onelittlewindow

This weekend, controversy surrounds the black hat/defcon security conferences once again. Students at MIT were slated to present on research on hacking the MTA farecard system (both magnetic stripe and RFID technologies), but a temporary restraining order granted this morning by a Boston judge has caused the cancellation of the talk.

There have been several different cases of legal threats shutting down talks in the past few years — in fact, it almost seems a mandatory event every year now. However, RFID seems to have attracted it disproportionately now, with IOActive having been forced to pull a talk in a previous year as well.

I’ll leave the details of this case to the reader’s google-fu right now (google news defcon, you’ll get plenty). But we put forward this question:

Why are the lawsuits brought against the researcher who uncovers the flaw in a system, rather than the vendors who provide the flawed system?

Most of the issues with RFID are already widely known, and the execution of the “exploits” are a matter of clever people utilizing cheaply available resources. Trying to repress their findings does nothing to truly protect the systems — all it does is mean that another clever person, who may mean more harm and less good, will come along shortly and do it again.

Perhaps some day organizations and government will evolve from having to place blame first and foremost. But until then, perhaps the blame should go on the group that created the problem, as opposed to the person who revealed there was one.