Arnhem in preliminary relief proceedings dated 18 July 2008 in the action between NXP B.V. and Stichting Katholieke Universiteit trading under the name of Radboud Universiteit Nijmegen (LJN: BD 7578)
The Case
NXP B.V. is marketing the Mifare Classic Chip since 1995. This chip is frequently used worldwide for, amongst other things, access systems in businesses and for access and payment systems in public transport. The best-known applications of this chip are the OV-Chip Card in the Netherlands and the Oyster card in London public transport.
The Mifare Classic Chip can communicate by means of radio signals with readers which are installed in fixed places, for instance in entrance gates in metro stations. In order to secure this communication and to prevent abuse, the information exchange between the reader and the chip takes place via encryption, using the secret CRYTP01 encryption algorithm.
Researchers of the Digital Security researching group of the Institute for Computing and Information Sciences of Radboud University Nijmegen have investigated the functioning of the Mifare Classic Chip and have found a security leak. They want to publish this investigation and the results thereof, including the secret algorithm, in a scientific article. NXP has initiated preliminary relief proceedings in order to prevent this publication.
Claims and Adjudication
In order to prevent publication NXP first and foremost took the position that the algorithm is a copyright-protected work because during its development own and original choices were made. Publication of the article would infringe NXP’s copyright. The Court in preliminary relief proceedings ruled that it is possible that own and subjective choices were made during the design of the algorithm, as a result of which copyright protection could be possible, but that without further furnishing of evidence this cannot be assumed in preliminary relief proceedings.
In addition to this, NXP relied on the protection of documents in case the Court would rule that the algorithm would be insufficiently original. The Court in preliminary relief proceedings rejected this reliance too. It appears from established case law that in order to be able to rely on the protection of documents, the object must have been made available to the public. Since the algorithm is secret, there is no question of making it available to the public.
The third shot fired by NXP is the argument that the publication is unlawful. According to NXP, with the help of this publication third parties with a relevant basic knowledge may abuse the security system, which could cause considerable damage to NXP and to society. According to NXP, this constitutes an urgent social necessity as a result of which the right to freedom of speech of the University may be restricted pursuant to Article 10 paragraph 2 of the ECHR. The Court is of the opinion that the nature and the scope of the security risks that may arise as a result of the publication of the article have not been convincingly proven by NXP. In addition thereto, the publication has a direct social interest, namely the interest that society is quickly informed of the fact that the chip has a defect. The Court in preliminary relief proceedings has therefore rejected the claim.
Conclusion
The most interesting part of this case is that the Court in preliminary relief proceedings was of the opinion that a mathematical algorithm in itself could be a work protected by copyright. In addition thereto, this judgment illustrates that a company that produces a product with a possible defect must have what it takes to prevent a scientific publication about this product, even if the company argues that the publication may incite others to hack.
