Yesterday, the Massachusetts Bay Transportation Authority issued a statement to CNET that misrepresents the facts leading up to the MBTA's lawsuit against three MIT students. The statement said:

A week ago, the MBTA learned about the presentation to be made at the conference, and immediately contacted MIT. At a meeting last Tuesday involving all the parties, MIT staff and the students agreed to provide the MBTA with a copy of the presentation. After several days passed without getting any information from MIT, the MBTA had no choice but to seek assistance from a federal court judge on Friday. At 4:30 a.m. on Saturday, the presentation was finally provided to the MBTA. Staff is thoroughly reviewing the information to determine if there is any degree of substance to the claims being made by the students.

The MIT students would like to clarify a few facts:

  • The MIT students, through their Professor Ron Rivest, initiated contact with the MBTA. The students wanted to let the MBTA know what they found and wanted to provide some ideas about how to fix the system.
  • The meeting referenced in the MBTA's statement was held on Monday, not Tuesday.
  • In the course of the Monday meeting, the MIT students confirmed that the DEFCON presentation would not provide technical details sufficient for others to use their research to defeat the security systems in place at the MBTA. To address the concerns raised by the MBTA, the MIT students asked DEFCON to revise the description of the presentation originally posted on the conference website.
  • After the Monday meeting, the students understood that the MBTA's concerns were resolved, and that the students were to provide a confidential vulnerability assessment by the end of the week. Contrary to the MBTA statement, the students did not believe that the MBTA wanted to see a copy of the presentation slides, and they did not agree to provide them to the MBTA.
  • Between the Monday meeting and Friday, there were communications between various people involved in this dispute, including (contrary to the MBTA statement) communications between MIT Professor Rivest and the MBTA.
  • The students provided the MBTA with a confidential vulnerability assessment by the end of the week and prior to their scheduled presentation, as promised. The vulnerability assessment was marked "Confidential" because the MIT students felt it was in the best interests of the MBTA to keep the information in the report confidential.
  • The students did not understand that the MBTA wanted a copy of the presentation slides until Friday.
  • The MBTA went to court on Friday afternoon before providing notice to the MIT students of their intent to sue, and sought an immediate hearing. The MBTA's actions deprived the students of an opportunity to have representation in court on Friday at the initial hearing held in the federal district court in Boston. (A subsequent hearing was held Saturday morning.)
  • EFF began representing the MIT students Friday afternoon, when the lawsuit was filed. EFF advised the students not to send further materials to the entity that had just sued them before EFF attorneys in Las Vegas had a chance to review the lawsuit. The presentation slides were sent to the MBTA's counsel at 1:30 a.m. Nevada time.

In addition, the MBTA issued a statement today to the Boston Globe:

"There have been claims in the past that have been made against our card or other cards, and, happily, they've all been able to be dismissed or dealt with," said Daniel A. Grabauskas, general manager of the Massachusetts Bay Transportation Authority. "I'm confident it will be the same thing here."

This statement illustrates the First Amendment problems of the temporary restraining order. Due to the unconstitutional prior restraint obtained by the MBTA, the students are unable to respond substantively to this statement and meaningfully participate in the public debate over whether the MBTA uses adequate security measures.