Three MIT students are facing the Massachusetts Bay Transportation Authority after they exposed flaws in the authority’s CharlieCard system that could allow them to ride the T for free.

Before MIT students Zack Anderson, R.J. Ryan and Alessandro Chiesa were able to present their computer science research project at the DEFCON, a Las Vegas convention for security researchers, the MBTA filed a complaint and gag order forbidding the students and their attorneys from discussing their work with the media or the public.

That gag order was lifted with the help of the Electronic Frontier Foundation, a civil liberties group that deals with legal issues that arise from new technologies. According to EFF spokeswoman Rebecca Jeschke, the students contacted the MBTA with their professor, Ronald L. Rivest, and the transit authority allowed them to share their presentation. Still, a few days later, the MBTA filed a motion in court against the students, Jeschke said.

Anderson, Ryan and Chiesa did the same research a professional security researcher would have done, but because they are students, the MBTA may have tried to intimidate them, Jeschke said.

“We wanted to share our academic work with the security community and had planned to withhold a key detail of our results so that a malicious attacker could not use our research for fraudulent purposes,” Anderson said in a press release. “We’re disappointed that the court is preventing us from presenting our findings even with this safeguard.”

The students said through their lawyer they wanted to share their information with the MBTA before it sued them. MBTA general manager Daniel Grabauskas said the T is willing to discuss the students’ findings as long as they consent not to make their knowledge of the system public.

“I renew my invitation to the students to sit down with us and discuss their findings,” Grabauskas said. “With respect to the information that was sealed, I have every expectation that the students will act in accordance with the principles of ‘responsible disclosure.'”

Anderson, Ryan and Chiesa’s research shows the weakness of the magnetic strip and ID system used in many cities’ transportation systems. The system only stores information on the card but does not track it.

Leonid Reyzin, an associate professor of computer science at Boston University and part-time MIT professor, defended the students choice to fight the MBTA’s gag order.

“The T has taken the completely wrong approach,” Reyzin said. “The students did the MBTA a great service for free. If some undergraduate students can find a flaw in the system, then anyone could have exploited the T.”

“If the T wanted to keep this quiet, and the flaws out of the public, then suing the students was about the worst thing they could have done,” he continued.