1 July 1998
Source:
http://www.fsk.dk/fsk/div/hearing/report.html
Thanks to Theodor Schlickman
The Copenhagen Hearing April 23 - 24 1998 |
||
European expert hearing on digital signatures and encryption |
| Ministry of Research and Information Technology | EU-commission | Hearing |
The first day of the Copenhagen Hearing was dedicated to the global market trends in cryptography, the business use of cryptographic techniques, the development of the European cryptographic industry and the problems of law enforcement with the wide-spread use of cryptography. This report summarises the presentations and discussions of these subjects during the hearing.
It is the common view of almost all experts that the market for products using cryptographic techniques will face a large growth within the next years. Driving force of this growth is the Internet where cryptographic techniques are used for secure authentication, secure communication, digital signatures and to provide secure payment systems. These techniques will provide the basis that allow reliable electronic commerce, which is in most forecasts one of the fastest growing business areas in the near future. It will create new business opportunities but will also produce new technical and political challenges. So cryptographic techniques are a key feature that allow us to use the business opportunities of an electronic world in a secured way. They are already a standard feature of today’s Web browsers and will be part of much more applications in the near future.
It is also the common view of the experts that the overall amount of this growth and the share European industry will take in this market depends not only on technical but also on political regulations with respect to the export, import and use of cryptographic techniques. Such regulations should reflect the business needs as well as the technical progress to serve as enabling, not disabling factors for the deployment of cryptographic techniques as supporting elements for new business areas like electronic commerce.
Although cryptographic algorithms in general are well known and simple
implementations are widely available, the market volume for those products
in Europe is not as large as one would expect. Several factors have been
identified that have been prohibitive for a large scale deployment in the
past:
To overcome some of the technological problems that prohibit the wide-scale
deployment of cryptographic techniques some encouraging trends can be determined
which will provide the basis for the forecasted growth of the market.
There is the fear that the wide-spread use of encryption services will
significantly reduce the ability of law enforcement to combat criminal
activities. This has lead to several proposals within Europe and other countries
throughout the world to set up a scheme which would enable law enforcement
agencies to have access to the keys used for encryption under defined
circumstances. The basis for those proposals are methods integrated into
the key management scheme used, which provide the ability for a third party
to access the key. Two technical methods are discussed in this context: Key
Escrow and Key Recovery. The discussion on the subject revealed a set of
problems with the use of those techniques:
Generally spoken most experts view the technology for Key Escrow and Key Recovery as not mature enough to propose them for large scale deployment. In addition the requirements from government and business regarding encryption services in general and emergency access to encryption keys in particular need to be discussed and harmonised on a European basis. Different national regulations will result in significant interoperability problems which would lead to a major disadvantage of European industry in the effort to take over a leading role in the development of cryptographic services within a global information infrastructure.
The position of the European industry on the global market for cryptographic
services is characterised by the following statements:
On April 23-24, 1998, a European expert hearing on digital signatures and encryption took place in Copenhagen. The following discussions on the first day related to: global market trends on cryptography (session 1), business use of cryptography (session 2), the European cryptography industry (session 3) and law enforcement and cryptography (session 4). The second day of the hearing dealt with electronic authentication and digital signatures.
As for the deliberations for the first day of the hearing, the discussions
on the second day were based on a theme paper in which a number of questions
were identified within the following session headlines:
Recapitulating the discussions within these three sessions, three general
problem areas were dealt with which face governments, industry and private
users who face the challenge of providing (at least) the same security for
digital signatures as applicable for paper based signatures:
Minimum requirements for digital signatures have already been set forth in a number of digital signature laws in order to provide for trust in digital signatures. However, on an international scale, the Copenhagen hearing made it clear that it is still an open question whether such requirements should be put into legislation or left to the market. Whereas market forces might be an effective way to develop such requirements, there is a risk that requirements will be established which do not provide for interoperability. To address this question, the theme paper had raised a number of questions as to the need to regulate the interoperability question, the need to develop minimum requirements for certification procedures and the need to develop rules for digital signature products.
Strong arguments were made that states should promote the development of generally accepted practices before taking the step of amending their laws that would permit acceptance of electronic information in satisfaction of statutory obligations and would allow the use of electronic media as a means of communication between private parties. Such practices might more effectively serve as a wide basis for trust in electronic documents and signatures. At the time of the hearing, some states are specifically considering the establishment of minimum requirements in relation to the use and management of digital signature keys and to the issue of certificates by Certification Authorities. There was no consensus that this approach should be adopted on a global scale.
It was generally felt, however, that minimum requirements set by states must be reasonable and flexible to accommodate the variety of contexts, purposes and transactions in which electronic documents and signatures will be used. Reference in legislation to specific technologies should not have the effect of restricting the use or development of other technologies or preventing the use of other technologies that may be suitable for legal purposes. Also, the risk that every state may create its own, preferred set of requirements as a prerequisite to legal recognition in that state, may aggravate discrepancies among states and create barriers to cross-border recognition. This concern prompted recommendations for the development of common minimum requirements - or one set of standards - that could be acceptable and apply to all member states.
According to the draft European Union Directive, the main contents of which were reported at the hearing, there is no prohibition against the provision of electronic authentication services. CAs may provide services without being regulated or without meeting the minimum requirements set out in the EU Directive. However, only those electronic signatures based on a qualified certificate issued by a CA which comply with minimum requirements set out in the EU Directive will be granted automatic recognition for the purposes of admissibility as evidence and of private or civil law requirements of a signature. Legal recognition of other electronic signatures or associated with CAs that do not satisfy the minimum requirements will have to be obtained by proving the reliability or trustworthiness of the signature method and related procedures. In answering concerns that the Directive would entrench the use of digital signatures only, it was emphasized that the Directive is technology-neutral and that electronic signature is defined in an objective manner that would encompass other technologies.
According to the draft Directive, member states will be permitted to use voluntary accreditation schemes to evaluate CAs. CAs will have the choice to be accredited voluntarily or to compete in the market, proving the reliability of its certificate. Although minimum requirements are set out in the Directive for the authentication activities of CAs, for their products and for certificates, no requirements have been proposed to regulate the conduct of users and users’ products.
According to some digital signature laws, minimum requirements for CA-services and digital signature products serve as a prerequisite to legal recognition of digital signatures in place of conventional signatures. Different concepts in each state underlying signatures and formal requirements make it difficult to establish common requirements that can permit recognition in other states. States are also faced with the problem of interpreting or revising their current laws to accommodate the use of technologies and to determine the extent to which laws require revision. The decision to establish minimum requirements as a prerequisite to recognition may have a bearing on the nature and extent of revision to a state’s legal framework. Apart from the decision to establish minimum requirements, however, a state must consider how to organize and encourage its government in the revision of its legal framework.
To address these issues, the nature of legal recognition was first discussed. It was agreed that "legal recognition" of electronic documents and signatures manifested itself in European member states in a number of areas: evidence in civil litigation; in the form of electronic contracts and signed documents between contracting parties; and by public administrations, to the extent that they are computerized to accept electronic form.
Second, the ways of achieving legal recognition were considered. It was pointed out that there are two ways to achieve legal recognition: through interpretation of current statutes, without statutory reform; or through statutory reform, either through the revision of current statutes or by means of new legislation. It was suggested that existing statutes may not require amendment if they could be interpreted flexibly to accommodate or to recognize electronic equivalents to conventional documents. If statutes cannot be flexibly interpreted, only minor adjustments may be effective to provide for electronic equivalent to formal requirements, without affecting the substance of the statute. If new legislation is specifically needed to accommodate the use of information technology, the legislation should be technology-neutral and should not re-invent legal substance. If not, legislators may realize that technology-specific amendments to existing legislation may have to be revised within the near future.
There seemed to be widespread consensus that the primary purpose of interpretation of statutes or revisions to statutes is to ensure that an electronic signature will not be rejected simply because of its electronic form. In order to accomplish revisions to statutes, governments must look behind the actual form of the signatures, and look instead to the function and use of the signature.
The role of minimum requirements and their relationship to legal recognition was explained. The purpose of the minimum requirements to be established in legislation is to introduce a high standard which may be followed, but which is not required to be followed. In return for following the standard, legal recognition would be granted. It was emphasized that the introduction of a standard by legislation should not eliminate the recognition of electronic documents that had been signed by means other than digital signatures. Rather, adherence to minimum requirements or standards provide the basis for automatic recognition without exhaustive proof. In order to avoid the proliferation of national standards throughout Europe, however, a recommendation was made that only one standard should be established for the European Union. It was also stated that this standard should be limited to the use of digital signature technique for the purpose of producing a "legal signature and if the standard is followed, then the signature would be recognized as "legal" in other member states. No indication was given, however, of how this general standard should be produced.
Third, a method was described by which governments could organize their departments to review and revise their statutes in order to accommodate the recognition of electronic documents and signatures. A general review of statutes to assess the volume of form requirements was carried out. The specific form requirements must be reviewed in order to evaluate whether digital signatures could be accepted for the particular requirement of the signature. By the opt-out or exception model, departments would start from the premise that digital and conventional signatures would be on an equal footing unless the department specifically opted out. The alternative approach, the opt-in or inclusion model, would permit departments to review each statutory and regulatory provision and specifically opt-in to the equivalence principle. The advantages and disadvantages of the opt-in and opt-out models were described.
The discussions on liability raised two questions: Liability for the CA (e.g. for flaws in the issuing of certificates or the identification of key holders), and the liability of users (for not taking proper care of signature devices so that false signatures are issued). The discussions on this issue which in the theme paper is stated as "the single most important problem when creating a framework for digital signatures" proved that these two questions should be discussed separately, since different concerns come into play.
Regarding the liability for CAs, the discussions made it quite clear that there is a relationship between the willingness of CAs to accept liability for damages which might arise from their electronic authentication activities and the willingness of governments, courts and commercial parties to recognize digital signatures and certificates associated with that CA. In order to manage their risk, CAs will have to limit their liability through contractual networks or by means of notice clauses in certificates or practice statements.
The presentations and discussion centered on two major fields:
As to the role of government, it was generally felt to be premature to legislate specific liability rules relating to electronic authentication activities. Government liability rules as a global solution would not be a useful because they would increase uncertainty. Moreover, it would be difficult to formulate a global framework on liability.
The use of contracts as a method to establish a scheme for obligations and liabilities of parties was generally felt to be acceptable. However, it was pointed out that the use of contracts might not be accepted as a global solution to establishing a liability regime that would apply to all parties, especially where there is no contract between a CA and a relying party or where there are consumer protection laws. The group considered the possibility of establishing default rules which could apply in the absence of contractual liability scheme, but this option was not fully explored.
On one hand, it was suggested that government should legislate minimum standards for CAs to define their responsibilities and to allow them to limit their liabilities using a CPS. On the other hand, however, concern was expressed that a statutory regime on digital signatures and CA activities might be interpreted in a manner that would override contractual schemes or notices established by a CA for closed system.
Generally, it was agreed that, in the absence of a contractual framework, a CA must bring notice to a relying third party of limitations on the use of the certificate and of the CA’s liability. In this regard, it is worth noting the statement made in an earlier session, that the Draft European Union Directive requires limitations of certificates and on CA liability to be expressly set out in the certificate, not merely incorporated by reference to other documents.
In considering the nature of the CA’s liability, it was strongly felt that it would be premature to establish the CA’s liability for electronic authentication activities as strict in nature. Strict liability regimes were established for dangerous activities or where insurance and liabilities regimes have not produced fair results. There is no evidence at this time that errors or damages arising from electronic authentication activities will lead to unfair allocation or assessment of liability. There was a definite leaning towards establishing the CA’s liability as contractual in nature, based on its contracts, certification practice statements, and notices in certificates, subject to rules which protect consumers.
The availability of insurance is a recent trend. Several years ago, CAs claimed that insurance was not available to underwrite risks as it was not possible for insurance companies to assess the level of potential risk. CAs lobbied governments to recognize and uphold limits of liability and limitations of liability in contracts and notices to third parties. The availability of insurance may relieve governments from lobbying for this particular issue. However, governments retain an interest in consumer protection and may continue to monitor the CA industry to ensure that responsible practices are developed and that business is not conducted at the expense of the consumer.
Although governments have previously been lobbied to harmonize liability regimes for international commerce, no statement was made at the Copenhagen hearing that governments should take active steps to harmonize liability regimes internationally or even to legislate limitations of liability in favour of CAs. Instead, it was suggested that governments would not succeed in harmonizing liability schemes. With the increasing availability of insurance, it may be premature for governments to engage in liability harmonization initiatives.
At this time, there seems to be a trend not to regulate a liability scheme for CAs, but simply to let CAs manage their risks and compete in the marketplace, according to their willingness to accept liability, subject to current rules on contracts and consumer protection. The immediate concern of governments will be to monitor how CAs and insurance companies collaborate to manage the CA’s risk and to assess how CAs act towards consumers. The policy questions posed in the theme paper may then be reviewed in light of developing trends.
One of the first reactions of some governments to digital signature technology was to legislate all aspects of digital signatures and related activities. The aims of this legislation were to ensure a level of trust in the use of digital signature and in the conduct of CAs by setting minimum standards of both the digital signature and the CA itself; and to confer a benefit on CAs by recognizing limits to their liability, thereby encouraging CA activity. However, this legislation tended to be restrictive in scope and effect. Also, it is considered that legislation had the effect of discouraging CA activity. Also, the Copenhagen hearing brought to light the understanding that the term "digital signature legislation" is imprecise. Contrary to other kinds of legislation which deal with specific and discrete subject matters, such as traffic, taxation, sales legislation and crime, the scope and content of digital signature legislation may vary from government to government.
It was strongly suggested that digital signature legislation be introduced
– when needed – to balance a number of objectives:
In particular, governments were cautioned to provide for legal recognition by making minor adjustments to the current statutory framework instead of building a new a new statutory framework on digital signatures to replace paper-based rules. Overall, the general message to governments is the following: if governments intend to create a set of common minimum requirements in order to achieve legal recognition on a harmonized basis, the potential to use other technologies and to prove their merit for the purpose of legal recognition must be preserved.