Subject: Re: Certificate Policy Standardization

From: [email-masked] (Peter Gutmann)
Date: Thu, 27 Nov 2003 04:36:04 +1300

Andreas Mitrakas <[email-masked]> writes:

>Especially so in some implementations in Europe where there is a direct link
>between the policy and the law under which certain certs like QC certs are
>issued.

The feeling was that digital signature legislation (following the UNCITRAL
model) is so vaguely worded that this wouldn't be a problem.  Qualified certs
are a bit more problematic, but that's only in Europe.

>A CP becomes part of the parties agreement and binding by means of e.g. a
>subscriber agreement. So it is not unthinkable albeit not necessarily
>desirable, that a courts might  scrutinise policies. --God forbid.

The feeling here was that a ToS-style policy might violate (at least NZ)
consumer protection legislation, however since a number of large organisations
relied on these types of agreements there would probably be a spirited defence
of them in court and/or existing case law upholding them.  See e.g Xtra
(Telecom NZ ISP) terms, which state:

  12. Changes to these Customer Terms

  We may change these Customer Terms by changing or removing existing terms,
  or by adding new ones. Changes may take the form of completely new terms.

  [Notification stuff snipped]

  A copy of our current terms is displayed on our Website. It is your
  responsibility to check these Customer Terms regularly (at least monthly)
  for any modifications or updates. You will be deemed to have accepted the
  changes to these Customer Terms and to have agreed to be bound by the
  revised Customer Terms if you continue to use and/or access the Services
  after the date that the changes are stated to be effective.

  We reserve the right to change any charges or Services, or any Separate
  Terms, at any time without notice. It is your responsibility to check all
  applicable Separate Terms regularly for any modifications or updates.

That's the sort of thing the "policy is what we say it is" that I mentioned
earlier was based on.  Just for reference, here's what Yahoo says:

  Yahoo! provides its service to you, subject to the following Terms of
  Service ("TOS"), which may be updated by us from time to time without notice
  to you. You can review the most current version of the TOS at any time at:
  http://docs.yahoo.com/info/terms/. 
  
  [Snippage]

  Yahoo! reserves the right at any time and from time to time to modify or
  discontinue, temporarily or permanently, the Service (or any part thereof)
  with or without notice. You agree that Yahoo! shall not be liable to you or
  to any third party for any modification, suspension or discontinuance of the
  Service.

The debate then went off on a tangent about whether a PKI was providing a
service of any value to a user (if it doesn't it's not covered by standard
consumer-protection law), and how you'd present that in court.

Disclaimer: IANAL, I just talk to them occasionally.

Peter.

---

From: Michael Ströder <[email-masked]>
Date: Thu, 27 Nov 2003 16:44:53 +0100

Peter Gutmann wrote:
> consumer protection legislation,

I'm not a lawyer and the terms are for sure used much differently in other
countries. But I also guess that most ToS-style CPs would not withstand a
court trial based on german AGB-Gesetz, the law regulating "Allgemeine
Geschäftsbedingungen" (similar to ToS).

But since PKI did not hit the mass market yet a CA with such a ToS-style CP
can assume that this risk is quite low.
Less RPs => less serious usage => less risks. ;-)

Ciao, Michael.

---

From: Michael Ströder <[email-masked]>
Date: Thu, 27 Nov 2003 16:44:53 +0100

Ciao, Michael.