AN
ACT Relating to electronic signatures; amending RCW 19.34.030, 19.34.040,
19.34.100, 19.34.110, 19.34.120, 19.34.200, 19.34.210, 19.34.240, 19.34.250,
19.34.260, 19.34.280, 19.34.300, 19.34.310, 19.34.320, 19.34.340, 19.34.350,
19.34.400, 19.34.500, 19.34.901, 19.34.020, 19.34.220, and 19.34.410; adding
new sections to chapter 19.34 RCW; adding a new section to chapter 43.105 RCW;
prescribing penalties; and providing an effective date.
BE IT ENACTED BY THE
LEGISLATURE OF THE STATE OF WASHINGTON:
Sec.
1. RCW
19.34.030 and 1996 c 250 s 104 are each amended to read as follows:
(1)
((If six months elapse during which time no certification authority is
licensed in this state, then the secretary shall be a certification authority,
and may issue, suspend, and revoke certificates in the manner prescribed for
licensed certification authorities. Except for licensing requirements, this
chapter applies to the secretary with respect to certificates he or she
issues. The secretary must discontinue acting as a certification authority if
another certification authority is licensed, in a manner allowing reasonable
transition to private enterprise.
(2))) The
secretary must maintain a publicly accessible data base containing a
certification authority disclosure record for each licensed certification
authority, and a list of all judgments filed with the secretary, within the
previous five years, under RCW 19.34.290. The secretary must publish the
contents of the data base in at least one recognized repository.
(((3)))
(2) The secretary ((must)) may adopt rules consistent with
this chapter and in furtherance of its purposes:
(a)
To govern licensed certification authorities and recognized repositories,
their practice, and the termination of a licensed certification
authority's or recognized repository's practice;
(b)
To determine an amount reasonably appropriate for a suitable guaranty, in light
of the burden a suitable guaranty places upon licensed certification
authorities and the assurance of quality and financial responsibility it
provides to persons who rely on certificates issued by licensed certification
authorities;
(c)
To specify reasonable requirements for the form of certificates issued by
licensed certification authorities, in accordance with generally accepted
standards for digital signature certificates;
(d)
To specify reasonable requirements for recordkeeping by licensed certification
authorities;
(e)
To specify reasonable requirements for the content, form, and sources of
information in certification authority disclosure records, the updating and
timeliness of the information, and other practices and policies relating to
certification authority disclosure records;
(f)
To specify the form of certification practice statements; ((and))
(g)
To specify the procedure and manner in which a certificate may be suspended
or revoked, as consistent with this chapter; and
(h)
Otherwise to give effect to and implement this chapter.
Sec.
2. RCW
19.34.040 and 1996 c 250 s 105 are each amended to read as follows:
The
secretary may adopt rules establishing reasonable fees for all services
rendered by the secretary under this chapter, in amounts that are
reasonably calculated to be sufficient to compensate for the costs of all
services under this chapter, but that are not estimated to exceed those
costs in the aggregate. All fees recovered by the secretary must be
deposited in the state general fund.
Sec.
3. RCW
19.34.100 and 1996 c 250 s 201 are each amended to read as follows:
(1)
To obtain or retain a license, a certification authority must:
(a)
Be the subscriber of a certificate published in a recognized repository;
(b)
Employ as operative personnel only persons who have not been convicted within
the past fifteen years of a felony or have ever been convicted of a
crime involving fraud, false statement, or deception;
(c)
Employ as operative personnel only persons who have demonstrated knowledge and
proficiency in following the requirements of this chapter;
(d)
File with the secretary a suitable guaranty, unless the certification authority
is a ((department, office, or official of a state,)) city((,)) or
county ((governmental entity, provided that:
(i)
Each of the public entities in (d) of this subsection act through designated
officials authorized by rule or ordinance to perform certification authority
functions; or
(ii)
This state or one of the public entities in (d) of this subsection is the
subscriber of all certificates issued by the certification authority)) that
is self-insured or the department of information services;
(e)
((Have the right to)) Use a trustworthy system, including a
secure means for limiting access to its private key;
(f)
Present proof to the secretary of having working capital reasonably sufficient,
according to rules adopted by the secretary, to enable the applicant to conduct
business as a certification authority;
(g)
Maintain an office in this state or have established a registered agent for
service of process in this state; and
(h)
Comply with all further licensing requirements established by rule by the
secretary.
(2)
The secretary must issue a license to a certification authority that:
(a)
Is qualified under subsection (1) of this section;
(b)
Applies in writing to the secretary for a license; and
(c)
Pays a filing fee adopted by rule by the secretary.
(3)
The secretary may by rule classify licenses according to specified limitations,
such as a maximum number of outstanding certificates, cumulative maximum of
recommended reliance limits in certificates issued by the certification
authority, or issuance only within a single firm or organization, and the
secretary may issue licenses restricted according to the limits of each
classification. ((A certification authority acts as an unlicensed
certification authority in issuing a certificate exceeding the restrictions of
the certification authority's license.)) The liability limits of RCW
19.34.280 do not apply to a certificate issued by a certification authority
that exceeds the restrictions of the certification authority's license.
(4)
The secretary may revoke or suspend a certification authority's license, in
accordance with the administrative procedure act, chapter 34.05 RCW, for
failure to comply with this chapter or for failure to remain qualified under
subsection (1) of this section. The secretary may order the summary
suspension of a license pending proceedings for revocation or other action,
which must be promptly instituted and determined, if the secretary includes
within a written order a finding that the certification authority has either:
(a)
Utilized its license in the commission of a violation of a state or federal
criminal statute or of chapter 19.86 RCW; or
(b)
Engaged in conduct giving rise to a serious risk of loss to public or private
parties if the license is not immediately suspended.
(5)
The secretary may recognize by rule the licensing or authorization of
certification authorities by other governmental entities, provided that those
licensing or authorization requirements are substantially similar to those of
this state. If licensing by another government is so recognized:
(a)
RCW 19.34.300 through 19.34.350 apply to certificates issued by the
certification authorities licensed or authorized by that government in the same
manner as it applies to licensed certification authorities of this state; and
(b)
The liability limits of RCW 19.34.280 apply to the certification authorities
licensed or authorized by that government in the same manner as they apply to
licensed certification authorities of this state.
(6)
Unless the parties provide otherwise by contract between themselves, the
licensing requirements in this section do not affect the effectiveness,
enforceability, or validity of any digital signature, except that RCW 19.34.300
through 19.34.350 do not apply ((in relation)) to ((a digital
signature that cannot be verified by)) a certificate, and associated
digital signature, issued by an unlicensed certification authority.
(7)
A certification authority that has not obtained a license is not subject to the
provisions of this chapter, except as specifically provided.
NEW
SECTION. Sec. 4. A
new section is added to chapter 19.34 RCW, to be codified to follow RCW
19.34.100 immediately, to read as follows:
Licenses
issued under this chapter expire one year after issuance, except that the secretary
may provide by rule for a longer duration. The secretary shall provide, by
rule, for a system of license renewal, which may include requirements for
continuing education.
Sec.
5. RCW
19.34.110 and 1996 c 250 s 202 are each amended to read as follows:
(1)
((A certified public accountant having expertise in computer security or an
accredited computer security professional must audit the operations of each
licensed certification authority at least once each year to evaluate compliance
with this chapter. The secretary may by rule specify the qualifications of
auditors.)) A licensed certification authority shall obtain a compliance
audit, as may be more fully defined by rule of the secretary, at least once
every year. The auditor shall issue an opinion evaluating the degree to which
the certification authority conforms to the requirements of this chapter and
the administrative rules adopted by the secretary. If the certification
authority is also a recognized repository, the audit must include the
repository.
(2)
((Based on information gathered in the audit, the auditor must categorize
the licensed certification authority's compliance as one of the following:
(a)
Full compliance. The certification authority appears to conform to all
applicable statutory and regulatory requirements.
(b)
Substantial compliance. The certification authority appears generally to
conform to applicable statutory and regulatory requirements. However, one or
more instances of noncompliance or of inability to demonstrate compliance were
found in an audited sample, but were likely to be inconsequential.
(c)
Partial compliance. The certification authority appears to comply with some statutory
and regulatory requirements, but was found not to have complied or not to be
able to demonstrate compliance with one or more important safeguards.
(d)
Noncompliance. The certification authority complies with few or none of the
statutory and regulatory requirements, fails to keep adequate records to
demonstrate compliance with more than a few requirements, or refused to submit
to an audit.)) The certification authority shall file a
copy of the audit report with the secretary. The secretary may provide by rule
for filing of the report in an electronic format. The secretary ((must))
shall publish the report in the certification authority
disclosure record it maintains for the certification authority ((the date of
the audit and the resulting categorization of the certification authority.
(3)
The secretary may exempt a licensed certification authority from the
requirements of subsection (1) of this section, if:
(a)
The certification authority to be exempted requests exemption in writing;
(b)
The most recent performance audit, if any, of the certification authority
resulted in a finding of full or substantial compliance; and
(c)
The certification authority declares under oath, affirmation, or penalty of
perjury that one or more of the following is true with respect to the
certification authority:
(i)
The certification authority has issued fewer than six certificates during the
past year and the recommended reliance limits of all of the certificates do not
exceed ten thousand dollars;
(ii)
The aggregate lifetime of all certificates issued by the certification
authority during the past year is less than thirty days and the recommended
reliance limits of all of the certificates do not exceed ten thousand dollars;
or
(iii)
The recommended reliance limits of all certificates outstanding and issued by
the certification authority total less than one thousand dollars.
(4)
If the certification authority's declaration under subsection (3) of this
section falsely states a material fact, the certification authority has failed
to comply with the performance audit requirements of this section.
(5)
If a licensed certification authority is exempt under subsection (3) of this
section, the secretary must publish in the certification authority disclosure
record it maintains for the certification authority that the certification
authority is exempt from the performance audit requirement)).
NEW
SECTION. Sec. 6. A
new section is added to chapter 19.34 RCW, to be codified to follow RCW
19.34.110 immediately, to read as follows:
(1)(a)
An auditor signing a report of opinion as to a compliance audit required by RCW
19.34.110 must:
(i)
Be a certified public accountant, licensed under chapter 18.04 RCW or
equivalent licensing statute of another jurisdiction; or
(ii)
Meet such other qualifications as the secretary may establish by rule.
(b)
Auditors must either possess such computer security qualifications as are necessary
to conduct the audit or employ, contract, or associate with firms or
individuals who do. The secretary may adopt rules establishing qualifications
as to expertise or experience in computer security.
(2)
The compliance audits of state agencies and local governments who are licensed
certification authorities, and the secretary, must be performed under the
authority of the state auditor. The state auditor may contract with private
entities as needed to comply with this chapter.
Sec.
7. RCW
19.34.120 and 1996 c 250 s 203 are each amended to read as follows:
(1)
The secretary may investigate the activities of a licensed certification
authority material to its compliance with this chapter and issue orders to a
certification authority to further its investigation and secure compliance with
this chapter.
(2)
The secretary may suspend or revoke the license of a certification authority
for its failure to comply with an order of the secretary.
(3)
The secretary may by order impose and collect a civil monetary penalty against
a licensed certification authority for a violation of this chapter in an
amount not to exceed ((five)) ten thousand dollars per incident,
or ninety percent of the recommended reliance limit of a material certificate,
whichever is less. In case of a violation continuing for more than one day,
each day is considered a separate incident. The secretary may adopt rules
setting forth the standards governing the exercise of the secretary's
discretion as to penalty amounts.
(4)
The secretary may order a certification authority, which it has found to be in
violation of this chapter, to pay the costs incurred by the secretary in
prosecuting and adjudicating proceedings relative to the order, and enforcing
it.
(5)
The secretary must exercise authority under this section in accordance with the
administrative procedure act, chapter 34.05 RCW, and a licensed certification
authority may obtain judicial review of the secretary's actions as prescribed
by chapter 34.05 RCW. The secretary may also seek injunctive relief to compel
compliance with an order.
Sec.
8. RCW
19.34.200 and 1996 c 250 s 301 are each amended to read as follows:
(1)
A licensed certification authority or subscriber ((may)) shall
use only a trustworthy system:
(a)
To issue, suspend, or revoke a certificate;
(b)
To publish or give notice of the issuance, suspension, or revocation of a
certificate; or
(c)
To create a private key.
(2)
A licensed certification authority must disclose any material certification
practice statement, and any fact material to either the reliability of a
certificate that it has issued or its ability to perform its services. A
certification authority may require a signed, written, and reasonably specific
inquiry from an identified person, and payment of reasonable compensation, as
conditions precedent to effecting a disclosure required in this subsection.
Sec.
9. RCW
19.34.210 and 1996 c 250 s 302 are each amended to read as follows:
(1)
A licensed certification authority may issue a certificate to a subscriber only
after all of the following conditions are satisfied:
(a)
The certification authority has received a request for issuance signed by the
prospective subscriber; and
(b)
The certification authority has confirmed that:
(i)
The prospective subscriber is the person to be listed in the certificate to be
issued;
(ii)
If the prospective subscriber is acting through one or more agents, the
subscriber duly authorized the agent or agents to have custody of the
subscriber's private key and to request issuance of a certificate listing the
corresponding public key;
(iii)
The information in the certificate to be issued is accurate;
(iv)
The prospective subscriber rightfully holds the private key corresponding to
the public key to be listed in the certificate;
(v)
The prospective subscriber holds a private key capable of creating a digital
signature; ((and))
(vi)
The public key to be listed in the certificate can be used to verify a digital
signature affixed by the private key held by the prospective subscriber; and
(vii)
The certificate provides information sufficient to locate or identify one or
more repositories in which notification of the revocation or suspension of the
certificate will be listed if the certificate is suspended or revoked.
(c)
The requirements of this subsection may not be waived or disclaimed by either
the licensed certification authority, the subscriber, or both.
(2)
If the subscriber accepts the issued certificate, the certification authority
must publish a signed copy of the certificate in a recognized repository, as
the certification authority and the subscriber named in the certificate may
agree, unless a contract between the certification authority and the subscriber
provides otherwise. If the subscriber does not accept the certificate, a
licensed certification authority must not publish it, or must cancel its
publication if the certificate has already been published.
(3)
Nothing in this section precludes a licensed certification authority from
conforming to standards, certification practice statements, security plans, or
contractual requirements more rigorous than, but nevertheless consistent with,
this chapter.
(4)
After issuing a certificate, a licensed certification authority must revoke it
immediately upon confirming that it was not issued as required by this
section. A licensed certification authority may also suspend a certificate
that it has issued for a reasonable period not exceeding ((forty-eight))
ninety-six hours as needed for an investigation to confirm grounds for
revocation under this subsection. The certification authority must give notice
to the subscriber as soon as practicable after a decision to revoke or suspend
under this subsection.
(5)
The secretary may order the licensed certification authority to suspend or
revoke a certificate that the certification authority issued, if, after giving
any required notice and opportunity for the certification authority and
subscriber to be heard in accordance with the administrative procedure act,
chapter 34.05 RCW, the secretary determines that:
(a)
The certificate was issued without substantial compliance with this section;
and
(b)
The noncompliance poses a significant risk to persons reasonably relying on the
certificate.
Upon
determining that an emergency requires an immediate remedy, and in accordance
with the administrative procedure act, chapter 34.05 RCW, the secretary may
issue an order suspending a certificate for a period not to exceed ((forty-eight))
ninety-six hours.
NEW
SECTION. Sec. 10. A
new section is added to chapter 19.34 RCW, to be codified to follow RCW
19.34.230 immediately, to read as follows:
(1)
A unit of state or local government, including its appropriate officers or
employees, may become a subscriber to a certificate for purposes of conducting
official business, but only if the certificate is issued by a licensed
certification authority. A unit of state government, except the secretary and
the department of information services, may not act as a certification
authority.
(2)
A city or county may become a licensed certification authority under RCW
19.34.100 for purposes of providing services to local government, if authorized
by ordinance adopted by the city or county legislative authority.
(3)
The limitation to licensed certification authorities in subsection (1) of this
section does not apply to uses of digital signatures or key pairs limited to internal
agency procedures, as to which the signature is not required by statute,
administrative rule, court rule, or requirement of the office of financial
management.
Sec.
11. RCW
19.34.240 and 1996 c 250 s 305 are each amended to read as follows:
(1)
By accepting a certificate issued by a licensed certification authority, the
subscriber identified in the certificate assumes a duty to exercise reasonable
care to retain control of the private key and prevent its disclosure to a
person not authorized to create the subscriber's digital signature. The
subscriber is released from this duty if the certificate expires or is revoked.
(2)
A private key is the personal property of the subscriber who rightfully holds
it.
(3)
((If a certification authority holds the private key corresponding to a
public key listed in a certificate that it has issued, the certification authority
holds the private key as a fiduciary of the subscriber named in the
certificate, and may use that private key only with the subscriber's prior,
written approval, unless the subscriber expressly grants the private key to the
certification authority and expressly permits the certification authority to
hold the private key according to other terms.)) A private key in the
possession of a state agency or local agency, as those terms are defined by RCW
42.17.020, is exempt from public inspection and copying under chapter 42.17
RCW.
Sec.
12. RCW
19.34.250 and 1996 c 250 s 306 are each amended to read as follows:
(1)
Unless the certification authority and the subscriber agree otherwise, the
licensed certification authority that issued a certificate that is not a
transactional certificate must suspend the certificate for a period not to
exceed ((forty-eight)) ninety-six hours:
(a)
Upon request by a person ((identifying himself or herself as)) whom
the certification authority reasonably believes to be: (i) The subscriber
named in the certificate((,)); (ii) a person duly authorized to act
for that subscriber; or ((as a person in a position likely to know of a
compromise of the security of a subscriber's private key, such as an agent,
business associate, employee, or member of the immediate family of the
subscriber)) (iii) a person acting on behalf of the unavailable
subscriber; or
(b)
By order of the secretary under RCW 19.34.210(5).
The
certification authority need not confirm the identity or agency of the person
requesting suspension. The certification authority may require the person
requesting suspension to provide evidence, including a statement under oath or
affirmation, regarding the requestor's identity, authorization, or the
unavailability of the subscriber. Law enforcement agencies may investigate
suspensions for possible wrongdoing by persons requesting suspension.
(2)
Unless the certificate provides otherwise or the certificate is a transactional
certificate, the secretary ((or a county clerk)) may suspend a
certificate issued by a licensed certification authority for a period ((of
forty-eight)) not to exceed ninety-six hours, if:
(a)
A person identifying himself or herself as the subscriber named in the
certificate ((or as an agent, business associate, employee, or member of the
immediate family of the subscriber requests suspension)), a person
authorized to act for that subscriber, or a person acting on behalf of that
unavailable subscriber; and
(b)
The requester represents that the certification authority that issued the
certificate is unavailable.
The
secretary ((or county clerk)) may require the person requesting
suspension to provide evidence, including a statement under oath or
affirmation, regarding his or her identity, authorization, or the
unavailability of the issuing certification authority, and may decline to
suspend the certificate in its discretion. ((The secretary or)) Law
enforcement agencies may investigate suspensions by the secretary ((or
county clerk)) for possible wrongdoing by persons requesting suspension.
(3)
Immediately upon suspension of a certificate by a licensed certification
authority, the licensed certification authority must give notice of the
suspension according to the specification in the certificate. If one or more
repositories are specified, then the licensed certification authority must
publish a signed notice of the suspension in all the repositories. If a
repository no longer exists or refuses to accept publication, or if no
repository is recognized under RCW 19.34.400, the licensed certification
authority must also publish the notice in a recognized repository. If a
certificate is suspended by the secretary ((or county clerk)), the
secretary ((or clerk)) must give notice as required in this subsection
for a licensed certification authority, provided that the person requesting
suspension pays in advance any fee required by a repository for publication of
the notice of suspension.
(4)
A certification authority must terminate a suspension initiated by request
only:
(a)
If the subscriber named in the suspended certificate requests termination of
the suspension, the certification authority has confirmed that the person
requesting suspension is the subscriber or an agent of the subscriber
authorized to terminate the suspension; or
(b)
When the certification authority discovers and confirms that the request for
the suspension was made without authorization by the subscriber. However, this
subsection (4)(b) does not require the certification authority to confirm a
request for suspension.
(5)
The contract between a subscriber and a licensed certification authority may
limit or preclude requested suspension by the certification authority, or may
provide otherwise for termination of a requested suspension. However, if the
contract limits or precludes suspension by the secretary ((or county clerk))
when the issuing certification authority is unavailable, the limitation or
preclusion is effective only if notice of it is published in the certificate.
(6)
No person may knowingly or intentionally misrepresent to a certification
authority his or her identity or authorization in requesting suspension of a
certificate. Violation of this subsection is a gross misdemeanor.
(7)
((The subscriber is released from the duty to keep the private key secure
under RCW 19.34.240(1) while the certificate is suspended.)) The
secretary may authorize other state or local governmental agencies to perform
any of the functions of the secretary under this section upon a regional
basis. The authorization must be formalized by an agreement under chapter
39.34 RCW. The secretary may provide by rule the terms and conditions of the
regional services.
(8)
A suspension under this section must be completed within twenty-four hours of
receipt of all information required in this section.
Sec.
13. RCW
19.34.260 and 1996 c 250 s 307 are each amended to read as follows:
(1)
A licensed certification authority must revoke a certificate that it issued but
which is not a transactional certificate, after:
(a)
Receiving a request for revocation by the subscriber named in the certificate;
and
(b)
Confirming that the person requesting revocation is the subscriber, or is an
agent of the subscriber with authority to request the revocation.
(2)
A licensed certification authority must confirm a request for revocation and
revoke a certificate within one business day after receiving both a
subscriber's written request and evidence reasonably sufficient to confirm the
identity and any agency of the person requesting the ((suspension)) revocation.
(3)
A licensed certification authority must revoke a certificate that it issued:
(a)
Upon receiving a certified copy of the subscriber's death certificate, or upon
confirming by other evidence that the subscriber is dead; or
(b)
Upon presentation of documents effecting a dissolution of the subscriber, or
upon confirming by other evidence that the subscriber has been dissolved or has
ceased to exist, except that if the subscriber is dissolved and is
reinstated or restored before revocation is completed, the certification
authority is not required to revoke the certificate.
(4)
A licensed certification authority may revoke one or more certificates that it
issued if the certificates are or become unreliable, regardless of whether the
subscriber consents to the revocation and notwithstanding a provision to the
contrary in a contract between the subscriber and certification authority.
(5)
Immediately upon revocation of a certificate by a licensed certification
authority, the licensed certification authority must give notice of the
revocation according to the specification in the certificate. If one or more
repositories are specified, then the licensed certification authority must
publish a signed notice of the revocation in all repositories. If a repository
no longer exists or refuses to accept publication, or if no repository is
recognized under RCW 19.34.400, then the licensed certification authority must
also publish the notice in a recognized repository.
(6)
A subscriber ceases to certify, as provided in RCW 19.34.230, and has no
further duty to keep the private key secure, as required by RCW 19.34.240, in
relation to the certificate whose revocation the subscriber has requested,
beginning at the earlier of either:
(a)
When notice of the revocation is published as required in subsection (5) of
this section; or
(b)
One business day after the subscriber requests revocation in writing, supplies
to the issuing certification authority information reasonably sufficient to
confirm the request, and pays any contractually required fee.
(7)
Upon notification as required by subsection (5) of this section, a licensed
certification authority is discharged of its warranties based on issuance of
the revoked certificate, as to transactions occurring after the
notification, and ceases to certify as provided in RCW 19.34.220 (2) and
(3) in relation to the revoked certificate.
Sec.
14. RCW
19.34.280 and 1996 c 250 s 309 are each amended to read as follows:
(1)
By specifying a recommended reliance limit in a certificate, the issuing
certification authority ((and accepting subscriber)) recommends
that persons rely on the certificate only to the extent that the total amount
at risk does not exceed the recommended reliance limit.
(2)
Subject to subsection (3) of this section, unless a licensed
certification authority waives application of this subsection, a licensed
certification authority is:
(a)
Not liable for a loss caused by reliance on a false or forged digital signature
of a subscriber, if, with respect to the false or forged digital signature, the
certification authority complied with all material requirements of this
chapter;
(b)
Not liable in excess of the amount specified in the certificate as its recommended
reliance limit for either:
(i)
A loss caused by reliance on a misrepresentation in the certificate of a fact
that the licensed certification authority is required to confirm; or
(ii)
Failure to comply with RCW 19.34.210 in issuing the certificate;
(c)
Not liable ((only)) for ((direct compensatory damages in an
action to recover a loss due to reliance on the certificate. Direct
compensatory damages do not include)):
(i)
Punitive or exemplary damages. Nothing in this chapter may be interpreted to
permit punitive or exemplary damages that would not otherwise be permitted by
the law of this state; or
(ii)
((Damages for lost profits or opportunity; or
(iii)))
Damages for pain or suffering.
(3)
Nothing in subsection (2)(a) of this section relieves a licensed certification
authority of its liability for breach of any of the warranties or
certifications it gives under RCW 19.34.220 or for its lack of good faith,
which warranties and obligation of good faith may not be disclaimed. However,
the standards by which the performance of a licensed certification authority's
obligation of good faith is to be measured may be determined by agreement or
notification complying with subsection (4) of this section if the standards are
not manifestly unreasonable. The liability of a licensed certification
authority under this subsection is subject to the limitations in subsection (2)
(b) and (c) of this section unless the limits are waived by the licensed
certification authority.
(4)
Consequential or incidental damages may be liquidated, or may otherwise be
limited, altered, or excluded unless the limitation, alteration, or exclusion
is unconscionable. A licensed certification authority may liquidate, limit,
alter, or exclude consequential or incidental damages as provided in this
subsection by agreement or by notifying any person who will rely on a
certificate of the liquidation, limitation, alteration, or exclusion before the
person relies on the certificate.
NEW
SECTION. Sec. 15. A
new section is added to chapter 19.34 RCW, to be codified to follow RCW
19.34.290 immediately, to read as follows:
(1)
A licensed certification authority that discontinues providing certification
authority services shall:
(a)
Notify all subscribers listed in valid certificates issued by the certification
authority, before discontinuing services;
(b)
Minimize, to the extent commercially reasonable, disruption to the subscribers
of valid certificates and relying parties; and
(c)
Make reasonable arrangements for preservation of the certification authority's
records.
(2)
A suitable guaranty of a licensed certification authority may not be released
until the expiration of the term specified in the guaranty.
(3)
The secretary may provide by rule for a process by which the secretary may, in
any combination, receive, administer, or disburse the records of a licensed
certification authority or a recognized repository that discontinues providing
services, for the purpose of maintaining access to the records and revoking any
previously issued valid certificates in a manner that minimizes disruption to
subscribers and relying parties. The secretary's rules may include provisions
by which the secretary may recover costs incurred in doing so.
Sec.
16. RCW
19.34.300 and 1996 c 250 s 401 are each amended to read as follows:
(1)
Where a rule of law requires a signature, or provides for certain consequences
in the absence of a signature, that rule is satisfied by a digital signature,
if:
(((1)
No party affected by a digital signature objects to the use of digital
signatures in lieu of a signature, and the objection may be evidenced by
refusal to provide or accept a digital signature;
(2)
That)) (a) The digital signature is verified by reference
to the public key listed in a valid certificate issued by a licensed
certification authority;
(((3)
That)) (b) The digital signature was affixed by the signer with the
intention of signing the message((, and after the signer has had an
opportunity to review items being signed)); and
(((4)))
(c) The recipient has no knowledge or notice that the signer either:
(((a)))
(i) Breached a duty as a subscriber; or
(((b)))
(ii) Does not rightfully hold the private key used to affix the digital
signature.
((However,))
(2) Nothing in this chapter:
(a)
Precludes a mark from being valid as a signature under other applicable law;
(b)
May be construed to obligate a recipient or any other person asked to rely on a
digital signature to accept a digital signature or to respond to an electronic
message containing a digital signature except as provided in section 20 of this
act; or
(c)
Precludes the recipient of a digital signature or an electronic message
containing a digital signature from establishing the conditions under which the
recipient will accept a digital signature.
Sec.
17. RCW
19.34.310 and 1996 c 250 s 402 are each amended to read as follows:
Unless
otherwise provided by law or contract, the recipient of a digital signature
assumes the risk that a digital signature is forged, if reliance on the digital
signature is not reasonable under the circumstances. ((If the recipient
determines not to rely on a digital signature under this section, the recipient
must promptly notify the signer of any determination not to rely on a digital
signature and the grounds for that determination. Nothing in this chapter
shall be construed to obligate a person to accept a digital signature or to
respond to an electronic message containing a digital signature.))
NEW
SECTION. Sec. 18. A
new section is added to chapter 19.34 RCW, to be codified to follow RCW
19.34.310 immediately, to read as follows:
The
following factors, among others, are significant in evaluating the
reasonableness of a recipient's reliance upon a certificate and upon the
digital signatures verifiable with reference to the public key listed in the
certificate:
(1)
Facts which the relying party knows or of which the relying party has notice,
including all facts listed in the certificate or incorporated in it by
reference;
(2)
The value or importance of the digitally signed message, if known;
(3)
The course of dealing between the relying person and subscriber and the
available indicia of reliability or unreliability apart from the digital
signature; and
(4)
Usage of trade, particularly trade conducted by trustworthy systems or other
computer-based means.
Sec.
19. RCW
19.34.320 and 1996 c 250 s 403 are each amended to read as follows:
A
message is as valid, enforceable, and effective as if it had been written on
paper, if it:
(1)
Bears in its entirety a digital signature; and
(2)
That digital signature is verified by the public key listed in a certificate
that:
(a)
Was issued by a licensed certification authority; and
(b)
Was valid at the time the digital signature was created.
Nothing
in this chapter shall be construed to eliminate, modify, or condition any other
requirements for a contract to be valid, enforceable, and effective. No
digital message shall be deemed to be an instrument under ((the provisions
of)) Title 62A RCW unless all parties to the transaction agree,
including financial institutions affected.
NEW
SECTION. Sec. 20. A
new section is added to chapter 19.34 RCW, to be codified to follow RCW
19.34.320 immediately, to read as follows:
(1)
A person may not refuse to honor, accept, or act upon a court order, writ, or
warrant upon the basis that it is electronic in form and signed with a digital
signature, if the digital signature was certified by a licensed certification
authority or otherwise issued under court rule. This section applies to a
paper printout of a digitally signed document, if the printout reveals that the
digital signature was electronically verified before the printout, and in the
absence of a finding that the document has been altered.
(2)
Nothing in this chapter shall be construed to limit the authority of the
supreme court to adopt rules of pleading, practice, or procedure, or of the
court of appeals or superior courts to adopt supplementary local rules,
governing the use of electronic messages or documents, including rules
governing the use of digital signatures, in judicial proceedings.
Sec.
21. RCW
19.34.340 and 1996 c 250 s 405 are each amended to read as follows:
(1)
Unless otherwise provided by law or contract, ((a certificate issued by a
licensed certification authority is an acknowledgment of a digital signature
verified by reference to the public key listed in the certificate, regardless
of whether)) if so provided in the certificate issued by a licensed
certification authority, a digital signature verified by reference to the
public key listed in a valid certificate issued by a licensed certification
authority satisfies the requirements for an acknowledgment under RCW 42.44.010(4)
and for acknowledgment of deeds and other real property conveyances under RCW
64.04.020 if words of an express acknowledgment appear with the digital
signature ((and)) regardless of whether the signer ((physically))
personally appeared before either the certification authority or
some other person authorized to take acknowledgments of deeds, mortgages, or
other conveyance instruments under RCW 64.08.010 when the digital signature
was created, if that digital signature is:
(((1)))
(a) Verifiable by that certificate; and
(((2)))
(b) Affixed when that certificate was valid.
(2)
If the digital signature is used as an acknowledgment, then the certification
authority is responsible to the same extent as a notary up to the recommended
reliance limit for failure to satisfy the requirements for an acknowledgment.
The certification authority may not disclaim or limit, other than as provided
in RCW 19.34.280, the effect of this section.
Sec.
22. RCW
19.34.350 and 1996 c 250 s 406 are each amended to read as follows:
In
adjudicating a dispute involving a digital signature, ((a court of this
state presumes)) it is rebuttably presumed that:
(1)
A certificate digitally signed by a licensed certification authority and either
published in a recognized repository, or made available by the issuing
certification authority or by the subscriber listed in the certificate is
issued by the certification authority that digitally signed it and is accepted
by the subscriber listed in it.
(2)
The information listed in a valid certificate and confirmed by a licensed
certification authority issuing the certificate is accurate.
(3)
If a digital signature is verified by the public key listed in a valid
certificate issued by a licensed certification authority:
(a)
That digital signature is the digital signature of the subscriber listed in
that certificate;
(b)
That digital signature was affixed by that subscriber with the intention of
signing the message; ((and))
(c)
The message associated with the digital signature has not been altered since
the signature was affixed; and
(d)
The recipient of that digital signature has no knowledge or notice that the
signer:
(i)
Breached a duty as a subscriber; or
(ii)
Does not rightfully hold the private key used to affix the digital signature.
(4)
A digital signature was created before it was time stamped by a disinterested
person utilizing a trustworthy system.
Sec.
23. RCW
19.34.400 and 1996 c 250 s 501 are each amended to read as follows:
(1)
The secretary must recognize one or more repositories, after finding that a
repository to be recognized:
(a)
Is ((operated under the direction of)) a licensed certification authority;
(b)
Includes, or will include, a data base containing:
(i)
Certificates published in the repository;
(ii)
Notices of suspended or revoked certificates published by licensed
certification authorities or other persons suspending or revoking certificates;
(iii)
Certification authority disclosure records for licensed certification
authorities;
(iv)
All orders or advisory statements published by the secretary in regulating
certification authorities; and
(v)
Other information adopted by rule by the secretary;
(c)
Operates by means of a trustworthy system, that may, under administrative
rule of the secretary, include additional or different attributes than those
applicable to a certification authority that does not operate as a recognized
repository;
(d)
Contains no significant amount of information that is known or likely to be
untrue, inaccurate, or not reasonably reliable;
(e)
Contains certificates published by certification authorities that conform to
legally binding requirements that the secretary finds to be substantially
similar to, or more stringent toward the certification authorities, than those
of this state;
(f)
Keeps an archive of certificates that have been suspended or revoked, or that
have expired, within at least the past three years; and
(g)
Complies with other reasonable requirements adopted by rule by the secretary.
(2)
A repository may apply to the secretary for recognition by filing a written
request and providing evidence to the secretary sufficient for the secretary to
find that the conditions for recognition are satisfied.
(3)
A repository may discontinue its recognition by filing thirty days' written
notice with the secretary. In addition the secretary may discontinue
recognition of a repository in accordance with the administrative procedure
act, chapter 34.05 RCW, if ((it)) the secretary concludes that
the repository no longer satisfies the conditions for recognition listed in
this section or in rules adopted by the secretary.
Sec.
24. RCW
19.34.500 and 1996 c 250 s 603 are each amended to read as follows:
The
secretary of state may adopt rules to implement this chapter beginning ((July
1, 1996)) July 27, 1997, but the rules may not take effect until January
1, 1998.
NEW
SECTION. Sec. 25. A
new section is added to chapter 19.34 RCW, to be codified to follow RCW
19.34.500 immediately, to read as follows:
This
chapter supersedes and preempts all local laws or ordinances regarding the same
subject matter.
NEW
SECTION. Sec. 26. A
new section is added to chapter 19.34 RCW, to be codified to follow section 25
of this act immediately, to read as follows:
This
chapter does not preclude criminal prosecution under other laws of this state,
nor may any provision of this chapter be regarded as an exclusive remedy for a
violation. Injunctive relief may not be denied to a party regarding conduct
governed by this chapter on the basis that the conduct is also subject to
potential criminal prosecution.
NEW
SECTION. Sec. 27. A
new section is added to chapter 19.34 RCW, to be codified to follow section 26
of this act immediately, to read as follows:
Issues
regarding jurisdiction, venue, and choice of laws for all actions involving
digital signatures must be determined according to the same principles as if
all transactions had been performed through paper documents.
Sec.
28. RCW
19.34.901 and 1996 c 250 s 602 are each amended to read as follows:
((This
act shall)) (1) Sections 1 through 601, 604, and 605, chapter 250, Laws
of 1996 take effect January 1, 1998.
(2)
Sections 602 and 603, chapter 250, Laws of 1996 take effect July 27, 1997.
NEW
SECTION. Sec. 29. A
new section is added to chapter 43.105 RCW to read as follows:
The
department of information services may become a licensed certification
authority, under chapter 19.34 RCW, for the purpose of providing services to
state and local government. The department is not subject to RCW
19.34.100(1)(a). The department shall only issue certificates, as defined in
RCW 19.34.020, in which the subscriber is:
(1)
The state of Washington or a department, office, or agency of the state;
(2)
A city, county, district, or other municipal corporation, or a department,
office, or agency of the city, county, district, or municipal corporation;
(3)
An agent or employee of an entity described by subsection (1) or (2) of this
section, for purposes of official public business; or
(4)
An applicant for a license as a certification authority for the purpose of
compliance with RCW 19.34.100(1)(a).
Sec.
30. RCW
19.34.020 and 1996 c 250 s 103 are each amended to read as follows:
Unless
the context clearly requires otherwise, the definitions in this section apply
throughout this chapter:
(1)
"Accept a certificate" means either:
(a)
To manifest approval of a certificate, while knowing or having notice of its
contents; or
(b)
To apply to a licensed certification authority for a certificate, without
canceling or revoking the application by delivering notice of the cancellation
or revocation to the certification authority and obtaining a signed, written
receipt from the certification authority, if the certification authority
subsequently issues a certificate based on the application.
(2)
"Accept a digital signature" means to verify a digital signature
or take an action in reliance on a digital signature.
(3)
"Asymmetric cryptosystem" means an algorithm or series of algorithms
that provide a secure key pair.
(((3)))
(4) "Certificate" means a computer-based record that:
(a)
Identifies the certification authority issuing it;
(b)
Names or identifies its subscriber;
(c)
Contains the subscriber's public key; and
(d)
Is digitally signed by the certification authority issuing it.
(((4)))
(5) "Certification authority" means a person who issues a
certificate.
(((5)))
(6) "Certification authority disclosure record" means an
on-line, publicly accessible record that concerns a licensed certification
authority and is kept by the secretary. A certification authority disclosure
record has the contents specified by rule by the secretary under RCW 19.34.030.
(((6)))
(7) "Certification practice statement" means a declaration of
the practices that a certification authority employs in issuing certificates
generally, or employed in issuing a material certificate.
(((7)))
(8) "Certify" means to declare with reference to a
certificate, with ample opportunity to reflect, and with a duty to apprise
oneself of all material facts.
(((8)))
(9) "Confirm" means to ascertain through appropriate inquiry
and investigation.
(((9)))
(10) "Correspond," with reference to keys, means to belong to
the same key pair.
(((10)))
(11) "Digital signature" means a transformation of a message
using an asymmetric cryptosystem such that a person having the initial message
and the signer's public key can accurately determine:
(a)
Whether the transformation was created using the private key that corresponds
to the signer's public key; and
(b)
Whether the initial message has been altered since the transformation was made.
(((11)))
(12) "Financial institution" means a national or
state-chartered commercial bank or trust company, savings bank, savings
association, or credit union authorized to do business in the state of
Washington and the deposits of which are federally insured.
(((12)))
(13) "Forge a digital signature" means either:
(a)
To create a digital signature without the authorization of the rightful holder
of the private key; or
(b)
To create a digital signature verifiable by a certificate listing as subscriber
a person who either:
(i)
Does not exist; or
(ii)
Does not hold the private key corresponding to the public key listed in the
certificate.
(((13)))
(14) "Hold a private key" means to be authorized to utilize a
private key.
(((14)))
(15) "Incorporate by reference" means to make one message a
part of another message by identifying the message to be incorporated and
expressing the intention that it be incorporated.
(((15)))
(16) "Issue a certificate" means the acts of a certification
authority in creating a certificate and notifying the subscriber listed in the
certificate of the contents of the certificate.
(((16)))
(17) "Key pair" means a private key and its corresponding
public key in an asymmetric cryptosystem, keys which have the property that the
public key can verify a digital signature that the private key creates.
(((17)))
(18) "Licensed certification authority" means a certification
authority to whom a license has been issued by the secretary and whose license
is in effect.
(((18)))
(19) "Message" means a digital representation of information.
(((19)))
(20) "Notify" means to communicate a fact to another person in
a manner reasonably likely under the circumstances to impart knowledge of the
information to the other person.
(((20)))
(21) "Operative personnel" means one or more natural persons
acting as a certification authority or its agent, or in the employment of, or
under contract with, a certification authority, and who have:
(a)
Managerial or policymaking responsibilities for the certification authority; or
(b)
Duties directly involving the issuance of certificates, creation of private
keys, or administration of a certification authority's computing facilities.
(((21)))
(22) "Person" means a human being or an organization capable
of signing a document, either legally or as a matter of fact.
(((22)))
(23) "Private key" means the key of a key pair used to create
a digital signature.
(((23)))
(24) "Public key" means the key of a key pair used to verify a
digital signature.
(((24)))
(25) "Publish" means to record or file in a repository.
(((25)))
(26) "Qualified right to payment" means an award of damages
against a licensed certification authority by a court having jurisdiction over
the certification authority in a civil action for violation of this chapter.
(((26)))
(27) "Recipient" means a person who ((receives or has a
digital signature)) has received a certificate and a digital signature
verifiable with reference to a public key listed in the certificate and is
in a position to rely on it.
(((27)))
(28) "Recognized repository" means a repository recognized by
the secretary under RCW 19.34.400.
(((28)))
(29) "Recommended reliance limit" means the monetary amount
recommended for reliance on a certificate under RCW 19.34.280(1).
(((29)))
(30) "Repository" means a system for storing and retrieving
certificates and other information relevant to digital signatures.
(((30)))
(31) "Revoke a certificate" means to make a certificate
ineffective permanently from a specified time forward. Revocation is effected
by notation or inclusion in a set of revoked certificates, and does not imply
that a revoked certificate is destroyed or made illegible.
(((31)))
(32) "Rightfully hold a private key" means the authority to
utilize a private key:
(a)
That the holder or the holder's agents have not disclosed to a person in
violation of RCW 19.34.240(1); and
(b)
That the holder has not obtained through theft, deceit, eavesdropping, or other
unlawful means.
(((32)))
(33) "Secretary" means the secretary of state.
(((33)))
(34) "Subscriber" means a person who:
(a)
Is the subject listed in a certificate;
(b)
Accepts the certificate; and
(c)
Holds a private key that corresponds to a public key listed in that
certificate.
(((34)))
(35) "Suitable guaranty" means either a surety bond executed
by a surety authorized by the insurance commissioner to do business in this
state, or an irrevocable letter of credit issued by a financial institution
authorized to do business in this state, which, in either event, satisfies all
of the following requirements:
(a)
It is issued payable to the secretary for the benefit of persons holding
qualified rights of payment against the licensed certification authority named
as the principal of the bond or customer of the letter of credit;
(b)
It is in an amount specified by rule by the secretary under RCW 19.34.030;
(c)
It states that it is issued for filing under this chapter;
(d)
It specifies a term of effectiveness extending at least as long as the term of
the license to be issued to the certification authority; and
(e)
It is in a form prescribed or approved by rule by the secretary.
A
suitable guaranty may also provide that the total annual liability on the
guaranty to all persons making claims based on it may not exceed the face
amount of the guaranty.
(((35)))
(36) "Suspend a certificate" means to make a certificate
ineffective temporarily for a specified time forward.
(((36)))
(37) "Time stamp" means either:
(a)
To append or attach to a message, digital signature, or certificate a digitally
signed notation indicating at least the date, time, and identity of the person
appending or attaching the notation; or
(b)
The notation thus appended or attached.
(((37)))
(38) "Transactional certificate" means a valid certificate
incorporating by reference one or more digital signatures.
(((38)))
(39) "Trustworthy system" means computer hardware and software
that:
(a)
Are reasonably secure from intrusion and misuse;
(b)
Provide a reasonable level of availability, reliability, and correct operation;
and
(c)
Are reasonably suited to performing their intended functions.
(((39)))
(40) "Valid certificate" means a certificate that:
(a)
A licensed certification authority has issued;
(b)
The subscriber listed in it has accepted;
(c)
Has not been revoked or suspended; and
(d)
Has not expired.
However,
a transactional certificate is a valid certificate only in relation to the
digital signature incorporated in it by reference.
(((40)))
(41) "Verify a digital signature" means, in relation to a
given digital signature, message, and public key, to determine accurately that:
(a)
The digital signature was created by the private key corresponding to the
public key; and
(b)
The message has not been altered since its digital signature was created.
NEW
SECTION. Sec. 31. A
new section is added to chapter 19.34 RCW to read as follows:
Acceptance
of a digital signature may be made in any manner reasonable in the
circumstances.
Sec.
32. RCW
19.34.220 and 1996 c 250 s 303 are each amended to read as follows:
(1)
By issuing a certificate, a licensed certification authority warrants to the
subscriber named in the certificate that:
(a)
The certificate contains no information known to the certification authority to
be false;
(b)
The certificate satisfies all material requirements of this chapter; and
(c)
The certification authority has not exceeded any limits of its license in
issuing the certificate.
The
certification authority may not disclaim or limit the warranties of this
subsection.
(2)
Unless the subscriber and certification authority otherwise agree, a
certification authority, by issuing a certificate, promises to the subscriber:
(a)
To act promptly to suspend or revoke a certificate in accordance with RCW
19.34.250 or 19.34.260; and
(b)
To notify the subscriber within a reasonable time of any facts known to the
certification authority that significantly affect the validity or reliability
of the certificate once it is issued.
(3)
By issuing a certificate, a licensed certification authority certifies to all
who reasonably rely on the information contained in the certificate, or on a
digital signature verifiable by the public key listed in the certificate,
that:
(a)
The information in the certificate and listed as confirmed by the certification
authority is accurate;
(b)
All information foreseeably material to the reliability of the certificate is
stated or incorporated by reference within the certificate;
(c)
The subscriber has accepted the certificate; and
(d)
The licensed certification authority has complied with all applicable laws of
this state governing issuance of the certificate.
(4)
By publishing a certificate, a licensed certification authority certifies to
the repository in which the certificate is published and to all who reasonably
rely on the information contained in the certificate that the certification
authority has issued the certificate to the subscriber.
Sec.
33. RCW
19.34.410 and 1996 c 250 s 502 are each amended to read as follows:
(1)
Notwithstanding a disclaimer by the repository or a contract to the contrary
between the repository, a certification authority, or a subscriber, a
repository is liable for a loss incurred by a person reasonably relying on a
digital signature verified by the public key listed in a suspended or revoked
certificate, if loss was incurred more than one business day after receipt by
the repository of a request to publish notice of the suspension or revocation,
and the repository had failed to publish the notice when the person relied on
the digital signature.
(2)
Unless waived, a recognized repository or the owner or operator of a recognized
repository is:
(a)
Not liable for failure to record publication of a suspension or revocation,
unless the repository has received notice of publication and one business day
has elapsed since the notice was received;
(b)
Not liable under subsection (1) of this section in excess of the amount
specified in the certificate as the recommended reliance limit;
(c)
Not liable under subsection (1) of this section ((only)) for ((direct
compensatory damages, which do not include)):
(i)
Punitive or exemplary damages; or
(ii)
((Damages for lost profits or opportunity; or
(iii)))
Damages for pain or suffering;
(d)
Not liable for misrepresentation in a certificate published by a licensed
certification authority;
(e)
Not liable for accurately recording or reporting information that a licensed
certification authority, or court clerk, or the secretary has published as
required or permitted in this chapter, including information about suspension
or revocation of a certificate;
(f)
Not liable for reporting information about a certification authority, a
certificate, or a subscriber, if the information is published as required or
permitted in this chapter or a rule adopted by the secretary, or is published
by order of the secretary in the performance of the licensing and regulatory
duties of that office under this chapter.
(3)
Consequential or incidental damages may be liquidated, or may otherwise be
limited, altered, or excluded unless the limitation, alteration, or exclusion
is unconscionable. A recognized repository may liquidate, limit, alter, or
exclude damages as provided in this subsection by agreement, or by notifying
any person who will rely on a digital signature verified by the public key
listed in a suspended or revoked certificate of the liquidation, limitation,
alteration, or exclusion before the person relies on the certificate.
NEW
SECTION. Sec. 34. A
new section is added to chapter 19.34 RCW, to be codified to follow RCW 19.34.350
immediately, to read as follows:
The
effect of this chapter may be varied by agreement, except:
(1)
A person may not disclaim responsibility for lack of good faith, but parties
may by agreement determine the standards by which the duty of good faith is to
be measured if the standards are not manifestly unreasonable; and
(2)
As otherwise provided in this chapter.
NEW
SECTION. Sec. 35.
Sections 1 through 23, 25 through 27, and 29 through 34 of this act take effect
January 1, 1998.
NEW SECTION. Sec. 36. If
any provision of this act or its application to any person or circumstance is
held invalid, the remainder of the act or the application of the provision to
other persons or circumstances is not affected.
