Web Security and Commerce

Ten Policy Questions

We include the following helpful policy questions about digital signatures with the permission of Bradford Biddle.^[38]

Following the lead of the state of Utah, numerous states and several foreign countries have enacted “digital signature” legislation aimed at promoting the development of a public key infrastructure. While PKI legislation has acquired significant momentum, it is not clear that lawmakers have carefully considered the public policy implications and long-term consequences of these laws.

Is legislation necessary at all?

Proponents of digital signature legislation start with the premise that the need for a PKI is clear: public key cryptography and verifiable certificates offer the best hope for sending secure, authentic electronic messages over open networks, thereby facilitating electronic commerce. They argue that the reason that the commercial marketplace has not produced a viable certification authority (CA) industry is because of legal uncertainty (CAs are unable to determine their potential liability exposure because of a confusing array of applicable background law) or because existing law imposes too much liability on CAs. Thus, proponents argue, legislation is necessary in order to provide certainty in the marketplace and allow a much-needed industry to emerge, as well as to address other issues such as the legal status of digitally signed documents.

Opponents of this view assert that it is far too soon to conclude that the market will not ...