Massachusetts Bay Transportation Authority v. Anderson

BEFORE THE HONORABLE GEORGE A. O'TOOLE, JR.
UNITED STATES DISTRICT JUDGE

August 19, 2008

APPEARANCES:

HOLLAND & KNIGHT LLP
By: Ieuan-Gael Mahony, Esq.
Maximillian J. Bodoin, Esq.
10 St. James Avenue - Suite 12 Boston, Massachusetts 02116
On behalf of plaintiff Massachusetts Bay Transportation Authority

ELECTRONIC FRONTIER FOUNDATION
By: Cindy Cohn, Esq.
Marcia Hofmann, Esq.
454 Shotwell Street
San Francisco, California 94110

- and -

AMERICAN CIVIL LIBERTIES UNION
By: John Reinstein, Esq.
211 Congress Street
Boston, Massachusetts 02110

- and -

FISH & RICHARDSON, PC
By: Thomas A. Brown, Esq.
Lawrence K. Kolodney, Esq.
Adam J. Kessel, Esq.
225 Franklin Street
Boston, Massachusetts 02110-2804
On Behalf of the Defendants Zack Anderson, RJ Ryan and Alessandro Chiesa

EDWARDS ANGELL PALMER & DODGE, LLP
By: Jeffrey Swope, Esq.
111 Huntington Avenue
Boston, Massachusetts 02199
On Behalf of the Defendant MIT

Also in Attendance:
Scott Darling III, Esq., MBTA Legal Department
Jaren Wilcoxson, Esq., Office of the General Counsel of MIT

Proceedings

THE CLERK: All rise. 

This is the United States District Court for the District of Massachusetts. Court is now in session.
You may be seated.

Calling Civil Action 08-11364, Mass. Bay Transportation Authority versus defendant Zack Anderson, et al.

Counsel, please state your names for the record.

MR. MAHONY: Ieuan Mahony from Holland & Knight for the MBTA.

MR. BODOIN: Max Bodoin from Holland & Knight for plaintiff, MBTA.

MR. DARLING: Scott Darling from the MBTA.

MS. COHN: Good morning, your Honor. Cindy Cohn from the Electronic Frontier Foundation for defendants Anderson, Chiesa and Ryan.

MS. HOFMANN: Marcia Hofmann from the Electronic Frontier Foundation for defendants Anderson, Chiesa and Ryan.

MR. REINSTEIN: John Reinstein, ACLU of Massachusetts, for the individual defendants.

MS. COHN: And, your Honor, co-counsel of the Electronic Frontier Foundation are on the telephone, including Jennifer Granick who could not be here today due to a conflict.

MR. SWOPE: Good morning, your Honor. Jeffrey Swope, Edwards Angell Palmer & Dodge for MIT. With me is Jaren Wilcoxson of the general counsel's office of MIT.

MR. KOLODNEY: Good morning, your Honor. Lawrence Kolodney, Fish & Richardson, for the MIT students.

MR. BROWN: Good morning, your Honor, Thomas Brown from Fish & Richardson on behalf of the MIT students.

MR. KESSEL: Adam Kessel, also from Fish & Richardson, on behalf of the MIT students.

THE COURT: Who is going to speak on behalf of the MIT students?

MS. COHN: I am, your Honor.

THE COURT: All right. Well, there's been a lot of filings in this case recently. And since I've been on the bench for the last hour and a half or so I don't know whether I've missed anything this morning that has come in late. I've seen things that were filed last night. Is there anything that has been filed recently that I haven't -- you don't know whether I've seen it or not -- that I might not have seen?

MS. COHN: Your Honor, we haven't filed anything

THE COURT: Okay.

MR. MAHONY: Nothing, your Honor.

THE COURT: So the last thing I remember was the memorandum from --

MR. MAHONY: The MBTA. That's correct.

THE COURT: -- plaintiffs that was filed last night.

A VOICE: Your Honor, may I approach the bench since I will file some evidence this morning?

THE COURT: Who are you?

A VOICE: I'm Dean Chen. I am just an interested party. But I will be filing some evidence.

THE COURT: No. You have no standing here.

A VOICE: Okay. Thank you.

THE COURT: Well, then if we could refer to yesterday's filings, the most recent, I think, are the papers with respect to the plaintiff's motion for a preliminary injunction which I understand to be essentially a request to continue the temporary restraining order, perhaps with some slight language change, as a preliminary injunction. Let me just address one matter, which I'm not sure has much significance or not, before we proceed to that because I think the way to address the issue is even though there may be other pending matters, is to go directly to that issue. There seems to be some understanding, I guess is the way to put it, or "thought" may be better, that this being August 19th, which is ten days after the entry of the TRO, that the TRO would expire as of today. I'm not sure that's the case.

Rule 6(a)(2) of the federal rules says that any period less than 11 days excludes weekends, and so on in the computation. And so under that computation the TRO would continue, of its own force, for the full ten days, I think till Friday. In other words, it would be -- it was granted on a Saturday, which would be excluded, and the counting would begin on last Monday, that would be five days, and then pick up again yesterday, and it would be another five days. So I think it would probably expire on Friday. But I'm not sure that's of any moment; it just may affect the timing of this.

But anyway, we have the motion now to convert, or extend, the TRO as a preliminary injunction. So, Mr. Mahony, if you want to address that motion.

MR. MAHONY: Yes, your Honor. Thank you, your Your Honor, I would like to make five points in the argument in support of this motion. Your Honor, the discussion -- my points will be driven by the facts here. As one of the commentaries in the articles the EFF submitted said, "Talk is talk. Let's see the code. The goal here is to show the facts to the Court."

Your Honor, the five points are as follows:

First, I'd like to examine, what is the information here that is at issue? Keep in mind that the MIT students provided last Wednesday night a 30-page security analysis of substantially better quality and quantity than the materials the MBTA had before. With that security analysis, your Honor, the MBTA, with vendor assistance, has determined that, in fact, the CharlieTicket -- not the CharlieCard, but the CharlieTicket -- system is compromised; that the MIT students know how to clone and counterfeit CharlieTickets. So, your Honor, I would like to examine the information at issue here.

Second: Illegal conduct. Your Honor, illegal conduct, in fact, took place here. This must inform the Court's decision-making and all arguments by opposing counsel here. Your Honor, whatever the end of the MIT students, whether good or bad, it is unequivocally the case that they used illegal means toward that end.

Third: I'd like to examine the presentation at issue here. I'd like to examine the face of the presentation, but also, your Honor, the information behind the presentation: the software code, the demonstrations that have not been produced in this case despite the Court's instruction to either produce or respond.

Your Honor, I will show, I submit, that these materials, from what we can glean, even though they've been withheld presentation materials, are not -- they are not abstract theoretical advocacy but rather specific instructions and demonstrations on the methods for committing crimes under the CFAA. Your Honor, these are words likely to incite lawless action, and that's a quote from the North American Man/Boy Love case from this very Court.

Four: I'd like to address the balancing of harms and what is responsible -- what is responsible -- disclosure in this case under these circumstances. Were these MIT students responsible? Are they being responsible now in withholding information about security vulnerabilities potentially at the T?

And then finally, your Honor, I'd like to talk briefly about the public interest. This is policy issues concerning security through secrecy, security through open disclosure. And I propose, your Honor, that these broad issues -- these broad policy points -- do not conflict in these circumstances.

The MBTA, with vendor assistance -- and again, based on the security analysis that the students provided last Wednesday -- has concluded that a five-month period of time is needed to mitigate and remedy the threats that the information poses and what the students have discovered. Your Honor, it's a five-month period of time. There is good public interest in following through with that.

Now, let me turn, then, to the particular points, your Honor. The information at issue: I'd like to call the Court's attention to Docket No. 56, Exhibit 1, which is the third supplemental declaration that I presented, your Honor, last night. The Court has it?

THE COURT: No.

MR. MAHONY: Do we have some copies?

THE COURT: Well, actually, I can get it. Gina, can you pull it up? I'll turn to my assistant to do it.

MR. MAHONY: Your Honor, if I could just bring this up.

MS. COHN: Counsel, do you have a copy for me?

MR. MAHONY: It's in the exhibit book; you have it.

MS. COHN: What book?

MR. MAHONY: The courtesy copy. What do you have right there? Yes, it's 56. So, your Honor, the docketed copy is at 56.

THE COURT: Fifty-six, Exhibit 1.

MR. MAHONY: And it's Exhibit 1, and it's a document Bates-stamped at the bottom MBTA0001. And I'll just call the Court's attention to the very top of that page. It's an e-mail from Zack Anderson to DefCon, and it states, "Attached is my submission for a talk at DefCon 16 this year." And that's dated May 15, 2008.

Now, your Honor, if we look at the submission itself, you can see that -- the title of the presentation on the first page, "Anatomy of the Subway Hack," and then if we take a look at the second page of the document, it's MBTA0002, under "Presentation Information" -- and again, your Honor, we're talking about what is the information at issue; what are we concerned about? This is the submission that goes to DefCon that says the full presentation, and I'll point that out to the Court.

Up at the top it says "Presentation Information." And then if the Court looks down three or four lines it says "Is there a demonstration?" And the answer is "Several." If we look at the next line: "Are we releasing a new tool?" So that's a new software tool. The answer is "Yes."

Now, if the Court takes a look a little further down the page it says "Detailed Outline." And if the Court looks at Item III(B) which says "MIFARE RFID card attacks," under that in item one, line one, it says "Code Release." If we look at Item 2 it says "Possible demo and code release (possible because as of today the Verilog is not finished)."

If we look on the next page, so page 3 of this document, Item 4 says "Algebraic attacks." It says "Code Release." Your Honor, this code is what the Court -- is what we ask the Court to ask the plaintiff -- I mean, I'm sorry, the defendants -- to produce.

Four: "Algebraic code release." Item C refers to cloning and forgery attacks on the CharlieTicket. Item 1 refers to automated magstrip reverse-engineering tool release. Item 2 says "Python script release and demo." So there are a number of various software code releases and other tool releases that are referenced in this submission.

And also, your Honor, I'll note that when the code was not completed, when Mr. Anderson had code that wasn't done, he informed DefCon, "Oh, the code isn't ready yet," as in Item 2 about the Verilog isn't finished. The reason the MIT students have said they're unwilling -- or they refuse -- to produce the software code that -- in connection with this presentation is, they say, "Oh, it wasn't ready yet."

Now, your Honor, I also point out reference to a white paper on page 4. Up at the very top of page 4 it says "Sample slides about this talk." And then if the Court looks to the next paragraph it says "White paper about the material in the talk," and that is a web address. And we believe, your Honor, that that's the class paper that the students have also refused to produce. There's no password referenced in connection with this. That appears to be openly available to anyone on the Internet. And, again, they refuse to produce that paper.

Now, your Honor, if the Court were to take a look at the page -- further down this page it says "Legal Stuff," and then it says "Copyright Use Grant." And in that last paragraph down there it says "If I am selected for presentation, I hereby give DefCon Communications, Inc., permission to duplicate, record and distribute this presentation including, but not limited to, the conference proceedings, conference CD, video, audio, handouts to the conference attendees for educational, online, and all other purposes."

This is an unlimited grant; this is not a grant for educational purposes only. But for non-commercial [sic] purposes this is an ultimate grant device to DefCon as well as the attendees.

Now, your Honor, let me call the Court's attention to the next section which says -- on this same page, page 5, which says "Terms of Speaking Requirements." Your Honor, this is a contract. And Mr. Anderson, on behalf of MIT students, agreed in Paragraph 1 -- he said, "I will submit a completed and possibly updated presentation, a copy of the tools and/or codes, and a reference to all of the tools, laws, websites and/or publications referenced to at the end of my talk and as described in this CFP submission for publication."

So, your Honor, all of the materials that I read to the Court -- the code, the demonstration, all of those tools -- Mr. Anderson agreed to submit to DefCon, and signed this contract to do so.

Now, your Honor, where is -- where is this information? Your Honor, during the hearing before Judge Woodlock, EFF counsel stated that all of the information that was relevant -- all of the information -- was just inside this presentation; nothing outside the presentation, nothing outside the four corners. And the Court asked three times -- the Court said, "Just a moment." And this is from page 11 of our brief that gives the precise pinpoint cites of that transcript, your Honor. And this is with EFF counsel.

"THE COURT: Just a moment. Is there anything of substance to the presentation, anticipated for the presentation that is not on the slides?

"ANSWER: No, your Honor."

The Court again: "All right. These are the entire materials that you intend for presentation?"

"MS. GRANICK: Those are the visual materials.

"THE COURT: Well, is there anything else that is of substance for the presentation?

"MS. GRANICK: No, your Honor.

"THE COURT: There will be nothing beyond what's shown on these several slides?

"MS. GRANICK: No, your Honor."

Your Honor, that's inaccurate. Later on after the Court's pressing, Ms. Granick admitted, "Oh, yes, there are," and counsel is pointing out the reference to the software tools. Oh, there are software tools.

The Court asked: "What are these tools?" And the response was, well, these tools, they're tools that allow you to carry out these attacks, but they're not malicious.

How are we to judge that, your Honor? We don't have the tools, and we're to take the word of counsel because the tools have been withheld.

Now, your Honor, the Court asked at that hearing: "Demonstrations. What are these? What do the demonstrations do?" And the response was -- and again, this is on page 12 of our brief -- the response was, "The demonstrations by the MIT students at the DefCon conference will be designed to show how to create a forged card; in other words, one that is not issued by the MBTA."

Now, your Honor, the students have asserted their First Amendment right to withhold demonstration materials and to withhold these software tools. We've seen, your Honor, that the key information that has been produced so far -- which is compiled in that 30-page document under seal, which I believe is Docket 32 -- the key information here, your Honor, is real; this is not a prank. They've compromised the CharlieTicket, your Honor.

So the information has value; it's of concern; it has a real threat. And there is additional information that was designed for this conference that they contractually agreed to present at this conference that they refuse to withhold [sic] on First Amendment grounds.

This is the second point: Your Honor, I would like to call the Court's attention to the presentation. And if I may just approach the bench? What we have here are just a compilation of exhibits. We've given these to opposing counsel. But the only exhibit -- this was done for last Thursday's meeting. But the only exhibit that is really of value for the present purpose is Exhibit 17. And Exhibit 17, your Honor, which looks like this, is the same as Docket No. 9-7. So Exhibit 7 in Docket 9. The difference, though, your Honor, is that we've put Bates numbers at the bottom of the pages to make it easier to refer to the specific pages.

Now, your Honor, if I could call the Court's attention to Bates No. 140 in the presentation which looks like this. And, your Honor, our surmise from this document is that it is a way, visually, to indicate how to take a dollar twenty-five CharlieTicket and turn it into a $100 CharlieTicket so it's counterfeit.

What T officials did, your Honor, is in this second $100 ticket, there's a serial number. Now, T personnel took that serial number, linked the image of that CharlieTicket and that serial number to serial numbers of multiple additional CharlieCards. These are all clones of each other. The officials constructed an auto trail showing payments, use and other activities.

The linked tickets, they all were used illegally. Again, your Honor, whatever the end the MIT students might have had in mind, or have in mind, it's unequivocal in this case that they used illegal means.

And let's examine what MIT student -- the MIT students and counsel say about this. Mr. Anderson says in the press, and now, just as of last night in a declaration, "We never rode the T for free," so it must be okay. Counsel -- EFF counsel says -- and this, again, is in our brief at page 13. We give the cite to the transcript from the original hearing. Counsel claims that the research the MIT students compiled was not obtained through any kind of unauthorized access to computers.

Now, your Honor, not riding the T for free is very different than claiming no unauthorized access to computers. So we have the clients saying one thing and we have their counsel saying another. Which is it?

Your Honor, this is misinformation that the requested deposition was designed to prevent. And I'd note, your Honor, that while counsel said to this Court on Thursday Mr. Anderson is on holiday and he is too busy to appear for a four-hour telephone deposition, Mr. Anderson has been giving press statements, I understand he was on WBZ radio this morning, and he's had time to put together declarations. Your Honor, the Court asked for a good, factual record before to make this decision.

Now, your Honor, let me turn to my third point, which is the presentation itself. And, again, that's the material in Tab 17 in the handout that I just provided the Court.

Your Honor, this document, plus what we believe is the underlying software code and demonstration materials, are not abstract theoretical advocacy, but instead, they're specific instructions for violating the CFAA.

If the Court were to take a look at page 105, which is the first page, down at the bottom of that page the Court can see it says "For updated slides and code" see this website. That's the code we ask for, your Honor. If the Court could take a look at page 107, the slide says "What this talk is not: Evidence in court, (hopefully)." It shows an anticipation and realization that this talk was problematic.

Let me look at -- call your attention to the next page, which is 108. The slide says "You'll learn how to..." Your Honor, this is instructional text. "You'll learn how to generate stored-value fare cards" -- those are counterfeits -- "reverse engineer magstrips"; "hack RFID cards"; "use software radio to sniff" -- that is to obtain information from computer systems; "use FPGAs" -- so field-programmable gate arrays -- "to brute force"; "tap into the fare vending network"; "social engineer"; and "Warcart." So this is instructional text.

Now, your Honor, if the Court would take a look at the next page which states, "And this is very illegal!" And, your Honor, just as a note, at the bottom it says "So the following material is for educational use only." Well, we've seen in the contract that the MIT students have granted unlimited rights of their material. And if the Court could take a look at page 129. After working through a variety of methods on cloning and counterfeiting cards the text says "You now have free subway rides for life." It doesn't say "you will have" or "you may have" or "if you follow these instructions," et cetera, it says "You now have free subway rides for life."

If I could call the Court's attention to page 142, this is a page that is showing a demonstration to the MagCard reverse engineering toolkit. And it refers to Python libraries -- again, these are software libraries, an open source for analyzing MagCards. And at the bottom it says "Can now forge cards."

And then lastly, your Honor, I'd like to call the Court's attention to page 176. And, your Honor, this is a photo of network switches in the T's network system. These are sensitive devices, and in order to get here there would need to be some trespass committed. But that's not the point right now. The point is that: Take a look at -- these are network switches. All the data is running through these network switches. It's not just the CharlieCard and the CharlieTicket; it's all ACF data are running through these switches.

And then if the Court could take a look at the next page, you would see it's the same photo, but at the bottom there's the addition of a blue rectangle that says "Wireshark." Wireshark is sniffer technology that allows one to sniff -- in other words, monitor, surveil, intercept -- information over a computer network.

Your Honor, these are words -- and again, we don't have the full presentation because they refuse to give it, but these are words likely to incite imminent lawless behavior. This is the DefCon conference. As commentators have stated, there are the white hats at the conference who are out for the greater good, there are the grey hats who are in between, and then there are the black hats who are out to cause problems.

We have submitted an affidavit that has a collection of articles about the DefCon conference to give the Court a flavor of the type of audience that this is being presented to.

Like the Rice case, which is the case about the book called "Hit Man" -- and the book essentially teaches you how to rough people up and kill them. But it doesn't do it in an abstract, theoretical matter; it has pictures, it has tools, it has everything -- your Honor, these are instructions and step-by-step directions on how to engage in conduct prohibited by the CFAA; this is not protected speech.

Let me point now to balancing of the harms in responsible disclosure. Your Honor, the MBTA does not claim that the doctrine, or the principle or the concept or whatever you might want to call it, of responsible disclosure is written in the law. The Court on the injunction motion is acting equity. Your Honor, responsible disclosure should inform this Court, we believe, deeply in terms of the equities. What is fair between the parties here? What is responsible?

Your Honor, the students posted their presentation online -- this document we were just going through, posted it online -- starting June 30. It was available unpassword-protected. There was no meeting with the T until August 4. At that meeting the MIT students and Mr. Anderson told law enforcement that nothing illegal went on. We've seen that's incorrect; that was untrue.

They did not provide the presentation at that time. After that there were numerous contacts between MBTA officials and Professor Rivest who was acting, we view, at least with apparent authority as their agent in setting up the meetings and scheduling the communications with the T. And finally, your Honor, on Friday, the 8th, they agreed to give the presentation, but then at roughly 6:45 EFF counsel instructed them not to give the presentation to the T, even though the presentation had been publicly available at the conference as of Thursday. So we have a document that's available publicly that counsel is instructing clients not to provide, and I'm not sure why. And, your Honor, that was their responsible disclosure.

Now, I want to temper that statement, your Honor, with a clear statement that the security analysis that the students provided to us last Wednesday, that is a very useful document. As I said, from that document we came to the conclusion that the ticket has been compromised. They're able to compromise the ticket.

So, your Honor, when I talk about responsible disclosure, there are spots of great sunlight and then there are spots of great darkness. So I don't want to be too argumentative in talking about this as unequivocal non-irresponsible disclosure. But, your Honor, in terms of prior to that security analysis, yes.

And now, your Honor, the security analysis is wonderful, but there are additional materials that cause us great concern. Is this responsible disclosure now: withholding the class paper, withholding the software code, withholding the demonstration materials?

Balancing the harms, your Honor? We ask for a five-month injunction. We've tailored the injunction so it only covers nonpublic materials. We believe that will preserve the status quo. Our hope, your Honor, is that the parties will continue to talk in a constructive manner along the lines of the security analysis to resolve these issues, and at the end of that five-month period they're free to discuss whatever they need to discuss or whatever they feel like discussing.

Finally, your Honor, the last: the public interest. On the one hand, your Honor, the MIT students claim an unfettered right to disclose. Despite illegal conduct, despite incitement to others to copycat, they say: We should be able to disclose. On the other hand, your Honor, they claim essentially an unfettered right to withhold. We're not disclosing the class paper, we're not disclosing the demonstration papers, et cetera.

In this vein, your Honor, I would like to point briefly to the letter from the professors -- the 11 professors -- that was submitted to this Court. And I think that letter is useful, one, in terms of demonstrating that the MBTA's position and the professors' position is not that different; and, two, demonstrating that the professors are addressing a question that does not bear on the facts here.

Your Honor, the professors state that they have a firm belief that research and security vulnerabilities and sensible publication of the results of the research are critical for scientific advancement. That's on page 1 in the brief, your Honor. Your Honor, that term "sensible publication" we agree with strongly.

The professors also state, "Generally speaking, the norm in our field is that researchers take reasonable steps to protect the individuals using the systems studied." We agree as well, your Honor. Your Honor, where we diverge is the professors say that using the law to silence researchers is improper.

Your Honor, we're not asking to silence these researchers at all; we're asking for a time-limited injunction with respect to nonpublic information that we now know, based on further disclosures, is threatened and poses a real threat to the system.

Your Honor, as the professors state on page 4, "It is much better from everyone's perspective if researchers discover the break and publish it than if unscrupulous discoverers of the break exploit it without public notice." Your Honor, we can agree with that position, but we think better than that position is the responsible disclosure doctrine from industry, not from academia, that we propose, which is researcher finds the flaw, brings it to the target, there's a resolution, and then there's publication. That prevents the harm to the target and serves the public interest in providing full disclosure of the issue.

Now, your Honor, finally, the professors ask that vendors should not be given complete control over the publication of information as it appears that the MBTA sought here. Your Honor, again, with the relief that we requested, we have not sought complete control over what the students are saying and the point is inaccurate.

Your Honor, a final point on the professors' formulation: The professors' formulation did not address the situation where the researcher has used illegal means to capture the valuable research. Your Honor, in that position Mr. Bodoin has hacked into my system and he has committed illegal acts -- but he hasn't hurt anyone -- to get that information. Now, your Honor, from an interperspective, I want that information so that I can fix my system.

Now, who owns the information, whether I should be able to exploit it for someone else or whether Mr. Bodoin should be able to, you know, reap the commercial benefit of that, that's another issue. But, your Honor, I am going to want that value to know where my flaws are. Mr. Bodoin, however, if he's used illegal activity to get into that system to discover this valuable flaw, is going to be concerned that I'm going to say to him, "Mr. Bodoin: CFAA. You'd better watch out. You've got criminal exposure," or civil exposure.

The solution to that problem, your Honor, in other words, in order to get the plum, the prize, the value: I need to commit an illegal act. I need to hack into someone's system. And the solution the professors propose is: Narrow the CFAA. Don't make that conduct -- or talking about that conduct -- don't make that illegal. So, in other words, if I've committed illegal acts like the students here, and I get that plum, that value, and I talk about it to the world at large, that should not be a violation of the CFAA.

Your Honor, it proves too much. Narrowing the CFAA, as is proposed here -- in other words, by reading this term "transmission" to exclude written transmissions like the presentation, code transmissions like the code, verbal transmissions like the verbal presentation -- to narrow the CFAA in that manner will exclude -- sure, it will protect the good guys, but it will exclude a vast range of potential bad guys.

If this were a terrorist conference and terrorists were saying: This is the way -- you have code here to hack the federal court system, or to disrupt the financial institutions, it would be a much easier issue. But it's still the same, your Honor. The solution should not be to narrow the CFAA; the solution should be to rely on established First Amendment jurisprudence which prohibits words likely to incite imminent unlawful activity and read the CFAA the way it's intended to be written, which it picks up transmissions of information.

Now, in sum, your Honor, these broad issues of the public interest we think strongly support the requested relief here. It's time-limited relief. It allows the parties to talk, solve the problem, and it leaves the students free to publish research results and continue on or have presentations as they see fit.

Thank you, your Honor.

THE COURT: Ms. Cohn?

MS. COHN: Good morning, your Honor.

I want to first clarify a couple of factual things that I think have become clear as a result of the preliminary injunction papers that were filed late last night. And I do want to apologize in advance: I'm ready to argue the preliminary injunction today but I will note they were filed while I was on an airplane and I had the two hours after my red eye landed today to prepare. So I apologize if I'm not as polished as I might be this morning.

THE COURT: They are quite similar to the other filings, I noted.

MS. COHN: So the first thing is that the MBTA has now been really clear that there was not a compromise of the CharlieCard in the students' presentation; there was a compromise of the CharlieTicket. So any of the information or allegations or anything about the CharlieCard are simply irrelevant for purposes of the preliminary injunction because the students were not able to expose a vulnerability in that card. They came up with theoretical information about possible vulnerabilities but they were not able to demonstrate one. So I think that the CharlieCard issue should be off the table for purposes of the preliminary injunction because the only information that could cause harm to the MBTA, even under their own analysis, is the information about the CharlieTicket.

So now moving to the actual merits of the preliminary injunction hearing, I think that the Court -- you know, the preliminary injunction standard is the likely success on the merits, irreparable harm and the balancing. I don't think your Honor needs to reach the second two because there is no Computer Fraud and Abuse Act claim here. There simply is not. And that is the sole basis on which they have asked for this injunction.

The Computer Fraud and Abuse Act is a statute that is expressly and intentionally aimed at attackers to computers. It's aimed at viruses and worms and damage that can happen to computers. And it is expressly limited to transmission of information to a computer under 1030(a)(5)(A)(i).

This is clear and consistent throughout the case law applying this statute. In fact, Judge Posner in the International Airport Center case expressly talked about how you can't read "transmit" too broadly because if you did, you know, hitting the delete key would be transmit, and Congress didn't intend for it to reach that. So while counsel cites the Webster dictionary definition which includes both the definition that we think is appropriate here, which is definition seven about "transmission" meaning transmission to a device or a computer, that's not really what Congress was talking about here.

And it's very clear from the legislative history and it's consistent throughout the case law. And they can cite not a single case that supports the definition of "transmission" as computer -- as communications to people as opposed to communication to computers.

And you can see that even in the text of the statute itself. 1030(a) is the provision involving national security computers: computers that are owned by the Justice Department, that are actually part of Homeland Security. There Congress said communication of information could be a violation of the Computer Fraud and Abuse Act.

But in the provision of the statute that we're talking about here, which is at (a)(5)(A)(i) which involves the rest of the computers in the world, the ones that aren't involved in national security, which is what we're talking about here with the transit computers, communication is not included in the definition. And I think that's intentional. I think in the context of the national security situation and an attack on a national security computer, I think the First Amendment -- there's at least an argument there that the First Amendment might countenance criminalizing the communication.

But in the context of every computer that is possibly connected to the Internet, which is what the rest of the CFAA reaches, the definition of "protected computer" under that law, there is no use of the word "communication"; there's only use of the word "transmit."

So if you look at the legislative history, if you look at the statute itself, and if you look at the -- all of the case law on the Computer Fraud and Abuse Act, it's clear that "transmission" under the statute means transmission to a computer, not speech to a person.

There's also a second -- there are two other problems with the Computer Fraud and Abuse Act claim here that we haven't had a chance to develop more fully but I think are fairly obvious from what we have so far. First, entirely -- it doesn't allege the $5,000 jurisdictional minimum for a Computer Fraud and Abuse Act claim has been met here. That's because a computer must be damaged in an amount; it must be actually damaged by an attack. Again, we're thinking about viruses and worms and other sorts of direct attacks on computers.

And there's no allegation of any damage to any computer through anything that the student did or the presentation. The damage is, to the extent that there is one, that the MBTA might not make as much money as it might otherwise make. There's no allegation of damage to any computer. And there's certainly no allegation of loss in excess of $5,000 here. It's purely speculative.

Their argument turns on the idea that somebody who hears this general information might turn around and do something, and that something may cause damage and that damage might be over $5,000. That is not sufficient for a CFAA claim, and it's certainly not sufficient for an injunction under the CFAA at this particular point.

Secondly, it does appear to be unclear whether this is actually -- the MBTA's claims actually affect interstate commerce. It is not at all clear that there are fare devices in Rhode Island. My understanding from my local counsel is that the fare devices are all in Massachusetts. And I think there is a threshold-level question about whether these are protected computers under the CFAA that is worthy of further consideration.

So the CFAA just doesn't apply here. And there's a good reason why it shouldn't apply here, why it shouldn't be expanded in the way that plaintiffs would like you to expand it. And that, of course, is the First Amendment. If the CFAA was read to reach speech, truthful speech, on a matter of public importance, then the statute would be in tension with the First Amendment. And of course your Honor is well familiar with the idea that you should not read a statute to create constitutional problems and that you should avoid reading statutes in such a way, and yet the MBTA urges on you an interpretation of the CFAA that -- again, supported by no case law, no legislative history and no significant analysis, and would put the statute in tension with the First Amendment. And I think you should not consider going in that direction.

Now, in the preliminary injunction papers the MBTA -- and in the oral presentation that counsel just made MBTA makes -- brings in new information. We made these arguments about transmission. And the parties have gone back and forth on them. There's one new piece of information that's MBTA brings to this -- in the preliminary injunction papers. And this is their conclusory allegation that there may have been some illegal activities by defendants in doing their research.

Now, but that conclusory allegation -- first of all, it's unsupported; they don't say what it is the clients -- what it is that the students did, where they did it, how they did it. They just assert that now it's incontrovertible. Well, we would like to see that evidence. Certainly their conclusory assertion shouldn't be the basis upon which this Court makes a finding.

But in any event, even if it is true that they may have a small claims action for something against -- the clients did, or there was some minor infraction along the way to doing their research, that is not a Computer Fraud and Abuse Act claim. It doesn't meet the jurisdictional minimum, it doesn't appear that there was any transmission -- illegal transmission in this particular incident, and it's simply below the statutory threshold for the Computer Fraud and Abuse Act.

So the fact now that they have made a new allegation that there may have been some illegal activity by the students, which we hotly dispute, doesn't provide them a Computer Fraud and Abuse Act claim in this case. So if they don't have it for the speech and they don't have it for what the students may have done in creating the speech, then they don't have a Computer Fraud and Abuse Act claim and they do not have a likelihood of success on the merits.

Even if you were to find that there was a colorable Computer Fraud and Abuse Act claim, the law would not countenance a prior restraint in these instances. Remember that the prior restraint doctrine is one of the strongest doctrines in constitutional law; it protects truthful scientific speech, it protects speech that was gained illegally, and it protects speech when the publication of that speech would be illegal.

And we need look no further than the Pentagon Papers case decided by the U.S. Supreme Court. When Daniel Ellsberg took the Pentagon Papers out of the Defense Department, he violated federal law clear and unequivocally. And when he sought to publish that information which was classified, that publication violated public law. The Supreme Court said a prior restraint shall not issue for this publication and the information -- and the lower court's prior restraint was overturned.

Now, in that instance we have both of the things that Mr. Mahony claims that my clients did here. They claim that they got the information illegally, or that they broke some law along the way, and they claim that presenting this information to the public, while not itself illegal -- it's one step further removed from the Pentagon Papers case -- might incite other people to lawless behavior.

Well, if that was the law, the Pentagon Papers case would have gone the other way. And that's still the controlling Supreme Court authority here. That's because the First Amendment and the prior restraint doctrine countenance strongly against prior restraints on speech. There may be subsequent punishment after speech. And indeed, all of the cases that they cite in their argument that there's imminent lawless action and aiding and abetting are not prior restraint cases; they are all 201 subsequent punishment cases. The Paladin Press case is a subsequent punishment, the Rice case that we talked about earlier; NAMBLA -- the NAMBLA case -- the Curley case is a subsequent punishment case; the Brandenburg case is a subsequent punishment case; the Knapp case is a subsequent punishment case.

All of the cases that they are using to support their legal theory that a prior restraint is legal here are not prior restraint cases. And there's a very good

reason why they're not: because there aren't any prior restraint cases that would countenance what they're trying to do to the clients here. The clients are engaged in academic research, the information they want to publish is truthful and it's important to the public debate. This -- if you issue this preliminary injunction here you will be setting -- you will be making an unprecedented ruling, and I think that it's the wrong course to go on. I think that we've had a prior restraint too far -- so far here for far too long.

The second -- the next thing I want to talk about is the issue of irreparable harm. Now, they have not met their burden to show that they will suffer irreparable harm here, especially in the specific context of this situation. While they like to say that the students want to be free to say everything, the students have never wanted to say everything. They have always wanted to withhold what they call key information, information that would allow someone to replicate the attacks from what they speak about.

But let's be clear. There are three categories of speech here that we're talking about -- and by the way, they even went above and beyond, I think, what they needed to do here and they wrote a paper called "A Security Analysis" that we submitted to you under seal and gave to them last week to try to capture the universe of what they want to say publicly.

They have been very clear, they have been very consistent, and they have told anybody who wants to listen that they never intended to give information necessary to replicate the attack. And, in fact, they didn't. They have never given the information necessary to replicate the attack. And to the extent that anyone in this courtroom gave information that was necessary to replicate the attack on the CharlieTicket, it was the plaintiffs, because they published the first confidential report that the defendants wrote for them even before the presentation on the court docket. And that included the information that the clients -- that the MIT students did not intend and were not going to present at the DefCon conference. So to the extent that anyone's been a little laissez-faire here about making sure that nobody can replicate the vulnerabilities that our clients found, I think you have to look at the MBTA.

But in any event, they have not met their burden of proving irreparable harm here because the students don't want to give that key information. As I said, there are three pieces of information or three categories of information: There's the public information. Everybody agrees that that's outside the case -- outside the scope of the injunction. There is the key information, the crown jewel that you would need to replicate this attack. The clients do not want to publish this, they never indicated they want to publish it, and they certainly don't want to publish it now.

Then there is the universe of nonpublic materials that is important to understanding what the students did, without allowing replication, but to give context and background to what -- to what it is the students are saying. Remember, it was not until just this morning that the MBTA admitted that what the students did wasn't a prank. Until we pushed this to this Court, they were trying to deny that this happened and punish the whistle-blowers.

You know, if there's ever been a shoot-the-messenger case, I guess this is it. Our clients didn't create a vulnerability in the MBTA fare security system; they just discovered one. The vulnerability was there. Other people would have found it, or may have found it already, but the -- you know, to the extent, you know, that they are being punished here, they're being punished because they want to speak about a truthful thing that they discovered.

So the MBTA has not met their burden that there will be irreparable harm here if the students are allowed to talk about not the key -- crown jewels, because they don't want to talk about that, but the second category of nonpublic information that is contained in the security analysis.

Now, we gave this to your Honor very explicitly because we wanted you to take a look at that security analysis, and we felt that if you did, you would agree with this: that there's nothing in that security analysis but speech. It's pure protected speech. It's research materials and it's the result of the research, and that's all that's in there.

So we have given them the universe of what the clients want to say. And effectively I think what the MBTA is saying here today is: Well, we want an injunction because we're scared that they might say something else. But the First Amendment is very clear on this: You don't get an injunction against speech based on a speculative fear; you don't get an injunction on speech based on the fact that, well, you don't want to say it anyway so let's just enjoin you from saying it. Those are the things that are off the table in the context of prior restraints on speech.

And it does appear that that's kind of what they want here. They want to enjoin the clients from not -- from saying things that the clients don't want to say, and they want to enjoin the clients because they're afraid that the clients might say something else other than what the clients have very consistently, both privately and publicly, told the MBTA they want to say.

So finally, the balancing, the third prong of the preliminary injunction test: Again, MBTA has not met its burden -- its very high burden -- to counteract the public interest in the free flow of information here. The status quo under the First Amendment is the free flow of information. And the computer science professors and computer scientists agree that the free flow of science could be chilled here.

If your Honor issues an injunction preventing the students from presenting their research, you're going to have a ripple effect across the computer research community. You're going to have people afraid to do research; you're going to have people afraid to talk about their research; you're going to have people afraid to engage in peer review of their research, which, by the way, is what the DefCon conference is about, it's about peer review of scientific research by researchers; and they -- you're going to set an example that's going to cause ultimately all of us to be less secure. Because what security researchers do, while it may not be popular with vendors and transit authorities, ought to be popular for all the rest of us, because it's what keeps us safe from the hackers, from the worms, from the viruses, from the evil people. And I guess it's what keeps the MBTA safe from people who want to not pay for transit fees.

Ultimately -- this is the main point made by the 11 eminent computer security researchers, and I believe that given more time I could have easily gotten triple this number to sign -- is that the dialogue that happens in computer security research is important to the public interest. It's exactly why the First Amendment protects research and scientific speech to the same level as it protects journalists and their speech and speech on public affairs and speeches on political events.

Scientific speech and the ongoing dialogue that scientists widely have, that computer revolution that we have today, as the scientists say, and chilling that, by forcing researchers to come into court and to present to the other side in the court their research, the entire sum body of their research authorities, will endanger us all.

Now, I want to talk a little about the TRO language and the specific preliminary injunction language because one of the problems in the language that is most troubling to us -- as I said, there are three categories: There's the stuff they don't want to say, there's the nonpublic stuff that they do want to say and there's the public stuff. But the way that the TRO is drafted, it says that anything that gives material assistance to anyone in not paying their fare on the T could -- is a violation of the injunction.

Well, this is an extremely vague term and I think could easily reach a tremendous amount of ordinary speaking that the clients want to do in order to explain why it is they did what they did and the vulnerabilities that they found. So the injunction language that they're proposing is actually quite vague and creates a lot of uncertainty for the students even if it were to be adopted by the Court, which we don't think it should be.

Now, I want to address a couple of things that counsel said in his presentation. I'm happy to answer questions, however, that the Court may have. The first thing I guess I want to talk about a little bit is that, you know, counsel spent a lot of -- well, I guess the first thing -- I'll go in order from the five points. I think that's probably the easiest way to do it.

The first issue is that -- the idea that the information that's at issue here is that the MBTA still doesn't know what the students know. I think that there's a serious First Amendment problem in ordering the students as a condition of this lawsuit to divulge everything that they may know as part of a preliminary injunction.

What -- and there are several cases about this. And I think the Bextra case and the Cusumano case are cases that lay out exactly why such a requirement on the students for providing their research materials and their non-published information about their work would create a chill on First Amendment speech, and that's why Cusumano has to exist, to avoid this kind of free-form inquiry into the research process.

I guess the second thing that I want to talk about is the allegation that illegal conduct took place here now. I mentioned it briefly before, but I do want to point out that that allegation is merely an allegation and they have not provided anyone with any information supporting that allegation. And, indeed, the allegation is somewhat vague about what it is they think the students did and how it is they think they can prove it.

But that is a mere allegation and it is not a basis for a preliminary injunction. And, indeed, even if it was the basis for a preliminary injunction -- even if it was the case that the clients engaged in illegal behavior, which we firmly deny, that doesn't have anything to do with the preliminary injunction they're seeking here. The preliminary injunction doesn't ask that the students not engage in whatever illegal behavior it is under whatever statute they think it is they violated; the preliminary injunction prevents the clients from speaking.

And so there's a disconnect between the harm that they said that they found, the illegal behavior, and the relief that they're seeking here with this preliminary injunction. And the First Amendment is very clear that you should not punish someone for behavior unrelated to speech by stopping their speech.

Next, counsel spent a lot of time talking about the presentation materials, but I guess the thing that I think is most important to observe from this is that the DefCon presentation passed. They did not give the presentation. And they have not stated, nor is there any indication, that they're going to ramp up and give this presentation any time again. Instead, what they did was, they provided you with a security analysis that gives the four corners of what they want to say publicly, and that's the analysis that has to be had here, not whether some presentation that didn't happen in the past or some random thing that, you know, was part of that presentation that was clearly puffery by 20-year-old students should be the basis for a preliminary injunction.

The students have now told you and the MBTA exactly what they would like to say, and the only question here is: Is it speech and is it protected? It plainly is. So a lot of time was spent on the presentation and the other materials, but that's not what the students want to do right now, and there's no indication that they do want to do, and an injunction to prohibit them from doing something that they don't want to otherwise do is improper under the case law.

Counsel also spent a lot of time talking about the communications between the students and DefCon, and trying to make some intimation that because the students were willing to tell the conference what it is they wanted to say -- and they didn't get to finish it because they didn't provide a lot of things to DefCon because of the perfunkle that happened -- the
students --

What MBTA is asking here is exactly what the Court rejected in the Bextra case, the case involving New England Journal of Medicine. In submitting articles to the New England Journal of Medicine, I would bet that a full copyright assignment is given to the New England Journal of Medicine. I believe that in submitting a paper to the New England Journal of Medicine, an author provides more information than just the paper itself, but some of the supporting information.

And in the Bextra case they talk about the dialogue between the New England Journal of Medicine and the researchers who are submitting their information to be presented, in this particular instance in the journal rather than a conference. But the situation is directly analogous. The fact that the students were willing to tell the publisher, or the vehicle for publishing their information -- the information -- doesn't change the research privilege. It didn't change it in Bextra, it certainly didn't change it in the Cusumano case where clearly a lot of that information was given to the publisher, and it shouldn't make a difference here.

The presentation at DefCon was part of the research; it was part of the publication of the research. And the research privilege is not waived by giving the information to the publisher on your way to publishing the information. So I think that the New England Journal of Medicine case, the Bextra case, is actually on all fours with the students 'relationship with DefCon here. And just as the research privilege should have prevented them from having to provide the confidential materials there, the same should be the case here.

Finally, counsel gave a characterization of the facts that led us to today that I think I don't really want to belabor and go through, but I think there is one important piece of evidence that was presented by the defendants last Thursday without comment, the supplemental Sullivan declaration, that I think is tremendously important because it demonstrates that the MBTA wasn't really straight with Professor Goodlaw -- excuse me -- Judge Goodlaw about --

THE COURT: Woodlock.

MS. COHN: Woodlock. Excuse me. Jet lag is starting to hit.

-- about what had happened.

What Sergeant Sullivan says in the second declaration, which was omitted from the first declaration that they presented to the judge last week, is two things of tremendous importance. First, he says, "I told the students that they didn't have to give us anything except for a confidential report which was due in two weeks." The students actually got that report to them much sooner because they heard through their professor that MBTA wanted the report much sooner than the two weeks.

But the students were asked to do one thing in person by a representative of the MBTA, and they did that one thing. They met with the FBI. They communicated with the FBI and the MBTA. They were asked to do one thing and they did it.

The other thing that is important is that nobody else from MBTA ever talked to the students. As far as they knew, after they did this, they heard from their professor that they wanted the paper sooner, they got the paper sooner, and they were good to go. And without any notice to them, and while clearly on notice that they were out of state, the MBTA came to Judge Woodlock and presented a version of the story that omitted that they got -- that omitted this fact: that nobody talked to the students requesting anything else from Monday until Friday, and that the Friday conversation that they referenced was in the context of the MBTA telling the students, after they learned through counsel from MIT that they were being sued, that they should now turn over the slides.

And I think it was completely legitimate and appropriate for the students to wait and see what the causes of action were against them before continuing to try to cooperate with the MBTA because it was clear that cooperating with the MBTA wasn't helping them. And, you know, in any event, the slides were withheld for less than 12 hours, and they were ultimately presented.

So I think that the Sullivan declaration is tremendously important because I think it changes -- it very clearly supports the students' version of what happened and it very clearly, I think, undermines the MBTA's story that they repeatedly asked the students -- they asked the students many, many times for information; the students refused to give it to them. That's not what happened here.

Now, the MBTA tries to bolster this by saying, "Well, maybe we didn't talk to the students, but we talked to their professor. We talked to Professor Rivest." But Professor Rivest isn't the agent for the students. They knew how to reach the students. They could have called them directly if they wanted more from them. And, you know, while Professor Rivest did ask them to present their paper more quickly, they were not told that they needed the slides; they were not told that the MBTA wanted all of their presentation materials. The only person who talked to the students before they rushed to court and filed suit and got an injunction while the students were in Las Vegas is Sergeant Sullivan. And the last thing they heard from him, "Everything's fine. I believe you. You guys aren't going to be a problem. I've seen all the DefCon materials."

All these materials that counsel just walked you through with great drama were all seen by the MBTA before that Monday meeting -- actually, that's not true. Those came later. But they had seen the ad -- the conference ad saying "This is what we're going to do at the conference." So they knew that the students -- what the students were saying they were going to do when they met with the students.

And I think the MBTA is trying to present the students as somehow dragging their feet in terms of trying to help the MBTA. And that's not the case. The students are standing on their privileges and their First Amendment rights. That's appropriate. You should not waive those in this country. But the students have been trying, within the bounds of their own rights, to help the MBTA. And what they've gotten in response is a litigation flurry the likes of which I think I've never seen and a tremendous amount of pressure on them. And I think it's completely inappropriate and it's really time for this to stop. And the MBTA really ultimately is trying to silence some uncomfortable truths that these students uncovered. They're trying to -- they want to hide the fact -- they've wanted to hide all along the fact that their fare system is broken, and rather than respond the way that the transit authorities in London and in Amsterdam did when similar security flaws were brought to their attention, by taking the time and addressing the problem, they're trying to sue the messengers and they brought an action against three college kids rather than addressing the problems in their own house.

I'm going to conclude now. I'm happy to answer some questions. But ultimately, your Honor, we believe that the temporary restraining order should not be converted to a preliminary injunction, it should be dissolved immediately, and the case should go forward.

THE COURT: Mr. Swope?

MR. SWOPE: Thank you, your Honor. Good afternoon.

The temporary restraining order doesn't run to MIT, nor does the request for the preliminary injunction; therefore, I only have 30 seconds of points that I'd like to make to the Court, simply to correct what might be the impression left by the plaintiffs' briefs and comments today.

It was MIT who first contacted the T regarding this matter. When the students contacted the Professor Rivest, they asked him to call the MBTA. And it was that call that generated the meeting on Monday which you've heard so much about.

Professor Rivest is not the agent or authorized spokesperson for the students. These were kids who took one class of his. He's not their advisor; they're simply students in his class. He agreed to set up the meeting. When the T then called him afterward to say that they wanted to reach the students who were at this point dispersed around the country, he relayed the message to those students, but he is not their agent nor acting as their attorney in that regard.

THE COURT: Mr. Mahony, I'll give you an opportunity to respond.

MR. MAHONY: Your Honor, just briefly.

A number of the MIT students' arguments that turn on information provided, your Honor, for example, the argument that the CharlieCard should be released from any injunction. Your Honor, based on the security analysis, it's correct that the CharlieCard has not been compromised. But, your Honor, we still don't know -- again, it's the same old concern: We don't know that additional information that the students declined to share.

Your Honor, with respect to that additional information, it's difficult to envision the purpose served by advertising, as they did in the initial announcement. "We present several attacks to completely break the CharlieCard." That's what they've advertised. And that remained in the second announcement: "Completely break the CharlieCard." To make those statements, and then when they say "We've given you everything we want to talk about publicly. There's other stuff that we could talk about but we don't want to talk about but we're not going to tell you what that is," and for us to have that concern of "completely break the CharlieCard" as they've claimed, when they won't provide even in a confidential structure -- we have a protective order that we've provided to opposing counsel to try to work this out -- it's hard to fathom what the reasons are.

Your Honor, in terms of the claims that the illegal activity is conclusory, your Honor, we are happy to provide discovery on that point, attorneys' eyes only, and after we've had a chance to depose the students so we're clear about who said what to whom. But, your Honor, that information is solid information. We've provided a thinner version for public consumption because the more that's discussed about the audit trails and the protections, the more unfriendly hackers know about the system. But, your Honor, understand that that is solid information and my sister is incorrect.

Finally -- actually, two points, your Honor. My sister has said, "Court, be careful. If you continue the injunctive relief, researchers will be afraid. They won't research here anymore."

Your Honor, I submit well-tailored relief here will set the rules, will settle expectations, will remove the fear on both sides -- perhaps researchers are afraid. But I can tell you, your Honor, entities that rely on computer networks are pretty afraid as well. Your Honor, we need some civil, responsible structures here in place.

The students had their presentation and knew they were going to present it for two and a half months before they went to the T. Is that responsible? Do we want to say to researchers who know flaws in computer networks: It's okay to take two and a half months before you go, and then give less than ten days, and then want to disclose everything all over the world? Your Honor, that's not rational structure at all.

We need to balance the interests. We need to protect the fears of the researchers, absolutely. They perform an incredibly valuable function. Your Honor, I'm not underestimating when I say the students in their security analysis perform valuable function. That's value, your Honor. But we don't want to discount the fear that the network owners also have of researchers acting irresponsibly.

Your Honor, the last point was, my sister said it's time to stop. Your Honor, we have offered to mediate on many occasions. We have offered to discuss settlement on several occasions. Even yesterday we presented two offers. So the statement to the Court that it's time to stop coming from the MIT students seems out of place.

Thank you, your Honor.

THE COURT: Okay. Well, it hardly needs repeating here, I guess since it's been repeated already, repeatedly, what the test is for a preliminary injunction: the familiar four steps that the party seeking a preliminary injunction, as with a TRO, must show a likelihood of success on the merits of the underlying claim, the prospect that in the absence of that relief there would be, if not immediate, at least imminent harm that would be irreparable, it is a term of art which the law classifies certain inadequacy of other remedies.

The test recognizes that there are, as in any lawsuit, competing interests that can be affected by the judgments, and that the balance shouldn't weigh in favor of the party seeking the restraint. And finally, public interest is to be taken account of in light, I think, of disposition of the other factors. So let me try to address those in summary fashion.

First is the likelihood of success on the merits. In many cases I've noted from the circuit and elsewhere, this is the most fundamental criterion for establishing a case for a preliminary injunction, and as the First Circuit has said, it's the sine qua non element of preliminary injunction.

Plaintiff's claim here, as I understand it, is that the Computer Fraud and Abuse Act, as codified at 18 U.S. Code Section 1030, was violated, or was threatened to be violated. And the section of that statute that the plaintiffs rely on is Subsection (a)(5)(A)(i). Let me note that that claim of a past, present or future violation of the federal statute is the basis for federal jurisdiction on this case. The federal courts -- of course courts have limited jurisdiction. And as I understand the papers, the plaintiff relies on its claim arising under the CFAA to be the basis for this Court's jurisdiction.

There are some state law claims that are included in the complaint and, if anchored to a federal basis for jurisdiction, might also be heard, but I don't understand that any of the claims that we've been -- or issues that we've been addressing rest on any of those state claims; it's federal claims exclusively. And that's the same now as it was at the outset. It's the pleading; the complaint frames the pleading. And I guess the issue that was -- it was the way that the issues were addressed initially before Judge Woodlock in the motion for a TRO, and as I understand it continues to be the case.

And I think to keep the focus -- I mean, many people have different interests in the broad issues at stake here. My interest is rather limited in that I have a federal statute that is claimed to be violated and a particular legal remedy is sought. So I appreciate the breadth of views of others, but my view is considerably more focused on the issues that are presented by the lawsuit.

Now, let me also say that there had been a number of motions and other papers filed in the course of the last ten days or so, and there is an outstanding issue concerning the discovery order that was made last week. I think it's not necessary on this occasion to resolve that because I think it can be, for present purposes, sufficient to infer or assume, either way, that information in the possession of defendants might in some ways -- if publicized, might in some ways facilitate, in ways that I can't be specific about, the cloning or forging of CharlieTickets. I'll assume that the information that it might do that has not been disclosed. I don't think it matters for present purposes because I think that for other reasons based on the claim that is made the MBTA has not shown the likelihood of success to the merits of the CFAA claim, which is, as I say, based on 1030l(a)(5)(A)(i).

And specifically, I think I'm actually in agreement with the argument made this morning by the defendants, and that is that the -- it is likely -- this is not a definitive resolution of the construction of the statute -- but let me just even back up to that statement.

The issue presented first, it seems to me, is a question of statutory construction rather than a question of the constitutional conventions. Counsel pointed out the statutes are to be construed consistent with the Constitution, if possible, and construction that would raise constitutional issues are generally avoided, if possible. That's true. I think it is also true that if there is a statutory answer to a question that we need not reach, that we can prescind from reaching constitutional questions if the issues presented can be resolved on constitutional grounds. And I think that's the case here that's central.

So I agree with the argument by the defendants that the construction of the statute argued for by the plaintiff that the "transmission" information, according to the section under the statute, by publication to an audience is not likely the correct construction of that provision of the statute.

First of all, I agree simply as a matter of examination of the language and syntax. I think there's a point maybe not made this morning with quite the same precision but it was in one of the briefs that the placement of the comma before the phrase "to a protected computer" at the end of the phrase suggests that not only the nearest clause, but a more remote clause, is associated with that qualification to a protected computer; and in particular, that is the offense described here, is that a person commits the offense if the person knowingly causes the transmission of a program to a protected computer -- programmed information -- to a protected computer. I think that is a completely orthodox syntactical reading of the section. And if that's the case, it's unusual for us to try to find otherwise.

I note also that the word "information" relied on by the plaintiff is used in association with the words "program code" and "command" which tend to be more technical terms, suggesting that information is an entity of the same order of information as codes, commands and programs. And I'm not suggesting that this is, in fact, a transmission of information to a computer that is being addressed rather than, obviously, to an audience. And I think these interpretations of the statutory language are consistent with what relatively minor guidance we can get from the legislative history which suggests that this particular provision was aimed primarily, at least, at things such as viruses and worms that could be introduced by transmission to a protected computer.

So I think that the match between the giving of a public lecture or publishing in written form information, that behavior, the language of the statute, isn't sufficiently present for me to conclude there's a likelihood of success on the merits of that claim.

I would also say that -- although this hasn't been a primary focus here, that I think there is a substantial question about whether the $5,000 loss figure in (5)(B)(i) would be satisfied under these circumstances. I think there's speculation about how high loss could be if the loss were to be characterized as loss of revenue from people using unauthorized, forged, cloned, whatever, manipulated cards. The extent to which the teaching of the defendants' project would, in the real world, produce forgery of the kind necessary to get to $5,000 I think is a matter of possibility but I don't think it has been sufficiently established to support the injunction requested.

I think -- that's the key, obviously. I think there are other problems with other steps. There's a question whether there's a sufficient reason to believe that there is likely imminent or irreparable harm. There's some issue as to what information will be produced and how harmful it will be, whether the defendants will release certain key information or nonpublic key information or not.

I think -- particularly in light of changed circumstances, I think the very publicity that's been attendant upon the case may change that likelihood from what it was when there was a scheduled conference appearance. And so I think that's less clear in the plaintiff's favor than perhaps it was even at the time of the original filing. And there remains also in the area of speculation, I think, whether any damaged remedy could be deemed adequate or not.

As I said earlier, in any case there's competing interests and there are winners and losers and there are harms that occur and don't occur. And so the balance -- there are things to be said on both sides about what might happen in either event, either the granting or denial. Essentially for the reasons I've already described with respect to the information bearing on whether there's likelihood of immediate irreparable harm, I think the balance is hard to assess as well, and it falls to the party seeking the matter to more than show it's an issue, to show it's an issue that cuts in their favor.

So there's obviously interest in protecting the integrity of the fare system, in avoiding major loss to the MBTA. That's certainly legitimate harm to be concerned about. There's an interest and a potential harm to persons in the position of the defendants regarding their ability to engage in public discussions about these matters. And I make that point in the first instance without reference to the First Amendment, what it may or may not guarantee under these circumstances; that is, I think the harm exists as a practical matter without consideration of whether it's something that also implicates the person. In other words, I think this matter can be resolved without resort to constitutional principles at this stage.

And finally, public interest. Again, there's an ambiguity. Obviously, the public has some interest in the integrity of public institutions and systems such as the MBTA in avoiding losses that will -- if they occur, will likely be borne by innocent third parties such as other properly paying MBTA riders and perhaps even the general taxpayers. That's not an inconsiderable interest. On the other hand, there's a public interest in frank debate and truth-telling about weaknesses in public systems so they can be improved. So I think that factor comes out to be a wash. But the overriding one, I think, is that here in a federal court there must be a federal claim that is sufficiently viable to justify orders supposed -- where they are needed.

Now, let me just note that a lot of reference has been made to illegal behavior. And sort of a general term, for purposes of establishing what needs to be established here, the illegal behavior has to mean illegal in the sense that it is a violation of federal law, particularly, the CFAA. And for the reasons I've said, I don't think that's been shown.

So the fact that there might be other illegal behavior in violation of state law -- for example, theft, damage to property, things that arise under the common law -- I don't think that's significant under this kind of a claim, and so any -- I don't say that the facts might not show that there was some illegal behavior in terms of getting free rides or whatever, but the key is whether that was a violation of federal law to support a federal court's jurisdiction and order.

So in summary, then, those are the, I think, significant reasons. And as is obvious, I conclude the plaintiff has not satisfied the prerequisites for a preliminary injunction, so the motion for a preliminary injunction is denied.

I referred earlier to what the life of the TRO is. I think that it apparently has life beyond this, but obviously for the same reasons that I would deny the motion for the preliminary injunction, I will dissolve the existing TRO at this point.

I think it was Miss Cohn who said the case goes on, it does, and we'll see what happens next, all right?

We'll be in recess.

THE CLERK: All rise.