1 Summary of the Desk Study on Technical Issues

BESTS Annex to Final Report

FINAL DRAFT

PricewaterhouseCoopers Luxembourg, 20 January 1999

1 Table of Contents

1 SUMMARY OF THE DESK STUDY ON TECHNICAL ISSUES...... 3

2 EXECUTIVE SUMMARY TECHNICAL PANEL REPORT...... 6

3 SCENARIOS TECHNICAL PANEL...... 9

4 SUMMARY OF THE DESK STUDY ON LEGAL ISSUES...... 13

5 SUMMARY OF THE DESK STUDY ON BUSINESS ISSUES...... 15

6 SUMMARY OF THE DESK STUDY ON GOVERNMENT ISSUES...... 17

7 EXECUTIVE SUMMARY LEGAL PANEL REPORT...... 19

PRELIMINARY REMARKS...... 19 BESTS BACKGROUND...... 19 MAIN CONCLUSIONS...... 19 8 FURTHER RECOMMENDATIONS ON LEGAL ISSUES...... 27

9 SCENARIOS LEGAL PANEL MEETING...... 30

9.1 CASE AND PERTAINING QUESTIONS HANDED OUT ON THE FIRST DAY OF THE LEGAL EXPERT MEETING...... 30 9.2 QUESTIONS SUBMITTED DURING THE MEETING AND ANSWERED IN WRITING BY THE EXPERTS...... 44 10 SUMMARY OF THE DESK STUDY ON BUSINESS ISSUES...... 46

11 SUMMARY OF THE DESK STUDY ON GOVERNMENT ISSUES...... 48

12 EXECUTIVE SUMMARY BUSINESS GOVERNMENT PANEL REPORT. 50 Scenario Gaming...... 54 Goals of scenario gaming...... 54 Components of a scenario game...... 54 Scenario tuning...... 54 12.1 SCENARIO 1: GROWTH...... 55 12.2 SCENARIO 2: STAGNATION...... 56 12.3 SCENARIO 3: DECLINE...... 57 12.4 SCENARIO 4: MATURITY...... 59 13 BESTS FINAL CONFERENCE (2 DECEMBER 1998, VIENNA)...... 60

14 PARTICIPANTS TECHNICAL PANEL...... 61

15 PARTICIPANTS LEGAL PANEL...... 61

16 PARTICIPANTS BESTS FINAL CONFERENCE...... 62

17 RELEVANT WEB SITES...... 64

2 1 Summary of the Desk study on Technical Issues

Due to the enormous growth of Internet, there is a lot of attention for electronic commerce. Through a network, such as the Internet digitised data can be rapidly, cheaply and simply transferred. Electronic commerce offers low entry barriers, low transaction costs and improved access to information.

To the full realisation of electronic commerce there are many barriers. One of the main barriers is the lack of confidence in electronic commerce. Electronic commerce is perceived as insecure. There is a need for a trust infrastructure in which the identity of each participant in a binding transaction can be identified.

Secure technologies, most notably cryptography and a predictable regulatory environment to support them will form the basis for building business and consumer trusts in electronic transactions.

Cryptography creates the possibility to use digital signatures and digital certificates. These electronic representations that link individuals and entities to operations in the electronic environment are only meaningful when they are accompanied with trusted services, i.e. means of independently verifying information about transactions and transacting parties.

There are several technical aspects, which play a role in the creation of a market for these trusted services. The technical aspects can be categorised as follows:

 Technology

 Implementation of technology

 Management of technology

The technology used for security of electronic information is cryptography. There are two main types of cryptographic systems, symmetric cryptosystems and public key cryptosystems. The latter one is more complicated, but offers a higher level of security in a distributed environment with many users. The longer the cryptographic size, the more difficult it is to break the key. However, the leading vendor of public key technology is RSA, an U.S. firm and it is illegal to export strong cryptography from the U.S.A. without government approval. But, this is rather a legal and government issue than a technical one.

With public key cryptography digital signatures and digital certificates can be created. Digital signatures are the electronic equivalent of the traditional hand-written signatures. They can help to prove the authenticity and the integrity of data.

Digital certificates offer proof of identity. A digital certificate binds an identity or another attribute of its principal to an electronic document.

But, the use of digital signatures and certificates is limited by the ability of the receiver to ensure the authenticity of the key used to verify the signature. In order to rely on the authenticity of that public key, often trusted services will be used. Trusted services can generate cryptographic key s and they can also certificate users. An organisation can provide the complete range of trusted services, from registration, to certification and time stamping. Each function of trusted services can be provided by a separate organisation.

3 Generally, Certification Authorities (CAs), create, distribute, revoke and generally manage the certificates. In a distributed computing system Public Key Infrastructure, or PKI, enables the user of public key cryptography and certificates. In PKI Certification Authorities, Registration Authorities etc. can operate off-line, on-line or inline and they can co-operate in a hierarchical system, through cross-certification or a combination of both.

A major technical issue is the management of certificates and keys. Concerning certificate management there are problems related to performance and storage, the period maintains a revocation and the frequency of a Certificate Revocation List (CRL). The technical issues regarding key management are key generation, key backup and recovery, key escrow and key update. Furthermore, there is little experience with large numbers of certificates and keys (scalability). For a successful implementation of trusted services the client-side software has to be consistent, transparent and easy-to-use.

Co-operation between trusted services is only possible when there is interoperability between different systems. Many of the services in the PKI architecture can be implemented using a variety of different mechanisms and protocols. For interoperability standards are required. A great deal of activity related to PKI standards has occurred the last two years. Consequently, the baseline requirements for an interoperable PKI for the Internet and open networks are becoming increasingly clear. Several efforts are underway to address the need for PKI standards. Standards are emerging or exist in two basic areas, namely RSA’s Public Key Cryptography Standards (PKCS) and the IETF (Internet Engineering Task Force) PKIX working group. Other important organisations for PKI standards are The Open Group and ISO.

There are now accepted standards for digital signatures, certificate and CRL formats, certificate and CRL retrieval, certificate management, and PKI policy. However, there are no standards yet for key recovery and escrow, APIs (Applied Programming Interfaces) and time stamping. And although for most PKI issues there seems to be an accepted standard, most CA products, as a whole, are not interoperable yet. This is a large problem for the development of a world-wide network of trusted services. Probably, in the next two years, vendors of CA products will be forced to agree on their interoperability.

There are some industry standards which will have a large impact on the development of trusted services, S/MIME and especially SET. S/MIME is a set of specifications that supports the structuring of secure message body. S/MIME is used for sending and receiving complex messages and attachments securely. SET is standard partly developed by Visa and MasterCard for secure credit card payments across the Internet. In the SET system, member banks can act as CAs for their credit card holders.

Currently there are two technologies emerging which in combination with cryptography can increase the users trust in electronic commerce and PKI, these are biometrics and smart cards. Biometric technologies are stepping out of the laboratory phase. It still has to be proven that they’re almost 100 % safe. Biometrics could give an impulse for digital certificates, since people will trust this technologies more likely than electronic technologies. Smart cards, especially multifunctional ones, will in the near future be used within PKI, but first smart cards have to be improved further.

During the last two year various CAs have been established. Examples are VeriSign and BelSign. The European Commission is supporting different initiatives, such as Eurotrust and ICE-TEL.

Concluding, there is a set of technical solutions for secure electronic commerce. For specific issues some standards have been accepted, but for some issues there are not any standards yet. The market forces will determine the missing standards in the next years. The market will

4 also demand interoperability between the different CAs. Smart cards and biometric will in the future give an extra drive for the development of trusted services.

Another aspect, which has not been mentioned before are the high costs for good technology. Unless someone tries to break in unsuccessfully into your online information system, the value of the investment will not be noticed. And until it is clear how companies can make a profit from trusted services, they will not invest in them.

Apparently the technical aspects do not play a dominant factor in the development of a trusted services market. In general there is a lack of technical expertise and knowledge, especially in relation to public CAs and certificate and key management. Compared to the U.S., in Europe there seems to be little support for PKI. But what is more the case, in general there is little awareness in the market concerning CAs and TTPs.

Since U.S. firms have a leading edge in PKI technology and they determine the relevant standards, European organisations should follow them. European firms seem to lead in biometrics. This could be a way to get ahead of the U.S. concerning information security and electronic commerce.

5 2 Executive Summary Technical Panel Report

BESTS aims to identify the barriers, which impede businesses from entering the trusted services market. BESTS makes a distinction between technical, legal, business and government barriers. To determine these barriers desk research was performed and panel meetings were held. This report summarises the discussion of the two technical panel meetings, which were held on 4 June and 1 July 1998.

At the technical panel meetings six cases, derived from the desk research, where discussed:

 Standards and compatibility

 Scaleability of the PKI infrastructure

 Security and control of use of private keys

 Certificate content and privacy

 The Registration Authority process

 Management of many different keys

According to the technical panel members the technical issues do not form the main barriers for the development of a European trusted services market. However, there are some problems, which are slowing down the development of trusted services. For the mayor technical bottlenecks there are solutions, but these can be very expensive.

The most important technical barrier is the lack of compatibility. Currently there are too many standards. Real interoperability is still underestimated. Interoperability demands more than standards alone. The existing standards leave too much open when implemented. Besides that, especially European market players fear that U.S. PKI product developers will set their standards as de facto standards into the market.

Although there are many standards, some standards are still missing. According to the panel members there is especially a lack of standards concerning time stamping, on-line certification, long-lasting documents, smart cards, visualisation of validity of digital signatures, key management, cross-certification and there is still no single certificate format in use. However, several organisations, including the PKIX Working Group are working on these standards. Standards on key recovery are not required.

Moreover, trusted services will only be used in a specific context. Therefore standard models for specific PKI application areas were suggested. This would allow (potential) services providers to focus their resourcces on providing a limited number of well-defined services that fit the needs of specific market segments.

At the moment there are no official guidelines or standards on how to certify CAs. Global accreditation guidelines for trusted services are desired.

6 There is little experience with large scale CAs and it is not expected that in the near future very large global operating CAs will appear. Large CAs would only operate through many intermediaries. Although there is little experience with large scale PKI systems, the technical problems are not seen as mayor inhibiting factors. The technical issues can be solved by more expensive systems. The real bottlenecks here are not technical, but financial ones. Significant problems regarding scaleability of the PKI infrastructure are anticipated in the organisational and management sphere. Much training and an adequate control are necessary to avoid management problems concerning PKI scaleability. Universities could direct some of their PKI research towards the organisational issues of trusted services. Besides that, many security and legal issues need to be solved, before parties can scale up their PKI system

There is a lack of security and control of private keys. The mayor reason is that the current PC environment is not secure. End-to-end security cannot be provided. To increase the security of private keys it is very important to create awareness among users of digital certificates.

Certificates could harm privacy, especially multipurpose certificates, if people can access fields in the certificate containing private data, for which they do not have any permission. The technical panel members mentioned that there were several solutions for protecting certificate content and privacy.

Various technical problems were mentioned related to the Registration Authority process. For higher security purposes, at local offices consumers can request a digital certificate showing a means of identification. One of the mayor problems when designing the RA function might be the lack of local offices. Control is needed on how and what certificates are brought into a PKI system.

The management of many different keys does not need to be a considerable technical problem. But, old keys and time stamping issues could pose significant problems, when managing a large number and different types of keys.

Most of the barriers will be and need to be solved by the market players. The market forces will set the de facto standards and will develop the necessary technologies.

But, this does not mean that governments cannot influence the market development. The technical panel members provided several recommendations for the European Commission. According to them the European Commission could accelerate the development of the European trusted services market by amongst others:

 Creating an interoperability testing platform

 Supporting standard models for specific PKI application areas

 Supporting the development of (worldwide) accreditation guidelines

 Supporting research on the organisation and management of trusted services

 Creating awareness amongst potential users

7  Stimulating European researchers to commercialise the PKI technologies they are developing, such as biometrics and smart cards, in which the Europeans have a leading edge, and user friendly systems

Where the issues are of global concern, the European Commission could support developments at OECD-level.

It is however not recommended that the European Commission supports the development of new standards where other standards have already been established, or where standards are emerging. The market will develop the necessary standards and the market will determine which standards are to be used.

8 3 Scenarios Technical Panel

Standards and compatibility The word standard is sometimes used very loosely. Use of a standard does not always imply compatibility. There are many standards for some things, and none for others. Although the available products do use the existing standards for the different PKI components, the products from different vendors are not (always) interoperable.

The questions could be:

 In which areas, if any, is a lack of (adequate) standards inhibiting the introduction and/or expansion of trusted third party services?

 Where are new or better standards needed?

 Which components need to be compatible and interoperable with which other components, and at what level?

Scaleability of the PKI Scaleability of PKI components can be determined by:

 computational performance

 manageability

 costs

 user friendliness

In a PKI architecture which consists of a Registration Authority (RA), a Certification Authority (CA), a Certificate Directory and a Certification Revocation List (CRL), the RA officially registers associations between identifiers and public keys. It works in association with the CA, which creates and issues certificates (that bind the associations) and maintains the CRL (that retracts previously bound associations). Certificates and the CRL are maintained in and accessed via a (distributed) Certificate Directory.

This model and its working are relatively well understood for small-scale implementations. However, many design issues arise as the size increases, and consequently, the working becomes less predictable. In order to enable national, pan- European or world-wide electronic commerce, extremely large-scale implementations will be needed. There is no experience yet with millions of users, much less hundreds of millions.

Questions with respect to the scaleability of the PKI infrastructure could include:

 How can the Certificate Directory (certificates and CRLs) best be distributed to ensure that up-to-date certificates and CRLs are available as and when needed?

9  Is current database and network technology up to the task required by a Certificate Directory function?

 What other problems related to technical limitations (scaleability) are to be expected with a mass implementation?

Security and control of private keys use

Solutions for electronic commerce (and the related trusted third party services) are based on cryptography. In these solutions a person's identity, and the fact that she has initiated or authorized a transaction, is based upon the fact that the transaction is "sealed" (e.g. digitally signed) with a "private" key that only she has access to.

Use of private keys is, however, not directly tied to the person in question. Unlike in the paper world where a signature is directly (manually) set on a piece of paper, a digital signature is indirectly set. An application submits a request to a PKI module (subsystem).

As electronic commerce develops, a wide range of applications will become available and will be needed to carry out different types of electronic transactions. The user must be able to trust the applications she uses to submit (only) the proper information to the PKI module (e.g. for signing).

The intention is that the PKI module only performs functions that have been authorized by the user. In most existing systems, the user authorizes functions on a "session" basis by making her private key available for use (e.g. by providing a password used to recover the key from storage and/or by providing the token on which it is stored). The user must be able to trust that the PKI module will only perform functions for the intended (authorized) applications during a session.

The user must also be able to trust that the private key is not exposed in storage or during use.

It is not feasible to eliminate all risks.

 How significant are these risks in the following environments?

 the consumer PC;

 the small business LAN;

 the corporate network.

 What steps can be taken to further mitigate risks?

10  What steps can be taken to allow users to understand the risks they are taking, and how they can minimize those risks?

Certificate content and privacy Certificates, like the X. 509 certificate, can contain several additional fields with information for specific purposes. Potentially, these fields could include privacy sensitive information such as sex, age, race, or membership in organisations, which is needed in the context of a specific application, but should not be made publicly available.

Mechanisms must be put in place to prevent unauthorised access to this information. On the other hand, certificates will need to be multi-purpose and some of the additional information content, though privacy sensitive, will be needed by a number of different applications. It will not be practical for additional fields to be added for each application. Some form of shared access will probably be needed.

 What mechanisms are currently available for addressing this problem?

 Are these mechanisms adequate?

 If not, what requirements must be met by a yet to be developed mechanism?

The Registration Authority process, authentication and proof of authorization A Registration Authority (RA) officially registers associations between identifiers and public keys. A person presents the RA with a public key and the identifier to which the person wishes the key to be bound, along with proof of the identity of the person (authentication) and that the person is authorized to claim or act on behalf of the identifier (authorization).

The means through which the public key, proof of authentication and proof of authorization are presented, and the nature of the proof required to establish the identity of the requester and to establish that the person is authorized may vary depending upon the purpose for which the association (certificate) will be used.

Questions with respect to the RA process could include:

 What means are available for situations where a strong form of authentication / authorization is required?

 How well are the associated processes and mechanisms understood?

 What drawbacks do the various systems have?

11  Are there serious technical problems which need to be resolved before these systems can be implemented (on a large scale, internationally)?

 What constraints do implementation of the various systems imply in terms of:

 The distribution of the RA function?

 The types of organization that could appropriately carry out the RA function?

Management of many different keys PKI standards are designed to allow for, among other things, different choices of algorithm and key length, in order to meet the differing security needs of the various applications for which cryptographic functions are used, both now and in the future.

Over time, this could potentially lead to an explosion in the number of keys and certificates needed per person, and the number of algorithms and key lengths which devices must support, when one considers:

 different keys and algorithms for different purposes;

 retention of old keys, certificates and algorithms (e.g. to check existing signatures).

 How serious is this problem?

 Is it already an obstacle that is inhibiting the introduction and/or expansion of third party services?

 What steps need to be taken to control and manage the problem?

12 Bests Summary Desk Study Legal Issues

4 Summary of the Desk study on Legal Issues

This part of the desk research report represents the first phase of the work carried out by the legal sector within the BESTS project. Its purpose is to identify the legal key issue areas and some alternative governmental policy scenario's pertaining thereto, thus defining the scope and the content of the work to be carried out by the legal sector in the next phases of the BESTS project. It should be stressed that it does not answer any legal questions related to TTPs and their services yet.

Building on the legal studies carried out already, the legal sector within the BESTS project focuses on the critical legal key issue areas that withhold businesses from entering the European trusted services provision area. Taking a casuistic and illustrative approach, the document also accessible to non-lawyers interested in this area of law.

The key issue areas concern:

 Organisational aspects. What are the basic requirements to be met by TTPs? (inter alia financial reliability, impartiality, lawfulness and security).

 Legal status of TTP services. What is the legal status of the various TTP services? Some types of contracts require special provisions of form. This brings up the question whether TTP services can (in some cases) replace these formal requirements. Obviously, this legal key issue area becomes even more relevant if the parties concerned resort under different legislation.

 Liability. Liability of TTPs is terra incognita. It brings up questions regarding applicability of national law and applicability of general liability regulations. Additionally, many factors that may have an impact on the (extent of) liability need to be thought over.

 Insurance and exoneration of potential risks. How should the user’s interest of financial security and the TTP’s interest of reduction of financial risks be balanced? Governments may need to monitor this process in order to ensure that unbalanced contracts are not imposed, scaring off potential users or harming the interests of weaker parties (e.g. consumers).

 Evidential value of TTP services. Within the different individual Member States a high level of uncertainty exists concerning the admissibility and value of certain TTP services (e.g. digital signatures) in a Court of law. Obviously, these legal uncertainties come to front even more blatantly in an international environment.

 Foreign recognition. Foreign TTPs (or (some of) their services) may not be recognised in certain countries. Such non-recognition may fall within the scope of acts considered to be unlawful under national and/or international competition rules.

 Export restrictions. A number of countries throughout the world consider the import and export of specific cryptography software hazardous to their national safety. Such impediments, justified or not, may hamper the prosperous development of international development of TTPs.

 Public authority interests. Use of cryptographic methods to protect confidentiality may help criminals to conceal their activities. Government agencies may wish to have access to the plain text of encrypted data in certain circumstances.

13 Bests Summary Desk Study Legal Issues

 Privacy. Trans-border privacy issues need to be addressed, because TTP services – that include the collection and processing of highly sensitive personal data - will go beyond national and EU borders. Other (non-EU) countries may hold other views on the protection of privacy. These discrepancies may impede internationalisation of TTP services seriously.

The role national governments and international organisations may play in the development of TTP services is considered to be of critical importance. What are the policy options to address (part of) the legal key issue areas identified? Oversimplifying, basically three policy options would be available.

 First Scenario 'Governmental-Run (GR) TTP services'. Taking this approach TTP services are regarded as public services, directly provided by the governments using governmental resources.

 Second scenario 'Licensed Private (LP) TTP services'. In this concept, private business provides TTP services in a territory under government licensing and regulating insuring standards of quality, public safety, service and protection. Governments may limit the number and type of services to a practical and manageable level.

 Third scenario 'Free Market (FM) Unregulated TTP services'. Private business provides TTP services as independent companies, not limited by any contractual license agreements or any legislation directly aimed at TTP service provision. The role of the government is limited to the provision of some remote legislation in areas neighbouring the services that are not sold in the marketplace yet.

The policy scenario's identified are merely models, rather than realistic options to be applied in practise. Obviously, some legal key issue areas may be suited for a specific (e.g. non-regulatory) approach, whereas other areas are more fit to be regulated differently. The scenario's aim to draw some opposing possibilities in (non-)regulating the TTP service provision area that may be taken into consideration. Needless to say that in between these possibilities a wide variety of other solutions exist.

14 5 Summary of the Desk study on Business Issues

All BESTS issues are fundamentally business issues. The ultimate goal of BESTS is to address the commercial ETS industry in Europe. Therefore, when technical, legal and government issues are raised in the study, it should be borne in mind that the purpose is to discuss these matters in the context of the creating a favourable business environment for ETS service providers.

BESTS goes well beyond electronic commerce to encompass all areas of interaction between suppliers and consumers, including secure messaging, asset trading, health care, citizen interactions with government (registration, tax payment, elections), banking and much more.

There is little agreement in industry and academia as far as the definitions of the various terms that BESTS concerns itself with are concerned. This includes phrases such as “trusted service”, “trusted third party”, and “certificate authority”. The BESTS have agreed on terms among themselves.

Players in the PKI-based ETS field fall into two groups: a) organisations which finance, build and run the PKI infrastructure, such as certificate authorities, telecoms and banks, and b) organisations and persons who use the infrastructure, such as Internet retailers, consumers and organisations building and using intranets and extranets.

Key BESTS business issues fall into the following 15 categories:

 Assurance

 Capital equipment

 Competition

 Cross-certification

 Customer base (provider)

 Customer base (user)

 Differentiation and added value

 Existing players

 Export restrictions

 Infrastructure and Access

 Insurance and Liability

 Investment (external)

 Perception and trust

 Profitability

 Related products and services

15 A hypothesis has been put forth by the BESTS business team which states that certificates and their associated markets will evolve to the point there the only differentiation between certificates will be in the areas of user perception and insurance. The user, directed by his or her perception of the trustworthiness of a certificate, will decide which certificate authority to use, or whether to use one at all.

A “high-assurance” certificate is generally crypto-graphically equivalent to one providing less assurance – the only difference between the two being, in many cases, the amount of insurance associated with the certificate. This difference in insurance accounts for 100% of the difference in cost to the certificate authority. Hopefully, the BESTS study will shed light on the validity of this hypothesis.

16 6 Summary of the Desk study on Government Issues

The desk study on Government issues looks at the issues for Government involvement in the area of trusted services.

The report distinguishes the role of Government in two areas of trusted services separately: authentication services as provided by Certification Authorities and private-key escrow and storage services.

A number of interested parties are listed, such as consumers, businesses, interest communities, suppliers of trusted services and government agencies and their specific interests in this area.

For the role of Government, a number of tasks that have a relation with trusted services are listed and potential approaches that can be taken by Government in these areas are indicated.

 To ensure consumer protection, Government could set clear rules and provide a framework for complaints

 For national security and law enforcement, Government might want to set requirements for key escrow

 To provide market support, there could be a mechanism for market stimulation and subsidies to enable new entrants in the market

 Government as a user of trusted services could act as a launching customer when it mandates the use of trusted services for example for on-line voting

 Government should seek international agreements for mutual recognition of trusted services and harmonisation of export controls

The actions that Government can take towards trusted services are given in relation to three scenarios for market operation:

 Government-run trusted services, where Government could partly or fully monopolise this service area

 Licensed private trusted services, either with Government-driven or market-driven licensing. In a Government-driven licensing scheme, Government would set the rules and could also provide a liability cover. In the market-driven scenario, market parties would work together to establish a mechanism for licensing and evaluation, in which Government could participate as a contributor or as an observer.

 Free market unregulated services, where Government would choose not to be involved in the service area.

 A number of issues related to the economic framework that could be relevant to the market for trusted services are indicated. It is identified that the area of trusted services in itself is an economic activity and, if well organised, could enhance national competitiveness. The area of insurance and re-insurance could be an area where Government plays a role. For taxation purposes, the provision of cross-border services will meet with the same international tax issues as other electronic services. Finally, Government should be careful to mandate expensive technical measures of trusted service providers, for example to enable Government access to encrypted information.

17  Conclusions and key issues derived from the report are listed in the following areas:

 general issues with respect to government role, where Government should set a clear decision and consultation process, in an early stage defining its own position in the chain of trust.

 regulation of use of trusted services, where Government can play an important role by mandating the use of trusted services in interactions with administration, both for businesses and for citizens.

 regulation of market of trusted services, where Government can influence the market operation in several ways, such as defining the licensing scheme and setting competition rules.

 stimulation of the market, where Government can act as the launching customer and provide start-up subsidies

 legal issues, where Government needs to take into account the speed of change in technological areas.

 international context, where Government needs to be involved in building a global framework for trusted services.

18 7 Executive Summary Legal Panel Report

Preliminary remarks

This report summarizes the discussions of the Legal Expert Panel Meeting held in Amsterdam on July 15 and 16, 1998. This executive summary holds the main conclusions. Under C. in part I it focuses on the legal barriers perceived, withholding businesses from entering the PKTSP service provision area. In part II the role of the EU government (and national governments) in razing these impediments is touched upon. In both parts the general conclusions are listed preliminary to the conclusions per issue (along the structure of the discussions held). However, before listing the main conclusions, below under B., a short summary of the background and the perspective of the meeting are given.

BESTS background

The Business Environment study of Trusted Services (“BESTS”) aims to investigate the elements that impede businesses from entering the PKTSP (see for definitions: Introduction, page 9) service provision area, identify bottlenecks and propose scenarios for creating a favorable business environment for PKTSP service providers. The BESTS study features a multidisciplinary and layered framework. The output of the legal and technological sectors within BESTS establish the input for the strategic sector, being the government and business panels. In this perspective the work done by the legal panel has heavily focused on the legal issues dealing with the question what should be done by the national and international governments and what should be left to the market in order to create a healthy environment for the sound development of PKTSP’s and their services.

Main conclusions

Part I : The Barriers

General Many experts underlined the state of flux the legal framework is in, both at national and international level, in the area op PKTSP’s services. Numerous new regulations are being enacted, often conflicting in its requirements between jurisdictions. The application of existing legislation and the requirements and liabilities it imposes are uncertain. This lack of certainty is a major ‘killer’ of any initiative in the PKTSP environment, making it hardly possible to predict any future developments and making it impossible to assess potential gains and losses. Nevertheless some experts felt that, provided there is a legal basis for the services which the PKTSP wishes to deliver, no particular specific regulatory barrier exists. In their view the real obstacles relate to the economic, operational and marketing issues of PKTSP’s services.

Conclusions per issue

19  Organizational aspects  Organizational requirements are critical to the sound development of PKTSP’s, since these will facilitate the creation of a notion of a trustworthy PKTSP, as a general concept. Requirements to be met highly depend on the type of services to be rendered and the risk perceived by the client using these services.  Most experts expressed that burdensome licensing schemes would hinder starting PKTSPs from entering the market. This would lead to an increased level of costs (to be paid by the customer at the end of the day) and to a limitation of opportunities to experiment or develop new business practices.  Liability  A majority of the experts felt that lack of certainty in respect of exposure to potential liabilities to customers and third parties, especially in relation to consumers, and the uncertainty as regards protection provided by law to PKTSPs, hampers the development of services in this area. Since it is unclear what the requirements are, it will be hard to meet them.  Insurance  Given the uncertain situation as regards liability, many experts expressed that a lack of a cost efficient insurance system to back up any liabilities seriously withholds potential PKTSPs to enter the market.  Foreign recognition  Although the general feeling was that at present foreign recognition is not a practical problem yet; all experts were convinced that it would become in the future. This will particularly apply whereas many countries are in the process of enacting rules on foreign recognition.  Export restrictions  All experts felt that existing export controls, restricting and hindering cross border service provision, even within the EU, form a major barrier to exploit PKTSP’s services.  Law enforcement  Since it seems possible that law enforcement agencies may require key recovery/escrow (for encryption keys) in different jurisdictions, compliance herewith may be exorbitantly expensive and may be something customers do not want to pay for. Additionally, the question is whether there is any form of immunity from the ramifications of being forced by law enforcement agencies to disclose confidential information? As such, these uncertainties may hinder the sound development of PKTSP’s services.  Competition  There was consensus that the current European competition rules do not impede the sound development of PKTSPs. Most experts expressed that the role of client software manufacturers is critical in the sense that it may be quite difficult to get your root PKTSP installed and recognized in client software. This may seriously hamper market access.  Public interest

20  Many (rules on) different public interests, in particular regulation as regards consumer protection (e.g. requirements for information to put in certificates), are unclear as to the applicability in an on line situation, let alone in the PKTSP environment. This legal uncertainty may hamper the prosperous development of PKTSP’s services seriously.  Privacy  There was more or less general consensus that the phenomena of PKTSPs does not impose any unique new questions in respect of privacy. Looking at the European privacy Directive it was underlined that it explicitly applies to PKTSPs. Most experts felt that the directive is far from sensible in the sense that it is not well suited for the PKTSP industry. Again the uncertainty as regards the requirements to be met (for example the adequate protection levels in third countries) may withhold businesses from entering the PKTSP market.  Legal status and evidential value of TTP services  Most experts considered uncertainty as to the legal effect of certificates and evidentiary status of digital signatures a critical barrier.

Part II. Role of the government General All experts felt that there is an important role for the government in removing barriers for the sound development of PKTSP’s services. However, different views were expressed as to how this role should materialize. Some felt that the government should have an active role in providing trust, others held that the government should limit itself to activities aimed at stimulating debates between interest parties, create awareness and educate potential users, e.g. by means of creating platforms and organizing conferences. In this context national governments could set an example by using and providing PKTSP’s services themselves.

All experts expressed that there is major risk that governments may overregulate the PKTSP market before it has even come to birth. In the broader context of E- commerce development, experts urged the EU to discourage national legislators from enacting conflicting legislation and discourage overregulating and stimulate member states to amend national laws that retard the growth of E-commerce.

Additionally, the view was given that governments (in general) do not tend to be the most efficient decision-makers, or determine the most efficient processes. Furthermore, governmental involvement may not create the lowest cost solutions and may be quite time consuming. Many experts stressed that governments have limited experience in regulating such a fast changing and nascent industry. Some experts urged the government to wait until the use of PKTSP’s services has matured and give businesses the opportunity to develop voluntary good practices before even thinking about licensing or legislation in this area. Therefore, it should limit itself to removing existing barriers, stimulate industry and increase public awareness of the advantages of PKTSP’s services.

However, several other experts held that government involvement is absolutely necessary in some areas, for the following reasons:

21 1. Necessity of involvement

One expert stated that market practice is non-existent or at least not homogeneous. Therefore, the government may have an important role in fostering the development of sound practice. He stressed that Electronic Commerce is not only about law trying to catch up with technology, it is also about law providing a framework within which technical solutions may evolve. Although this situation does not necessarily call for increased involvement on the part of the government, governments are definitely in a good position to provide a balance of what is needed to create Electronic Commerce. If one combines the need for certainty about applicable rules (before market parties get established), the need for general cross-sectoral rules, and the fact that a number of legal issues can not be solved by contract, because a body of mandatory law exists, one realizes the need for some level of state involvement. Leaving it to Courts would only foster disharmony among jurisdictions. Other experts endorsed this view.

2. Protection of general interests and interests of weaker parties

Additionally, many experts expressed that on the market, the stronger party usually takes the advantage of its positions of strength. Given the fact that the market has other objectives than general interest, the market needs to be monitored and, in limited cases, supervised.

3. Traditional governmental involvement

It was stated that PKTSP’s services are analogue in many ways to other services, which have always been government regulated (e.g. civil notaries). Therefore, it would make no sense to privatize such services in view of PKTSP’s services.

4. Stimulation of public trust

Some experts strongly felt that – against the background that the market is presently too fragmented and thus in need of government encouragement - government involvement will stimulate public trust. However, this notion was severely criticized by other experts.

5. Balance

Additionally it was expressed that if the government is going to give PKTSPs certain benefits (e.g. evidentiary presumptions or liability limitations), it is reasonable that governments ensure that they are worthy of public trust. A balance will need to be struck here.

At the same time, many experts felt that where a PKTSP may offer a variety of services (identification, registration, certification, authentication, key escrow, time stamping) regulatory considerations will need to be applied differently, depending on the market situation regarding that particular service.

22 Conclusions per issue  Organizational requirements

 Most experts strongly opposed legislative actions by the government (at national or international level) in this area. They favored relying on market forces. Client’s expectations will impose requirements to feed the notion of trustworthiness. In fact, legislation was regarded an inflexible and time costly mechanism.

 Some experts stressed that official recognition by government will increase trust in PKTSP’s services. Licensing could serve this aim. Nevertheless, if a PKTSP feels strong enough to do without, it should be allowed to do so. In this respect, some experts advocated the establishment of uniform licensing requirements internationally. However, some experts strongly opposed the idea of mandatory licensing schemes.

 Liability

 Most participants felt that current regulations on liability can be applied to PKTSPs and their services without many problems. Most experts felt that no additional regulation in this field was necessary. Instead, governments should make efforts to clarify applicability of regulations on PKTSP’s services. In this respect a distinction needs to be made between (a) the trust activity of the PKTSP and (b) the content or intrinsic value of the transaction. Since the PKTSP is not inherently involved in the actual transaction, it should not be automatically liable for risks pertaining to the latter activity. A clarification should not be left to market parties and should be created at European and preferably at global level.

 Insurance

 Many experts stressed that no need for government involvement is required in respect of insurance and liability. As regards the trust activity of PKTSP’s liability and subsequently insurance should be a contractual issue. However, some experts expressed that a distinction could be made between insurance with respect to business transactions, which should be left to market parties, and consumer transactions, which may require backing up by some sort of neutral fund.

 Foreign recognition

 All experts felt that the issue of foreign recognition requires some form of governmental involvement, preferably at global level. They encouraged the EU to work in international fora (e.g. GATT) to get international consensus to enable sensible functioning of PKTSPs internationally and to promote cross border recognition within the EU (e.g. by means of a Directive).

 However, the government should be aware of the diversity of services: a monolithic approach could be very dangerous. Additionally, some experts stressed that the issue of foreign recognition may be addressed easier focussing on the development of international minimum (and possibly mandatory) standards and criteria (possibly by means of a Directive) along which PKTSPs can be evaluated.

23  Export restrictions

 There was consensus that the current solutions (e.g. Wassenaar Agreement) do not go far enough. Many experts underlined the importance of removing export barriers, at least within the EU, for relevant software and to work together with governments to establish equitable export guidelines. Regulatory actions should be initiated to reach this aim as soon as possible.

 Law enforcement

 All experts expressed their concern as to the current practice in this field. They felt that the EU should encourage law enforcement agencies to seek practical solutions on the cryptography issue. There was consensus that a distinction needs to be made between encryption in signing and encryption in hiding messages, urging the EU government to recognize such distinction.

 Competition

 There was consensus that the current European competition rules do not impede the sound development of PKTSPs. Given this highly dynamic environment it would be premature to establish any kind of regulation, let alone PKTSPs specific regulations in respect of PKTSPs in this area. At the same time, the role of client software manufacturers is perceived to be critical and the EU should encourage EU software producers to make competing products and should enforce its competition policy particularly against US software manufacturer monopolists.

 Public interest

 Most experts stressed the role the EU government should have in protecting consumer/user interests. They touched upon issues such as: right of appropriate disclosure of trust and assurances provided by PKTSPs, freedom of choice as regards algorithm, technology and PKTSPs, non discriminatory access for users, universal access, freedom of choice not to use certain services, protection against unfair contractual terms and new mechanisms for dispute resolutions.

 All experts felt that a serious attempt should be made to get international agreement even informally just among consumer organizations in terms of standardized warnings, disclosures and other critical messages. In this respect, the role of the government should be focused on stimulation of technology, allowing users to build up good practices.

 Additionally, all experts felt that there is a role for the government in increasing and enhancing awareness and cooperation in the PKTSP and digital signature industry. Additionally, it was stressed that software manufactures may have an important role in providing adequate information to consumers.

 Privacy

 A vast majority of the experts felt that under the Privacy Directive protection concepts have been introduced that may work in theory but may not fit in the business model of providing ICT services, and among them PKTSP’s services.

24 Since the regulatory framework leaves many issues unregulated, expectedly, there will be room for selfregulation. In this context, it was stressed that monitoring of selfregulatory initiatives will be essential. It was suggested that a tripartite approach would be desirable, preferably at global level.

 Legal status and evidential value of PKTSP’s services

 Some experts stressed that electronic documents and signatures must be dealt with in legislation and made equivalent, from a legal point of view. At the same time users should be made aware of the legal consequences of using PKTSP’s services, if necessary by means of regulatory provisions.

 Some experts stressed that different legal systems put different emphasis of the issue of evidential value of signatures. There are divergent views of functions of requirements between countries, especially comparing common law and continental law. There is great need to build up agreement on the functions of the requirements. Before undertaking any regulatory action in this area, it would be beneficial to look at the ratio of those requirements first.

The main conclusions per issue regarding the role of the EU Government in the prosperous development of PKTSP’s services (as detailed above) have been summarised in the following table (see next page).

25 Aspect \ Role Legislation Stimulation of Awareness/Edu- Other self regulation cation initiatives 1. Large majority Establishment of All advocate Majority stresses to rely opposes legislation, quality requirements, government to on market forces, giving Organiza- in particular enabling official (non- stimulate debates, an opportunity to tional mandatory licensing mandatory) creating awareness develop good practices aspects schemes recognition by government 2. Some advocate Majority stresses revision of consumer clarification legislation Liability law in context of instead of additional electronic commerce legislation 3. Insurance Some feel consumer Large majority feels no transactions may need government involvement backing of a is needed, since this is a governmental fund. contractual issue. 4. Large majority All feel that stresses need for government should Foreign international work in international recognition governmental fora to create involvement, international creating cross border consensus recognition within EU 5. Many underline All feel that importance of government should Export removing barriers, at stimulate international restrictions least within the EU dialogue 6. Some express that Most urged the Most feel encouragement regulation is needed government to of all enforcement Law providing PKTSPs stimulate debates agencies is needed to enforcement with some privileges between interest seek practical solutions against powers of groups to consider the on cryptography issues; law enforcement legal issues involved most feel clarification of agencies existing rules is needed 7. Competition All feel no legislative Most feel that the action is required government should stimulate EU software producers to compete with US-monopolists and fight against (US) monopolies 8. All stress the need to All stress the need for The government Some stress the role protect consumer stimulation of should establish a software producers may Public interests, most likely selfregulatory platform of interest have in providing interest by means of initiatives to build up groups of PKTSP information to legislation good practice and services, creating consumers. The experiences. awareness and co- government needs to operation stress this role 9. All feel no legislative Some stress the need The government Most feel clarification action is required in for promoting and should establish a may be needed of Privacy addition to the monitoring emerging platform of interest Privacy Directive in European Privacy self regulatory groups of PKTSP PKTSP area Directive initiatives services, creating awareness and cooperation 10. Many stress the need Governments need to Some stress the need to for dealing with increase awareness of build up agreement on Legal status electronic signatures consumers of legal the functions of the and and electronic consequences of using requirements of the evidential documents and their PKTSP-services evidential value of legal consequences digital signatures value and status

26 8 Further recommendations on legal issues

The following issues were recommended by the legal panel to be addressed by further study in the future.

1. International scope  What are the issues to be addressed on an international scale; who should determine which issues "make" the agenda?  What are the prime motivators for a government to work in concert on these issues?

2. Paperless transactions in general  Party autonomy versus regulation: where should the accents be put?  Business-to-business versus consumer transactions: where should the accents be put?  What should be the legal form requirements, evidence requirements, and archiving requirements in respect of enabling electronic commerce?

3. Protection of interests  Should the government focus more heavily on the rights and needs of the corporations or of the customers?  Are these rights/needs necessarily at odds with one another?

4. List of achievements sought  what is it that government want to achieve by formulating standards/requirements a) from a consumer's perspective b) from the industry's perspective c) from the government's (as a service provider) perspective?

5. Data protection  How will implementation of the EU Data Protection Directive impact the use of digital signatures?  Should pseudonyms be required for all users of digital signatures or are there users for which they would not be necessary?

6. Law enforcement  What are the law enforcement implications of digital signatures in terms of an actual situation in which their use could be hamper law enforcement?  Should digital signature legislation include express prohibition on PKTSPs generating or storing private signature keys?

7. Encryption standards  Should there be a governmentally supported international standard of encryption?  What are the implications of such a standard and the government?

8. Separation of issues  The government should establish consensus on the separation of authentication and privacy, i.e. encryption for authentication and encryption for secrecy. How can this be addressed?

9. Escrow  Should the government require keys to be kept in escrow?  What are the implications of such a requirement?

27 10. Foreign recognition  What are the WTO implications, if any, of providing or condition for recognition of EU certificates, which are different than those for recognition of non-EU certificates?  Should international agreements with non-EU countries be concluded by the EU, by members states, or both?

11. Evidence  What functions does a signature perform which should be reflected in digital signature legislation?  Should parties be able to override evidentiary requirements by contracts?

12. Open versus closed system  Should there be different legal rules for open and closed systems?  Should signatures from closed system enjoy the same evidentiary presumptions of those from open systems?

13. Certificates  What percentage of certificates used will be tied to personal identity?  Should there be different rules for identity and non-identity certificates?

14. Key management  Why mandate key recovery without: a) having empirically demonstrated that it is economically and technically viable; b) demonstrating that appropriate solutions cannot be implemented without the participation of PKTSPs?

15. Technology neutrality  why seek/require a technology neutral (rather than a product-neutral solution) if the only viable and recognized technology to facilitate ubiquitous secure electronic commerce is asymmetric cryptography?  Why seek technology neutral legislation if the necessary result will impede the certainty of PKI, and confuse or slow the development/implementation of such legislation?

16. Two/three party certification  The government should make a decision between two-party certification and three-party certification and define the different requirements, if any, for both types of certification services providers. How should this be addressed?

17. Hardware versus Software  In what time frame will use of hardware for digital signatures (i.e. chip cards) predominate over software certificates?  Is the extra cost of hardware for digital signature worth the increased security they provide? 18. Dispute settlement  Dispute settlement should be dealt with preferably at global level, e.g. by way of uniform law (regional or preferably global). How will the government initiate/address this?

19. Access to the markets for new PKTSPs  What actions can the government take to keep the barrier to entry at a minimum?

20. Standardisation of techniques, e.g. materials  How can government contribute to stimulate that a single technical infrastructure would support diverging applications?

28 21. Default private law rules  Is it possible to develop or adopt existing provisions that arrange the relations regarding the use of PKI, that are not mandatory but apply as default rules?

22. Consumer advocacy  Should the government support the formation of consumer advocacy groups with respect to PKTSPs?  What would the government's responsibility be to such groups?

23. Government as a relying party  How can the government stimulate the development of certificate policies by requiring or drafting them for use by the public?

29 9 Scenarios Legal Panel Meeting

9.1 Case and pertaining questions handed out on the first day of the Legal Expert Meeting

Preliminary Remarks

In order to stimulate a vivid debate, we decided to use the mechanism of a case. Shortly after, you will be introduced to several key players surrounding a PKTSP. During the course of the meeting, additional information on the characters involved will be provided. Please note that all characters are located in imaginary countries. This, you should try to release yourself from your national legal framework. You look at the legal and practical issues concerned in a highly conceptual manner.

Furthermore, we intend to create an informal atmosphere, where all participants are able to contribute equally to the discussions. You should feel free to bring up your views, whenever you want

30 Introduction : Grisham Inc. and Trustsign Corp.

It is in the spring of 1998. Seth Greenbaum, the marketing manager of Grisham Inc., a publisher of legal content (legal books, legal dictionaries, compilations of laws and compilations of case law, journals) faces a new challenge. Top management has told him to enter the market of agreements’ models to be provided via the Internet.

In organising this new service, Seth plans to assign a number of external legal specialists (suppliers from all over the world) to draft models in all legal areas thinkable and to update them whenever necessary. Seth, although no IT expert, has worked out a plan to deal with the practical IT issues concerned. First, a website needs to be erected. The established site has to contain (1) a public domain to attract the general public and (2) a private domain, accessible to a selected group: suppliers and buyers. This private domain needs to be divided into segments allowing clients to pick up the newest releases of model agreements and allowing suppliers to drop their newest releases. This 24 hours up to date service should launch Grisham Inc. right into the 21-century, reaping the benefits of the Information Society.

Seth is somewhat concerned about the security of the site and the services. Both suppliers and clients need to have absolute certainty that they are accessing the Grisham site. Furthermore, Grisham needs to be sure that it is communicating with its suppliers and clients. Seth submits these issues to Grisham Inc.'s IT department. It advises Seth to get in contact with a company providing Public Key Trusted Service Provider.

After some shopping, Seth gets in contact with, Smiley Nerdwich a sales representative from TrustSign Corp. In order to give Seth a short understanding of the potential services to be performed, Smiley draws up a schematical set-up, detailed below. Server Certificate ID Grisham Inc. Supplier Website s

Personal TrustSign Private Public General Certificates Corp. domain domain Public

Clients Request for a certificate

Smiley explains that Grisham Inc. will need a server certificate to authenticate its website. TrustSign Corp.'s rootcertificates (necessary to check the digital signature on

31 Grisham Inc.’s server certificate) are incorporated in browsers like Netscape Communicator and Microsoft Internet Explorer. He assures that all clients and suppliers use either of these two products. Smiley adds that, in order to get a personal certificate, clients and suppliers will need to fill in an application form on the Grisham Inc. website to order a certificate. The request for a certificate along with a generated public key - key pairs are generated in the browser, private keys never leave the system - will be sent to TrustSign Corp. subsequently. After verification by Grisham Inc. (accompanying a request with a special field with a clientnumber, making a phonecall, checking a third party database), TrustSign Corp. signs the public key of the client/supplier and creates a certificate (X 509 v.3). Finally, the client/supplier receives e-mail with an URL providing information where to pick up the newly created personal digital ID. On the basis of these ID’s suppliers can drop off their drafts whenever necessary, whereas clients can pick up new releases whenever they want.

32 Case I : Organisational aspects

Technically, TrustSign Corp. is capable of rendering any PKTSP service. However, its top management fears that from an organisational point of view it may not be ready yet to supply a full range of PKTSP services. In order to assess its current and future possibilities, TrustSign Corp. seeks advice fromGrey & Dull and grandsons (an accounting firm with a management-consultancy branch.) requiring to establish a long list of possible requirements with respect to the internal organisation of a PKTSP.In the process of creating this list, Grey & Dull and grandsons studies a massive amount of (draft) legislation and other (scientific and policy) documents. On the basis of this exercise it compiles a longlist of issues to be addressed by a PKTSP.  PKTSP long terms strategy and policy  Financial reliability  Security  Personnel  Compliance with standards  Regular audit  Transparency  Impartiality  Supervisory mechanisms  Lawfulness  Physical establishment

Questions

a. Which internal organisational requirements should be met by PKTSPs? b. What are the most appropriate mechanisms to ensure that these requirements are met? c. Suppose that certain PKTSP services can only be rendered by governmental bodies (e.g. Super PKTSP). Should there be any specific requirements in respect of such bodies rendering these services?

33 Case II : Liability

After addressing the concerns raised in Grey & Dull and grandsons’ report, Grisham Inc.’s top management approves Smiley Nerdwich’s plan. Grisham Inc. is in business. In the summer of 1998 businesses is booming, both for TrustSign Corp. and Grisham Inc. Attracted by these successes, Smiley Nerdwich decides to establish his own PKTSP. Considering that he gave the best years of his life to TrustSign, without receiving any proper recognition, Smiley feels that he is fully entitled to copy all software and know-how available at TrustSign Corp. and to sell it to the highest bidder. Cum Fraude Ltd., the biggest competitor of Grisham Inc. acquires all software and know-how from Smiley. The same day it downloads the entire database of agreements and it retrieves many details regarding Grisham Inc.’s clients and suppliers. Additionally, Cum Fraude Ltd. starts up exploiting the material, held by Grisham Corp. Furthermore, Trustsign Corp.'s signing key has been compromised. Top management of both Grisham Inc. and Trustsign Corp. request their respective legal departments to advice on the legal positions of the actors involved.

Questions

a. Do you consider the legal questions concerning liability to be a potential barrier that could hamper the sound development of PKTSPs?

b. If so, via which mechanisms and by whom should these issues be addressed?

34 Case III : Insurance

After assessing the debt recovery chances and based on the advice of its legal department, Grisham Inc. decides to hold TrustSign Corp. responsible for the damages suffered. Fortunately, TrustSign services include an insurance agreement, worth 10.000 ECU. The risks pertaining to this part of the agreement have been reinsured by Luzern Insurance Ltd. Obviously, the costs incurred by Grisham exceed the maximum amount. Referring to the maximum amount TrustSign refuses to pay anything over 10.000 ECU. Furthermore, its legal department stresses that the failure and that the general terms and conditions contain an exoneration clause for other damages. At that point the lawyers come in and a dazzling amount of writs are insurance agreement only covers damages incurred as a direct result of technical issued (note the amount of potential liabilities and the amount of different parties involved).

Questions

a. Do you think that the present situation as regards the possibilities to cover damages resulting from risks pertaining to the rendering and use of PKTSP services may hamper the sound development of PKTSPs? b. If so, via which mechanisms and by whom should this matter be dealt with? (e.g. what should be the role of the different players? In case financial backing is required, should this be a public or private initiative?)

35 Case IV : Foreign recognition

TrustSign Corp. is not a licensed PKTSP because in Utopia, the country where it has its seat of business, no compulsory licensing regime for PKTSPs exists. One of its prospect partners Co-opsign Ltd. is seated in Regularia. Under Regularian law, a governmental license is required to convey PKTSP business. These licenses contain a clause regarding co-operation with foreign PKTSPs. According to this license-agreement a Regularian PKTSP is not allowed to recognise a foreign PKTSP unless this foreign PKTSP has obtained a license under Regularian law.

Questions a. In what situations does the issue of foreign recognition emerge? b. Do you consider this issue critical to the sound development of PKTSPs? c. How could this issue be addressed and by whom?

36 Case V : Export restrictions

TrustSign Corp. uses a signing key of 1024 bits for its certificates. Under Utopian criminal law, the export of longer signing keys is considered to be illegal. One of TrustSign's foreign competitors, SuperCript S.A., which resorts under the looser national export and import regime of Liberalia, shows great interest in Trustsign’s technology. Hence, Superscript’s marketing director gets in contact with Trustsign. Although Trustsign is flattered by the interest shown it has to turn down SupersCript’s request. SupersCript finds it hard to accept this legal impediment. It proposes to have a meeting in order to assess how this legal provision can be circumvented, taking to account all possibilities thinkable.

Questions

a. Does the present situation concerning export restrictions on encryption software impede the sound development of PKTSPs? b. If so, how could this barrier be removed and by whom?

37 Case VI : Law enforcement

In the autumn of 1998 local authorities raid the TrustSign Corp. office. Allegedly an international network of criminals is using its services to communicate secretly. TrustSign Corp. is forced to give access to all data it holds, including all keys, databases, software, paper documents etc.

Questions

a. Does the specific dimension of PKTSPs contribute anything new to the discussion regarding law enforcement in the digital environment? b. If so, what governmental actions can be expected and at what level?

38 Case VII : Competition

(Hand-out: EC Treaty, Competition section)

Early 1999 the Utopian government decides to abolish its export restrictions. Thus, Trustsign Corp. is free to export its technology to a subsidiary company to be established in Liberalia and enter the Liberalian market of PKTSP services. However, it finds itself confronted by highly competitive prices of SupersCript S.A., which is heavily subsidized by its national government. Trustsign regards this situation as a clear example of unfair competition practice.

In the domestic market, Trustsign is the only supplier of PKTSP services. Some members of the Utopian government consider this hazardous to fair competition, since they feel that Trustsign’s contractual arrangements offered to its clients are unfair. At the same time the PKTSP-industry in Utopia is still in an infancy stage and due to a lack of critical mass, Trustsign is losing money. It argues that any governmental measure aimed at creating more competition or lowering prices, would be lethal.

Question

a. Could the application of European competition rules impede the sound development of PKTSPs? b. If so, how could these issues be addressed and by whom? (e.g. Block exemptions at European level.)

39 Case VIII : Public interest

Question

a. Are there any other public interests (complementary to 5, 6 and 7) that need to be addressed? (e.g. consumer and SME protection, a ‘universal access right’, requirements in respect of interoperability, archiving certain data for a period of time.) b. If so, by whom and how?

40 Case IX : Privacy

(Hand-out: EU privacy-directive 1995)

After addressing the issue of alleged unfair competition, TrustSign Corp. and SuperCript S.A. work out a modus operandi to do business. In this process, Superscript gathers an enormous amount of privacy sensitive information about Grisham Inc.'s clients, not only living in Liberalia, but also living in Utopia and Regularia. Due to the nature of the country, privacy protection is low key in Liberalia. Thus, Superscript decides to process (for its own benefit) and to sell these personal data to information brokers. Under Liberalian law this is totally legal.

Question

a. Can the Privacy Directive, issued in 1995, impede the prosperous development of PKTSPs? (e.g. in respect of the qualification of a PKTSP under the Directive and the provision regarding ‘adequate protection level’ (article 25 Directive) in messages exported to third countries). b. How could theses issues be addressed and by whom?

41 Case X : Legal status of PKTSP services

Triggered by the legal procedures against Trustsign Corp., Grisham Inc. seeks advice regarding the legal status of PKTSP services. Its external legal counsel, Persky, Persky & associates, provides an elaborate advice as to the validity of contracts entered into, using PKTSP services. It stresses that certain agreements require special provisions of form, which can not be complied with if the contract is conducted via means provided by PKTSPs. To Seth Greenbaum's great relief, Persky, Persky & associates reaches the conclusion that in respect of the specific type of agreements Grisham Inc. will enter into, no such provisions of form are required.

Question

a. Starting point is that many initiatives are being undertaken in this area (Utah law, Uncitral, OECD). Is there a need for a harmonized approach on the legal status of PKTSP services? b. If so, how should it be regulated and by whom?

42 Case XI : Evidential value

During the civil procedure between Grisham Inc. and TrustSign Corp., the latter wishes to submit certain digitally timestamped documents to prove that certain actions have taken place at a certain time. Grisham Inc.'s lawyer disputes the evidential validity of such documents and, secondly, if the Court would consider them admissable, he claims that such proove is not trustworthy.

Questions

a. Does the present situation concerning evidential value of electronic services impede the prosperous development of PKTSPs? b. If so, how and by whom could this issue be addressed?

43 9.2 Questions submitted during the meeting and answered in writing by the experts

Preliminary remarks

You are requested to answer these three questions trying to put yourself in the position of a potential provider of PKTSP services, eager to get into the market (question 1) and in the position of the Government aiming to stimulate the development of the market for PKTSP services (question 2). In the last question you are requested to create a list of ten issues to be addressed by the BESTS government panel experts who will convene in September.

Question 1

Suppose that you want to enter the PKTSP market from scratch. a. Which legal key issues + uncertainties may really hinder you to enter the market? b. Would you want to have the EU government a role in removing barriers by way of e.g.

- regulatory activities

- stimulating good practice

- setting a voluntary framework

- Setting international standards? c. What are really the key problems in giving the government a certain role?

Question 2

Suppose that you are the EU government and you want to stimulate the market for trusted services. a. What are the key reasons why you do not want to leave it to the market b. What issues do you not want to leave to the market?

44 c. Is there a necessity to distinguish in this respect different types of services?

Question 3

Consider yourself in the position that you are asked to determine the agenda of the government panel (consisting of representatives involved in the creation of governmental policies in respect of PKTSPs at national, EU and global level within the BESTS framework. Please provide a list of ten issues to be put on its agenda, adding two questions for each issue to be posted at this meeting.

45 10 Summary of the Desk study on Business Issues

All BESTS issues are fundamentally business issues. The ultimate goal of BESTS is to address the commercial ETS industry in Europe. Therefore, when technical, legal and government issues are raised in the study, it should be borne in mind that the purpose is to discuss these matters in the context of the creating a favourable business environment for ETS service providers.

BESTS goes well beyond electronic commerce to encompass all areas of interaction between suppliers and consumers, including secure messaging, asset trading, health care, citizen interactions with government (registration, tax payment, elections), banking and much more.

There is little agreement in industry and academia as far as the definitions of the various terms that BESTS concerns itself with are concerned. This includes phrases such as “trusted service”, “trusted third party”, and “certificate authority”. The BESTS have agreed on terms among themselves.

Players in the PKI-based ETS field fall into two groups: a) organisations which finance, build and run the PKI infrastructure, such as certificate authorities, telecoms and banks, and b) organisations and persons who use the infrastructure, such as Internet retailers, consumers and organisations building and using intranets and extranets.

Key BESTS business issues fall into the following 15 categories:

 Assurance

 Capital equipment

 Competition

 Cross-certification

 Customer base (provider)

 Customer base (user)

 Differentiation and added value

 Existing players

 Export restrictions

 Infrastructure and Access

 Insurance and Liability

 Investment (external)

 Perception and trust

 Profitability

 Related products and services

46 A hypothesis has been put forth by the BESTS business team which states that certificates and their associated markets will evolve to the point there the only differentiation between certificates will be in the areas of user perception and insurance. The user, directed by his or her perception of the trustworthiness of a certificate, will decide which certificate authority to use, or whether to use one at all.

A “high-assurance” certificate is generally crypto-graphically equivalent to one providing less assurance – the only difference between the two being, in many cases, the amount of insurance associated with the certificate. This difference in insurance accounts for 100% of the difference in cost to the certificate authority. Hopefully, the BESTS study will shed light on the validity of this hypothesis.

47 11 Summary of the Desk study on Government Issues