HOUSE BILL ANALYSIS
HB 2931
Brief Description: Refining electronic signature law.
Sponsors: Representatives McMorris, Conway and B.Thomas; by request of Secretary of State.
Hearing: February 4, 1998
BACKGROUND:
On January 1, 1998, the Washington Electronic Authentication Act became effective. This law allows the use of digital signature technology in electronic transactions and creates a process for licensing certification authorities.
Digital signature encryption systems are used to both protect the confidentiality of an electronic document and authenticate its source. These systems operate on the basis of two digital keys, or codes, created by the person desiring to send encrypted messages. One key is the Aprivate@ key, which is known only to the signer of the electronic message, and the other is the signer=s Apublic@ key, which is given to individuals with whom the sender wishes to exchange the confidential or authenticated message. The public key is used to verify both that the message was signed by the person holding the private key and that the message itself was not altered during its transmission.
To verify the ownership of public keys, each public key is provided with a computer-based certificate of authenticity. These certificates are created by Acertification authorities,@ which guarantee that the public keys they certify belong to the people possessing the corresponding private keys.
To qualify for a license, a certification authority must be a subscriber of a certificate published in a recognized repository. The authority may not hire persons who have been convicted of a felony in the past 15 years or have been convicted of a crime involving fraud, false statement or deception. The authority must also present proof of sufficient working capital to operate as a certification authority.
Certain information regarding trade secrets, information on criminal background of individuals or information on design, security or programing of computer systems used for licensing in the possession of government agencies are not specifically exempt from public disclosure.
The office of the Secretary of State has responsibility for implementing and administering the Electronic Authentication Act. A working group convened by the Secretary of State to assist with implementation has recommended a number of changes to the original act. The changes relate primarily to the licensing requirements and procedures for certification authorities.