Volkswagen Aktiengesellschaft v Garcia & Ors [2013] EWHC 1832 (Ch) (25 June 2013)

Car security isn't what it was when I was young. Leaving aside the fact that my old Frogeye didn't even have door locks (although there was a lock on the bonnet, so that might have foiled a thief, who'd have had to be pretty mad to go for a bright orange car in the first place)  let alone an immobiliser, even the locks on cars of that era left a lot to be desired. On a camping holiday with a schoolfriend and his family, he locked the keys to his Cortina GT in the boot, but his father (who ran a Ford dealership, although he himself drove a very exotic BMW 3.0CSi) opened it with the key to his caravan.

Nowadays, although there are still mechanical aspects to vehicle security, it's an area which has a great deal more to do with electronics. It was to protect the algorithm that lies at the heart of the security system it uses (along with several other manufacturers), the Magamos Crytpo chip, that Volkswagen found itself in court last week (Volkswagen Aktiengesellschaft v Garcia & Ors [2013] EWHC 1832 (Ch) (25 June 2013)).

The facts were quite simple. A handful of academics had "attacked" (as they say in the field) that security system, and discovered some flaws. The vehicle manufacturers who stood to be embarrassed by those flaws might, you'd think, be grateful, but the academics proposed to deliver a paper at a conference, and in doing so would reveal the key algorithm to the world. In the name of "responsible disclosure" they had not simply gone ahead and done this: they had talked to the proprietor of the confidential information concerned. But they hadn't talked to VW, not until much nearer the date of the conference (which was last week, hence VW's need to seek an interim injunction).

To do this, the academics used a program called Tango Programmer, produced by an organisation called Scorpio, which is based in Bulgaria, and purchased by the academics for €1,000. There is some discussion in the judgment of how the program was devised, and where its authors found the Megamos Algorithm, which they might have arrived at by "chip-slicing" - cutting open the chip and examining the gates under a microscope. The important question was whether the software was legitimate or not. As the judge observed, "Just because it comes from Bulgaria does not mean it is illegitimate." And the fact that the website (not available when I went looking for it the other day, but back on line now) was written in "broken English" did not persuade him. In fact the website looks plausible, and the products shown on suggest that this is a business of some substance; it appears to be a limited company, and the strangest thing about it is its location bang in the middle of Bulgaria.

There was an issue about VW's right to sue. The algorithm was devised by Thales, who were not initially a party to the action, but the judge added them as a "proper and necessary" party, saying that it was likely within the meaning of Cream Holdings Ltd & Ors v. Banerjee & Ors [2004] UKHL 44 (14 October 2004) that "the confidentiality in the Megamos Crypto algorithm belongs to them", which is an interesting way to express it. This point did not stand in the way of an injunction being granted: Thales had standing to sue, but the judge held that VW did too, as they had a legitimate interest in being a co-claimant.

There is an old Jacob J case, Mars UK Ltd v Teknowledge Ltd [1999] EWHC 226 (Pat) (11 June 1999), [1999] 2 Costs LR 44, [1999] EWHC 226 (Pat), [2000] FSR 138, on reverse engineering, in which he held that it was not a misuse of confidential information to reverse engineer a product you had bought even to obtain information encrypted for security. The present case was argued on the basis that that case had been correctly decided, though that is in dispute, and (of course) it was the claimants' submission that it did not apply because the Scorpio Programmer software was not legitimate. The judge ended up relying on the "murky" origins of the program and the lack of effort on the part of the defendants to ascertain whether it had been produced by legitimate reverse-engineering or otherwise, and on that basis he held that there would be a breach of confidence. Should an injunction be granted to prevent publication? Not merely to save VW's blushes, said Mr Justice Birss, considering Article 10 of the European Convention, section 12(3) of the Human Rights Act, and the Cream Holdings judgment (but not American Cyanamid, which he said was clearly not the right test in the circumstances), which gave the guidance that the standard for not allowing publication is a flexible one, and that the court should be "exceedingly slow" to make interim orders if it is not satisfied that the claimant will probably succeed at trial.

Thales or VW would, he thought, probably succeed at trial, so that hurdle was cleared. Then the balance of public interest and the public interest defence fell to be considered. Freedom of expression and academic freedom were very important, but the epidemic of car crime that would be unleashed if the algorithm were published was more important. The software is sold by someone who understands that it can facilitate crime: there's a disclaimer that says (sic)

All devices and software developed by Scorpio-LK Ltd. are designed and sold with legal purpose to enchance and help people working in the sphere of car repairs and maintenance. The company doesn't take responsibility for any misuse of our products for illegal purpuses. Hence persons misusing our products for illegal purpuses bear their own responsebility for such acts.

And elsewhere:

Scorpio-lk Ltd accepts no responsibility for misuse of software for illegal purposes. The purchased softawre can only be used to repair vehicle immobilisers. On purchase of software client accepts responsibility for software use rendering Scorpio-lk Ltd unaccountable for illegal use.

The English, incidentally, seems no more broken than that of many native speakers. But the judge concluded that the claimants would probably be able to show that the software was not legitimate, and the defendants should have appreciated that.

The judge granted the injunction sought by VW, requiring "redaction" (the trendy alternative to "editing") of the paper they had written. They could still impress their peers by showing that they had derived the algorithm, and the claimants could remedy the problem identified with it: win win. The judge clearly came to the view that the defendants' protestations about "reasonable disclosure"  were nothing more than self-justification, and not the actions of responsible academics - a harsh view, but consistent with their reluctance to take even a few simple steps to ascertain where Scorpio-Lk Ltd had found the algorithm.

Dutch court holds Bulgarian decision contrary to public policy

It sounds like it should be none of their business, but, as that Dutch IP oracle Nauta Dutilh (and in particular Prof Charles Gielen, who coincidentally acted for the successful party in this case) explain in an article on their website, it's very much the business of the Dutch court when considering whether the Brussels I Regulation applies. Because the Bulgarian court's judgment was contrary to public policy, it did not have to be recognised by the Dutch court.

For a court to hold a foreign court's judgment to be contrary to public policy is powerful stuff. The case concerned Johnny Walker whisky, placed on the market outside the EEA but confiscated in Bulgaria at the instance of Diageo, the trade mark owner. The Sofia district court, on the basis of an interpretation of the relevant law by the country's Supreme Court, held that the importation into the EEA of goods placed on the market outside the EEA with the trade mark owner's consent did not amount to an infringement. That's a view of the rules about exhaustion which is perhaps more archaic than novel. It's certainly surprising. Equally surprising is that five judges dissented. How many judges does the Bulgarian Supreme Court have, for goodness' sake? A lot, apparently, but I can't find its judgments on the web, although I have learned some useful Bulgarian words (and letters in its version of the Cyrillic alphabet: съд is transliterated as "sud", the vowel being my new letter: the word means "court". The Russian sounds the same but with the phonetically equivalent letter у in the middle).

Because the trade mark registrations were held by Diageo's Dutch subsidiary (not an uncommon situation, for tax reasons) the confiscatee brought proceedings in Amsterdam to recover damages. Diageo contended that the Sofia district court's judgment was contrary to public policy within the meaning of Article 34(1) of the Brussels I Regulation. The Supreme Court had gone against the Silhouette judgment (which also involved parallel imports and Bulgaria, though at that time it was not an EU Member State) and should have made a reference to the Court of Justice under Article 267 of the Treaty. The Supreme Court had violated a fundamental principle of EU constitutional law, so not only the district court's judgment but also the Supreme Court's interpretation on which it was based was contrary to public policy.