AN ACT Relating to
electronic signatures; adding a new chapter to Title 19 RCW; prescribing
penalties; and providing an effective date.
BE IT ENACTED BY THE
LEGISLATURE OF THE STATE OF WASHINGTON:
PART I. SHORT TITLE, INTERPRETATION, AND
DEFINITIONS
NEW SECTION. Sec.
1. SHORT TITLE. This chapter shall be
known and may be cited as the Washington electronic authentication act.
NEW SECTION. Sec.
2. PURPOSES AND
CONSTRUCTION. This chapter shall be construed consistently with what is
commercially reasonable under the circumstances and to effectuate the following
purposes:
(1) To facilitate
commerce by means of reliable electronic messages;
(2) To minimize the
incidence of forged digital signatures and fraud in electronic commerce;
(3) To implement
legally the general import of relevant standards, such as X.509 of the international
telecommunication union, formerly known as the international telegraph and
telephone consultative committee; and
(4) To establish, in
coordination with multiple states, uniform rules regarding the authentication
and reliability of electronic messages.
NEW SECTION. Sec.
3. DEFINITIONS. Unless the
context clearly requires otherwise, the definitions in this section apply
throughout this chapter:
(1) "Accept a
certificate" means either:
(a) To manifest
approval of a certificate, while knowing or having notice of its contents; or
(b) To apply to a
licensed certification authority for a certificate, without cancelling or
revoking the application by delivering notice of the cancellation or revocation
to the certification authority and obtaining a signed, written receipt from the
certification authority, if the certification authority subsequently issues a
certificate based on the application.
(2) "Asymmetric
cryptosystem" means an algorithm or series of algorithms that provide a
secure key pair.
(3)
"Certificate" means a computer-based record that:
(a) Identifies the
certification authority issuing it;
(b) Names or identifies
its subscriber;
(c) Contains the
subscriber's public key; and
(d) Is digitally signed
by the certification authority issuing it.
(4) "Certification
authority" means a person who issues a certificate.
(5) "Certification
authority disclosure record" means an on-line, publicly accessible record
that concerns a licensed certification authority and is kept by the secretary.
A certification authority disclosure record has the contents specified by rule
by the secretary under section 104 of this act.
(6) "Certification
practice statement" means a declaration of the practices that a
certification authority employs in issuing certificates generally, or employed
in issuing a material certificate.
(7) "Certify"
means to declare with reference to a certificate, with ample opportunity to
reflect, and with a duty to apprise oneself of all material facts.
(8) "Confirm"
means to ascertain through appropriate inquiry and investigation.
(9)
"Correspond," with reference to keys, means to belong to the same key
pair.
(10) "Digital
signature" means a transformation of a message using an asymmetric
cryptosystem such that a person having the initial message and the signer's
public key can accurately determine:
(a) Whether the
transformation was created using the private key that corresponds to the
signer's public key; and
(b) Whether the initial
message has been altered since the transformation was made.
(11) "Financial
institution" means a national or state-chartered commercial bank or trust
company, savings bank, savings association, or credit union authorized to do
business in the state of Washington and the deposits of which are federally
insured.
(12) "Forge a
digital signature" means either:
(a) To create a digital
signature without the authorization of the rightful holder of the private key;
or
(b) To create a digital
signature verifiable by a certificate listing as subscriber a person who
either:
(i) Does not exist; or
(ii) Does not hold the
private key corresponding to the public key listed in the certificate.
(13) "Hold a
private key" means to be authorized to utilize a private key.
(14) "Incorporate
by reference" means to make one message a part of another message by
identifying the message to be incorporated and expressing the intention that it
be incorporated.
(15) "Issue a
certificate" means the acts of a certification authority in creating a
certificate and notifying the subscriber listed in the certificate of the
contents of the certificate.
(16) "Key
pair" means a private key and its corresponding public key in an
asymmetric cryptosystem, keys which have the property that the public key can
verify a digital signature that the private key creates.
(17) "Licensed
certification authority" means a certification authority to whom a license
has been issued by the secretary and whose license is in effect.
(18)
"Message" means a digital representation of information.
(19) "Notify"
means to communicate a fact to another person in a manner reasonably likely
under the circumstances to impart knowledge of the information to the other
person.
(20) "Operative
personnel" means one or more natural persons acting as a certification
authority or its agent, or in the employment of, or under contract with, a
certification authority, and who have:
(a) Managerial or
policymaking responsibilities for the certification authority; or
(b) Duties directly
involving the issuance of certificates, creation of private keys, or
administration of a certification authority's computing facilities.
(21) "Person"
means a human being or an organization capable of signing a document, either
legally or as a matter of fact.
(22) "Private
key" means the key of a key pair used to create a digital signature.
(23) "Public
key" means the key of a key pair used to verify a digital signature.
(24) "Publish"
means to record or file in a repository.
(25) "Qualified
right to payment" means an award of damages against a licensed
certification authority by a court having jurisdiction over the certification
authority in a civil action for violation of this chapter.
(26)
"Recipient" means a person who receives or has a digital signature
and is in a position to rely on it.
(27) "Recognized
repository" means a repository recognized by the secretary under section
501 of this act.
(28) "Recommended
reliance limit" means the monetary amount recommended for reliance on a
certificate under section 309(1) of this act.
(29)
"Repository" means a system for storing and retrieving certificates
and other information relevant to digital signatures.
(30) "Revoke a certificate"
means to make a certificate ineffective permanently from a specified time
forward. Revocation is effected by notation or inclusion in a set of revoked
certificates, and does not imply that a revoked certificate is destroyed or
made illegible.
(31) "Rightfully
hold a private key" means the authority to utilize a private key:
(a) That the holder or
the holder's agents have not disclosed to a person in violation of section
305(1) of this act; and
(b) That the holder has
not obtained through theft, deceit, eavesdropping, or other unlawful means.
(32)
"Secretary" means the secretary of state.
(33)
"Subscriber" means a person who:
(a) Is the subject
listed in a certificate;
(b) Accepts the
certificate; and
(c) Holds a private key
that corresponds to a public key listed in that certificate.
(34) "Suitable
guaranty" means either a surety bond executed by a surety authorized by
the insurance commissioner to do business in this state, or an irrevocable
letter of credit issued by a financial institution authorized to do business in
this state, which, in either event, satisfies all of the following
requirements:
(a) It is issued
payable to the secretary for the benefit of persons holding qualified rights of
payment against the licensed certification authority named as the principal of
the bond or customer of the letter of credit;
(b) It is in an amount
specified by rule by the secretary under section 104 of this act;
(c) It states that it
is issued for filing under this chapter;
(d) It specifies a term
of effectiveness extending at least as long as the term of the license to be
issued to the certification authority; and
(e) It is in a form
prescribed or approved by rule by the secretary.
A suitable guaranty may
also provide that the total annual liability on the guaranty to all persons
making claims based on it may not exceed the face amount of the guaranty.
(35) "Suspend a
certificate" means to make a certificate ineffective temporarily for a
specified time forward.
(36) "Time
stamp" means either:
(a) To append or attach
to a message, digital signature, or certificate a digitally signed notation
indicating at least the date, time, and identity of the person appending or
attaching the notation; or
(b) The notation thus
appended or attached.
(37)
"Transactional certificate" means a valid certificate incorporating
by reference one or more digital signatures.
(38) "Trustworthy
system" means computer hardware and software that:
(a) Are reasonably
secure from intrusion and misuse;
(b) Provide a
reasonable level of availability, reliability, and correct operation; and
(c) Are reasonably
suited to performing their intended functions.
(39) "Valid
certificate" means a certificate that:
(a) A licensed
certification authority has issued;
(b) The subscriber
listed in it has accepted;
(c) Has not been
revoked or suspended; and
(d) Has not expired.
However, a
transactional certificate is a valid certificate only in relation to the
digital signature incorporated in it by reference.
(40) "Verify a
digital signature" means, in relation to a given digital signature,
message, and public key, to determine accurately that:
(a) The digital
signature was created by the private key corresponding to the public key; and
(b) The message has not
been altered since its digital signature was created.
NEW SECTION. Sec.
4. ROLE OF THE SECRETARY.
(1) If six months elapse during which time no certification authority is
licensed in this state, then the secretary shall be a certification authority,
and may issue, suspend, and revoke certificates in the manner prescribed for
licensed certification authorities. Except for licensing requirements, this
chapter applies to the secretary with respect to certificates he or she
issues. The secretary must discontinue acting as a certification authority if
another certification authority is licensed, in a manner allowing reasonable
transition to private enterprise.
(2) The secretary must
maintain a publicly accessible data base containing a certification authority
disclosure record for each licensed certification authority. The secretary
must publish the contents of the data base in at least one recognized
repository.
(3) The secretary must
adopt rules consistent with this chapter and in furtherance of its purposes:
(a) To govern licensed
certification authorities, their practice, and the termination of a
certification authority's practice;
(b) To determine an
amount reasonably appropriate for a suitable guaranty, in light of the burden a
suitable guaranty places upon licensed certification authorities and the
assurance of quality and financial responsibility it provides to persons who
rely on certificates issued by licensed certification authorities;
(c) To specify
reasonable requirements for the form of certificates issued by licensed
certification authorities, in accordance with generally accepted standards for
digital signature certificates;
(d) To specify
reasonable requirements for recordkeeping by licensed certification
authorities;
(e) To specify
reasonable requirements for the content, form, and sources of information in
certification authority disclosure records, the updating and timeliness of the
information, and other practices and policies relating to certification
authority disclosure records;
(f) To specify the form
of certification practice statements; and
(g) Otherwise to give
effect to and implement this chapter.
NEW SECTION. Sec.
5. FEES OF THE SECRETARY.
The secretary may adopt rules establishing reasonable fees for all services
rendered under this chapter, in amounts sufficient to compensate for the costs
of all services under this chapter. All fees recovered by the secretary must
be deposited in the state general fund.
PART II. LICENSING AND REGULATION OF
CERTIFICATE AUTHORITIES
NEW SECTION. Sec.
201. LICENSURE AND
QUALIFICATIONS OF CERTIFICATION AUTHORITIES. (1) To obtain or retain a
license, a certification authority must:
(a) Be the subscriber
of a certificate published in a recognized repository;
(b) Employ as operative
personnel only persons who have not been convicted within the past fifteen
years of a felony or a crime involving fraud, false statement, or deception;
(c) Employ as operative
personnel only persons who have demonstrated knowledge and proficiency in
following the requirements of this chapter;
(d) File with the
secretary a suitable guaranty, unless the certification authority is a
department, office, or official of a state, city, or county governmental
entity, provided that:
(i) Each of the public
entities in (d) of this subsection act through designated officials authorized
by rule or ordinance to perform certification authority functions; or
(ii) This state or one
of the public entities in (d) of this subsection is the subscriber of all
certificates issued by the certification authority;
(e) Have the right to
use a trustworthy system, including a secure means for limiting access to its
private key;
(f) Present proof to
the secretary of having working capital reasonably sufficient, according to
rules adopted by the secretary, to enable the applicant to conduct business as
a certification authority;
(g) Maintain an office
in this state or have established a registered agent for service of process in
this state; and
(h) Comply with all
further licensing requirements established by rule by the secretary.
(2) The secretary must
issue a license to a certification authority that:
(a) Is qualified under
subsection (1) of this section;
(b) Applies in writing
to the secretary for a license; and
(c) Pays a filing fee
adopted by rule by the secretary.
(3) The secretary may
by rule classify licenses according to specified limitations, such as a maximum
number of outstanding certificates, cumulative maximum of recommended reliance
limits in certificates issued by the certification authority, or issuance only
within a single firm or organization, and the secretary may issue licenses
restricted according to the limits of each classification. A certification
authority acts as an unlicensed certification authority in issuing a
certificate exceeding the restrictions of the certification authority's
license.
(4) The secretary may
revoke or suspend a certification authority's license, in accordance with the
administrative procedure act, chapter 34.05 RCW, for failure to comply with
this chapter or for failure to remain qualified under subsection (1) of this
section.
(5) The secretary may
recognize by rule the licensing or authorization of certification authorities
by other governmental entities, provided that those licensing or authorization
requirements are substantially similar to those of this state. If licensing by
another government is so recognized:
(a) Sections 401
through 406 of this act apply to certificates issued by the certification
authorities licensed or authorized by that government in the same manner as it
applies to licensed certification authorities of this state; and
(b) The liability
limits of section 309 of this act apply to the certification authorities
licensed or authorized by that government in the same manner as they apply to
licensed certification authorities of this state.
(6) Unless the parties
provide otherwise by contract between themselves, the licensing requirements in
this section do not affect the effectiveness, enforceability, or validity of
any digital signature, except that sections 401 through 406 of this act do not
apply in relation to a digital signature that cannot be verified by a
certificate issued by an unlicensed certification authority.
(7) A certification
authority that has not obtained a license is not subject to the provisions of
this chapter.
NEW SECTION. Sec.
202. PERFORMANCE AUDITS. (1)
A certified public accountant having expertise in computer security or an accredited
computer security professional must audit the operations of each licensed
certification authority at least once each year to evaluate compliance with
this chapter. The secretary may by rule specify the qualifications of
auditors.
(2) Based on information
gathered in the audit, the auditor must categorize the licensed certification
authority's compliance as one of the following:
(a) Full compliance.
The certification authority appears to conform to all applicable statutory and
regulatory requirements.
(b) Substantial
compliance. The certification authority appears generally to conform to
applicable statutory and regulatory requirements. However, one or more
instances of noncompliance or of inability to demonstrate compliance were found
in an audited sample, but were likely to be inconsequential.
(c) Partial
compliance. The certification authority appears to comply with some statutory
and regulatory requirements, but was found not to have complied or not to be
able to demonstrate compliance with one or more important safeguards.
(d) Noncompliance. The
certification authority complies with few or none of the statutory and
regulatory requirements, fails to keep adequate records to demonstrate
compliance with more than a few requirements, or refused to submit to an audit.
The secretary must
publish in the certification authority disclosure record it maintains for the
certification authority the date of the audit and the resulting categorization
of the certification authority.
(3) The secretary may
exempt a licensed certification authority from the requirements of subsection
(1) of this section, if:
(a) The certification
authority to be exempted requests exemption in writing;
(b) The most recent
performance audit, if any, of the certification authority resulted in a finding
of full or substantial compliance; and
(c) The certification
authority declares under oath, affirmation, or penalty of perjury that one or
more of the following is true with respect to the certification authority:
(i) The certification
authority has issued fewer than six certificates during the past year and the
recommended reliance limits of all of the certificates do not exceed ten
thousand dollars;
(ii) The aggregate
lifetime of all certificates issued by the certification authority during the
past year is less than thirty days and the recommended reliance limits of all
of the certificates do not exceed ten thousand dollars; or
(iii) The recommended
reliance limits of all certificates outstanding and issued by the certification
authority total less than one thousand dollars.
(4) If the
certification authority's declaration under subsection (3) of this section
falsely states a material fact, the certification authority has failed to
comply with the performance audit requirements of this section.
(5) If a licensed
certification authority is exempt under subsection (3) of this section, the
secretary must publish in the certification authority disclosure record it
maintains for the certification authority that the certification authority is
exempt from the performance audit requirement.
NEW SECTION. Sec.
203. ENFORCEMENT OF
REQUIREMENTS FOR LICENSED CERTIFICATION AUTHORITIES. (1) The secretary may
investigate the activities of a licensed certification authority material to
its compliance with this chapter and issue orders to a certification authority
to further its investigation and secure compliance with this chapter.
(2) The secretary may
suspend or revoke the license of a certification authority for its failure to
comply with an order of the secretary.
(3) The secretary may
by order impose and collect a civil monetary penalty for a violation of this
chapter in an amount not to exceed five thousand dollars per incident, or
ninety percent of the recommended reliance limit of a material certificate,
whichever is less. In case of a violation continuing for more than one day,
each day is considered a separate incident.
(4) The secretary may
order a certification authority, which it has found to be in violation of this
chapter, to pay the costs incurred by the secretary in prosecuting and
adjudicating proceedings relative to the order, and enforcing it.
(5) The secretary must
exercise authority under this section in accordance with the administrative
procedure act, chapter 34.05 RCW, and a licensed certification authority may
obtain judicial review of the secretary's actions as prescribed by chapter
34.05 RCW. The secretary may also seek injunctive relief to compel compliance
with an order.
NEW SECTION. Sec.
204. DANGEROUS ACTIVITIES BY A
CERTIFICATION AUTHORITY PROHIBITED. (1) No certification authority, whether
licensed or not, may conduct its business in a manner that creates an
unreasonable risk of loss to subscribers of the certification authority, to
persons relying on certificates issued by the certification authority, or to a
repository.
(2) The secretary may
publish in the repository it provides, or elsewhere, brief statements advising
subscribers, persons relying on digital signatures, or other repositories about
activities of a certification authority, whether licensed or not, that create a
risk prohibited by subsection (1) of this section. The certification authority
named in a statement as creating or causing such a risk may protest the
publication of the statement by filing a written defense of ten thousand bytes or
less. Upon receipt of such a protest, the secretary must publish the protest
along with the secretary's statement, and must promptly give the protesting
certification authority notice and an opportunity to be heard. Following the
hearing, the secretary must rescind the advisory statement if its publication
was unwarranted under this section, cancel it if its publication is no longer
warranted, continue or amend it if it remains warranted, or take further legal
action to eliminate or reduce a risk prohibited by subsection (1) of this
section. The secretary must publish its decision in the repository it
provides.
(3) In the manner
provided by the administrative procedure act, chapter 34.05 RCW, the secretary
may issue orders and obtain injunctions or other civil relief to prevent or
restrain a certification authority from violating this section, regardless of
whether the certification authority is licensed. This section does not create
a right of action in a person other than the secretary.
PART III. DUTIES OF CERTIFICATION AUTHORITIES
AND SUBSCRIBERS
NEW SECTION. Sec.
301. GENERAL REQUIREMENTS FOR
CERTIFICATION AUTHORITIES. (1) A licensed certification authority or
subscriber may use only a trustworthy system:
(a) To issue, suspend,
or revoke a certificate;
(b) To publish or give
notice of the issuance, suspension, or revocation of a certificate; or
(c) To create a private
key.
(2) A licensed
certification authority must disclose any material certification practice
statement, and any fact material to either the reliability of a certificate
that it has issued or its ability to perform its services. A certification
authority may require a signed, written, and reasonably specific inquiry from
an identified person, and payment of reasonable compensation, as conditions
precedent to effecting a disclosure required in this subsection.
NEW SECTION. Sec.
302. ISSUANCE OF A
CERTIFICATE. (1) A licensed certification authority may issue a certificate to
a subscriber only after all of the following conditions are satisfied:
(a) The certification
authority has received a request for issuance signed by the prospective
subscriber; and
(b) The certification
authority has confirmed that:
(i) The prospective
subscriber is the person to be listed in the certificate to be issued;
(ii) If the prospective
subscriber is acting through one or more agents, the subscriber duly authorized
the agent or agents to have custody of the subscriber's private key and to
request issuance of a certificate listing the corresponding public key;
(iii) The information
in the certificate to be issued is accurate;
(iv) The prospective
subscriber rightfully holds the private key corresponding to the public key to
be listed in the certificate;
(v) The prospective
subscriber holds a private key capable of creating a digital signature; and
(vi) The public key to
be listed in the certificate can be used to verify a digital signature affixed
by the private key held by the prospective subscriber.
The requirements of
this subsection may not be waived or disclaimed by either the licensed
certification authority, the subscriber, or both.
(2) If the subscriber
accepts the issued certificate, the certification authority must publish a
signed copy of the certificate in a recognized repository, as the certification
authority and the subscriber named in the certificate may agree, unless a
contract between the certification authority and the subscriber provides
otherwise. If the subscriber does not accept the certificate, a licensed
certification authority must not publish it, or must cancel its publication if
the certificate has already been published.
(3) Nothing in this
section precludes a licensed certification authority from conforming to
standards, certification practice statements, security plans, or contractual
requirements more rigorous than, but nevertheless consistent with, this
chapter.
(4) After issuing a
certificate, a licensed certification authority must revoke it immediately upon
confirming that it was not issued as required by this section. A licensed
certification authority may also suspend a certificate that it has issued for a
reasonable period not exceeding forty-eight hours as needed for an
investigation to confirm grounds for revocation under this subsection. The
certification authority must give notice to the subscriber as soon as
practicable after a decision to revoke or suspend under this subsection.
(5) The secretary may
order the licensed certification authority to suspend or revoke a certificate
that the certification authority issued, if, after giving any required notice
and opportunity for the certification authority and subscriber to be heard in
accordance with the administrative procedure act, chapter 34.05 RCW, the
secretary determines that:
(a) The certificate was
issued without substantial compliance with this section; and
(b) The noncompliance
poses a significant risk to persons reasonably relying on the certificate.
Upon determining that
an emergency requires an immediate remedy, and in accordance with the
administrative procedure act, chapter 34.05 RCW, the secretary may issue an
order suspending a certificate for a period not to exceed forty-eight hours.
NEW SECTION. Sec.
303. WARRANTIES AND
OBLIGATIONS OF CERTIFICATION AUTHORITY UPON ISSUANCE OF A CERTIFICATE. (1) By
issuing a certificate, a licensed certification authority warrants to the
subscriber named in the certificate that:
(a) The certificate
contains no information known to the certification authority to be false;
(b) The certificate
satisfies all material requirements of this chapter; and
(c) The certification
authority has not exceeded any limits of its license in issuing the
certificate.
The certification
authority may not disclaim or limit the warranties of this subsection.
(2) Unless the
subscriber and certification authority otherwise agree, a certification authority,
by issuing a certificate, promises to the subscriber:
(a) To act promptly to
suspend or revoke a certificate in accordance with section 306 or 307 of this
act; and
(b) To notify the
subscriber within a reasonable time of any facts known to the certification
authority that significantly affect the validity or reliability of the
certificate once it is issued.
(3) By issuing a
certificate, a licensed certification authority certifies to all who reasonably
rely on the information contained in the certificate that:
(a) The information in
the certificate and listed as confirmed by the certification authority is
accurate;
(b) All information
foreseeably material to the reliability of the certificate is stated or
incorporated by reference within the certificate;
(c) The subscriber has
accepted the certificate; and
(d) The licensed
certification authority has complied with all applicable laws of this state
governing issuance of the certificate.
(4) By publishing a
certificate, a licensed certification authority certifies to the repository in
which the certificate is published and to all who reasonably rely on the
information contained in the certificate that the certification authority has
issued the certificate to the subscriber.
NEW SECTION. Sec.
304. REPRESENTATIONS AND
DUTIES UPON ACCEPTANCE OF A CERTIFICATE. (1) By accepting a certificate issued
by a licensed certification authority, the subscriber listed in the certificate
certifies to all who reasonably rely on the information contained in the
certificate that:
(a) The subscriber
rightfully holds the private key corresponding to the public key listed in the
certificate;
(b) All representations
made by the subscriber to the certification authority and material to the
information listed in the certificate are true; and
(c) All material
representations made by the subscriber to a certification authority or made in
the certificate and not confirmed by the certification authority in issuing the
certificate are true.
(2) By requesting on
behalf of a principal the issuance of a certificate naming the principal as
subscriber, the requesting person certifies in that person's own right to all
who reasonably rely on the information contained in the certificate that the requesting
person:
(a) Holds all authority
legally required to apply for issuance of a certificate naming the principal as
subscriber; and
(b) Has authority to
sign digitally on behalf of the principal, and, if that authority is limited in
any way, adequate safeguards exist to prevent a digital signature exceeding the
bounds of the person's authority.
(3) No person may
disclaim or contractually limit the application of this section, nor obtain
indemnity for its effects, if the disclaimer, limitation, or indemnity
restricts liability for misrepresentation as against persons reasonably relying
on the certificate.
(4) By accepting a
certificate, a subscriber undertakes to indemnify the issuing certification
authority for loss or damage caused by issuance or publication of a certificate
in reliance on:
(a) A false and
material representation of fact by the subscriber; or
(b) The failure by the
subscriber to disclose a material fact;
if the representation or
failure to disclose was made either with intent to deceive the certification
authority or a person relying on the certificate, or with negligence. If the
certification authority issued the certificate at the request of one or more
agents of the subscriber, the agent or agents personally undertake to indemnify
the certification authority under this subsection, as if they were accepting
subscribers in their own right. The indemnity provided in this section may not
be disclaimed or contractually limited in scope. However, a contract may
provide consistent, additional terms regarding the indemnification.
(5) In obtaining
information of the subscriber material to issuance of a certificate, the
certification authority may require the subscriber to certify the accuracy of
relevant information under oath or affirmation of truthfulness and under
penalty of perjury.
NEW SECTION. Sec.
305. CONTROL OF THE PRIVATE
KEY. (1) By accepting a certificate issued by a licensed certification
authority, the subscriber identified in the certificate assumes a duty to
exercise reasonable care to retain control of the private key and prevent its
disclosure to a person not authorized to create the subscriber's digital
signature.
(2) A private key is
the personal property of the subscriber who rightfully holds it.
(3) If a certification
authority holds the private key corresponding to a public key listed in a
certificate that it has issued, the certification authority holds the private
key as a fiduciary of the subscriber named in the certificate, and may use that
private key only with the subscriber's prior, written approval, unless the
subscriber expressly grants the private key to the certification authority and
expressly permits the certification authority to hold the private key according
to other terms.
NEW SECTION. Sec.
306. SUSPENSION OF A
CERTIFICATE. (1) Unless the certification authority and the subscriber agree
otherwise, the licensed certification authority that issued a certificate that
is not a transactional certificate must suspend the certificate for a period
not to exceed forty-eight hours:
(a) Upon request by a
person identifying himself or herself as the subscriber named in the
certificate, or as a person in a position likely to know of a compromise of the
security of a subscriber's private key, such as an agent, business associate,
employee, or member of the immediate family of the subscriber; or
(b) By order of the
secretary under section 302(5) of this act.
The certification
authority need not confirm the identity or agency of the person requesting
suspension.
(2) Unless the
certificate provides otherwise or the certificate is a transactional
certificate, the secretary or a county clerk may suspend a certificate issued
by a licensed certification authority for a period of forty-eight hours, if:
(a) A person
identifying himself or herself as the subscriber named in the certificate or as
an agent, business associate, employee, or member of the immediate family of
the subscriber requests suspension; and
(b) The requester
represents that the certification authority that issued the certificate is
unavailable.
The secretary or county
clerk may require the person requesting suspension to provide evidence,
including a statement under oath or affirmation, regarding his or her identity,
authorization, or the unavailability of the issuing certification authority,
and may decline to suspend the certificate in its discretion. The secretary or
law enforcement agencies may investigate suspensions by the secretary or county
clerk for possible wrongdoing by persons requesting suspension.
(3) Immediately upon
suspension of a certificate by a licensed certification authority, the licensed
certification authority must give notice of the suspension according to the
specification in the certificate. If one or more repositories are specified,
then the licensed certification authority must publish a signed notice of the
suspension in all the repositories. If a repository no longer exists or
refuses to accept publication, or if no repository is recognized under section
501 of this act, the licensed certification authority must also publish the
notice in a recognized repository. If a certificate is suspended by the
secretary or county clerk, the secretary or clerk must give notice as required
in this subsection for a licensed certification authority, provided that the
person requesting suspension pays in advance any fee required by a repository
for publication of the notice of suspension.
(4) A certification
authority must terminate a suspension initiated by request only:
(a) If the subscriber
named in the suspended certificate requests termination of the suspension, the
certification authority has confirmed that the person requesting suspension is
the subscriber or an agent of the subscriber authorized to terminate the
suspension; or
(b) When the
certification authority discovers and confirms that the request for the
suspension was made without authorization by the subscriber. However, this
subsection (4)(b) does not require the certification authority to confirm a
request for suspension.
(5) The contract between
a subscriber and a licensed certification authority may limit or preclude
requested suspension by the certification authority, or may provide otherwise
for termination of a requested suspension. However, if the contract limits or
precludes suspension by the secretary or county clerk when the issuing
certification authority is unavailable, the limitation or preclusion is
effective only if notice of it is published in the certificate.
(6) No person may
knowingly or intentionally misrepresent to a certification authority his or her
identity or authorization in requesting suspension of a certificate. Violation
of this subsection is a misdemeanor.
(7) The subscriber is
released from the duty to keep the private key secure under section 305(1) of
this act while the certificate is suspended.
NEW SECTION. Sec.
307. REVOCATION OF A
CERTIFICATE. (1) A licensed certification authority must revoke a certificate
that it issued but which is not a transactional certificate, after:
(a) Receiving a request
for revocation by the subscriber named in the certificate; and
(b) Confirming that the
person requesting revocation is the subscriber, or is an agent of the
subscriber with authority to request the revocation.
(2) A licensed certification
authority must confirm a request for revocation and revoke a certificate within
one business day after receiving both a subscriber's written request and
evidence reasonably sufficient to confirm the identity and any agency of the
person requesting the suspension.
(3) A licensed
certification authority must revoke a certificate that it issued:
(a) Upon receiving a
certified copy of the subscriber's death certificate, or upon confirming by
other evidence that the subscriber is dead; or
(b) Upon presentation
of documents effecting a dissolution of the subscriber, or upon confirming by
other evidence that the subscriber has been dissolved or has ceased to exist.
(4) A licensed
certification authority may revoke one or more certificates that it issued if
the certificates are or become unreliable, regardless of whether the subscriber
consents to the revocation and notwithstanding a provision to the contrary in a
contract between the subscriber and certification authority.
(5) Immediately upon
revocation of a certificate by a licensed certification authority, the licensed
certification authority must give notice of the revocation according to the
specification in the certificate. If one or more repositories are specified,
then the licensed certification authority must publish a signed notice of the
revocation in all repositories. If a repository no longer exists or refuses to
accept publication, or if no repository is recognized under section 501 of this
act, then the licensed certification authority must also publish the notice in
a recognized repository.
(6) A subscriber ceases
to certify, as provided in section 304 of this act, and has no further duty to
keep the private key secure, as required by section 305 of this act, in
relation to the certificate whose revocation the subscriber has requested,
beginning at the earlier of either:
(a) When notice of the
revocation is published as required in subsection (5) of this section; or
(b) One business day
after the subscriber requests revocation in writing, supplies to the issuing
certification authority information reasonably sufficient to confirm the
request, and pays any contractually required fee.
(7) Upon notification
as required by subsection (5) of this section, a licensed certification
authority is discharged of its warranties based on issuance of the revoked
certificate and ceases to certify as provided in section 303(2) and (3) of this
act in relation to the revoked certificate.
NEW SECTION. Sec.
308. EXPIRATION OF A
CERTIFICATE. (1) A certificate must indicate the date on which it expires.
(2) When a certificate
expires, the subscriber and certification authority cease to certify as
provided in this chapter and the certification authority is discharged of its
duties based on issuance, in relation to the expired certificate.
NEW SECTION. Sec.
309. RECOMMENDED RELIANCE
LIMITS AND LIABILITY. (1) By specifying a recommended reliance limit in a
certificate, the issuing certification authority and accepting subscriber
recommend that persons rely on the certificate only to the extent that the
total amount at risk does not exceed the recommended reliance limit.
(2) Unless a licensed
certification authority waives application of this subsection, a licensed
certification authority is:
(a) Not liable for a
loss caused by reliance on a false or forged digital signature of a subscriber,
if, with respect to the false or forged digital signature, the certification
authority complied with all material requirements of this chapter;
(b) Not liable in
excess of the amount specified in the certificate as its recommended reliance
limit for either:
(i) A loss caused by
reliance on a misrepresentation in the certificate of a fact that the licensed
certification authority is required to confirm; or
(ii) Failure to comply
with section 302 of this act in issuing the certificate;
(c) Liable only for direct
compensatory damages in an action to recover a loss due to reliance on the
certificate. Direct compensatory damages do not include:
(i) Punitive or
exemplary damages. Nothing in this chapter may be interpreted to permit
punitive or exemplary damages that would not otherwise be permitted by the law
of this state;
(ii) Damages for lost
profits or opportunity; or
(iii) Damages for pain
or suffering.
NEW SECTION. Sec.
310. COLLECTION BASED ON
SUITABLE GUARANTY. (1)(a) If the suitable guaranty is a surety bond, a person
may recover from the surety the full amount of a qualified right to payment
against the principal named in the bond, or, if there is more than one such
qualified right to payment during the term of the bond, a ratable share, up to
a maximum total liability of the surety equal to the amount of the bond.
(b) If the suitable
guaranty is a letter of credit, a person may recover from the issuing financial
institution only in accordance with the terms of the letter of credit.
Claimants may recover
successively on the same suitable guaranty, provided that the total liability
on the suitable guaranty to all persons making qualified rights of payment
during its term must not exceed the amount of the suitable guaranty.
(2) In addition to
recovering the amount of a qualified right to payment, a claimant may recover
from the proceeds of the guaranty, until depleted, the attorneys' fees,
reasonable in amount, and court costs incurred by the claimant in collecting
the claim, provided that the total liability on the suitable guaranty to all
persons making qualified rights of payment or recovering attorneys' fees during
its term must not exceed the amount of the suitable guaranty.
(3) To recover a
qualified right to payment against a surety or issuer of a suitable guaranty,
the claimant must:
(a) File written notice
of the claim with the secretary stating the name and address of the claimant,
the amount claimed, and the grounds for the qualified right to payment, and any
other information required by rule by the secretary; and
(b) Append to the
notice a certified copy of the judgment on which the qualified right to payment
is based.
Recovery of a qualified
right to payment from the proceeds of the suitable guaranty is barred unless
the claimant substantially complies with this subsection (3).
(4) Recovery of a
qualified right to payment from the proceeds of a suitable guaranty are forever
barred unless notice of the claim is filed as required in subsection (3)(a) of
this section within three years after the occurrence of the violation of this
chapter that is the basis for the claim. Notice under this subsection need not
include the requirement imposed by subsection (3)(b) of this section.
PART IV. EFFECT OF A DIGITAL SIGNATURE
NEW SECTION. Sec.
401. SATISFACTION OF SIGNATURE
REQUIREMENTS. Where a rule of law requires a signature, or provides for
certain consequences in the absence of a signature, that rule is satisfied by a
digital signature, if:
(1) No party affected
by a digital signature objects to the use of digital signatures in lieu of a
signature, and the objection may be evidenced by refusal to provide or accept a
digital signature;
(2) That digital
signature is verified by reference to the public key listed in a valid
certificate issued by a licensed certification authority;
(3) That digital
signature was affixed by the signer with the intention of signing the message,
and after the signer has had an opportunity to review items being signed; and
(4) The recipient has
no knowledge or notice that the signer either:
(a) Breached a duty as
a subscriber; or
(b) Does not rightfully
hold the private key used to affix the digital signature.
However, nothing in
this chapter precludes a mark from being valid as a signature under other
applicable law.
NEW SECTION. Sec.
402. UNRELIABLE DIGITAL
SIGNATURES. Unless otherwise provided by law or contract, the recipient of a
digital signature assumes the risk that a digital signature is forged, if
reliance on the digital signature is not reasonable under the circumstances.
If the recipient determines not to rely on a digital signature under this
section, the recipient must promptly notify the signer of any determination not
to rely on a digital signature and the grounds for that determination. Nothing
in this chapter shall be construed to obligate a person to accept a digital
signature or to respond to an electronic message containing a digital
signature.
NEW SECTION. Sec.
403. DIGITALLY SIGNED DOCUMENT
IS WRITTEN. A message is as valid, enforceable, and effective as if it had
been written on paper, if it:
(1) Bears in its
entirety a digital signature; and
(2) That digital
signature is verified by the public key listed in a certificate that:
(a) Was issued by a
licensed certification authority; and
(b) Was valid at the
time the digital signature was created.
Nothing in this chapter
shall be construed to eliminate, modify, or condition any other requirements
for a contract to be valid, enforceable, and effective. No digital message
shall be deemed to be an instrument under the provisions of Title 62A RCW
unless all parties to the transaction agree.
NEW SECTION. Sec.
404. DIGITALLY SIGNED
ORIGINALS. A copy of a digitally signed message is as effective, valid, and
enforceable as the original of the message, unless it is evident that the
signer designated an instance of the digitally signed message to be a unique
original, in which case only that instance constitutes the valid, effective,
and enforceable message.
NEW SECTION. Sec.
405. CERTIFICATE AS AN
ACKNOWLEDGMENT. Unless otherwise provided by law or contract, a certificate
issued by a licensed certification authority is an acknowledgment of a digital
signature verified by reference to the public key listed in the certificate,
regardless of whether words of an express acknowledgment appear with the
digital signature and regardless of whether the signer physically appeared before
the certification authority when the digital signature was created, if that
digital signature is:
(1) Verifiable by that
certificate; and
(2) Affixed when that
certificate was valid.
NEW SECTION. Sec.
406. PRESUMPTIONS IN ADJUDICATING
DISPUTES. In adjudicating a dispute involving a digital signature, a court of
this state presumes that:
(1) A certificate
digitally signed by a licensed certification authority and either published in
a recognized repository, or made available by the issuing certification
authority or by the subscriber listed in the certificate is issued by the
certification authority that digitally signed it and is accepted by the
subscriber listed in it.
(2) The information
listed in a valid certificate and confirmed by a licensed certification
authority issuing the certificate is accurate.
(3) If a digital
signature is verified by the public key listed in a valid certificate issued by
a licensed certification authority:
(a) That digital
signature is the digital signature of the subscriber listed in that
certificate;
(b) That digital
signature was affixed by that subscriber with the intention of signing the
message; and
(c) The recipient of
that digital signature has no knowledge or notice that the signer:
(i) Breached a duty as
a subscriber; or
(ii) Does not
rightfully hold the private key used to affix the digital signature.
(4) A digital signature
was created before it was time stamped by a disinterested person utilizing a
trustworthy system.
PART V. REPOSITORIES
NEW SECTION. Sec.
501. RECOGNITION OF
REPOSITORIES. (1) The secretary must recognize one or more repositories, after
finding that a repository to be recognized:
(a) Is operated under
the direction of a licensed certification authority;
(b) Includes a data
base containing:
(i) Certificates
published in the repository;
(ii) Notices of
suspended or revoked certificates published by licensed certification
authorities or other persons suspending or revoking certificates;
(iii) Certification
authority disclosure records for licensed certification authorities;
(iv) All orders or
advisory statements published by the secretary in regulating certification
authorities; and
(v) Other information
adopted by rule by the secretary;
(c) Operates by means
of a trustworthy system;
(d) Contains no
significant amount of information that is known or likely to be untrue,
inaccurate, or not reasonably reliable;
(e) Contains
certificates published by certification authorities that conform to legally
binding requirements that the secretary finds to be substantially similar to,
or more stringent toward the certification authorities, than those of this
state;
(f) Keeps an archive of
certificates that have been suspended or revoked, or that have expired, within
at least the past three years; and
(g) Complies with other
reasonable requirements adopted by rule by the secretary.
(2) A repository may
apply to the secretary for recognition by filing a written request and
providing evidence to the secretary sufficient for the secretary to find that
the conditions for recognition are satisfied.
(3) A repository may
discontinue its recognition by filing thirty days' written notice with the
secretary. In addition the secretary may discontinue recognition of a
repository in accordance with the administrative procedure act, chapter 34.05
RCW, if it concludes that the repository no longer satisfies the conditions for
recognition listed in this section or in rules adopted by the secretary.
NEW SECTION. Sec.
502. LIABILITY OF
REPOSITORIES. (1) Notwithstanding a disclaimer by the repository or a contract
to the contrary between the repository, a certification authority, or a
subscriber, a repository is liable for a loss incurred by a person reasonably
relying on a digital signature verified by the public key listed in a suspended
or revoked certificate, if loss was incurred more than one business day after
receipt by the repository of a request to publish notice of the suspension or
revocation, and the repository had failed to publish the notice when the person
relied on the digital signature.
(2) Unless waived, a
recognized repository or the owner or operator of a recognized repository is:
(a) Not liable for
failure to record publication of a suspension or revocation, unless the
repository has received notice of publication and one business day has elapsed
since the notice was received;
(b) Not liable under
subsection (1) of this section in excess of the amount specified in the
certificate as the recommended reliance limit;
(c) Liable under
subsection (1) of this section only for direct compensatory damages, which do
not include:
(i) Punitive or
exemplary damages;
(ii) Damages for lost
profits or opportunity; or
(iii) Damages for pain
or suffering;
(d) Not liable for misrepresentation
in a certificate published by a licensed certification authority;
(e) Not liable for
accurately recording or reporting information that a licensed certification
authority, or court clerk, or the secretary has published as required or permitted
in this chapter, including information about suspension or revocation of a
certificate;
(f) Not liable for
reporting information about a certification authority, a certificate, or a
subscriber, if the information is published as required or permitted in this
chapter or a rule adopted by the secretary, or is published by order of the
secretary in the performance of the licensing and regulatory duties of that
office under this chapter.
PART VI. MISCELLANEOUS
NEW SECTION. Sec.
601. LEGISLATIVE DIRECTIVE.
Sections 101 through 502, 603, and 604 of this act shall constitute a new
chapter in Title 19 RCW.
NEW SECTION. Sec.
602. EFFECTIVE DATE. This act
shall take effect January 1, 1998.
NEW SECTION. Sec.
603. RULE MAKING. The
secretary of state may adopt rules to implement this chapter beginning July 1,
1996.
NEW SECTION. Sec.
604. SEVERABILITY. If any
provision of this act or its application to any person or circumstance is held
invalid, the remainder of the act or the application of the provision to other
persons or circumstances is not affected.
NEW SECTION. Sec.
605. PART HEADINGS AND SECTION
CAPTIONS. Part headings and section captions as used in this act do not
constitute any part of the law.
