The English High Court (the highest civil court) has blocked the publication of a scientific paper that would have revealed the full details of a zero day vulnerability in Volkswagen’s immobiliser mechanisms – the temporary injunction against publication has been granted to stop the publication of “Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobilizer” – due to be presented at a Usenix security conference.
One of the paper’s authors is Flavio D. Garcia, who is based in the UK (the University of Birmingham) and so would have to respect the injunction or face contempt proceedings (and the possibility of prison) – the two other authors Roel Verdult and Baris Ege, both of Radboud University Nijmegen are not in or from the UK so it’s not clear to me how effective the injunction would be against them if they opted to defy it.
It’s difficult to see this as an open-and-shut case about academic freedom – as Volkswagen were not trying to supress the fact of the vulnerability, merely the details of how to conduct the crack – but it does concern me. Many security researchers make it their normal practice to publish the full details of zero day exploits – some arguing that the pressure thus applied is the only way to ensure the problems get fixed. It’s a legitimate argument to make and it should not, in my view, be a matter for the courts to judge on as a matter of routine.
I am not a lawyer but my understanding is that temporary injunctions are usually granted pending a full hearing – to preserve the status quo ante while the full legal arguments are heard: so this may have some time to run yet.
- Researcher’s paper banned for containing luxury car security codes (rawstory.com)
- Scientist banned from revealing codes used to start luxury cars (guardian.co.uk)
- Scientist banned from revealing codes used to start luxury cars (zendialogue.wordpress.com)
- Court Prohibits Hacker from Revealing Automobile Security Flaw (darkgovernment.com)
- Criteria for reviewing a scientific paper (medicalimagecomputing.wordpress.com)