Volkswagen Aktiengesellschaft v Garcia & Ors

For an interim injunction restraining publication which engages freedom of expression, Human Rights Act 1998, section 12(3) requires prospects of success sufficiently favourable to justify relief in the particular circumstances. The court must adopt a flexible approach, but should be exceedingly slow to restrain publication unless the claimant will probably succeed at trial, subject to exceptional circumstances such as grave consequences of disclosure.

A claim for misuse of confidential information may arise where information has been obtained from a source whose legitimacy is obviously doubtful and the recipient recklessly fails to investigate. Academic freedom and responsible disclosure remain important considerations, but they may be outweighed by the risk that publication will facilitate serious crime and by the need to allow affected parties a reasonable opportunity to respond.

Volkswagen sought an interim injunction preventing academics from publishing an unedited paper concerning the Megamos Crypto vehicle immobiliser. The paper disclosed the algorithm and described an attack exploiting weaknesses in it. The defendants resisted publication restraints, relying on academic freedom, freedom of expression, responsible disclosure and the alleged legitimacy of the software from which they had derived the algorithm.

The application raised issues concerning Volkswagen’s legitimate interest in suing, the quality and acquisition of confidential information, the public interest in disclosure of security weaknesses, and the statutory threshold for interim relief where Article 10 rights were engaged.

1. Interim relief granted. The court granted an injunction requiring redaction of the algorithm and the attack based on its intrinsic weaknesses, subject to resolving any disagreement about the precise redactions.
2. There are three elements in a claim for misuse of confidential information: the information must have the necessary quality of confidence; it must have been imparted in circumstances importing an obligation of confidence; and there must be unauthorised use, as stated in Coco v Clark [1969] RPC 41.
3. The court proceeded on the accepted basis that reverse engineering a product purchased by the defendant, including encrypted security information, is not itself misuse of confidential information, as held in Mars v. Teknowledge [2000] FSR 138. The issue was whether the defendants had obtained the information from an obviously illegitimate source and ought to have appreciated that their conscience was affected.
4. Volkswagen had a legitimate interest in being a co-claimant because its products depended on the secrecy of the algorithm and publication would cause it substantial damage. The origin of the software was plainly murky. The defendants were on notice of that fact and had made no enquiries. Their attitude was reckless, and the claimants were probable to succeed in showing that the information had been obtained illegitimately and that the defendants ought to have appreciated this.
5. Article 10 was engaged and section 12(3) of the Human Rights Act 1998 applied. Following Cream Holdings v. Banerjee [2004] UKHL 44, the American Cyanamid test was inappropriate. The required likelihood of success is flexible, but the court should generally require the claimant probably to succeed at trial. The merits here were sufficiently strong to justify interference with academic freedom and freedom of expression.
6. The balance of interests favoured restraint. Publication would facilitate car theft on a large scale. The defendants’ conduct after Volkswagen raised its concerns was inconsistent with responsible disclosure, since publication was pursued immediately rather than being delayed for a reasonable period.