From the Manchester Guardian
The University of Birmingham says it will defer any publication of an academic paper which reveals secret codes to bypass the security on top-end cars including Porsches and Bentleys following a high court injunction.
It said it was "disappointed" with the judgement in a statement following the Guardian's revelation that the cryptography research of three British and Dutch academics had prompted legal action by the cars' manufacturer Volkswagen.
The motoring giant had argued that the work of Birmingham's computer scientist Flavio Garcia and two Dutch colleagues from the Raboud University could lead to the theft of not just the luxury cars but also of lower-end people-carriers and other makes, including Audis which use its Megamos Crypto algorithm. That algorithm allows the car to verify the identity of the ignition key.
Volkswagen complained to the judge that the publication could "allow someone, especially a sophisticated criminal gang with the right tools, to break the security and steal a car".
Garcia and the Dutch researchers Baris Ege and Roel Verdult discovered the unique algorithm and had planned to publish their paper at the Usenix Security Symposium in Washington DC in August, but Volkswagen won a temporary injunction banning this.
"The University of Birmingham is disappointed with the judgment which did not uphold the defence of academic freedom and public interest, but respects the decision. It has decided to defer publication of the academic paper in any form while additional technical and legal advice is obtained given the continuing litigation," a spokeswoman said.
The Dutch researchers said they had planned to "demonstrate the lack of security in the Megamos chip used in immobilisers in various automobile brands" and were not involved in any reckless research that could lead to auto theft.
"The chip dates back to the mid-nineties and has since become outdated, but is nevertheless still widely used in the automotive industry," they said in a statement issued by their university.
"The paper reveals inherent weaknesses, on the basis of mathematical calculations, and is based on an analysis of publicly available information. The publication in no way describes how to easily steal a car, as additional and different information is needed for this to be possible," they said.
They said they informed the chipmaker - which was contracted by Volkswagen - nine months before the intended publication so that measures could be taken.
In the court case, the judge was told that Volkswagen did not learn of the planned publication until May when it launched its legal action.
Ege and Verdult said that in Holland a six-month quarantine between scientific discovery and publication was considered the norm, but they too would be respecting the decision of the British court.
"The Dutch government considers six months to be a reasonable notification period for responsible disclosure. The researchers have insisted from the start that the chipmaker inform its own clients.
"The decision of the English judge imposes severe restrictions on the freedom of academic research in a field that is highly relevant to society (cyber security). Radboud university, nevertheless, respects the ruling of the Judge," they said in their statement.
The Guardian's article has prompted a massive debate about the balancing interests of industry and those of scientists, a debate that has infected all sectors ranging from medicine to car manufacturing.
Jim Hutchon commented on the article saying: "The scientific methodology is dependent upon publishing results so others can prove you wrong or right and build on the findings. So in my opinion there is a reason to publish. It's good science."
Another using the pseudonym EndersShadow asked: "The interesting thing is whether this discovery renders the cars no longer fit for purpose / satisfactory quality under the Sale of Goods Act, enabling owners to return for a full refund."
And "Charles VanDyke" asked: "Would Flavio Garcia instead have published in Germany (home of Volkswagen), no judge could have prevented him from doing so: the right of academic publication is protected by the German constitution (the basic law or Grundgesetz). Publication can therefore also not be hindered by a foreign court."
Volkswagen said it could not comment as this was an interim judgment.
No comments:
Post a Comment