Steven Murdoch

Background

Steven J. Murdoch is a British computer scientist specializing in security engineering, privacy-enhancing technologies, and anonymous communication systems. He completed his PhD at the University of Cambridge's Computer Laboratory in 2008, supervised by Markus Kuhn, with a dissertation on covert channel vulnerabilities in anonymity systems. His doctoral work was recognized with the 2008 ERCIM Security and Trust Management Working Group Award. He went on to hold a Royal Society University Research Fellowship starting in 2012 and became a bye-fellow of Christ's College, Cambridge, before later joining University College London (UCL), where he is a Professor of Security Engineering in the Department of Computer Science and leads work within its Information Security Research Group.

Tor Project and Anonymous Communication Research

Murdoch has been a long-standing member of and contributor to the Tor Project, the organization behind the Tor anonymity network and Tor Browser. His research in this area has focused on traffic analysis attacks against anonymity systems, the usability and latency trade-offs of mix networks, and techniques for resisting internet censorship. This work situates him among the academic researchers whose findings have directly influenced the design and hardening of widely deployed privacy tools used by journalists, activists, and ordinary users seeking to resist surveillance.

Exposing Chip and PIN / EMV Vulnerabilities

Murdoch became widely known outside academic circles for research conducted with colleagues at the University of Cambridge's Security Group — including Saar Drimer, Ross Anderson, and Mike Bond — into the EMV protocol underlying the UK's "Chip and PIN" bank card payment system. In 2010, the team published a paper, popularly summarized as "Chip and PIN is Broken," presented at the IEEE Symposium on Security and Privacy, describing what became known as the "no-PIN" or "wedge" attack. The attack used a small electronic device inserted between a stolen chip card and a payment terminal to intercept and falsify the PIN verification step, tricking the terminal into believing the correct PIN had been entered even though it had not. Critically, the resulting transaction record would falsely show that PIN verification had succeeded, a fact that had previously been used by banks to deny reimbursement to fraud victims on the assumption that a successfully PIN-verified transaction proved cardholder negligence. The research was first shared privately with the banking industry in late 2009 before formal academic publication and drew significant media coverage, including from the BBC's Newsnight program.

Further Banking Security Research

In related work, Murdoch, Drimer, and Anderson also examined the security of Chip Authentication Program (CAP) card readers used for UK online banking authentication, publishing findings in a paper titled "Optimised to Fail: Card Readers for Online Banking." That research identified design weaknesses in CAP readers and cards, including scenarios where zero-value "test" transactions could be manipulated by fraudsters to extract valid authentication codes from unsuspecting victims. The findings contributed to subsequent security improvements in later generations of CAP devices.

Legal and Public-Interest Work

Beyond academic publication, Murdoch has applied his technical expertise in legal contexts, serving as an expert witness in UK court cases involving disputed banking fraud claims and the reliability of electronic evidence. He has also been recognized as an expert commentator on the Post Office Horizon scandal, in which flawed accounting software was used to wrongfully prosecute subpostmasters, drawing on his background in evaluating the trustworthiness of computer-generated evidence. He has served on the board of the Open Rights Group, a UK digital rights organization, since March 2022, and has held program and general chair roles for security conferences including the Privacy Enhancing Technologies Symposium (PETS) and Financial Cryptography and Data Security.

Significance and Legacy

Murdoch's career illustrates how academic cryptographic and security research can have immediate consumer-protection consequences: his Chip and PIN findings undercut a widely used justification banks had relied on to reject fraud disputes, and his broader body of work connects theoretical anonymity research to the practical privacy tools relied on by millions of Tor users worldwide. He remains an active figure in both the academic security research community and public discourse on digital evidence, banking fraud, and privacy technology in the UK.

Timeline

• 2008Completed PhD at the University of Cambridge Computer Laboratory on covert channel vulnerabilities in anonymity systems; received the ERCIM Security and Trust Management Working Group Award for the thesis.
• 2009-12Cambridge researchers privately disclosed the EMV 'no-PIN' Chip and PIN vulnerability to the UK banking industry.
• 2010Co-authored and presented 'Chip and PIN is Broken' at the IEEE Symposium on Security and Privacy, detailing the no-PIN wedge attack on EMV bank cards.
• 2012Awarded a Royal Society University Research Fellowship.
• 2011Served as General Chair for the Financial Cryptography and Data Security conference.
• 2022-03Joined the board of the Open Rights Group.