Security researcher Christopher Soghoian, who was raided by the Federal Bureau of Investigation last October after he created a fake boarding pass generator, has gotten his computer equipment back, but remains under investigation by the Transportation Security Administration, which had ordered his Web site shut down.

The order, delivered to Web hosting provider DreamHost, raises questions on whether the government can order a Web site taken offline without a court order.

Ryan Singel of Wired News has done all the hard work on this story, and I can’t say much more than he already has in his reporter’s notebook stroke blog, 27B Stroke 6, which incidentally you should be reading.

Here are some of the choice cuts:

Soghoian says he has no plans to repost the generator, since another version — one which, unlike his own, can be downloaded, was released into the internet wilds after his was taken down.

He also wants the conversation not to be about the ability to just get into the security line with a fake boarding pass, but about the current uselessness of government watchlists for domestic flights. . . .

“I personally think the no-fly list should be abolished,” Soghoian said, “but if Congress decides that it wants a no-fly list they should make it work. Right now it’s broken.” . . .

“The message it sends to the community is that if you do security research, someday the FBI will come knock on your door.” — 27B Stroke 6

The FBI dropped its investigation after Soghoian met with FBI agents and an assistant U.S. attorney and got his stuff back. But the TSA decided to do its own investigation.

Laurie Uselding, a Transportation Security Administration spokeswoman, confirmed today that the TSA continues to investigate Soghoian for possible violations of civil statutes that govern aviation security. — 27B Stroke 6

Not like they’re actually going to be able to prosecute him for anything, but they could put him on the no-fly list, I suppose.

This whole mess started when Soghoian posted a fake boarding pass generator on his Web site to draw attention to a long-standing problem with airport security that he felt nobody was sufficiently addressing.

For his trouble, the FBI raided his house and, it has come out, the TSA sent a threatening letter to DreamHost, his Web hosting provider, asking them to take down the site and being generally menacing.

But, it turns out, that letter might not have any legal validity at all.

What’s interesting here is that there’s no statute that actually allows the government to compel anyone to take down a website, absent an order from a judge. There are ways to get hosting providers to take down alleged copyright infringement or defamatory content, ways that they generally comply with in order to avoid liablity. But even those methods can not force a hosting provider to take down a site.

More to the point, isn’t it censorship for the government to hand a service provider strong sounding language on Homeland Security letterhead with the intent of intimidating the company into repressing free speech? If the government really had a case, they’d get a judge to issue an order. — 27B Stroke 6

Oh, but that’s so inconvenient! And besides, most providers will just roll over and do whatever the government asks, whether it’s legal or not, without bothering to ask for a court order. This is a serious problem in the industry today.

Jennifer Granick of Stanford University’s Center for Internet and Society represents Soghoian, and in her legal opinion, the takedown order wasn’t at all legal, but the hosting provider had no way to evaluate “national security concerns” and erred on the side of caution.

I can’t blame them for being responsive to something like this. That being said, I don’t think anything illegal about his boarding pass generator.

You could go to a judge and order Chris or DreamHost to take it down. But that would be a really hard case, as long as he isn’t aiding and abetting anybody. Aiding and abetting requires you to intend to help a bad guy and Chris has no such intent. He’s not breaking the law.

This would fall pretty squarely in the realm of free speech and you can’t get prior restraint on speech. — 27B Stroke 6

And Ryan Singel suggests that this sort of government order might just be illegal and cites a 1963 Supreme Court decision to make his case.

To top it all off, someone actually remade the boarding pass generator into an application you can either run online or download and run on your own computer.

P.S. In case I forgot to mention it, you really should read 27B Stroke 6.

(Full disclosure: Homeland Stupidity has an affiliate relationship with DreamHost to promote its web hosting services for commissions. This relationship is being re-evaluated in light of the above news.)