HOUSE BILL REPORT
HB 2635
As Passed House:
February 6, 1996
Title: An act relating to electronic signatures.
Brief Description: Creating the Washington digital signature act.
Sponsors: Representatives Horn, Romero, McMorris, Chappell and Conway; by request of Secretary of State.
Brief History:
Committee Activity:
Energy & Utilities: 1/24/96 [DP].
Floor Activity:
Passed House: 2/6/96, 79-18.
HOUSE COMMITTEE ON ENERGY & UTILITIES
Majority Report: Do pass. Signed by 9 members: Representatives Casada, Chairman; Crouse, Vice Chairman; Hankins, Vice Chairman; Patterson, Ranking Minority Member; Poulsen, Assistant Ranking Minority Member; Chandler; Kessler; Mastin and Mitchell.
Staff: Karen Tyler (786-5793).
Background: An increasing amount of commerce, particularly international commerce, is transacted electronically. For example, it is possible to use on-line services to conduct financial transactions and to transmit other personal or business correspondence. To make the maximum possible use of the electronic medium in business transactions, participants require a means by which to transmit documents confidentially, and, perhaps more importantly, to transmit authenticated documents bearing legally binding original signatures. The ability to transmit electronic messages carrying legally binding signatures would allow businesses to conduct transactions and to enter into binding contracts entirely by electronic means.
A digital encryption system allows a person to 1) protect an electronic message so that only its intended recipients can read it, and 2) authenticate or "sign" the message so that recipients can verify its source. There are several types of digital encryption systems, of which the dual-key encryption system is one.
Each person using a dual-key encryption system has two digital codes or "keys," a secret key and a public key. The user keeps the secret key confidential, and shares the public key with persons with whom he or she wishes to exchange confidential and/or authenticated electronic messages. Each key can read a message encoded by the other and is the only means by which to read a message encoded by the other.
System users can send confidential electronic messages. Anyone can use a public key to encode a message to that key's owner, and the key owner can then use his or her corresponding secret key to read that message. No one but the owner of the public key, the intended recipient of the message, can decode the message, because no one else has access to the secret key.
Users can also authenticate, or "sign," electronic messages. The sender can use his or her secret key to encode, and thereby digitally "sign," a message, and the recipient can verify the electronic signature by using the sender's public key to decode it. Decoding the message with the sender's public key proves that the sender was the true originator of the message and that no one else has altered it, because the sender alone possesses the secret key that made the signature.
Public keys are kept, and made available to the public, in computer files called "key certificates" that generally include the key owner's identity, a time-stamp indicating when the key pair was generated, and the public key code. "Certification authorities" may be employed to create these certificates and guarantee that they are authentic. Certification authorities can play an important part in a dual-key system in guaranteeing that the public keys they make available really belong to the persons to whom they appear to belong. If there is no mechanism by which to ensure that a public key actually belongs to its purported owner, dishonest persons may create "imposter" key pairs, making possible both forgery and interception of confidential communications.
A number of private companies provide or plan to provide encryption services.
Summary of Bill:
Authorities of the Secretary of State
The Secretary of State (secretary) is authorized to license certification authorities, and, if no certification authority is licensed within 6 months of enactment, to serve as a certification authority until another authority is licensed. The secretary is directed to adopt rules to a) govern the practice of licensed certification authorities; b) determine the value of the surety bond or irrevocable letter of credit which a licensed authority must file with the secretary guaranteeing payment of any damages awarded against it for violation of the statute; c) review software used in creating digital signatures; d) specify requirements for the form of certificates issued by licensed certification authorities; e) specify requirements for record-keeping by licensed certification authorities; f) specify requirements for the content and form of certification authority disclosure records; and g) specify the form of certification practice statements. In addition, the secretary must maintain a publicly accessible database containing disclosure records for each licensed certification authority setting forth information as the secretary may require by rule.
The secretary is authorized to set fees for all services rendered under the statute, and fee revenues are deposited in the secretary's revolving fund.
Licensing of Certification Authorities
To qualify for a license, a certification authority must employ qualified persons who have not been convicted within the past 15 years of a felony or crime involving fraud, false statement, or deception; have the right to use a computer system that is reasonably secure from intrusion and misuse, reasonably reliable, and suited to its intended functions; present proof of sufficient working capital; maintain an office in the state or a registered in-state agent for service of process; file surety bonds or irrevocable letters of credit with the Secretary of State, in an amount the Secretary of State is directed to determine by rule, for payment of damages awarded against the certification authority for violation of the statute (public entities are excepted from this requirements under some circumstances); and comply with all further licensing requirements the secretary may establish. The secretary may issue restricted licenses.
The secretary may recognize the authority of other government entities to license or authorize certification authorities provided that they impose requirements similar to those of the state.
Issuance of a Certificate
"Certificates" are computer-based records digitally signed by the issuing authority, and containing three pieces of information: 1) the identity of the issuing certification authority, 2) the identity of the subscriber (key holder), and 3) the subscriber's public key. The "subscriber" holds the private key corresponding to the public key listed in the certificate.
A licensed certification authority may issue a certificate to a subscriber only if it has received a signed request for a certificate and confirmed the identity of the prospective subscriber, the accuracy of information to be listed in the certificate, that the prospective subscriber holds a private key capable of creating a digital signature, and that the prospective key holder has not obtained the private key corresponding to the public key to be listed in the certificate by illegal means, or disclosed it to persons who are not authorized to create the prospective key holder's digital signature. The authority must publish a signed copy of each certificate it issues in a "recognized repository" unless the parties provide otherwise by contract. A "repository" is a system for storing and retrieving certificates and other information relevant to digital signatures. The secretary must "recognize" repositories that meet specified standards (see below).
In issuing a certificate, a licensed authority warrants to the key holder (the subscriber) that the certificate contains no information known to be false and satisfies the requirements of the law, and promises to act promptly to suspend or revoke the certificate and give the subscriber reasonable notice if its reliability comes into question. The licensed authority certifies to all persons who reasonably rely on the information contained in a certificate that it is accurate and states all information foreseeably material to its reliability, that the subscriber has accepted it, and that the authority has complied with all applicable laws of the state.
Upon request, a licensed certification authority must disclose information material to the reliability of any certificate or to its ability to perform its services.
Duties of Subscriber
In accepting a certificate from a licensed authority, the subscriber certifies that 1) he or she holds the private key corresponding to the public key listed in the certificate and has not obtained it through unlawful means or disclosed it to persons who are not authorized to create his or her digital signature; and 2) all representations he or she has made to the authority material to information listed in the certificate are true. In accepting a certificate, the subscriber indemnifies the issuing authority for loss or damage caused by issuance or publication of a certificate in reliance on the subscriber's false representations or failure to disclose important facts with the intent to deceive or with negligence.
The subscriber assumes a duty to retain control of the private key. The private key is the personal property of the subscriber; if the certification authority holds the private key, it holds it as a fiduciary to the subscriber and may use it only with the subscriber's approval.
Suspension or Revocation of a Certificate
A licensed certification authority must immediately revoke a certificate upon discovery that it was not issued as required by the statute. The secretary may order a licensed authority to suspend or revoke a certificate if it determines that the certificate was issued without substantial compliance with the statute and noncompliance poses significant risk to persons relying on the certificate.
Unless the certification authority and subscriber agree otherwise, a licensed certification authority must suspend a certificate for up to 48 hours upon request of the secretary, the subscriber, or a person likely to know that the security of the subscriber's private key is compromised. Under specified circumstances, the secretary or a county clerk may suspend a certificate issued by a licensed authority. Licensed authorities must publish notice of a certificate's suspension as specified in the certificate.
A licensed certification authority must revoke a certificate upon request of the subscriber, once the subscriber no longer exists, and if the certificate becomes unreliable. Immediately upon revocation of a certificate, the licensed authority must publish notice in a recognized repository (see below). Once a certificate is revoked, and once they have met specified conditions, the subscriber and certification authority are relieved of duties and warranties.
Each certificate must state its expiration date. All certificates expire three years after they are issued unless a longer effective period is specified.
Liability for Damages Due to Reliance on a Certificate
A licensed certification authority must file surety bonds or irrevocable letters of credit with the secretary, in an amount the secretary is directed to specify by rule, to guarantee payment of damages assessed against the authority for violation of the statute. This guarantee may restrict the authority's total annual liability to the face amount of the guarantee.
Requirements are established for recovery on a surety bond or letter of credit. Claimants must file written notice within three years of a violation.
The certification authority and the subscriber may set a "reliance limit" on a certificate, suggesting that third parties rely on the certificate only to the extent that total risk does not exceed the recommended limit. A licensed certification authority is not liable for loss caused by reliance on false or forged digital signatures of a subscriber if the authority has complied with all requirements of the law, and is not liable in excess of the amount specified in the certificate as its recommended reliance limit for either loss caused by reliance on a misrepresentation of fact in the certificate that the authority was required to confirm or failure to comply with statutory requirements in issuing the certificate. A licensed certification authority is liable only for direct compensatory damages in an action to recover loss due to reliance on a certificate, and is not liable for punitive or exemplary damages, damages for lost profits or opportunities, or for damages due to pain and suffering.
A recipient of a digital signature assumes the risk of forgery if reliance on the digital signature is not reasonable under the circumstances.
Effect of a Digital Signature
When a lawful signature is required, a digital signature will suffice if the digital signature is verified by reference to the public key in a valid certificate issued by a licensed certification authority and was affixed by the signer with the intent to sign, and the recipient has no knowledge that the signer has improperly disclosed the private key used to affix the signature or obtained it illegally.
An electronic message is as valid, enforceable, and effective as if it had been written on paper if it 1) bears a digital signature, and 2) that signature is verified by the public key listed in a certificate that was issued by a licensed certification authority and valid at the time the signature was created.
Courts are required to make certain presumptions in adjudicating disputes involving a digital signature. Courts must presume that a certificate signed by a licensed certification authority was issued by that authority, accepted by the subscriber, and contains accurate information. If a digital signature is verified by a public key listed in a valid certificate issued by a licensed certification authority, courts must presume that the signature is that of the certificate subscriber and affixed with the intention of signing the message, that the message recipient assumed it was valid, and that the signature was created before it was time-stamped.
Repositories
A repository is a system for storing and retrieving certificates and other information relevant to digital signatures. Licensed certification authorities must publish copies of certificates they issue in "recognized repositories," unless the parties provide otherwise by contract.
The secretary is required to recognize one or more repositories that 1) are operated under the direction of a licensed certification authority; 2) include a proper database; 3) operate by means of a trustworthy system; 4) do not contain a significant amount of false information; 5) contain certificates published by certification authorities that conform to legally binding requirements that the secretary finds similar or more stringent than those of the state; 6) keep an archive of certificates that are suspended, revoked, or that have expired; and 7) comply with other requirements the secretary may adopt. A repository may apply for recognition by the secretary.
A repository is liable for loss incurred due to reliance on a digital signature verified by the public key listed in a suspended or revoked certificate, if the loss was incurred more than one business day after the repository received a request to publish notice of suspension or revocation of the certificate and failed to do so. A recognized repository is liable for only direct compensatory damages not to include punitive or exemplary damages, damages for lost profits or opportunity, or damages for pain and suffering, and is not liable for misrepresentation in a certificate published by a licensed certification authority, for reporting or recording information as required or permitted under the statute, or for an amount in excess of the recommended reliance limit set for the certificate at issue.
Oversight and Discipline of Certification Authorities
The secretary may investigate activities of a licensed certification authority material to its compliance with the statute, may suspend or revoke licenses, and may impose fines for violations not to exceed $5,000 per incident. The secretary may publish in the repository it maintains or elsewhere brief statements advising subscribers, persons relying on digital signatures, or other repositories about activities of licensed or unlicensed certification authorities that create an unreasonable risk of loss. A process is defined by which a named authority may contest these reports.
A certified public accountant with expertise in computer security or an accredited computer security professional must audit the operations of each licensed certification authority at least once per year to assess compliance with the statute. The secretary must publish the results of these audits in the certification authority disclosure records it maintains for all licensed authorities. The secretary may exempt small or less active certification authorities from audit requirements under certain circumstances.
Appropriation: None.
Fiscal Note: Requested on January 22, 1996.
Effective Date: The bill takes effect January 1, 1998.
Testimony For: Institution of a dual-key encryption system as proposed in the bill will strengthen Washington's position as a lead state in international trade. By making it possible to transmit electronic messages bearing authentic signatures, companies in the state will be able to conduct more transactions electronically and to conduct business more efficiently. Washington should move into the twenty-first century and offer companies in the state this "high-tech" communications system.
Several other states have already implemented systems as proposed in the bill. The bill incorporates guidelines for digital signatures developed and approved by the American Bar Association.
The banking industry is excited about the dual-key encryption system concept, but has concerns about details of the bill. The industry already transacts a good deal of business electronically and wants to ensure that the system proposed in the bill is consistent with its current practices. The industry also has some concerns about liability issues in the instance that one party to an electronic transaction does not accept a digital signature as a legally valid signature.
Testimony Against: None.
Testified: (in favor) Representative Jim Horn, prime sponsor; Ralph Munro, Secretary of State; Linda MacIntosh, Secretary of State's Office; and Meara Nisbet, Washington Banker's Association (with concerns).