing a delete or erase key in fact transmits a command, but it might be stretching the statute too far (especially since it provides criminal as well as civil sanctions for its violation) to consider any typing on a computer keyboard to be a form of "transmission" just because it transmits a command to the computer.

9

Id. at 419. Under the MBTA's formulation of "transmission," however, just telling someone about the existence of the delete key would be a transmission subject to the CFAA. In Arience Builders, the court addressed a motion to dismiss made in reliance on International Airport Centers. The court held the plaintiff had sufficiently alleged `transmission' in violation the CFAA, by claiming that a former employee entered `a code and/or command' which caused `deletion and/or damage' to employer's computer system by secretly and maliciously copying and converting proprietary data for his own use and then deleting proprietary and other data, including data that would have revealed the improper conduct. Arience Builders, Inc., 2008 WL 2580166 at *1-2. Again, "transmission" under the act required entering instructions into a computer. Thus, it is clear that a violation of the CFAA requires an actual transmission of instructions to a protected computer. Merely talking about potential vulnerabilities in computers does not state a cause of action. The MBTA has cited no contra authority.6 III. The MBTA's View of "Responsible Disclosure" Is Irrelevant. Here, the MBTA self-servingly defines "responsible disclosure" as preventing criticism of the computer security of public transit agency until that agency (a) is provided the factual basis for the criticism; and (b) can fix the problem. (See Complaint at ¶ 57, and Requested Relief ¶ 3(c), (g).) It then asserts that the letter signed by eleven preeminent computer scientists and security researchers and submitted on behalf of the MIT Students, see Docket #23-3, is "illogical" and "self contradictory." (MBTA Opp. at 13.) The letter speaks for itself and provides useful context for understanding this dispute. As outlined in the letter, the MIT Students have followed best practices in carrying out and disclosing their research.

6

The MBTA's discussion of "chains" of actors is similarly unsupported by authority. In any event, even in the hypothetical it provides, see MBTA Opp. at 8-9, malicious code is still transmitted to a computer while the actual harm is delayed. Here, there was no transmission of code to any computer, nor was any such transmission threatened or imminent.

10

Moreover, MBTA's view of responsible disclosure should not be credited by this Court because the MBTA's argument posits that an entity with the poor security has carte blanche to decide when or if the security vulnerability ever becomes public. Where, as here, the insecure entity is going about in the public sphere casting doubt on the vulnerabilities,7 the MBTA's view of "responsible disclosure" would prevent security researchers from proving their claims by giving sufficient information for third parties to replicate the claims. Instead, to the extent the MBTA would allow security researcher to participate in the debate at all,8 the researcher could only do so while crippled. In any event, the concept of "responsible disclosure" has no legal force. Even if the MIT Students had not acted responsibly, the MBTA has no cause of action. Neither the MBTA nor the courts may constitutionally impose a requirement of "responsible" speech. For example, in Westfield High School L.I.F.E. Club v. City of Westfield, 249 F. Supp. 2d 98 (D. Mass. 2003), another court in this district considered a "Responsible Speech" policy at a high school. Even in the more restrictive context of a high school, the court applied strict scrutiny and found the students "substantially likely to prevail on their claim that the school's speech policies are facially unconstitutional subject-matter-based restrictions." The court also found it to be an impermissible prior restraint to require students to obtain the permission of the administration before distributing literature on school grounds. If a government sponsored view of responsibility is not permissible for school administrators and high school students, it certainly is
7

See Christopher Baxter and Hiawatha Bray, MIT students' report makes security recommendations to T, Boston Globe, August 12, 2008 ("`There have been claims in the past that have been made against our card or other cards, and, happily, they've all been able to be dismissed or dealt with,' said Daniel A. Grabauskas, general manager of the Massachusetts Bay Transportation Authority. `I'm confident it will be the same thing here.'") See Complaint, Requested Relief ¶ 3(c) (requesting a preliminary injunction against "publicly stating or indicating that the security or integrity of the CharlieCard pass, the CharlieTicket pass, or the MBTA's Fare Media systems has been compromised...until the MBTA's vendors have had sufficient time to correct defects.")

8

11

not permissible for transit agencies and adults. Indeed, it the MBTA were to enforce the MBTA's views of "responsible disclosure" through discipline against own employees, it would run afoul of the Massachusetts Civil Rights Act, M.G.L.A. 12 § 11I. IV. The MIT Students' Speech Is Core First Amendment Speech and the MBTA's Reliance on "Commercial Speech" Cases Is Inapposite. The MBTA wrongly contends that the speech in question here is "commercial" and thus entitled to a lower level of protection. (See MBTA Opp. at 12.) To the contrary, the MIT Students had proposed to engage in core political speech: a matter of critical public and academic interest--the effectiveness of the security in Boston's mass transit fare payment system--with other security researchers. It is black letter law that issues of public policy are "core" speech under the First Amendment and thus entitled to the highest level of protection. See, e.g. Connick v. Myers, 461 U.S. 138, 145 (1983) ("speech on public issues occupies the highest rung of the hierarchy of First Amendment values, and is entitled to special protection.") (internal quotations omitted); see also First National Bank of Boston v. Bellotti, 435 U.S. 765, 776 (speech on matters of public concern lies "at the heart of the First Amendment's protection."). There can be no doubt the censored presentation and the "Security Analysis" currently at issue concern a matter of significant public interest--whether a major public subway system is using payment systems with sufficient security.9 Indeed, the articles in Boston-area press and elsewhere, long before the DEFCON conference, illustrate the public interest in this subject. E.g., Hiawatha Bray, T Card Has Security Flaw, Says Researcher, Boston Globe, Mar. 6, 2008; Szanislo, Marie, Research: Charlie Card is Far From Hack Proof, Boston Herald, Mar. 6, 2008; see also B. Schneier, Why Being Open About Security Makes Us All Safer in the Long Run, The
9

The Boston Herald reports that the "T gave a no-bid contract for CharlieCard services to a former government employee." Marie Szaniszlo, Board member demands MBTA audit, Boston Herald, August 14, 2008. This significantly increases the public interest in whether the MBTA's choice to deploy the CharlieCard was a good one.

12

Guardian, Aug. 7, 2008.10 Indeed, the intensity of public interest in these issues is amply demonstrated by the extensive coverage this litigation itself has received. See e.g., MBTA Blocks MIT Students from Revealing Fare Tips, Boston Globe, August 10, 2008; Christopher Baxter, and Hiawatha Bray, MIT Students' Report Makes Security Recommendations to T, Boston Globe, August 12, 2008; Marie Szaniszlo, Board Member Demands MBTA Audit, Boston Herald, August 14, 2008; Maddie Hanna, Court Tells Students to Disclose Hacker Secrets in T Case, Boston Globe, August 15, 2008. In addition to daily news coverage, this issue has sparked much public comment and opinion. See e.g. Boston Globe Editorial Board, Hacking and Free Speech, Boston Globe, August 14, 2008; Harvey Silverglate, National Security and Free Speech, August 16, 2008. By the same token, both the original presentation and the "Security Analysis" now at issue would help inform public discussion of a matter of public policy: whether Boston's transportation authorities have taken appropriate steps to protect the security of the public subway system. "The central commitment of the First Amendment . . . is that `debate on public issues should be uninhibited, robust, and wide-open." Bond v. Floyd, 385 U.S. 116, 136 (1966). That debate cannot be robust if important information about how government authorities are performing their duties is withheld from the public. New York Times, 376 U.S. at 275 (noting Founding Fathers viewed "The right of free public discussion of the stewardship of public officials [as] a fundamental principle of the American form of government."); Thornhill v. Alabama, 310 U.S. 88, 101-02 (1940) ("Freedom of discussion, if it would fulfill its historic function in this nation, must embrace all issues about which information is needed or appropriate to enable the members of society to cope with the exigencies of their period."). Indeed, the issues raised by the MIT Students presentation have already led one MBTA board member to publicly question the effectiveness of MBTA management, noting that the
10

Copies of all the articles cited here are attached to the Declaration of Corynne McSherry in Support of the MIT Students' Motion for Reconsideration.

13

apparent security vulnerabilities were just "the latest example of `a systemwide failure' to properly implement and oversee the system." See Christopher Baxter, T Board member says automated fare collection is a mess, Boston Globe, Aug. 13, 2008. The students, as members of the public, have a right to participate in this debate. Moreover, the students were planning to present to other security researchers the results of their academic, noncommercial research, conducted for a credited course on Computer and Network Security and acknowledged as superior work by a renowned MIT professor.11 Their speech, both as originally considered and now contemplated, is plainly academic work, which has long been understood to be a special concern of the First Amendment. See Keyishian v. Bd. of Regents of Univ. of State of N.Y., 365 U.S. 589, 603 (1967) ("Our Nation is deeply committed to safeguarding academic freedom, which is of transcendent value to all of us and not merely to the teachers concerned. That freedom is therefore a special concern of the First Amendment."); Sweezy v. New Hampshire, 354 U.S. 234, 250 (1957) (areas of academic freedom and political expression are "areas in which government should be extremely reticent to tread."). See also Regents of the Univ. of Cal. v. Bakke, 438 U.S. 265, 312 (1978) ("Academic freedom, though not a specifically enumerated constitutional right, long has been viewed as a special concern of the First Amendment"); accord Asociacion de Educacion Privada de Puerto Rico, Inc. v. GarciaPadilla, 490 F.3d 1 (1st Cir. 2007) ("The right to academic freedom establish[es] a zone of First Amendment protection for the educational process itself") (internal citations omitted). Indeed, this Court's temporary restraining order has been viewed as a threat to the free exchange of scholarship, prompting eleven leading computer scientists to file a letter supporting the students. See generally Letter from Computer Science Professors and Computer Scientists (Docket #23-3).
11

Dr. Ronald Rivest, the students' professor, is one of three inventors of the RSA algorithm, widely recognized as one of the first great advances in a particular type of cryptography that is now widely used. Prof. Rivest is also a member of the National Academy of Engineering, the National Academy of Sciences, and is a Fellow of the Association for Computing Machinery, the International Association for Cryptologic Research, and the American Academy of Arts and Sciences.

14

Contrary to the MBTA's argument, discussion of the MBTA security vulnerabilities is not commercial speech. The MBTA has, in fact, offered no evidence that the MIT Students' speech possesses any attributes of commercial speech. See Virginia State Bd. Of Pharm. v. Virginia Consumer Council, 425 U.S. 748, 762 (1976) (commercial speech is speech that does "no more than propose a commercial transaction"). Nor do they explain how any future comments on the issue could arguably be "commercial" for the purposes of First Amendment doctrine. The students did not and do not propose to offer any product or service for sale, nor are they affiliated with any commercial entity related to the research, nor is there a shred of evidence suggesting their presentation was economically motivated.12 Compare Bolger v. Young's Drug Products Corp. 463 U.S. 60 (1983) (pamphlets to be mailed to general public by contraceptives manufacturer were commercial speech under the First Amendment where they were conceded to be advertisements, contained references to manufacturer's products, and manufacturer had economic motivation for mailing them.). They did not propose even to provide information about any product. Compare Virginia Bd. of Pharmacy, 425 U.S. at 760-61 (prescription drug advertising constituted commercial speech). According to the MBTA's theory, any time a researcher attempted to promote her own research, even where, as here, the research concerns a matter of great public import, the speech would automatically lose its full First Amendment protection and be downgraded to the lower commercial speech standard that is afforded to material such as prescription drug advertising.
12

While speakers at the DEFCON conference have the option to receive a small honorarium or free passes to the conference, this nominal compensation would not have even covered the MIT Students' expenses in traveling to the conference. (Anderson Decl. ¶ 25.) "It is well settled that a speaker's rights are not lost merely because compensation is received; a speaker is no less a speaker because he or she is paid to speak." Riley v. National Federation of the Blind of North Carolina, Inc., 487 U.S. 781, 801 (1988); see also United States v. National Treasury Employees Union, 513 U.S. 454, 475 (1995) (invalidating a prohibition on the receipt of honoraria by government employees on First Amendment grounds). In any event, the students were not actually paid the honorarium. (Anderson Decl. ¶ 25.)

15

Were this true, academic research and publication would be chilled with potentially dire consequences for academic freedom and public discourse. The MBTA's position is not just wrong, it is dangerous.

16

CONCLUSION For the above-stated reasons, the Court should GRANT the MIT Students' Motion and dissolve the Temporary Restraining Order. The Court should also DENY any motion by the MBTA to convert the Temporary Restraining Order into a preliminary injunction.13 August 16, 2008 Respectfully submitted, /s/ Adam J. Kessel Lawrence K. Kolodney (BBO # 556851) Email: [e-mail] Adam J. Kessel (BBO # 661211) Email: [e-mail] Thomas A. Brown (BBO # 657715) Email: [e-mail] FISH & RICHARDSON P.C. 225 Franklin Street Boston, MA 02110-2804 [phone] (Telephone) [phone] (Facsimile) John Reinstein, BBO #416120 Email: [e-mail] ACLU of Massachusetts 211 Congress Street, 3rd Floor Boston, MA 02110 Jennifer Stisa Granick, CA Bar No. 168423 Email: [e-mail] Kurt Opsahl, CA Bar No. 191303 Email: [e-mail] Marcia Hofmann, CA Bar No. 250087 Email: [e-mail] ELECTRONIC FRONTIER FOUNDATION 454 Shotwell St. San Francisco, CA 94110 [phone] Counsel for Defendants Anderson, Ryan and Chiesa
13

The MIT Students reserve their right to file a separate opposition to any motion for a preliminary injunction the MBTA might file.

17

CERTIFICATE OF SERVICE I certify that this motion and the attached declaration are being filed through the Court's electronic filing system on August 18, 2008, which serves counsel for other parties who are registered participants as identified on the Notice of Electronic Filing (NEF). Any counsel for other parties who are not registered participants are being served by first class mail on the date of electronic filing. /s/ Adam J. Kessel Adam J. Kessel

18