Whistleblowers' rights and breach of confidence: Pharmagona v Taheri

When a breach of confidence case has a 'whistleblower' dimension, things can get complicated. The history of Pharmagona Ltd v Taheri and Anor [2020] EWHC 312 (QB) (17 February 2020), which came before Mr Justice Nicol on 30 January (the judgment appearing on 17 February) is complicated - a sorry-looking tale of orders made and arguably not complied with - considering that it was nothing more than a simple breach of confidence action brought by an employer against a couple of employees, who happened to be husband-and-wife.

The defendants, IT manager and office manager respectively, had been summarily dismissed for stealing money by the claimant on 2nd February 2018, after which date they allegedly criminally hacked into the complainant's computer system and downloaded "various materials". The first defendant did the hacking, but communicated information to his wife who knew or ought to have known that she had confidential information.

The defendants maintained in their defence that the claimants had engaged in unlawful and criminal activities, including exporting goods to Iran. This, they argued, was why they were accused of theft and dismissed, although a police investigation had found no evidence against them. They claimed the protection of the Public Interest Disclosure Act 1998 and the Employment Rights Act 1996. Many elements make this a rather unusual breach of confidence case.

The defendants say that their hacking was to collect evidence of wrongdoing, and whistle-blowing would of course be immensely difficult if an injunction could be obtained to prevent information being passed on - indeed, to prevent the whistle being blown (or perhaps to remove its pea before blowing took place).

The claimant sought (so the judge inferred - the pleadings seem to have been somewhat unorthodox) an interim injunction. This would normally be dealt with according to the American Cyanamid principles, but the judge decided that s. 12 of the Human Rights Act applied: publication is not to be restrained before trial unless the court is satisfied that the applicant is likely to establish at trial that publication should not be allowed. The purpose of this provision is to protect the Convention right to freedom of expression (Article 10, of the European Convention on Human Rights of course). "Likely" means more likely than not, according to the House of Lords in Cream Holdings v Bannerjee [2004] UKHL 44, [2005] 1 AC 253, although this ordinary meaning might have to be applied flexibly sometimes.

The claimant argued that s. 12(3) did not apply, relying on the carve-out in Article 10(2) which allows freedom of expression to be curtailed to protect the rights of others - here, the claimant's proprietary rights in its confidential information. Counsel for the claimant pointed out that there had been no reference to Article 10 or s.12 in the key earlier Court of Appeal case Tchenguiz and Ors v Imerman (Rev 4) [2010] EWCA Civ 908 (29 July 2010) but the judge reckoned that the point about likely success at trial had been fully considered, even if the provisions had not been mentioned in so many words.

The judge was satisfied that unless the defendants were restrained, the claimant would be able to show at trial that the defendants would be likely to use the confidential information. However, the judge was also satisfied that the defendants should be free to co-operate with public authorities investigating the claimants' activities. They had, in short, to be allowed to blow their whistle. In the end, an injunction to prevent disclosure with a suitable public interest proviso, allowing the defendants to answer questions and provide documents, seems a very sensible (and in the circumstances quite simple) solution, and that is what the judge granted.

Volkswagen Aktiengesellschaft v Garcia & Ors [2013] EWHC 1832 (Ch) (25 June 2013)

Car security isn't what it was when I was young. Leaving aside the fact that my old Frogeye didn't even have door locks (although there was a lock on the bonnet, so that might have foiled a thief, who'd have had to be pretty mad to go for a bright orange car in the first place)  let alone an immobiliser, even the locks on cars of that era left a lot to be desired. On a camping holiday with a schoolfriend and his family, he locked the keys to his Cortina GT in the boot, but his father (who ran a Ford dealership, although he himself drove a very exotic BMW 3.0CSi) opened it with the key to his caravan.

Nowadays, although there are still mechanical aspects to vehicle security, it's an area which has a great deal more to do with electronics. It was to protect the algorithm that lies at the heart of the security system it uses (along with several other manufacturers), the Magamos Crytpo chip, that Volkswagen found itself in court last week (Volkswagen Aktiengesellschaft v Garcia & Ors [2013] EWHC 1832 (Ch) (25 June 2013)).

The facts were quite simple. A handful of academics had "attacked" (as they say in the field) that security system, and discovered some flaws. The vehicle manufacturers who stood to be embarrassed by those flaws might, you'd think, be grateful, but the academics proposed to deliver a paper at a conference, and in doing so would reveal the key algorithm to the world. In the name of "responsible disclosure" they had not simply gone ahead and done this: they had talked to the proprietor of the confidential information concerned. But they hadn't talked to VW, not until much nearer the date of the conference (which was last week, hence VW's need to seek an interim injunction).

To do this, the academics used a program called Tango Programmer, produced by an organisation called Scorpio, which is based in Bulgaria, and purchased by the academics for €1,000. There is some discussion in the judgment of how the program was devised, and where its authors found the Megamos Algorithm, which they might have arrived at by "chip-slicing" - cutting open the chip and examining the gates under a microscope. The important question was whether the software was legitimate or not. As the judge observed, "Just because it comes from Bulgaria does not mean it is illegitimate." And the fact that the website (not available when I went looking for it the other day, but back on line now) was written in "broken English" did not persuade him. In fact the website looks plausible, and the products shown on suggest that this is a business of some substance; it appears to be a limited company, and the strangest thing about it is its location bang in the middle of Bulgaria.

There was an issue about VW's right to sue. The algorithm was devised by Thales, who were not initially a party to the action, but the judge added them as a "proper and necessary" party, saying that it was likely within the meaning of Cream Holdings Ltd & Ors v. Banerjee & Ors [2004] UKHL 44 (14 October 2004) that "the confidentiality in the Megamos Crypto algorithm belongs to them", which is an interesting way to express it. This point did not stand in the way of an injunction being granted: Thales had standing to sue, but the judge held that VW did too, as they had a legitimate interest in being a co-claimant.

There is an old Jacob J case, Mars UK Ltd v Teknowledge Ltd [1999] EWHC 226 (Pat) (11 June 1999), [1999] 2 Costs LR 44, [1999] EWHC 226 (Pat), [2000] FSR 138, on reverse engineering, in which he held that it was not a misuse of confidential information to reverse engineer a product you had bought even to obtain information encrypted for security. The present case was argued on the basis that that case had been correctly decided, though that is in dispute, and (of course) it was the claimants' submission that it did not apply because the Scorpio Programmer software was not legitimate. The judge ended up relying on the "murky" origins of the program and the lack of effort on the part of the defendants to ascertain whether it had been produced by legitimate reverse-engineering or otherwise, and on that basis he held that there would be a breach of confidence. Should an injunction be granted to prevent publication? Not merely to save VW's blushes, said Mr Justice Birss, considering Article 10 of the European Convention, section 12(3) of the Human Rights Act, and the Cream Holdings judgment (but not American Cyanamid, which he said was clearly not the right test in the circumstances), which gave the guidance that the standard for not allowing publication is a flexible one, and that the court should be "exceedingly slow" to make interim orders if it is not satisfied that the claimant will probably succeed at trial.

Thales or VW would, he thought, probably succeed at trial, so that hurdle was cleared. Then the balance of public interest and the public interest defence fell to be considered. Freedom of expression and academic freedom were very important, but the epidemic of car crime that would be unleashed if the algorithm were published was more important. The software is sold by someone who understands that it can facilitate crime: there's a disclaimer that says (sic)

All devices and software developed by Scorpio-LK Ltd. are designed and sold with legal purpose to enchance and help people working in the sphere of car repairs and maintenance. The company doesn't take responsibility for any misuse of our products for illegal purpuses. Hence persons misusing our products for illegal purpuses bear their own responsebility for such acts.

And elsewhere:

Scorpio-lk Ltd accepts no responsibility for misuse of software for illegal purposes. The purchased softawre can only be used to repair vehicle immobilisers. On purchase of software client accepts responsibility for software use rendering Scorpio-lk Ltd unaccountable for illegal use.

The English, incidentally, seems no more broken than that of many native speakers. But the judge concluded that the claimants would probably be able to show that the software was not legitimate, and the defendants should have appreciated that.

The judge granted the injunction sought by VW, requiring "redaction" (the trendy alternative to "editing") of the paper they had written. They could still impress their peers by showing that they had derived the algorithm, and the claimants could remedy the problem identified with it: win win. The judge clearly came to the view that the defendants' protestations about "reasonable disclosure"  were nothing more than self-justification, and not the actions of responsible academics - a harsh view, but consistent with their reluctance to take even a few simple steps to ascertain where Scorpio-Lk Ltd had found the algorithm.