Table of Contents

Project Overview Introduction I. Legislative Models A. The Tension Between Technological Neutrality and Legal Specificity B. A Typology of Electronic Authentication Legislation The "Prescriptive" Approach The "Two-Tier" Approach The "Minimalist" Approach II. Effects & Presumptions A. Legal Effect B. Legal Presumptions III. Licensing and Accreditation of Certificate Authorities IV. Liability A. Background B. National Approaches

V. Closed Systems / Party Autonomy A. The Growing Significance of Closed Systems B. Factors that Affect Closed Systems Licensing Permitting Contractual Departures from Prescribed Standards Giving Effect to Electronic Signatures in Closed Systems Accommodating Non-Identity, or "Authority," Certificates VI. Cross-Border Recognition VII. International Initiatives 1. European Union Draft Directive 2. UNCITRAL 3. Proposed International Convention 4. Organization for Economic Cooperation and Development 5. Other International Organizations Footnotes

The Internet Law & Policy Forum commissioned Steptoe & Johnson LLP to survey current legislative and regulatory efforts outside of the United States concerning digital and electronic signatures.^[1] This report provides a comparison and analysis of electronic authentication initiatives in jurisdictions outside of the United States, including international efforts at the United Nations Commission on International Trade Law (UNCITRAL), the Organization for Economic Cooperation and Development (OECD), and the European Union (EU).

This report complements, and in many respects builds on, the ILPF Survey of Electronic and Digital Signature Legislative Initiatives in the United States (the "ILPF US Survey"). The report assumes familiarity with digital signatures and electronic authentication generally; readers desiring more background should refer to the Background and Authentication Models sections of the ILPF U.S. Survey. For ease of reference, this report summarizes the legislative initiatives described herein in the same table format as the ILPF U.S. Survey.

ILPF and the authors seek public comment on this report, and welcome additional information and corrections concerning the initiatives discussed in this report. We particularly encourage readers to submit information about new legislative and regulatory initiatives that are not discussed in this report, as we intend to update the report on a regular basis. Any comments should be sent to the ILPF, intsurvey@ilpf.org. and to the authors of this report, Stewart Baker and Matthew Yeo.

Perhaps the most significant observation about legislative initiatives outside of the United States is how few of them there have been to date. This report identifies only six countries that have enacted legislation specifically relating to electronic authentication: Argentina, Germany, Italy, Malaysia, Russia, and Singapore.^[2] By contrast, according to the ILPF US Survey, 36 states have introduced or are considering legislation concerning electronic signatures, with 26 states having enacted some type of legislation. In fact, a number of other U.S. states have since passed legislation relating to electronic authentication, so these numbers are now higher.

As in the United States, however, there have been a large number of official studies and proposed legislative initiatives that have not yet come to fruition. Australia, Austria, Belgium, Colombia, Denmark, Hong Kong SAR, South Korea, and the United Kingdom are in the process of reviewing and adopting proposed legislation. Canada, Finland, France, Ireland, Japan, the Netherlands, and New Zealand have published reports, consultative papers or policy statements on electronic authentication issues, and other countries are in the process of preparing similar reports.^[3]

It is difficult to compare national approaches to electronic authentication legislation because so few countries have conceived of the purpose of such legislation in quite the same way. Some countries, like Germany and Japan, have, to date, focused only on the technical standards for the operation of a Public Key Infrastructure ("PKI"). Others, like Singapore and Malaysia, have spanned the entire range of issues associated with the legal effect of electronic signatures, the legal framework for the operation of a PKI, and the establishment of a regulatory apparatus to oversee Certificate Authorities ("CAs"). Indeed, one of the themes of this survey is that countries do not always agree on the required scope of electronic authentication legislation.

As discussed later in this report, several international initiatives are underway to harmonize national approaches to electronic authentication. These initiatives include the draft EU Directive on electronic authentication, the work of the UNCITRAL Experts Group in preparing Uniform Rules on electronic authentication, and a proposed international convention on electronic authentication. Thus, it appears increasingly likely that many of the issues discussed in this report will be addressed at the international level, perhaps even before they are taken up by national legislators.

A. The Tension Between Technological Neutrality and Legal Specificity

Any legislative approach to electronic authentication must accommodate the inherent tension between the goal of technological neutrality and the goal of prescribing specific legal consequences for the use of electronic authentication systems. To the extent that legislation seeks to enable the use of diverse electronic authentication techniques, including some that are not yet even conceived, it becomes progressively more difficult to accord specific and meaningful legal consequences to their use. The reason for this inverse relationship is fairly straightforward - legislators' confidence in the security and reliability of known electronic authentication mechanisms allows them to grant greater legal benefits and presumptions to the use of those techniques. They may be less willing to grant the same level of legal benefits to as yet unknown techniques or to technologies that bear no imprimatur beyond recognition and acceptance in the marketplace.

This conundrum is the inevitable consequence of legislating against a backdrop of rapid technological change. As recently as 1995, when legislative initiatives began to emerge in the United States, the use of asymmetric, or "public key," cryptography as a means of creating "digital signatures" was widely perceived as the nearly-universal foundation for all electronic authentication. Indeed, it is safe to say that this perception continued well into 1997, both in the United States and abroad, and remains influential today. More recently, however, there has been growing recognition that other means of electronic authentication, including biometrics and dynamic signature analysis, will take on equal or greater importance in the years ahead.^[4] In fact, some of these techniques - and particularly those that are based on biometric features - may prove to be more reliable and less susceptible to compromise than digital signatures.

In all likelihood, no single technology will prevail as the sole means of electronic authentication. Different technologies will likely be used in different settings and for different purposes. This diversity of authentication techniques, while generally promoting the expansion of electronic commerce, nonetheless poses a significant challenge for legislators, because not all technologies necessarily require the same legal infrastructure or may be accorded the same presumption of security and integrity. Many believe that the widespread use of digital signatures, for example, requires a legally established "trust infrastructure," or PKI, that defines the rights and obligations of the parties to an authenticated transaction, including the potential liability of CAs to third parties. Other technologies, such as voice authentication, may not require the same type of legally-defined trust infrastructure, although it is very hard to predict how any of these technologies will be used in widespread commercial practice and what their specific legal requirements will be.^[5]

For those legislators and policymakers who believe that the continued expansion of electronic commerce requires a known and reliable authentication mechanism with established legal consequences, the preference is usually to enact legislation that specifically addresses the use of digital signatures, and to save the issues raised by other authentication techniques for another day. At the same time, legislators and policymakers naturally fear that any attempt to codify a known authentication mechanism - namely, digital signatures - runs the risk of stunting the development of other authentication mechanisms, or at least of giving undue benefits to a technology that is itself only in the earliest stages of commercial use. Apart from these concerns and the general desire to avoid the rapid obsolescence of new legislation, there is also a concern among national legislators and policymakers that premature endorsement of a particular technology will set the country outside of the mainstream of technological and legislative developments internationally.^[6] For these reasons, "technological neutrality" in electronic authentication legislation has become an increasingly prevalent objective.

B. A Typology of Electronic Authentication Legislation

The manner in which legislators and policymakers have sought to accommodate the conflicting concerns described above largely defines the typology of existing and proposed electronic authentication legislation. While this typology encompasses many of the issues discussed in more detail below - the legal effect of electronic signatures, licensing provisions, liability issues, etc. - it is nonetheless helpful to have a sense of the general approaches that national legislatures have taken.

1. The "Prescriptive" Approach

To date, the most common approach has been to ignore authentication mechanisms other than those based on digital signatures, and to adopt what the ILPF Survey of U.S. legislation refers to as the "prescriptive" approach. Argentina, Germany, Italy, and Malaysia have all enacted legislation that pertains solely to the use of digital signatures within a PKI, and the "Guidelines" issued by Japan's Electronic Commerce Promotion Council (ECOM) are similarly limited to digital signatures.^[7] Significantly, these legislative initiatives are among the oldest ("old" being a relative term, relating mostly to developments prior to early 1998), and, with the exception of Singapore, are also the only countries that have enacted legislation. More recent initiatives, whether in the form of proposed legislation or reports by national experts groups, have increasingly focused on the need to accommodate emerging and even unforeseen technologies.^[8]

2. The "Two-Tier" Approach

The second approach is what might be called the "two-tier" approach to electronic authentication legislation, referred to as the "hybrid" approach in the ILPF Survey of U.S. legislation. At the first level, the legislation accepts all or most electronic authentication mechanisms on a technologically-neutral basis, and grants these mechanisms a basic set of legal benefits. For example, technologies that are accepted at the first level might satisfy writing and form requirements, but would not be entitled to any presumptions concerning the signer's identity or intent. At the second level, the legislation creates a class of approved technologies whose use is invested with a broader array of legal benefits and obligations. The legislation may define these technologies - sometimes referred to as "secure" or "qualified" technologies - by reference to general criteria, by reference to the specific techniques of asymmetric cryptography, or by reference to a schedule of technologies approved by statute or regulation. Documents that are authenticated by one of these methods are typically entitled to a more robust set of legal entitlements, for example, a presumption concerning the identity of the signer and the integrity of the document's contents. At this second level, the legislation may also seek to address issues that are specifically associated with the operation of a PKI, such as the operational requirements and liabilities of CAs.

The virtues of the "two-tier" approach are fairly self-evident. It achieves the goal of technological neutrality by granting a minimum level of legal recognition to all or most authentication techniques, mostly with regard to satisfying form and writing requirements. At the same time, it affords greater legal certainty and benefits to those authentication mechanisms whose security and reliability permit greater confidence in their use. This approach also recognizes that some authentication mechanisms, and particularly those that are used in open systems, require a better-defined legal environment (for example, because of the third-party liability issues associated with the use of digital certificates), while not depriving legal recognition to those authentication mechanisms that do not require a significant external legal framework (for example, because the parties establish the terms of their use by contract - so-called "closed" systems).

Singapore's Electronic Transactions Bill, enacted in June 1998, is a good illustration of the two-tier approach. The ETB draws a basic distinction between electronic records and signatures, on the one hand, and secure electronic records and signatures on the other. An "electronic signature" is any set of letters, numbers, or other symbols in digital form attached to, or logically associated with, an electronic record, and executed or adopted with the intention of authenticating or approving the electronic record. An electronic signature satisfies the requirement of a signature (with limited exceptions relating to wills, conveyances, and similar documents), and may be proved "in any manner." A "secure electronic signature," by contrast, is either a digital signature that comports with the ETB's digital signature standards or a "commercially reasonable security procedure agreed to by the parties." A secure electronic signature must be (1) unique to the person using it; (2) capable of identifying the person; (3) created through a means that is under the sole control of the person using it; and (4) linked to the electronic record in such a way as to confirm the integrity of the document. Documents that are authenticated by a secure electronic signature are entitled to a presumption of integrity, a presumption that the signature is that of the person with whom it is associated, and a presumption that the user affixed the signature with the intent of signing or approving the document. The ETB treats digital signatures as a type of secure electronic signature, and establishes a comprehensive regime for their use and regulation.

The draft EU Directive also illustrates the two-tier approach, although in a somewhat different manner.^[9] The essential distinction drawn in the draft Directive is between "electronic signatures" and "qualified certificates." An electronic signature is one that satisfies the four criteria described above with respect to the Singapore ETB (uniqueness, identity, security, and integrity). The Directive would prohibit Member States from denying legal effect to an electronic signature solely on the grounds that it is in electronic form. A "qualified certificate," by contrast, is a "digital attestation which links a signature verification device to a person, confirms the identity of that person," and that satisfies the technical requirements specified in Annex I of the Directive (mostly pertaining to the contents of a qualified certificate). Member States would be obligated to ensure that electronic signatures based on qualified certificates satisfy the legal requirement of a hand-written signature and are admissible as evidence in legal proceedings in the same manner as hand-written signatures, but only if the electronic signature was generated using a "secure signature creation device" (as defined in Annex III of the Directive).

At the international level, the UNCITRAL Working Group on Electronic Commerce has also adopted the two-tier approach in the most recent draft of the Uniform Rules on Electronic Signatures. The draft Uniform Rules distinguish between "electronic signatures," which are those that satisfy the relatively broad requirements of Article 7 of the UNCITRAL Model Law on Electronic Commerce, and a narrower category of signatures (provisionally called "enhanced" electronic signatures) that satisfy a higher standard or that are executed according to the terms of an agreement between the parties.^[10] Electronic signatures would satisfy any requirement for a signature "if the electronic signature is as reliable as appropriate for the purpose for which the electronic signature was used, in light of all the circumstances, including any relevant agreement." "Enhanced" electronic signatures, on the other hand, would be entitled to a presumption that the data message was signed, a presumption that it was signed by the person associated with the signature, and a presumption that the data message was unaltered.

3. The "Minimalist" Approach

Interestingly, several of the most recent national initiatives relating to electronic authentication have decided to forego any effort to legislate detailed standards for the use of different authentication techniques, and have taken a purely minimalist approach to granting legal recognition to electronic signatures. The March 1998 report of the Australian Electronic Commerce Expert Group, entitled Electronic Commerce: Building the Legal Framework, surveys a wide range of national and international approaches to electronic authentication legislation, and concludes that:

... [T]he enactment of legislation which creates a detailed legislative regime for electronic signatures needs to be considered with caution. There is a risk, particularly given the lack of any internationally uniform legislative approach, that an inappropriate legislative regime may be adopted without regard to market-oriented solutions. Given the pace of technological development and change in this area, it is more appropriate for the market to determine issues other than legal effect, such as the levels of security and reliability required for electronic signatures. Accordingly, we have recommended that legislation should deal simply with the legal effect of electronic signatures.

The report further concludes that adoption of Article 7 of the UNCITRAL Model Law on Electronic Commerce, which creates broad standards for the recognition of an electronic signature, is the only legislative initiative required to create a framework for the use of different electronic authentication techniques. In this manner, the report specifically rejects the proposition that the widespread use of digital signatures and other electronic authentication methods requires a legal framework that allocates the rights, duties, and liabilities of the different parties to a secure electronic transaction.^[11]

The recommendation of the Australian Electronic Commerce Expert Group was adopted in the draft Electronic Transactions Bill released by the Attorney General in January 1999. Article 10 of the draft Bill would give broad effect to electronic signatures where the method used to create the signature "was as reliable as was appropriate for the purposes for which the information was communicated."

A. Legal Effect

The most elemental objective of any electronic authentication legislation is to ensure that electronic signatures are accorded appropriate legal recognition. Virtually every jurisdiction has laws that require that certain types of documents be "signed," or "in writing," or any one of countless other formulations that could be construed to require a physical document or hand-written signature. A report by the Canadian Department of Justice, for example, observed that the word "writing" appears 1,600 times in Canadian statutes, and other national surveys have produced similar results.

In attempting to resolve the issues surrounding the legal effect of electronic signatures and authenticated electronic documents, many countries have been influenced by Article 7 of the UNCITRAL Model Law on Electronic Commerce. Article 7 states that the requirements of a signature are satisfied with respect to a data message if (1) the method is used to identify the signer and to indicate that person's approval of the information contained in the message; and (2) the method is as reliable as was appropriate for the purpose for which the message was generated or communicated, in light of all the circumstances, including any relevant agreement between the parties. The means by which a particular jurisdiction will implement this standard, however, is likely to vary considerably according to the nature of its existing legal framework.

At least in common law jurisdictions, there is nothing about an "electronic signature" that is significantly different from a signature conveyed by a telegram, a telex, a facsimile, or by any of the other means that have been generally accepted in commercial practice and that are ordinarily accepted by most common law courts.^[12] Nonetheless, whether as a result of specific evidentiary problems or out of a general concern that courts will be reluctant to accept electronic signatures, several jurisdictions have chosen to clarify the legal validity of electronic signatures. Providing such clarification is also seen as an important reassurance to parties that might otherwise be reluctant to use electronic signatures in commercial transactions. As noted above, Australia and its constituent states intend to adopt some variant of Article 7 of the UNCITRAL Model Law, and New Zealand is also likely to base its legislation on Article 7.

The situation in civil law jurisdictions tends to be somewhat more complex, given the civil law's generally more prescriptive approach to methods of proof and authentication. A recent report by the French Conseil d'Etat reviewed the various circumstances under the Code Civil where a hand-written signature or original document is required, as well as the hierarchy of evidence that the law requires for proving the validity of a signature (ranging, depending upon the circumstances, from a notarized signature all the way down to a faxed or photocopied signature). The report concludes that the Code Civil does not readily accommodate electronic signatures, and must therefore be amended to recognize, under most circumstances, the functional equivalence of certain "trustworthy" (fiable) electronic signatures.^[13] Italy has already taken this step by establishing that digital signatures and electronic documents authenticated by a digital signature satisfy any form requirements and are accorded the same evidential weight as hand-written documents and signatures. In contrast to the French proposal, however, the Italian legislation only extends this benefit to digital signatures that are authenticated by licensed CAs.

Under the proposed EU Directive, Member States will be obligated to "ensure that an electronic signature is not denied legal effect, validity and enforceability solely on the grounds that the signature is in electronic form...." Significantly, however, the EU Directive adopts a relatively high standard for which "electronic signatures" benefit from this requirement of non-discrimination. The proposed Directive requires that an electronic signature (1) is uniquely linked to the signatory; (2) is capable of identifying the signatory; (3) is created using means that the signatory can maintain under his sole control; and (4) is linked to the data to which it relates in such a manner that any subsequent alteration of the data is revealed. This is a significantly more prescriptive and stringent standard than Article 7 of the UNCITRAL Model Law, and, at least at present, would appear to require the use of digital signature technology. Thus, the draft EU Directive will allow Member States to set a fairly high threshold for the types of electronic signatures that are not to be discriminated against because of their electronic form.

B. Legal Presumptions

All of the provisions described above are generally intended to ensure that national laws do not discriminate against or otherwise discourage the use of electronic signatures. As discussed above, several jurisdictions have gone a step further and attached certain legal presumptions to the use of electronic signatures, such as a presumption of identity or intent to sign. Several jurisdictions also permit the use of electronic signatures in situations where the law would ordinarily require some enhanced form of authentication, such as a sworn, certified, or sealed document. The willingness of national legislatures to extend these benefits to digital signatures - or at least those that are implemented according to prescribed standards - reflects the extent to which digital signature technology is not only a reliable substitute for a hand-written signature, but is actually more reliable than a hand-written signature for many purposes.

The extent to which different jurisdictions have adopted or proposed these measures varies. As noted above, the proposed EU Directive provides that a "qualified certificate" - i.e., one that is issued by a CA that satisfies the requirements of Annex II - must be recognized by the Member States as satisfying the legal requirements of a hand-written signature, and must be admissible in legal proceedings in the same manner as hand-written signatures, so long as it was generated using a "secure signature creation device." The standards for a "secure signature creation device," as set forth in Annex III of the Directive, are very much in flux as of this writing. The standards that have been proposed would impose fairly broad requirements on signature creation devices, such as ensuring that the secrecy of a private key is "reasonably assured," and that it can be "reliably protected" by the legitimate holder. However, some Member States have sought to impose more stringent technical requirements on "secure signature creation devices," which might, for example, effectively require that all private keys be stored on smart cards. It is not clear, at this time, how this debate will be resolved.^[14]

At first glance, the EU provision would appear to require the Member States to accept electronic signatures that satisfy the Annex II and Annex III criteria (whatever they turn out to be) in any situation where a hand-written signature is required by national law, including conveyances of real property, the formation of wills, and other such documents. Given that most Member States will want to retain at least some of these traditional signature requirements, the presumption accorded to qualified certificates appears exceptionally broad. At the same time, Article 1 of the Directive states that the Directive does not address "the conclusion and validity of contracts and other non-contractual formalities requiring signatures." This appears to be a significant exception to the requirement of granting legal equivalence to qualified certificates, and one that would permit Member States to retain many traditional writing requirements. Thus, it is unclear how these two provisions will interrelate.

Under the Singapore Electronic Transactions Bill, documents that are signed by a secure electronic signature are entitled to a presumption of integrity, a presumption that the signature is that of the person with whom it is associated, and a presumption that the user affixed the signature with the intent of signing or approving the document. Significantly, the ETB does not limit these presumptions to electronic signatures that are confirmed by licensed CAs; the presumption also applies to any "commercially reasonable security procedure agreed to by the parties" and that satisfies the general criteria for uniqueness, identity, security, and integrity.

The Malaysian legislation provides that a digital signature confirmed by a licensed CA is entitled to a presumption that the signature belongs to the listed subscriber and that it was affixed with the intention of signing the message.

Some jurisdictions have concluded that electronic signatures, even ones that satisfy heightened standards of security and reliability, should not benefit from any special presumptions or powers. As the recent Australian report concluded, these sorts of presumptions "may involve incorrect guesses about efficient and fair business practices across a range of commercial contexts and may have serious unintended consequences.... The law should not seek to place addressees of electronically signed data messages in a better position that addressees of manually signed paper-based messages. Accordingly, at this stage legislated attribution rules should not go beyond restating the common law."

Somewhat surprisingly, whether or not a particular country "requires" licensing of CAs is not always clear. Article 4(3) of the Malaysian legislation, for example, appears to require any certificate authority confirming the validity of a digital signature in Malaysia to be licensed by the Controller of Certificate Authorities, on pain of criminal prosecution. At the same time, Article 13 provides that a digital signature will not be denied legal effect simply because it was confirmed by an unlicensed CA. The paradoxical result is that the legislation would apparently accept the legal validity of a digital signature confirmed by an unlicensed CA, but then subject that CA to criminal prosecution. Thus, it is simply not clear whether Malaysia's licensing scheme is truly "mandatory."

The Italian legislation, as well as the recently-published draft implementing regulations, establishes a mandatory licensing scheme for all CAs, although this result is evident more by implication than by express provision. CAs are obligated to register with the Italian Authority for Information Technology in Public Administration (AIPA), and must comply with extremely specific (and generally quite stringent) financial and technical standards. For example, CAs must have a registered share capital of approximately U.S. $7.5 million, and must satisfy character and fitness requirements similar to those imposed on bank personnel.

Germany's licensing system is at least nominally voluntary, in that it permits "the application of [unlicensed] digital signature procedures ... insofar as digital signatures ... are not legally required under the [digital signature] law." At the same time, the law and the associated draft technical regulations clearly contemplate that all CAs will be licensed by the national "root" CA, and at least one commentator has observed that the stated intent of German officials is to create a de facto mandatory licensing regime.^[15]

The Singapore Electronic Transactions Bill, while not requiring CAs to be licensed, imposes a number of requirements on CAs without regard to whether they are licensed. For example, all CAs, licensed or unlicensed, must either issue a Certification Practice Statement or abide by the statutorily-prescribed requirements for issuing a digital certificate. Additionally, all CAs must comply with statutory standards for disclosing material information about a certificate and the procedures for revoking or suspending a certificate. As noted above, Singapore provides certain presumptions of attribution and intent both to licensed CAs and to others who satisfy the prescribed criteria, but only permits licensed CAs to state liability limitations in their certificates.

Significantly, the EU draft Directive prohibits Member States from requiring licensing of CAs. (This provision, if adopted, will likely have a significant effect on the Italian and, to a lesser extent, the German regulatory schemes.) At the same time, the Directive allows Member States to adopt voluntary licensing schemes, provide that those schemes are "objective, transparent, proportionate, and non-discriminatory."

Interestingly, the two benefits that accrue to "qualified certificates" under the Directive - legal equivalence to a hand-written signature and the right of the issuing CA to limit its liability - do not turn, and in fact may not turn, on whether the CA is licensed or accredited. The sole requirements are that the CA satisfy the standards for qualified certificates in Annex I, the operational standards for CAs set forth in Annex II, and, with regard to legal recognition, the standards for "secure signature creation devices" set forth in Annex III. In practice, however, there may be very little distinction between satisfying these standards and becoming licensed or accredited. With regard to Annex III, for example, the Member States are continuing to debate how individual CAs would certify their compliance with the relevant standards. The proposals on the table range from self-certification by the CA to elaborate testing and certification mechanisms administered by national governments and/or the European Commission. Others have proposed that appropriate industry organizations would have the power to certify compliance with the Annex III standards. Similar certification issues are raised by the Annex II standards concerning the operational requirements for CAs.^[16] Depending on how these issues are resolved, a CA that wanted to assure the legal equivalence of its electronic signatures might have no practical choice but to undergo one or more testing and accreditation processes.

While the apparent assumption in many jurisdictions has been that the government will act as the licensing or accreditation authority (whether as part of a mandatory or voluntary regime), there is growing recognition that private sector organizations, or other types of standards bodies, may be better suited to this role. The Netherlands, for example, recently established a voluntary "TTP Chamber" that brings together government and commercial representatives. The TTP Chamber serves, in effect, as a standards-setting organization for the use of electronic signatures in the Netherlands, and CAs are strongly encouraged (but not required) to join. The Netherlands adopted this approach, in part, because it concluded that an organization of this nature would be better equipped to respond to rapidly changing market and technological forces.^[17]

A. Background

One of the most complicated issues surrounding the creation of a public key infrastructure is the extent to which the law should define or limit the liabilities of the three main parties to a secure electronic transaction, that is, the person who digitally signs a message, the person who receives the message and who may rely on its validity, and the CA that vouches for the identity or some other attribute of the sender. In a purely "open" transaction - that is, one in which the parties have not previously defined their respective rights and duties by contract - there are several major faultlines of liability. Most importantly, the CA may be liable to the recipient of the message for any inaccuracies or misrepresentations contained in the certificate, or for the failure of the CA to revoke an invalid certificate. To take a simple example, a person who applies for a digital certificate may misrepresent his or her identity under circumstances where the CA, with more thorough investigation, could have discovered the deceit. When a third party relies on that certificate to its detriment, to what extent is the CA liable? Given that the CA and the third party do not necessarily have a preexisting relationship in which they have had an opportunity to allocate this sort of risk, they must turn to general legal principles to define the scope of the liability. Moreover, given the high value of transactions for which digital signatures might be used, the CA's potential liability is quite steep.

It is this central feature of an open PKI that was responsible for much of the initial legislative interest in digital signatures. One of the early rationales for digital signature legislation was that, in the absence of a legislatively-imposed limitation on the CA's potential liability, this method of electronic authentication would never emerge in the marketplace, to the detriment of electronic commerce generally. More recently, however, at least one commentator has observed that if a CA cannot operate without a legislatively-imposed limitation on its liability, it is not a business that can internalize its own costs, and therefore not one that should be brought into existence by legislative fiat.^[18] Critics contend that, in effect, a legislative limitation on liability merely shifts the risk of loss to third parties who may rely on an inaccurate digital certificate.^[19]

B. National Approaches

Three jurisdictions - the EU, Malaysia, and Singapore - have addressed the potential liability of CAs. Significantly, all three jurisdictions have taken an approach that combines some variant of strict liability for certain acts or misrepresentations with a system that permits the CA to limit its liability, at least under certain circumstances.^[20] Malaysia and Singapore, for example, require CAs to specify a "recommended reliance limit" in any certificate that they issue. The recommended reliance limit then sets a cap on the CA's potential liability for losses caused by reliance on a misrepresentation in the certificate of any fact that the CA was required to confirm, or as a result of any failure to comply with the statutorily-prescribed requirements for issuing a certificate. Similarly, while the EU Directive generally imposes strict liability on a CA for losses caused by reliance on an inaccurate certificate or failure to abide by the requirements for issuing a qualified certificate, Member States are required to permit CAs to specify the permissible uses of a qualified certificate and the maximum value of any transaction for which it may be used.^[21] In effect, these schemes permit the CA to define the value of a particular certificate in the manner described above.

These jurisdictions differ on whether licensing or accreditation is a prerequisite to a limitation on liability. Singapore and Malaysia only permit licensed CAs to state liability limitations in the certificates that they issue. The EU would permit any CA that issues a "qualified certificate" to limit the permissible uses of that certificate or to specify its maximum value. As discussed above, the draft Directive would permit unlicensed CAs to issue qualified certificates, but the practical reality is that most CAs that issue qualified certificates will be licensed or accredited under voluntary schemes.

Some jurisdictions have chosen not to address the liability issues associated with an open PKI. Germany, for example, has so far avoided any effort to legislate liability provisions for the operation of a PKI, and has actively opposed the liability limitation provision of the draft EU Directive (which, if adopted, would compel Germany to allow CAs to limit their liability). Many German lawyers and policymakers believe that existing principles of liability under German law adequately address the issues raised by an open PKI, and oppose the introduction of a system that is based on strict liability and that would permit CAs to state liability limitations. The recent Australian report noted the debate surrounding liability limitation provisions, and concluded that it would be premature to address the issue until "the technology develops and market issues and failures emerge...." Neither the Italian legislation nor the recent French report addresses liability issues.

At this stage, then, it is hard to identify a strong international consensus on the liability aspects of an open PKI. Some countries apparently believe that allowing CAs to limit their liability is a prerequisite to the widespread use of electronic authentication, while others believe that such a limitation is either unnecessary or premature. This lack of consensus may prove to be a significant obstacle to the formulation of international standards on electronic authentication, whether by means of the UNCITRAL Uniform Rules or an international convention.

A. The Growing Significance of Closed Systems

When digital signature technology first began to emerge, it was widely assumed that its principal use would be in "open" transactions, i.e., transactions in which the parties have not agreed in advance on their respective rights and duties in using that technology. Indeed, as discussed above, one of the principal motivations for digital signature legislation has been to define the rights, duties, and potential liabilities of the three central parties to a secure electronic transaction: the person who sends an authenticated message, the person who receives the authenticated message, and the CA that confirms the validity of that message.

More recently, however, it has become evident that many, if not most, applications of digital signature technology will be in "closed" environments, i.e., situations in which all of the relevant parties have agreed in advance on their respective rights and duties, and allocated any potential risks. For example, a company can issue digital signatures to all of its employees for purely internal use, with the company acting as its own CA and setting its own rules. More significantly, digital signatures can also form the basis for a secure electronic payment system, including the Secure Electronic Transaction (SET) specification developed by Visa, Mastercard, and other members of the payment card industry. In SET, each of the parties to a secure electronic transaction - the cardholder, the merchant, and the member banks that process the transaction - has a digital signature that establishes its identity and authority within the system. As in an ordinary payment card system, the parties' rights and duties are established by a series of contracts.

Because the parties to a closed transaction have already defined the terms and conditions for using digital signatures amongst themselves, there is a significantly reduced need for legislative intervention. Liability, for example, can be agreed upon by the parties in advance. Indeed, the greatest risk faced by users of closed systems is that legislation will fail to recognize the terms of their private agreements, or impose unnecessary regulatory burdens and costs on their use of digital signatures. Given that the use of electronic signatures within closed systems is likely to predominate over the use of electronic signatures in "open" transactions, it is extremely important that legislation not inhibit the continued development of closed systems.

B. Factors that Affect Closed Systems

1. Licensing

The extent to which electronic authentication legislation recognizes and accommodates closed systems is a function of several different factors. For example, legislation that requires licensing of all CAs or that establishes other types of requirements for unlicensed CAs is likely to impose a significant burden on closed systems, because it may require the CA to become licensed in multiple jurisdictions or to abide by standards that are different from those to which the parties have agreed. As discussed above, while only Italy has apparently imposed a licensing requirement for all CAs, several jurisdictions have adopted legislation that creates a de facto mandatory licensing regime or that imposes standards on unlicensed CAs. These provisions run the risk of significantly increasing costs for the operators of closed systems.

2. Permitting Contractual Departures from Prescribed Standards

At the simplest level, the most important accommodation for closed systems is to state that the standards and requirements established by electronic authentication legislation or policies do not affect the terms of private agreements concerning the use of electronic signatures. To date, no jurisdiction has made this statement explicitly, although it may be implicit to some degree in legislation that does not require licensing of CAs. This is not to say that legislation can, or should, treat closed systems equally. As discussed above, several jurisdictions have adopted certain presumptions that apply only to electronic signatures authenticated by licensed CAs, or to electronic signatures that satisfy statutorily-prescribed criteria. Similarly, the right of a CA to limit its liability will often depend on whether or not it is licensed or accredited. In practice, these distinctions should not have a significant effect on closed systems, because these are precisely the types of issues that can be addressed by contract among the parties. What is important is that legislation not preclude these types of agreements among parties.

3. Giving Effect to Electronic Signatures in Closed Systems

To the extent that legislation addresses the legal effect of electronic signatures, it is also important to ensure that the legislation accords at least a minimum degree of legal recognition to electronic signatures used within closed systems, such that they can be proven in court in accordance with whatever standards would ordinarily apply. Of those jurisdictions that have addressed the legal effect of electronic signatures, only Italy would appear to deny legal effect, or at least not to affirmatively grant legal effect, to electronic signatures used within unlicensed closed systems. As noted above, the draft EU Directive would prohibit Italy and other Member States from denying legal effect to an electronic signature solely on the grounds that it is in electronic form, which would provide at least some legal clarity to the use of electronic signatures within closed systems. Moreover, signatures that are verified by a "qualified certificate" within a closed system and that are executed with a "secure signature creation device" would be entitled to legal equivalence to a hand-written signature.^[22]

4. Accommodating Non-Identity, or "Authority," Certificates

From the standpoint of closed systems, it is also important that legislation recognize the legal effectiveness of signatures that establish some authority or attribute of the signer, rather than the signer's personal identity. Although this issue is not unique to closed systems (because there may very well be a market for various kinds of "authority certificates" on open systems), electronic signatures that are used within a closed system are considerably more likely to certify authority than identity. In a secure electronic payment system, for example, the signature confirms the signer's authority to use a particular credit card number, but does not necessarily establish the signer's identity. Electronic signatures may also be used in hardware and software components to identify a device or to prevent copyright offenses, and industries that rely on these techniques would like such signatures to have evidential weight.

The draft EU Directive raises a particular concern, in this regard, because it requires qualified certificates to be linked to "the unmistakable name of the holder or an unmistakable pseudonym." Because the Directive would only obligate Member States to give full legal effect to qualified certificates, the result is that Member States would apparently not have to give legal effect to non-identity certificates in judicial proceedings even if they otherwise satisfied the requirements for a qualified certificate. Similarly, Singapore defines a "secure electronic signature" as one that, inter alia, is capable of identifying the signer. The effect of these provisions will be to make it more difficult, if not impossible, to establish the legal validity of non-identity certificates and to enforce transactions that are authenticated by non-identity certificates.

One of the greatest risks posed by the current flurry of legislative interest in electronic signatures is that national legislation will actually inhibit the use of electronic signatures in international commerce. There are two distinct but closely interrelated ways in which this could happen. First, if electronic signatures and the CAs who authenticate them are subject to conflicting legal and technical requirements in different jurisdictions, it may be difficult or impossible to use electronic signatures in many cross-border transactions, simply because the conditions for their use have not been satisfied in one or more jurisdictions. These are substantive conflicts that many believe give rise to the need to harmonize international standards.

The second way in which legislation can inhibit the use of electronic signatures in international commerce (and the subject of this section) is the means by which national authorities grant recognition to foreign electronic signatures and certificates. So far, every jurisdiction to consider the matter has incorporated some assessment of the standards adhered to by the foreign CA, so the issue is inextricably related to the broader question of conflicting national standards. At the same time, legislation may also impose other geographic or procedural limitations that prevent cross-border recognition of electronic signatures.

Licensing requirements are a pivotal issue. To the extent that a jurisdiction requires a CA to be licensed, or to adhere to particular standards notwithstanding its status as a licensee, this could be construed to mean that any CA that issues a digital certificate in that jurisdiction - or that even confirms the validity of a digital certificate to someone in that jurisdiction - is required to abide by those conditions.^[23] This raises the possibility that a CA would have to obtain licenses in many different jurisdictions, which would certainly be costly and could very well be impossible in particular circumstances, if licensing conditions were not substantially the same.

The Malaysian legislation, for example, could be interpreted to require any CA operating in Malaysia to be licensed. As discussed above, however, the legislation also contains provisions that appear to recognize the legality of unlicensed CAs. Thus, it is simply not clear whether an unlicensed foreign CA would be subject to possible criminal prosecution for issuing or validating a digital certificate in Malaysia. The Malaysian legislation also provides that the Controller of Certificate Authorities may recognize CAs "licensed or otherwise authorized by governmental entities outside Malaysia that satisfy the prescribed requirements." Thus, to the extent that Malaysia would recognize foreign CAs at all, it would only do so for regulated foreign CAs - thereby denying recognition to unlicensed CAs or CAs from jurisdictions that have chosen, as a matter of policy, to forego any licensing scheme for CAs.

In the case of Italy and Germany, both geography and standards pose potential obstacles to cross-border recognition. The Italian legislation limits cross-border recognition to foreign CAs that satisfy "equivalent requirements" and that are from another EU Member State or from a member state of the European Economic Area ("EEA"). Thus, foreign CAs outside of the EU and EEA cannot be recognized. Similarly, the German legislation recognizes foreign certificates so long as the issuing CA is from an EU or EEA Member State and has demonstrated "an equivalent level of security." Because Germany has adopted extremely stringent technical standards for the use of digital signatures - for example, by requiring that private keys be stored on smart cards - many foreign CAs will be unable to demonstrate "an equivalent level of security." The German legislation also provides that foreign CAs may be recognized pursuant to an international agreement.

In time, both the Italian and German provisions are likely to be overtaken by whatever cross-border provision the EU ultimately adopts in its electronic authentication directive. At present, the draft EU Directive provides that a Member State must recognize a foreign CA if (1) the foreign CA has been accredited under a voluntary licensing scheme established by a Member State; (2) a CA established in a Member State guarantees the foreign CA's certificates to the same extent as its own; or (3) the foreign CA is recognized by an international agreement between the EU and a third country or countries. This provision is significantly more accommodating than the German and Italian legislation, but would still require a foreign CA either to become accredited in a Member State or to enter into a cross-certification arrangement with an accredited CA (absent an applicable international agreement to the contrary).

The problem of cross-border recognition directly implicates the broader question of whether the international community should adopt international standards concerning electronic authentication, and the means by which it should do so. Divergent national standards, as well as other types of regulatory obstacles, are likely to cause a significant drag on the use of electronic signatures in global electronic commerce. Uncertainty concerning the legal effect of electronic signatures, conflicting licensing regimes, conflicting operational and technical requirements for CAs, uncertain liability exposure - all of these factors are likely to impede the cross-border use of electronic signatures. Several initiatives are underway to develop international standards to overcome these obstacles.

1. European Union Draft Directive

The most significant of these initiatives, and one that has been discussed throughout this paper, is the EU draft Directive on Electronic Signatures. If adopted in its present form, the Directive would obligate the 15 members of the European Union to enact national legislation implementing the Directive's requirements by January 1, 2001. The Directive would harmonize national policies concerning electronic authentication and the recognition of electronic signatures across a diverse range of national legal systems. Although the Directive is not yet final, it has already had a significant impact on those Member States that are actively considering electronic authentication legislation. Some countries have apparently decided to await the final outcome of the Directive before considering national legislation. At the same time, there remain significant differences of opinion over the Directive - including, for example, the means by which CAs would certify their compliance with the Annex II and Annex III standards - so it is by no means certain what the final contours of the Directive will be.

2. UNCITRAL

In December 1996, UNCITRAL adopted the Model Law on Electronic Commerce to create a general framework for paperless transactions. As discussed above, Article 7 of the UNCITRAL Model Law establishes a broad, criteria-based standard for the recognition of electronic signatures as equivalent to hand-written signatures, and that provision has proven influential in several jurisdictions.

Building upon that work, the UNCITRAL Working Group on Electronic Commerce is now developing uniform rules that relate more specifically to electronic signatures and the operation of certificate authorities. As discussed above, the current draft of the UNCITRAL uniform rules adopts the two-tier approach to electronic authentication legislation, giving legal effect to a broad class of electronic signatures while granting more specific presumptions to electronic signatures that satisfy more stringent criteria. The Working Group continues its consideration of uniform rules for the operation of certificate authorities, including issues related to liability, operational requirements for CAs, and standards for cross-border recognition.

Recently, the Working Group has also started to consider an alternative draft set of uniform rules, WP.80, which would limit itself to a minimal set of requirements designed to give legal effect to electronic signatures. WP.80 is, in fact, part of an effort to bridge some fairly significant differences of opinion among the countries participating in the UNCITRAL talks. As of this writing (early February, 1999), it is impossible to predict whether WP.80 or some other initiative will be sufficient to hold the UNCITRAL talks together and produce a final set of rules.

3. Proposed International Convention

While the UNCITRAL process has proven extremely worthwhile, its objective is to develop uniform rules that governments may consider - but are by no means obligated to adopt - when drafting national legislation. In contrast, an international convention would bind signatories to recognize the principles and requirements contained in it. The United States Government has circulated an early draft of such a convention, and several other governments have expressed support for the idea.

4. Organization for Economic Cooperation and Development

In conjunction with the Ottawa Ministerial meeting on electronic commerce, held in October 1998, the OECD issued a comprehensive inventory of electronic authentication legislation and policies in the OECD member countries, and adopted a Declaration on Authentication for Electronic Commerce. The principles set forth in the Declaration generally encourage electronic authentication policies that minimize government regulation, support technological neutrality, and recognize party autonomy.^[24] The Declaration also recognizes "the potential impact that diverse national solutions for electronic authentication could have on the development of global electronic commerce," and encourages countries to "take a non-discriminatory approach to electronic authentication from other countries."

The OECD is continuing its work in this area through a workshop on authentication issues to be held in California in June 1999.

5. Other International Organizations

In addition to UNCITRAL and the OECD, a number of other international organizations have been involved in international electronic authentication issues:

• The International Chamber of Commerce has issued a General Usage for International Digitally Ensured Commerce ("GUIDEC"), which attempts to create a general framework for the use of digital signatures in international commercial transactions (i.e., for international business-to-business transactions). GUIDEC seeks to draw upon existing law and practice in different legal systems to identify and promote general principles for the use of digital signatures in international commerce.
• The Public Key Authentication Task Group of Asia-Pacific Economic Cooperation (APEC) issued a preliminary report in September 1997, which surveys the range of issues associated with electronic authentication legislation and recommends international coordination in numerous areas to avoid interoperability and trade obstacles.