The statement put up by blackboard about Interz0ne

BlackBoard Inc.

From speech_freedom2002@yahoo.com Wed Jul 16 10:59:47 2003
Date: Wed, 16 Jul 2003 06:14:52 -0400
From: Rockit [speech_freedom2002@yahoo.com]
Reply-To: root@se2600.org
To: root@se2600.org
Subject: [se2600] Interz0ne Press Release re: Blackboard Settlement

Interz0ne Press Release:

Censorship via lawsuit wins again.

Lawyers working for Blackboard Inc., the maker of a card transaction, vending and ID system used by approximately 275 colleges and universities globally, as well as an undiscosed number of government and military installations, succeeded in silencing two college students who have found numerous flaws in Blackboard's flagship product over the last two years.

Georgia Tech student Billy Hoffman, along with University of Alabama student Virgil Griffith, initially kept the discoveries quiet while attempting to report them to Blackboard engineers, along with possible fixes. Traditionally, the discoverers of such flaws allow the vendors time to fix problems before going public; this provides the vendors with essentially free quality control labor while the discoverers get later bragging rights and items to pad their resumes. This unofficial system has worked well in the past, to the extent that Blackboard even boasts of working with the hacker community on their website.

Instead of taking an interest in news of these flaws, however, Blackboard engineers first dismissed Hoffman as a know-nothing "kid", then attempted to have him expelled from Georgia Tech after he voiced his concerns about Tech's Blackboard system to campus administrators and student organizations. Hoffman responded by first publishing his (and later Griffith's) findings, and then updating his articles via talks at various vendor and security conferences.

It was at such a conference, Interz0ne II in Atlanta, that Hoffman and Griffith were planning to discuss the most severe problems they had uncovered to date, including a demonstration of several easy-to-assemble hardware devices that could supposedly allow anyone with malicious intent free reign on a Blackboard system.

Hoffman and Griffith never gave their talk.

Instead, they and the convention organizers were served with both restraining orders and cease and desist orders. Court dates soon followed, along with legal threats. Several months after the convention, both Hoffman and Griffith settled out of court. They refuse to discuss the issue, so one can assume that the settlement includes an NDA.

Blackboard spokesdrone Michael Stanton stated to AP reporters on Monday, July 14th (a day before the settlement was officially filed) that "...the claims [Hoffman and Griffith] were making were silly," that "...they really didn't do a lot of the things they were claiming to [have done]" and that the settlement reaffirms that Blackboard's systems are secure.

Bullshit.

The settlement does nothing of the sort.

If Hoffman and Griffith's clai... [ Read More (0.4k in body) ]

] Blackboard said the settlement shows its systems are
] secure but the whole case is better understood as a
] successful attempt to protect the firm's reputation
] against the possibly exaggerated claims of a pair of
] student hacker/crackers

The register got caught up in the spin as well.

Since when is using the law an appropriate way to silence critics? Thats the very definition of censorship.

Can we accept that this is really the final word on the story, given that its coming from blackboard, and that Acidus and Virgil are injoined from responding?

Is Blackboard's technology secure?

We may never know. What we do know is that Blackboard has effectively silenced their critics, with extreme prejudice. My lawyer is bigger then your lawyer should not trump the first amendment. In this case it has. These student settled because they did not have the means to defend themselves.

Acidus and Virgil owe $20,000 in (clears throat) "legal fees." They are college students. They can't really afford this and they need help. If you would like to contribute, you can paypal the following email address: gte344p@prism.gatech.edu

The Register - Blackboard press release

From Read_Me.txt in dir:
] These files mirror, brought to you courtesy of V1ru5,
] TheVoidAKABoB, and SystemFailure, seem to go well
] with the presentation that Acidus was to give at
] Interz0ne.

Lots of information on the Blackboard CampusWide system.

CampusWide Information Mirror (Socialfreedom)

A concise effective description that has my seal of approval. It is factually correct and a vast majority of the insinuations made are also true. A significantly better description and analysis than anything else I've seen written on the issue.

Analysis of the Blackboard Case

As they are attempting to screw with our freedom of speech, lets take a molment to single out the people and organizations behind Blackboard.

Senior Management:

* Matthew Serbin Pittinsky, Chairman
* Michael L. Chasen, CEO & Director
* Stephen Hoffman, President & COO
* Peter Repetti, CFO
* Andrew H. Rosen, Esq, EVP, Corporate Development & General Counsel, General Manager, International
* Ken Krushel, EVP, Business Development
* Todd Gibby, General Manager, Course & Portal Solutions
* Jim Hermens, General Manager, Commerce & Access Solutions
* Susan Katz, Senior Vice President, Sales

Board of Directors:

* Doug Alexander, Internet Capital Group
* Robert E. Grady, The Carlyle Group
* Dr. Arthur Levine, Teachers College, Columbia University
* Roger Novak, Novak Biddle
* William L. Jacobs, The New Power Company
* Mark L. Walsh, VerticalNet Inc.

Alliance Partners:

* AOL Time Warner Inc.
* Datatel
* Dell Computer
* Harcourt College Publishers
* Houghton Mifflin
* McGraw-Hill
* Microsoft
* NextEd
* Oracle
* Pearson Education
* PeopleSoft
* Sun Microsystems
* Thomson Learning

Anyone have any background info on any of their senior management or board that may be of interest? What other companies share board members with Blackboard, etc..

Blackboard Facts

] A pair of students were blocked by a federal court from
] presenting information at a Georgia security and hackers'
] conference on how to break into and modify a university
] electronic transactions system.

] "The temporary restraining order pointed out that the
] irreparable injury to Blackboard, our intellectual
] property rights and clients far outweighed the
] commercial speech rights of the individuals in
] question," said Michael Stanton, a Blackboard spokesman.
]
] The company claims that the speech being blocked is
] commercial speech because the students were a "small
] competitor" to Blackboard. One of the students,
] Georgia Institute of Technology's Billy Hoffman, had
] threatened to give away code allowing any computer to
] emulate Blackboard's technology, the company claims.

] Although an initial cease and desist letter sent to the
] Interz0ne conference organizers hinted that the students
] may have violated the DMCA, the complaint that resulted
] in the temporary restraining order did not touch on that
] copyright law.

Slightly different versions of this article by John Borland (CNet Staff Writer) are also running on BusinessWeek Online and ZDNet AU.

http://www.businessweek.com/technology/cnet/stories/996836.htm
http://www.zdnet.com.au/newstech/security/story/0,2000024985,20273726,00.htm

Court blocks security conference talk | CNET News.com

] On Saturday night, Virgil and Acidus, two young security
] researchers, were scheduled to give a talk at Interz0ne
] II on security flaws they'd found in a popular ID card
] system for universities. It's run by Blackboard, formerly
] by AT&T, and you may know it as OneCard, CampusWide, or
] BuzzCard. On Saturday, instead of the talk, attendees got
] to hear an Interz0ne official read the Cease and Desist
] letter sent by corporate lawyers. The DMCA, among other
] federal laws including the Economic Espionage Act, were
] given as the reasons for shutting down the talk. I spoke
] with Virgil this morning.

Slashdot | Blackboard Campus IDs: Security Thru Cease & Desist

Just caught this one in my inbox.. Psyiode has started up a site to keep track of the Blackboard case.

Its important to note that Psyiode has no connection to Acidus, Virgil, or any of the Interz0ne con staff. Blackboard may decide to come after him too.

I like the domain. :)

www.fuckblackboard.com

When CEO Michael Chasen thought about the other young people he knew who started companies when he did, he paused. Most of them aren't running companies anymore, he said. "I might be the only one."

Blackboard Looks Likely To Go Public