Security flaws in millions of Volkswagen cars stopped from being revealed after UK injunction

LONDON — A British university is delaying the release of an academic paper on how the anti-theft systems of millions of Volkswagen vehicles are at risk of being hacked after the German carmaker took legal action against it.

In a statement, the University of Birmingham said it would "defer publication" of the paper — which explains how researchers were able to subvert Volkswagen's security system — after an interim injunction issued by England's High Court. It said it was "disappointed with the judgment which did not uphold the defense of academic freedom and public interest, but respects the decision."

The university did not elaborate on how long the paper would be held, saying it was still getting legal advice.

The paper — which a group of academics including Birmingham's Flavio Garcia had planned to publish next month — revealed three ways to bypass a brand of computer chip used by several auto manufacturers to fight vehicle theft.

Often referred to as immobilizers, such chips use a secret algorithm to ensure that a car can only be started with the right key, and they've been a mandatory in all new vehicles sold in Britain over the past 15 years.

Crucially, the researchers planned to reveal how they were able to reverse-engineer the algorithm — and publish a copy of it in their paper.

Volkswagen said that publishing the formula would be "highly damaging" and "facilitate theft of cars," according to a ruling handed down last month by High Court Justice Colin Birss. The judge said that millions of Volkswagen vehicles were issued with the chip, including high-end cars such as Porsches, Audis, Bentleys, and Lamborghinis.

The researchers countered that Volkswagen's claim that the paper would be a boon to car thieves was overblown, that they had warned the chip's manufacturer about the vulnerability six months ago, and that a gag order would interfere with their legitimate academic work.

Birss said he sympathized with the researchers' rights, but that he had to weigh them against public safety.

"I recognize the high value of academic free speech, but there is another high value, the security of millions of Volkswagen cars," he said.

It's not yet clear if the case will go to trial. The University of Birmingham declined further comment Tuesday. Volkswagen also declined comment, citing ongoing proceedings.