UNITED STATES DISTRICT COURT …

                              UNITED STATES DISTRICT COURT
                               DISTRICT OF MASSACHUSETTS


MASSACHUSETTS BAY
TRANSPORTATION AUTHORITY,

                       Plaintiff,
v.                                                    Civil Action No. 08-11364-GAO

ZACK ANDERSON, RJ RYAN,
ALESSANDRO CHIESA, and the
MASSACHUSETTS INSTITUTE OF
TECHNOLOGY,

                       Defendants.


                       REPLY TO OPPOSITION TO
     MOTION FOR RECONSIDERATION OF TEMPORARY RESTRAINING ORDER
       On Tuesday, August 19, 2008, this Court will be asked to decide whether to allow the

Temporary Restraining Order ("TRO") in this matter to lapse, or to convert it into a preliminary

injunction. This Court should allow the TRO to lapse. The Massachusetts Bay Transportation

Authority ("MBTA") has failed to state a claim upon which any relief can be granted. The

MBTA has failed to identify how the MIT Students' speech could itself be illegal in any way.

The MBTA has failed to meet the standard for a preliminary injunction, never mind a prior

restraint on speech. Finally, any preliminary injunction enjoining the MIT Students from

engaging in core political speech about a quasi-governmental agency's conduct in a matter of

significant public interest is unconstitutional.

       The MBTA's Opposition to the MIT Students' Motion for Reconsideration of the

Temporary Restraining Order ("MBTA Opp.") errs on two crucial points of law upon which this

Motion (and indeed, this entire case) can be decided without the need to resolve any factual

issues. Contrary to the MBTA's view:
       (1) The Computer Fraud and Abuse Act ("CFAA") does not regulate pure speech. On its
           face, it prohibits the act of accessing without authorization and causing damage to
           protected computers. It also prohibits the transmission of viruses, worms and the like
           with the intent to cause damage to a protected computer. The statute does not
           prohibit talking about such intrusions, and the MBTA has failed to explain how the
           MIT Students could violate the law merely by speaking about the security flaws they
           discovered. The MBTA has not cited a single case that supports its attempt to apply
           the CFAA to speech. Nor are we aware of any such cases. For this reason alone, the
           MBTA has failed to state a claim upon which relief can be granted, and thus both the
           TRO and the Complaint should be dismissed.

       (2) Prior restraints on speech are nearly always unconstitutional. Even where the
           threatened disclosure implicated national security, the Supreme Court held a prior
           restraint unconstitutional, see New York Times Co. v. United States, 403 U.S. 713
           (1971). The prohibition on prior restraint is so strong that the First Circuit has
           vacated a district court's contempt sanction against a party who willfully violated a
           temporary restraining order, finding that unlawful prior restraints fell within the
           narrow range of exceptions to the "collateral bar" rule which ordinarily prohibits the
           violation of a wrongly-issued court order. In re Providence Journal Co., 820 F.2d
           1342, 1344 (1st Cir. 1986). As discussed below, the MBTA's allegations do not even
           meet the general standard for injunctive relief, much less the extraordinary standard
           of imposing a prior restraint on speech.

       The Court need go no further than either of these two points to grant the MIT Students'

Motion, dissolve the TRO, and refuse to issue a preliminary injunction.

                                     ADDITIONAL FACTS

       While the pleadings of the parties to date address most of the factual background, we

submit a brief discussion of new developments since the Thursday hearing below.

       On Friday, August 15, the MBTA filed without comment a Supplemental Declaration of

MBTA Transit Police Office Richard Sullivan. (Docket #37 ("Supp. Sullivan Decl.").) This

declaration undermines the MBTA's basic factual allegations. The MBTA's rush to the

                                                 2
courthouse was premised on its claim that the students refused repeated requests by the MBTA

to provide them with additional information prior to the DEFCON presentation and that based on

these failures, and the DEFCON presentation materials, they felt certain that the students were

intending to teach others how to avoid paying subway fares. (See e.g. Temporary Restraining

Order Request at ii; MBTA Opp. at 6-7.)1

         The Supplemental Sullivan Declaration belies these assertions. Mr. Sullivan was the only

MBTA representative to have spoken with the students prior to the MBTA's seeking of the TRO,

and prior to doing so he had reviewed the DEFCON materials that promoted the MIT Students'

presentation. Mr. Sullivan refutes the MBTA's claim that it asked the students for their slides

and other materials. He says that all he asked of the students was that they prepare a "summary"

of their work within two weeks, making it due on August 18, 2008. He continues: "I did not

request any other documents from the MIT Undergrads, and they did not offer to provide any

other documents." (Supp. Sullivan Decl. ¶ 7.)

         Moreover, contrary to the MBTA's representations to the Court, Mr. Sullivan states that,

well after he and FBI Agent Jacob Shaver both read the Announcement (Complaint ¶ 34) and

met with the MIT Students, they told MBTA General Manager for Systemwide Modernization

Joseph Kelley that "we were both comfortable and confident that the students would honor their

declaration to us that they would not disclose any information that would enable others to harm

the MBTA." (Id. ¶ 9.)

         Strangely, Mr. Kelley does not mention Mr. Sullivan's August 6th report to him in his

August 8th declaration. More importantly, Mr. Kelley's declaration admits that he never

communicated with the students directly; instead he states that he asked Professor Rivest to ask

them for their slides and report. There is no indication that this request, if it was made, was ever

conveyed to the students as Mr. Kelley seems to suggest.

1
    In its Opposition, the MBTA even provides a chart, purportedly demonstrating how the
     students refused to provide them with promised information. Id. at 6.



                                                 3
        Given this new information, which the MBTA must have known at the time it filed the

first declaration from Mr. Sullivan omitting this exculpatory language and the declaration of Mr.

Kelley, it is difficult to imagine how the MBTA could have brought this action, and sought an

emergency gag order, in good faith, two days after receiving Mr. Sullivan and Special Agent

Shaver's report. Indeed, in filing Mr. Sullivan's declaration, the MBTA made no attempt to

explain why the information was not included in Mr. Sullivan's first declaration, or in Mr.

Kelley's declaration, or indeed what changed between the time Mr. Sullivan made his

assessment on Monday and the time the MBTA decided to file suit and seek emergency relief on

Friday without any further communication with the students. On this new factual basis alone,

the TRO should be dissolved and no injunction should issue.

        The MBTA has also repeatedly complained that the MIT Students have yet to submit an

affidavit in this case. (See e.g., MBTA Opp. at 3 fn. 2 and 4.) No affidavits are needed to decide

any relevant issue, since the MBTA's claim fails on its face, even accepting all allegations in its

Complaint as true. However, this Court has indicated that further exposition of the facts would

assist in its resolution of the legal issues that are the basis for deciding the validity of any

restraining order. For that purpose, we have provided additional details in the Declaration of

Zack Anderson ("Anderson Decl.") submitted as Exhibit 1 in support of this motion, and we

identify the MBTA's misstatements and inaccuracies here.

        Anderson, Ryan, and Chiesa take their academic studies at MIT seriously. (Anderson

Decl. ¶¶ 3-7.) They have also acted responsibly with regard to the vulnerabilities they identified

in the MBTA CharlieTicket and CharlieCard system. (Id. ¶ 10.) The students initiated contact

with the MBTA through their professor Ronald Rivest. (Id. ¶¶ 15-16.) The students always

planned to limit the information they would publicly convey about their findings so as to avoid

inadvertently teaching others how to modify or counterfeit cards or tickets. (Id. ¶ 20.) The

students voluntarily met with the MBTA and with the FBI. (Id. ¶ 17.) The students agreed to

provide and timely provided a confidential vulnerability report to assist the MBTA in identifying



                                                   4
and repairing vulnerabilities in its system. (Id. ¶¶ 18, 22.) The students voluntarily provided a

longer and more comprehensive security report, filed under seal in this matter at Docket #32.

                                          ARGUMENT

       As stated above and in the MIT Students' Motion for Reconsideration of the Temporary

Restraining Order, the TRO should be vacated because (1) the MBTA has no cause of action and

any future speech by the MIT Students about fare card vulnerabilities is legal and (2) the TRO is

an unconstitutional prior restraint on speech involving the conduct of a quasi-governmental

agency in a matter of great public interest. Such speech is entitled to the highest level of

protection under the First Amendment.

       The MBTA's Opposition to this Motion offers several responses to the MIT Students'

arguments, all without merit. As an initial matter, the Order must be dissolved because the

MBTA has failed to show that any future violation of law is imminent, as required by controlling

case law. To the contrary, the Supplemental Sullivan Declaration indicates that the MBTA had

no reason to believe that any violation of law by the MIT Students was ever imminent.

Moreover, the MBTA's interpretation of the CFAA as controlling speech rather than damaging

conduct is contrary to the plain text of the statute and unsupported by any case law. The

MBTA's self-serving definition of "responsible disclosure" amounts to nothing more than a bald

and unsupported assertion controverted by the description of the issue offered by eleven

preeminent computer scientists and security researchers. In any event, to the extent that some

computer security professionals might agree with the MBTA, the term "responsible disclosure"

carries no legal weight. Finally, the MBTA wrongly characterizes the MIT Students' accused

speech as "commercial." Encouraging other researchers to attend even a self-promotional talk is

not "commercial" speech, which is defined as speech that merely proposes an economic

commercial transaction.




                                                 5
I.        The Temporary Restraining Order Must Be Dissolved
          Because the MBTA Has Not Shown Any Violation of Law Is "Imminent."
          The MBTA speculates that but for the Temporary Restraining Order, the MIT Students

"would have knowingly transmitted information that defendants knew would cause damage to

protected computers." (MBTA Opp. at 7) (emphasis added). This assertion appears to be

directly contrary to the only relevant record evidence. Specifically, the evaluation of the only

MBTA official to actually meet with the students, Mr. Sullivan, does not support the MBTA's

view. (Sullivan Decl. ¶ 9.)

          Moreover, the MBTA's unfounded assertion is irrelevant to the continued validity of the

Order.2 Injunctions are valid only if harm is "imminent" and there is a danger of "recurrent
violation." United States v. W.T. Grant Co., 345 U.S. 629, 633 (1953) ("An injunction issues

only if there is some showing that defendant has violated, or imminently will violate, some

provision of statutory or common law"); accord Hibernia Sav. Bank v. Ballarino, 891 F.2d 370

(1st Cir. 1989) (affirming denial of injunctive relief where no danger of recurrent violation was

shown).3 Under First Circuit law, a plaintiff seeking an injunction must demonstrate

          the likelihood of substantial and immediate irreparable injury, and the inadequacy
          of remedies at law. . . . It is not enough for a plaintiff to assert that she `could be'
          subjected in the future to the effects of an unlawful policy or illegal conduct by a
          defendant-the prospect of harm must have an `immediacy and reality.'
Steir v. Girl Scouts of the USA, 383 F.3d 7, 16 (1st Cir. 2004) (citations omitted). The Third

Circuit has echoed this point, emphasizing that "more than a risk of irreparable harm must be

demonstrated. The requisite for injunctive relief has been characterized as a `clear showing of

2
    Nor do these allegations state a valid claim. The MBTA must allege an actual violation of the
    CFAA. It has no right of civil action for either an attempted violation, or for aiding an abetting
    another in violating the law. 18 U.S.C. § 1030(g). Of course, the MIT Students neither
    attempted to violate the CFAA nor attempted to aid and abet another to do so.
3
    W.T. Grant Co. and Hibernia Sav. Bank discuss the standard for injunctive relief generally.
    They do not apply the even higher standard for injunctive relief that constitutes a prior restraint
    on speech. As shown here, the MBTA has not even met the general standard for injunctive
    relief, much less the heightened showing needed to enjoin speech.



                                                     6
immediate irreparable injury.'" Ammond v. McGahn, 532 F.2d 325, 329 (3d Cir. 1976) (internal

citations omitted). The MBTA must meet a high standard for demonstrating the likelihood of

future harm to justify a continued injunction.4 The MBTA must show "there exists some

cognizable danger of recurrent violation, something more than a mere possibility which serves to

keep the case alive." W.T. Grant, 345 U.S. at 633. "The purpose of an injunction is to prevent

future violations." Id.

         Thus, the MBTA's reliance on what "would have" or "might have" happened at the

DEFCON conference is irrelevant to whether an injunction should issue. The conference is over,

and the MIT Students have no plans or intentions to give a similar presentation in the future.

Ryan Declaration in Support of Motion for Reconsideration of Discovery Order ¶ 8; Attached

Anderson Decl. attached as Exhibit 1 ¶ 30.

         Although the MBTA might claim that despite the assessment of its own official and the

FBI it remains fearful about what might have happened or what could have happened at the

DEFCON conference, such fear does not support the continuation of an injunction, particularly

since the MIT Students have now repeatedly demonstrated their willingness to support the

MBTA in improving its security system. (Id. ¶ 24.) As the Third Circuit has emphasized,

"[i]njunctions will not be issued merely to allay the fears and apprehensions or to soothe the

anxieties of the parties. Nor will an injunction be issued `to restrain one from doing what he is

not attempting and does not intend to do.'" Continental Group, Inc. v. Amoco Chemicals Corp.,

614 F.2d 351 (3rd Cir. 1980). 5 The standard is even higher when the injunction sought restricts

4
    There has been no past violation--the MIT Students gave no presentation at the DEFCON
    conference.
5
    The MBTA improperly turns the test for injunctive relief on its head. The MBTA suggests
    continued application of the Temporary Restraining Order will cause no harm to the students,
    because "the TRO language does not prohibit the Individual Defendants from engaging in any
    conduct they originally planned." (MBTA Opp. at 10-11.) The MBTA gets the law
    backwards. Because the MIT Students have no intention of disclosing key information, the
    MBTA does not even have a colorable basis for an injunction.



                                                 7
speech. See Lawson v. Murray, 515 U.S. 1110, 1114 (1995) ("Precedent shows that a speech-

restricting `injunction' that is not issued as a remedy for an adjudicated or impending violation

of law is also a prior restraint in the condemnatory sense, that is, a prior restraint of the sort

prohibited by the First Amendment") (emphasis added).

        The situation here is analogous to Continental Group. In that case, a former employee of

the plaintiff testified that he did not intend to disclose damaging information, but the district

court nonetheless entered an injunction after attempting to "ascertain the possibility of

irreparable harm ... from the risk of inadvertent disclosure." Continental Group, 614 F.2d at 358.

The appeals court reversed, holding that the "risk of harm if information is inadvertently

disclosed is not sufficient to satisfy the standards for granting a preliminary injunction." Id.

        In this case, the MIT Students have repeatedly stated that they did not intend to disclose

at the DEFCON conference critical information necessary to compromise the MBTA Fare Cards,

nor do they intend to do so in the future. Supp. Sullivan Decl. ¶ 5 (the MIT Students "would

withhold key elements that would allow others to exploit the vulnerabilities"); Declaration of

Scott Henderson (Docket #10) ¶ 11 ("We are absolutely are not disclosing everything we found

in this report"); July 31 email from Zack Anderson to Nikita Caine (Anderson Decl. ¶ 19, Ex. 1)

("We left out a couple of key details from the slides"). Further, the MBTA asserts that the

information provided publicly so far is not sensitive. (Docket #30 at 5-6.) Even were such

disclosure unlawful, which it is not, there is no imminent risk that it will occur.

II.     The CFAA Regulates Attacks on Protected Computers, Not Speech.
        The MIT Students' Motion for Reconsideration provides a comprehensive discussion of

the legislative history and case law interpreting the CFAA. (See Docket #23, Mot. at 9-12.) In

response, the MBTA claims the MIT Students' interpretation of the CFAA is "illogical" but fails

to cite even a single statutory provision, court opinion, or item from the legislative record that

supports its interpretation. (See MBTA Opp. at 8-10.)




                                                   8
       The MBTA relies only on Webster's New World Dictionary for the definition of

"transmit," claiming that "transmission...to a protected computer" under the CFAA must include

"verbal acts" as well as actual electronic transmission of code. In every opinion of which we are

aware that involves a claim made, as here, under 18 U.S.C. § 1030 Section (a)(5)(A)(i),

"transmission" involves the transfer of code from one computer to another computer, not the

verbal act of talking about such transmission. Every case, including those that take the most

liberal view of what is required to state a claim under section (a)(5)(A) of the CFAA, require that

code be transmitted to a computer. See, e.g., Arience Builders, Inc. v. Baltes, 2008 WL 2580166

(N.D. Ill. June 17, 2008) (defendant deleted confidential and proprietary business data,

information and trade secrets as well as data that would have revealed his improper conduct);

U.S. v. Pok Seong Kwong, 237 Fed. Appx. 966 (5th Cir. 2007) (defendant installed harmful

programs on the plaintiff's computer system); International Airport Centers, L.L.C. v. Citrin,

440 F.3d 418 (7th Cir. 2006) (plaintiff sufficiently alleged "transmission" by claiming defendant

downloaded a program designed to permanently erase computer files); Four Seasons Hotels and

Resorts B.V. v. Consorcio Barr, S.A., 267 F. Supp. 2d 1268 (S.D. Fla. 2003) (accessing VPN and

spoofing computers constitutes transmission).

       The issue raised by the MBTA of what constitutes a "transmission" was specifically

addressed in International Airport Centers and Arience Builders, Inc. In International Airport

Centers, the court determined that the statute was satisfied when a program was "transmitted to

the computer electronically." 448 F.3d at 419 (emphasis added). The Seventh Circuit expressed

a concern about stretching the understanding of "transmission" beyond the electronic context.

Judge Posner, writing for the court, noted:

       Pressing a delete or erase key in fact transmits a command, but it might be
       stretching the statute too far (especially since it provides criminal as well as civil
       sanctions for its violation) to consider any typing on a computer keyboard to be a
       form of "transmission" just because it transmits a command to the computer.




                                                  9
Id. at 419. Under the MBTA's formulation of "transmission," however, just telling someone

about the existence of the delete key would be a transmission subject to the CFAA.

         In Arience Builders, the court addressed a motion to dismiss made in reliance on

International Airport Centers. The court held the plaintiff had sufficiently alleged `transmission'

in violation the CFAA, by claiming that a former employee entered `a code and/or command'

which caused `deletion and/or damage' to employer's computer system by secretly and

maliciously copying and converting proprietary data for his own use and then deleting

proprietary and other data, including data that would have revealed the improper conduct.

Arience Builders, Inc., 2008 WL 2580166 at *1-2. Again, "transmission" under the act required

entering instructions into a computer.

         Thus, it is clear that a violation of the CFAA requires an actual transmission of

instructions to a protected computer. Merely talking about potential vulnerabilities in computers

does not state a cause of action. The MBTA has cited no contra authority.6

III.     The MBTA's View of "Responsible Disclosure" Is Irrelevant.
         Here, the MBTA self-servingly defines "responsible disclosure" as preventing criticism

of the computer security of public transit agency until that agency (a) is provided the factual

basis for the criticism; and (b) can fix the problem. (See Complaint at ¶ 57, and Requested Relief

¶ 3(c), (g).) It then asserts that the letter signed by eleven preeminent computer scientists and

security researchers and submitted on behalf of the MIT Students, see Docket #23-3, is

"illogical" and "self contradictory." (MBTA Opp. at 13.) The letter speaks for itself and

provides useful context for understanding this dispute. As outlined in the letter, the MIT Students

have followed best practices in carrying out and disclosing their research.


6
    The MBTA's discussion of "chains" of actors is similarly unsupported by authority. In any
    event, even in the hypothetical it provides, see MBTA Opp. at 8-9, malicious code is still
    transmitted to a computer while the actual harm is delayed. Here, there was no transmission of
    code to any computer, nor was any such transmission threatened or imminent.



                                                  10
          Moreover, MBTA's view of responsible disclosure should not be credited by this Court

because the MBTA's argument posits that an entity with the poor security has carte blanche to

decide when or if the security vulnerability ever becomes public. Where, as here, the insecure

entity is going about in the public sphere casting doubt on the vulnerabilities,7 the MBTA's view

of "responsible disclosure" would prevent security researchers from proving their claims by

giving sufficient information for third parties to replicate the claims. Instead, to the extent the

MBTA would allow security researcher to participate in the debate at all,8 the researcher could

only do so while crippled.

          In any event, the concept of "responsible disclosure" has no legal force. Even if the MIT

Students had not acted responsibly, the MBTA has no cause of action. Neither the MBTA nor

the courts may constitutionally impose a requirement of "responsible" speech. For example, in

Westfield High School L.I.F.E. Club v. City of Westfield, 249 F. Supp. 2d 98 (D. Mass. 2003),

another court in this district considered a "Responsible Speech" policy at a high school. Even in

the more restrictive context of a high school, the court applied strict scrutiny and found the

students "substantially likely to prevail on their claim that the school's speech policies are

facially unconstitutional subject-matter-based restrictions." The court also found it to be an

impermissible prior restraint to require students to obtain the permission of the administration

before distributing literature on school grounds. If a government sponsored view of

responsibility is not permissible for school administrators and high school students, it certainly is

7
    See Christopher Baxter and Hiawatha Bray, MIT students' report makes security
     recommendations to T, Boston Globe, August 12, 2008 ("`There have been claims in the past
     that have been made against our card or other cards, and, happily, they've all been able to be
     dismissed or dealt with,' said Daniel A. Grabauskas, general manager of the Massachusetts
     Bay Transportation Authority. `I'm confident it will be the same thing here.'")
8
    See Complaint, Requested Relief ¶ 3(c) (requesting a preliminary injunction against "publicly
     stating or indicating that the security or integrity of the CharlieCard pass, the CharlieTicket
     pass, or the MBTA's Fare Media systems has been compromised...until the MBTA's vendors
     have had sufficient time to correct defects.")



                                                   11
not permissible for transit agencies and adults. Indeed, it the MBTA were to enforce the

MBTA's views of "responsible disclosure" through discipline against own employees, it would

run afoul of the Massachusetts Civil Rights Act, M.G.L.A. 12 § 11I.

IV.      The MIT Students' Speech Is Core First Amendment Speech and the MBTA's
         Reliance on "Commercial Speech" Cases Is Inapposite.
         The MBTA wrongly contends that the speech in question here is "commercial" and thus

entitled to a lower level of protection. (See MBTA Opp. at 12.) To the contrary, the MIT

Students had proposed to engage in core political speech: a matter of critical public and

academic interest--the effectiveness of the security in Boston's mass transit fare payment

system--with other security researchers.

         It is black letter law that issues of public policy are "core" speech under the First

Amendment and thus entitled to the highest level of protection. See, e.g. Connick v. Myers, 461

U.S. 138, 145 (1983) ("speech on public issues occupies the highest rung of the hierarchy of

First Amendment values, and is entitled to special protection.") (internal quotations omitted); see

also First National Bank of Boston v. Bellotti, 435 U.S. 765, 776 (speech on matters of public

concern lies "at the heart of the First Amendment's protection.").

         There can be no doubt the censored presentation and the "Security Analysis" currently at

issue concern a matter of significant public interest--whether a major public subway system is

using payment systems with sufficient security.9 Indeed, the articles in Boston-area press and
elsewhere, long before the DEFCON conference, illustrate the public interest in this subject.

E.g., Hiawatha Bray, T Card Has Security Flaw, Says Researcher, Boston Globe, Mar. 6, 2008;

Szanislo, Marie, Research: Charlie Card is Far From Hack Proof, Boston Herald, Mar. 6, 2008;

see also B. Schneier, Why Being Open About Security Makes Us All Safer in the Long Run, The

9
    The Boston Herald reports that the "T gave a no-bid contract for CharlieCard services to a
    former government employee." Marie Szaniszlo, Board member demands MBTA audit, Boston
    Herald, August 14, 2008. This significantly increases the public interest in whether the
    MBTA's choice to deploy the CharlieCard was a good one.



                                                   12
Guardian, Aug. 7, 2008.10 Indeed, the intensity of public interest in these issues is amply

demonstrated by the extensive coverage this litigation itself has received. See e.g., MBTA Blocks

MIT Students from Revealing Fare Tips, Boston Globe, August 10, 2008; Christopher Baxter,

and Hiawatha Bray, MIT Students' Report Makes Security Recommendations to T, Boston Globe,

August 12, 2008; Marie Szaniszlo, Board Member Demands MBTA Audit, Boston Herald,

August 14, 2008; Maddie Hanna, Court Tells Students to Disclose Hacker Secrets in T Case,

Boston Globe, August 15, 2008. In addition to daily news coverage, this issue has sparked much

public comment and opinion. See e.g. Boston Globe Editorial Board, Hacking and Free Speech,

Boston Globe, August 14, 2008; Harvey Silverglate, National Security and Free Speech, August

16, 2008.

          By the same token, both the original presentation and the "Security Analysis" now at

issue would help inform public discussion of a matter of public policy: whether Boston's

transportation authorities have taken appropriate steps to protect the security of the public

subway system. "The central commitment of the First Amendment . . . is that `debate on public

issues should be uninhibited, robust, and wide-open." Bond v. Floyd, 385 U.S. 116, 136 (1966).

That debate cannot be robust if important information about how government authorities are

performing their duties is withheld from the public. New York Times, 376 U.S. at 275 (noting

Founding Fathers viewed "The right of free public discussion of the stewardship of public

officials [as] a fundamental principle of the American form of government."); Thornhill v.

Alabama, 310 U.S. 88, 101-02 (1940) ("Freedom of discussion, if it would fulfill its historic

function in this nation, must embrace all issues about which information is needed or appropriate

to enable the members of society to cope with the exigencies of their period.").

          Indeed, the issues raised by the MIT Students presentation have already led one MBTA

board member to publicly question the effectiveness of MBTA management, noting that the

10
     Copies of all the articles cited here are attached to the Declaration of Corynne McSherry in
     Support of the MIT Students' Motion for Reconsideration.



                                                  13
apparent security vulnerabilities were just "the latest example of `a systemwide failure' to

properly implement and oversee the system." See Christopher Baxter, T Board member says

automated fare collection is a mess, Boston Globe, Aug. 13, 2008. The students, as members of

the public, have a right to participate in this debate.

          Moreover, the students were planning to present to other security researchers the results

of their academic, noncommercial research, conducted for a credited course on Computer and

Network Security and acknowledged as superior work by a renowned MIT professor.11 Their

speech, both as originally considered and now contemplated, is plainly academic work, which

has long been understood to be a special concern of the First Amendment. See Keyishian v. Bd.

of Regents of Univ. of State of N.Y., 365 U.S. 589, 603 (1967) ("Our Nation is deeply committed

to safeguarding academic freedom, which is of transcendent value to all of us and not merely to

the teachers concerned. That freedom is therefore a special concern of the First Amendment.");

Sweezy v. New Hampshire, 354 U.S. 234, 250 (1957) (areas of academic freedom and political

expression are "areas in which government should be extremely reticent to tread."). See also

Regents of the Univ. of Cal. v. Bakke, 438 U.S. 265, 312 (1978) ("Academic freedom, though not

a specifically enumerated constitutional right, long has been viewed as a special concern of the

First Amendment"); accord Asociacion de Educacion Privada de Puerto Rico, Inc. v. Garcia-

Padilla, 490 F.3d 1 (1st Cir. 2007) ("The right to academic freedom establish[es] a zone of First

Amendment protection for the educational process itself") (internal citations omitted). Indeed,

this Court's temporary restraining order has been viewed as a threat to the free exchange of

scholarship, prompting eleven leading computer scientists to file a letter supporting the students.

See generally Letter from Computer Science Professors and Computer Scientists (Docket #23-3).

11
     Dr. Ronald Rivest, the students' professor, is one of three inventors of the RSA algorithm,
     widely recognized as one of the first great advances in a particular type of cryptography that is
     now widely used. Prof. Rivest is also a member of the National Academy of Engineering, the
     National Academy of Sciences, and is a Fellow of the Association for Computing Machinery,
     the International Association for Cryptologic Research, and the American Academy of Arts
     and Sciences.


                                                   14
          Contrary to the MBTA's argument, discussion of the MBTA security vulnerabilities is

not commercial speech. The MBTA has, in fact, offered no evidence that the MIT Students'

speech possesses any attributes of commercial speech. See Virginia State Bd. Of Pharm. v.

Virginia Consumer Council, 425 U.S. 748, 762 (1976) (commercial speech is speech that does

"no more than propose a commercial transaction"). Nor do they explain how any future

comments on the issue could arguably be "commercial" for the purposes of First Amendment

doctrine.

          The students did not and do not propose to offer any product or service for sale, nor are

they affiliated with any commercial entity related to the research, nor is there a shred of evidence

suggesting their presentation was economically motivated.12 Compare Bolger v. Young's Drug

Products Corp. 463 U.S. 60 (1983) (pamphlets to be mailed to general public by contraceptives

manufacturer were commercial speech under the First Amendment where they were conceded to

be advertisements, contained references to manufacturer's products, and manufacturer had

economic motivation for mailing them.). They did not propose even to provide information

about any product. Compare Virginia Bd. of Pharmacy, 425 U.S. at 760-61 (prescription drug

advertising constituted commercial speech).

          According to the MBTA's theory, any time a researcher attempted to promote her own

research, even where, as here, the research concerns a matter of great public import, the speech

would automatically lose its full First Amendment protection and be downgraded to the lower

commercial speech standard that is afforded to material such as prescription drug advertising.

12
     While speakers at the DEFCON conference have the option to receive a small honorarium or
     free passes to the conference, this nominal compensation would not have even covered the
     MIT Students' expenses in traveling to the conference. (Anderson Decl. ¶ 25.) "It is well
     settled that a speaker's rights are not lost merely because compensation is received; a speaker is
     no less a speaker because he or she is paid to speak." Riley v. National Federation of the Blind
     of North Carolina, Inc., 487 U.S. 781, 801 (1988); see also United States v. National Treasury
     Employees Union, 513 U.S. 454, 475 (1995) (invalidating a prohibition on the receipt of
     honoraria by government employees on First Amendment grounds). In any event, the students
     were not actually paid the honorarium. (Anderson Decl. ¶ 25.)



                                                   15
Were this true, academic research and publication would be chilled with potentially dire

consequences for academic freedom and public discourse. The MBTA's position is not just

wrong, it is dangerous.




                                               16
                                           CONCLUSION

          For the above-stated reasons, the Court should GRANT the MIT Students' Motion and

dissolve the Temporary Restraining Order. The Court should also DENY any motion by the

MBTA to convert the Temporary Restraining Order into a preliminary injunction.13


August 16, 2008                      Respectfully submitted,

                                        /s/ Adam J. Kessel
                                        Lawrence K. Kolodney (BBO # 556851)
                                        Email: kolodney@fr.com
                                        Adam J. Kessel (BBO # 661211)
                                        Email: kessel@fr.com
                                        Thomas A. Brown (BBO # 657715)
                                        Email: tbrown@fr.com
                                        FISH & RICHARDSON P.C.
                                        225 Franklin Street
                                        Boston, MA 02110-2804
                                        (617) 542-5070 (Telephone)
                                        (617) 542-8906 (Facsimile)

                                        John Reinstein, BBO #416120
                                        Email: reinstein@aclum.org
                                        ACLU of Massachusetts
                                        211 Congress Street, 3rd Floor
                                        Boston, MA 02110

                                        Jennifer Stisa Granick, CA Bar No. 168423
                                        Email: Jennifer@eff.org
                                        Kurt Opsahl, CA Bar No. 191303
                                        Email: kurt@eff.org
                                        Marcia Hofmann, CA Bar No. 250087
                                        Email: marcia@eff.org
                                        ELECTRONIC FRONTIER FOUNDATION
                                        454 Shotwell St.
                                        San Francisco, CA 94110
                                        (415) 436-9333

                                        Counsel for Defendants Anderson, Ryan and Chiesa

13
     The MIT Students reserve their right to file a separate opposition to any motion for a
     preliminary injunction the MBTA might file.



                                                  17
                                 CERTIFICATE OF SERVICE


I certify that this motion and the attached declaration are being filed through the Court's
electronic filing system on August 18, 2008, which serves counsel for other parties who are
registered participants as identified on the Notice of Electronic Filing (NEF). Any counsel for
other parties who are not registered participants are being served by first class mail on the date of
electronic filing.

                                              /s/ Adam J. Kessel
                                              Adam J. Kessel




                                                 18