The public official, an implicit model for the certification of private documents

Transcription

1 The electronic legal document and the French Commercial Court Registrars, public and ministerial officials Pascal Beder Greffier associé du tribunal de commerce de Paris/Associate Registrar of the Commercial Court of Paris, President of ASG, Association Syndicale de Greffiers de Commerce de France with the participation of Jean Marc Bahans, Doctor of Law, Greffier associé du tribunal de commerce de Bordeaux/Associate Registrar of the Commercial Court of Bordeaux Outline I. The public official and the security of electronic documents in France The public official, legal instrument for the security of electronic documents: the electronic authentic document The public official, an implicit model for the certification of private documents 1.Third party certification, a reduced version of the public official The public official, third party certification II. The electronic document and the renewal of the traditional activities of the Registrars of the Commercial Court, public and ministerial officials 1. Electronic legal notices 2. The e-procedure III. The implementation of the Internet site of the Registrars of the commercial Court of Paris and the granting of the electronic signature keys European Trade Register Congress Cardiff, 5 October 2000 The electronic legal document and the French Commercial Court Registrars - public and ministerial officials I would like to address the question of the electronic document from the point of view of the Commercial Court Registrar s profession - which, in France, is responsible for the local trade registers. Acting in both a public and ministerial capacity, French Commercial Court Registrars give the legal, reliable and valid character to the business information they receive, validate and distribute. First, a precision is necessary: The French public and ministerial official directs an office which gives its holder a body of powers and obligations. These officials have the right to exercise their functions as independent professionals, following their official nomination. The office of the Registrar of the Commercial Court is ministerial, as the Ministry of Justice has delegated to it a part of public authority - that of validating the authenticity of documents within its area of competence. Therefore, acting in both a public and ministerial capacity, French Commercial Court Registrars embody the

2 third party responsible for the security of both legal and juridical documents. Now, security is at the heart of the question of electronic documents. If security is at the heart of the question, the public official is directly concerned. Why? In two ways: First, because French Law permits the drawing-up of electronic original documents and, under French Law, original documents are the most perfect example of authenticity. Then, indirectly, because the function of the Registrar - an independent person authorized by the State to carryout the verification of original documents - is taken as a model for the acceptance of electronic private documents in the same manner as documents drawn-up on paper. It is interesting to note that the legal texts present the certifying official s responsibility as one of validation and conservation of documents - and of confidentiality. We note that the validation of electronic signatures is not identified with the authenticity of the document. We also note that the electronic document - the validity of which is presumed - is a document verified by the intervention of a third party and, given the strictness of that verification, is therefore almost more valid than in its paper form. The methodology of the public official therefore influences the criteria used to render secure the electronic document. The electronic document in itself justifies anew the traditional activities of the public official. The public official and the electronic document therefore have a mutual base of interest. Examining the influence of the Registrar on the security of the electronic document must come before analysing the renewal of the traditional activities of public officials via the electronic document. 1. The public official and the security of electronic documents: the electronic original document As noted, security is at the heart of the question of electronic documents. Without legal security no commerce is possible - e.commerce is no exception to that rule. In my opinion, the public official plays a double role: it is he who validates the most authentic document - now possible electronically it is he who influences the model for securing electronic private documents, which, unlike such documents on paper, may be rated as to their level of credibility. In the second case, the official may compete with other certification service providers. A. The public official, the legal instrument for securing electronic documents: the electronic original document The original document is at the top of the security pyramid for legal documents and its effects are not the same as those of a private document. The original document is therefore both a writ of execution and a deed deemed authentic unless proved to be a forgery. The French Law of 13 March 2000 approved the electronic document and the possibility of concluding original deeds electronically. It also stated that the signature is necessary to complete a legal document - both to identify the author and to show his consent to the terms of the deed. The same law adds that the signature When it is signed by a public official, confirms the authenticity of the document. It is therefore clearly the public official s signature which validates the authenticity of the deed.

3 The public official s signature authenticates a legal document, whether it be electronic or hand written. The public official is therefore at the heart of the question of securing electronic documents. The Law of 13 March 2000, having approved the electronic original deed, then rates the security level of legal documents - particularly electronic deeds. First, the original document, exclusive domain of the public official, which implies verification of the information offered as proof, as well as the physical verification of the identity of the person signing. Verification made by a legal professional - nominated and monitored by a public authority - is incontestably proof of security. Second, the electronic private document verified in the same manner as by a public official. Lastly, the unverified electronic private document, of lesser value. To each level of security of the electronic document, a different legal power is implied : First, the original authentic document. It constitutes a writ of execution when it contains an enforceable obligation. Second, a certified document is assumed to equal a private document on paper. Lastly, the uncertified document which does not benefit from that assumption. The French legislator has established a scale for rating the level of security for electronic documents - thereby giving legal commerce a selection of tools to use according to the needs encountered. When the public official authenticates a document, his function should be differentiated from that of third party verification of an electronic private document - even when one uses the term verification to describe part of that procedure. Third party certification borrows the characteristics of the public official s functions in a somewhat reduced form. A public official may perform third party certification, but he is then in competition with other service providers. B. The public official, an implicit model for the certification of electronic private documents. Two aspects merit analysis from this point of view: First, the mechanics of the electronic document, the signature and third party certification. Then, recognising that third party certification acts almost in the same manner as a public official, comes the question of the public official s role in third party certification. 1. Third party certification: a reduced version of the public official I would like to explore the question first from a technical point of view. The electronic document is computer generated in the form of electronic data. This data then circulates via a telecommunications network, usually via the web (RNS, RNIS, Internet). This poses the following problem: When a user sends an e.mail, the body of the message normally appears unscrambled - therefore readable by anyone able to intercept the message before it reaches its destination. The structure of the web lends itself to such interceptions as electronic data leaves a temporary copy on each server it passes during its transmission. Even uninterrupted data may be altered during transmission for technical reasons. Therefore the security of electronic exchanges can only be assured with certainty if it is possible to:

4 identify the sender verify that the message really comes from the sender identified guarantee that the message has not been changed either deliberately or by error preserve the confidentiality of the message. Cryptology makes these functions possible by combining various techniques to protect information with a secret code. Information is transformed into numbers using algorithms and keys. The preferred system in France uses a combination of two keys - one public, the other private or user s code. These keys may be created by the user from an Internet programme. Or, the user could ask a third party to furnish him with the technical means according to a secure and guaranteed procedure. Coding and decoding can only operate by using a combination of the two keys. Thus, to encode the contents of a message and render it confidential before sending it to its destination, one encodes the message with the receiver s public key - who may then in turn decode it with his personal, or private, key. Having recalled these basic notions, let us examine the manner in which the electronic signature operates, and the role played by the third party certification process. We know that the secure transmission of an electronic document assumes that four functions be assured: the user s identity, verification that the message really comes from that person, the guarantee that the message has not been adulterated and also that it has remained confidential. Confidentiality, as we have seen, is assured by encoding the message with the receiver s public key. The other functions, also using codes, form the actual electronic signature. With the electronic signature, the sender identifies himself and validates that the message really comes from him. The assurance that a message remains unadulterated can only come from the combination of the electronic signature and the technique called hachage - a mathematical function which transforms a text into a group of bits or digest. This digest is then electronically signed with a private key. This constitutes an electronic signature. The electronic signature therefore consists of encoding a condensed version of the message with a private key and signing it - thereby technically certifying the source and the integrity of the message. Third party certification - called an electronic certification service provider by the European directive of 13 December 1999 on electronic signatures - intervenes between the sender and the receiver to guarantee the identity, the authenticity and the integrity of the message. Without going into the details of the various services linked to the electronic signature which might be offered, one notes that the essential functions of a service provider might be accomplished by one, or several people. The first function is that of a registration authority. The electronic certification provider registers the person who wishes to obtain a digital certificate. This registration entails verifying the identity, the qualifications and powers of an applicant by requiring official proof of identity (I.D. or copy of his registration with the Commerce and Trade Register), and filing the public key of the signature made by a secure mechanism for creating electronic signatures (double-key creation). The second function is that of a - rightly called - certification authority, who creates the digital certificate and thereby establishes and guarantees the link between the applicant registered by an official registrar and the two asymmetrical keys to which he is entitled. This certificate contains the essential information: the name of the person signing, ID references produced, the public key to the signature, the date of issue and of expiration of the certificate, the hachage algorithm

5 used and the name and electronic signature of the third party certification provider. During the exchange of e.mails, the third party s role essentially consists of attesting that a certificate has been issued to the person in question. The use of a private key by the user of a public key - the identity of which has been confirmed by a third party - thus secures the document. The other functions of third party certification, or certification service provider, are linked to the electronic signature. This service publishes an on-line directory of the certificates issued and confirms their current validity. It could also offer proof of the date the certificate was issued, or a conservation service - the access to which would only be possible by the combined use of the electronic signatures of the sender and the receiver. European and French texts foresee that third party certification could be the object of voluntary accreditation by a qualified private or public organisation. Either way, the certification service provider must report to the Prime Minister when documents are issued that claim to be legally valid. The service providers will also be monitored by the State. Two ratings for electronic signatures are written into the texts: The signature called advanced electronic signature is assumed to be valid given two conditions. The first concerns the manner in which the signature was created (key creation by an authorised programme), and the strictness of certification by the mechanism or computer programme. The other condition concerns the use of the electronic certificate issued by a certification service provider - the certificate of which must guarantee the signature s identity and the validity of the document. Other electronic signatures do not benefit from that assumption of validity. The burden of proof is therefore reversed: it falls upon the person signing to prove validity and not the person contesting the signature. Henceforth, the Law recognises that the electronic document, just like the electronic original deed, has the same power as a document written on paper under the following conditions: when the electronic signature is recognised as having been validated and the link between it and the document guaranteed when the document has been created and conserved under conditions that guarantee its integrity and when that recognition is based on a presumed (third party certification) or proven guarantee. Third party certification is therefore truly a key function in the electronic signature process - it gives the electronic document the benefit of presumed legal validity, and is therefore legally recognised in the same manner as a document written on paper. However, the function of third party certification comes from imitating the role of the public official. In fact, it acts as an independent third party, accredited by a public authority - or at least monitored by one - to attest to the identity of a digital signature and to link that signature to the electronic document to which it is affixed. It could also perform the functions of certification of the document s date and the conservation of it. It could also offer its services for the creation of the electronic signature, i.e. the creation of the key. 2. The public official, third party certification According to the legal texts, electronic certification service providers, or third party certification, could be the object of a procedure called voluntary accreditation, organised by member states of the European Union - accreditation coming from a decision by the public or private organisations chosen by internal state legislation in the framework of the adaptation of a directive to internal laws. The European legislator has therefore chosen to place the activity of certification service providers on the open market. No monopoly could be conferred to one or other regulated profession. The system will thus be

6 that of open competition between third party certification providers, who will, in France, be monitored by the Prime Minister s services, to which it must report all activity and who may also be accredited by a recognised organisation. According to Article 3 of the European directive relating to the electronic signature, this accreditation must be based on objective, transparent, proportional and non-discriminatory criteria. Member states may not affix numerous clauses concerning third party certification. They are obliged to put in place - again according to Article 3 of the directive - an adequate system of monitoring the certification service providers established on their territory and issuing certificates to the public. In France, monitoring is the responsibility of the Prime Minister s services, since third party certification issues certificates presented as conforming to legal norms. Subject to these procedures of accreditation and control, the activity of third party certification will be open to all. The electronic signature being founded on the use of Cryptology - which is not totally free for obvious reasons linked to national defence - it is necessary to say a few words about the legal system. French Law states that the use of Cryptology must usually be authorised. However, the law establishes a completely free system for the use of Cryptology when it only concerns functions of authentication of a message and the verification of its validity. Concerning the function of confidentiality of messages - which is what interests the national defence - a 1999 text states that the use of Cryptology is free in certain cases, such as: when the key used is less than, or equal to, 40 bits or when the key used is less than, or equal to 128 bits, on condition that the means and computer programme be used exclusively for a private purpose by an individual - or that the means have been reported by the producer, the provider or importer. Therefore, if the key used is less than, or equal to, 128 bits, the system of reporting to the Prime Minister must be applied. Thus, the activity of third party certification being open to any legal entity conforming to the norms, public officials, professionals of law and the security of documents, may, if they so wish, assume the functions of third party certification. This activity could be performed either by public officials themselves or in a group, given the importance of the means needed to develop a system conforming to the security norms required for these authentication activities. The Registrars of the Commercial Court already have the legal structure allowing them to rapidly perform the various roles concerning the responsibility of third party certification: that of a certifying authorisation might be attributed to a certification technician responsible for the management of the computer system. Thus, the public official, with his professional qualifications, will guarantee the registration procedure. During that procedure, the applicant will file his public key for the signature created by an authorised secure mechanism and prove his identity, his qualifications and his powers, which will then be listed on the electronic certificate. II. The electronic document and the renewal of the traditional activities of the Registrars of the Commercial Court - public and ministerial officials Two examples: electronic legal notices, which almost exist today, and the e-procedure, which does not yet

7 exist. 1.Electronic legal notices The activity of publishing legal notices by the Registrars of the Commercial Court is in fact almost in place today, as they are authorised to publish electronically copies of the registers of legal notices of which they have charge: the register of commerce and trade, and the different registers concerning company debts (debts to the State, the Social Security, and company, property, stock and equipment mortgages) This new form of publication of legal notices was recognised in In 1998, the Registrars extended the principal of electronic publication of legal notices to the all the registers under their control. All the Registrars of the Commercial Court publish the legal information contained in their registers on the local Minitel, and the Internet (Infogreffe, Greftel and Intergreffe). We note that until now, even though copies of the Register of Commerce and Trade may be delivered by e.mail, only a signed document is accepted as authentic. Therefore, electronic delivery of legal information is still not legally accepted - the texts explain that the information is only given as a service and that the copies are not legally binding. At present, there is neither supporting value nor opposability attached to documents delivered electronically. Thus, what we see today is quite revolutionary; for, once the legal texts have been accepted, they will allow authentic documents to be processed electronically - allowing one to electronically sign authentic copies of the Register of Commerce and Trade. Clearly, it will be extremely useful to obtain, on demand, authentic copies of the Register of Commerce and Trade, or other registers held by the Registrars - electronic copies that have the same authentic value as those traditionally delivered on paper. The electronic signature will be useful in many ways: it will make it possible to reply to the ever increasing demand for rapidity and efficiency from public services. 2. The e-procedure The realization of the e-procedure, or on-line processing, will not be generally accepted without some difficulty, but it will nevertheless be of considerable help to the commercial process. The first indication of satisfaction expected from the commercial e-procedure is its rapidity. The second is the quality of decisionmaking. The quality of decision-making will not be challenged by the electronic nature of the process in that its online character in no way modifies the need to write a justified decision. A note on what will doubtless be a reality in the very near future: A reality desired by the European directive of 13 December, 1999, which, in its preamble number 19, foresees that electronic signatures will be used in the public sector by the national and community administrations, as well as with citizens and electronic operations, for example, in the framework (... ) of the judicial system. That perspective fits into the framework of a recent French legal text recognising electronic authentic documents - the judgement, we may recall, being an authentic document signed by a public official, the registrar of the jurisdiction. How could the process be organised? one foresees the e-procedure only being used at first for laws of minor importance, that is common law commercial procedures and not public or collective procedures

8 the on-line character of the process must be accepted by the parties and the jurisdiction according to the nature of the request parties should have legal representation for obvious reasons of security With the exception of these three essential rules, the on-line character of a procedure should not pose any great difficulty. Submission to the jurisdiction may be made by electronic document from a lawyer s office to the registrar of the jurisdiction, if both structures are equipped for such exchanges in a secure manner - using the functions of the electronic signature and the confidentiality offered by cryptology. The parties may also easily exchange conclusions by e.mail. Most of the legal paperwork may be scanned and then sent electronically, followed by the actual documents sent by post. A closure of proceedings must then be given by the judge and sent to the parties in order that the exchange of conclusions be finalised. A mini-audience by video-conference could even be organised, even though one would not think it always necessary. The procedure could be concluded in writing -electronically, of course. The decision will be given by the judge, assisted by the public official -the registrar - who then will send authentic copies of the decision to the lawyers. One may see that the cyber-process is possible, as long as one respects the rules inherent in litigation of this sort. III. The implementation of the Internet site of the Registrars of the Commercial Court of Paris and the granting of electronic signature keys Replying to the growing need for help and information from almost people a day, the four associated registrars of the Commercial Court of Paris decided to create a workable web site - in addition to the services already offered in person, on the Minitel, by telephone and by post. In July 2000, a web site was opened for Internet users - during the first month, the site registered visits. What does the site offer? Part of the web site is open to the general public, offering general legal information, news updates, and, of course, information on the services of the Registrars of the Commercial Court. Questions posed by e.mail are answered on-line. Specifically geared to business - the site allows visitors to: complete the obligatory legal paperwork for the management of their business - on-line consult administrative obligations and fees all this in a completely secure on-line environment. Users may: register their company change their statutes close their company submit their annual accounts prepare an injunction for delinquent payers complete business documents for administrative paperwork on-line receive the validated documents by return on-line and print them out they may also use their bank charge card to pay for administrative

9 documents on-line. Plus - the site offers a team of Registrars, who are legal specialists, who reply on-line to business owners in answer to their personal business questions. The web site of the Registrars of the Commercial Court of Paris functions in two ways: First, secure exchanges allow the business owner to complete administrative paperwork on-line - using a coded exchange of information -which guarantees confidentially. Second, with an electronic signature, the sender and the Registrar benefit from a secure exchange using the digital certificate which proves the identity of the sender. Given the absence of legal texts covering the electronic signature in France, obtaining a personal code is given only in preparation of such texts on an experimental basis. The electronic signature will be given to any entrepreneur presenting his credentials - he will soon be able to use the services offered by the Registrar of the Commercial Court using that electronic signature in complete security.