ELECTRONIC SIGNATURE LAW

Transcription

1 Disclaimer: The Following is an unofficial translation, and not necessarily an updated one. The binding version is the official Hebrew text. Readers are consequently advised to consult qualified professional counsel before making any decision in connection with the enactment, which is here presented in translation for their general information only. ELECTRONIC SIGNATURE LAW CHAPTER ONE: GENERAL Definitions 1. In this Law "signature verification device" a unique software, object or information required for the identification of a secure electronic signature produced by a specific signature creation device; "signature creation device" a unique software, object or information required for the creation of a secure electronic signature; "certification authority" an entity that issues electronic certificates and is registered in the Register under the provisions of this Law; "foreign certification authority" an entity recognized under the provisions of section 22 and registered in the Register under the provisions of this Law; "electronic signature" a signature that is electronic information or an electronic symbol attached or connected to an electronic message; "secure electronic signature" an electronic signature, for which all the following hold true: (1) it is unique for the holder of a signature creation device; (2) it makes a priori identification of the holder of the signature creation device possible; (3) it was produced by a signature creation device that is under the exclusive control of the holder of the signature creation device; (4) it makes it possible to detect any change made in the electronic message after it was signed; "certified electronic signature" a secure electronic signature, for which a certification authority issued an electronic certificate in respect of the signature verification device, which identifies the signature; "computer", "computer material", "output" and "penetration of computer material" as defined in sections 1 and 4 of the Computers Law ; "electronic message" information produced, sent, received or stored by electronic or optical means, which is visualized, read, heard or retrieved by aforesaid means; "Register" the Register said in section 9; "Registrar" the Registrar appointed under the provisions of section 9; "electronic certificate" an electronic message produced by a certification authority under the provisions of Chapter Four, which certifies that a certain signature verification device belongs to a certain person; "the Minister" the Minister of Justice.

2 CHAPTER TWO: VALIDITY OF A SECURE ELECTRIC SIGNATURE Signature required by an enactment 2. (a) If, under any enactment, a person's signature is required on a document, then in respect of a document that is an electronic message this requirement can be met by means of an electronic signature, on condition that it is a certified electronic signature. (b) The provisions of subsection (a) shall not apply to provisions of enactments designated by the Minister in Schedule One with approval by the Knesset Constitution, Law and Justice Committee. Admissibility of secure electronic signature 3. An electronic message signed by a secure electronic signature shall be admissible in any legal proceeding and shall constitute a priori proof that (1) the signature is the signature of the holder of the signature creation device; (2) that the electronic message is what was signed by the holder of the signature creation device. Assumption in respect of certified electronic signature 4. It is assumed that a certified electronic signature is a secure electronic signature. Certificate from a certification authority 5. (a) A Court may if it does not think there is any danger of a miscarriage of justice accept certification signed by the manager of a certification authority or by any person on his behalf which certifies that a certain electronic certificate was issued by the certification authority (hereafter: certificate of certification authority); a said certificate shall be drawn up in accordance with a form prescribed by the Minister. (b) A certificate of a certification authority shall for the purposes of section 237 of the Penal Law be treated like testimony. (c) The provisions of subsection (a) shall not derogate from the power of the Court to order that the manager of a certification 2

3 (d) authority, or the person who signed the certificate of the certification authority on his behalf, be interrogated in Court, and the Court shall accede to the application of a party so to order. If the Court concludes that the party's application to interrogate in Court the manager of a certification authority or the person who signed the certificate of the certification authority on his behalf, as said in subsection (c), was vexatious or irresponsible, then it may adjudge the costs of the interrogation against the applicant. Status of output 6. (a) The output of an electronic message, which is signed by a secure electronic signature, shall in any legal proceeding be deemed the original of the electronic message on the basis of which it was printed out, and not its copy. (b) The provisions of subsection (a) shall not apply to categories of electronic messages, to categories of legal proceedings and to certain uses of electronic messages, which the Minister designated in Schedule Two with approval by the Knesset Constitution, Law and Justice Committee. Obligations and responsibility of the holder of a signature creation device 7. (a) The holder of a signature creation device (1) shall adopt all reasonable measures to keep his signature creation device safe and to prevent its unauthorized use; (2) shall immediately after he learned that his control of the signature creation device was compromised deliver notification to all persons who reasonably would depend on his electronic signature in consequence of routine relations between them, and to every person who he knows will almost certainly depend on his electronic signature. (b) When the holder of a signature creation device has fulfilled his obligations as said in subsection (a), then he shall bear no responsibility for damage caused in consequence of the unauthorized use of his signature creation device. Obligations and responsibility of the holder of a certified electronic signature creation device 8. (a) The holder of a signature creation device used for the production of certified electronic signatures (1) shall comply with the provisions of section 7(a)(1); (2) give a certification authority at its request information that to his best knowledge is correct and complete and 3

4 (b) which the certification authority needs for the performance of its tasks under this Law; (3) deliver notification to the certification authority that issued an electronic certificate for him immediately after he learned that his control of the signature creation device was compromised. When the holder of a signature creation device used for the production of certified electronic signatures has fulfilled his obligations as said in subsection (a), then he shall bear no responsibility for damage caused in consequence of the unauthorized use of his signature creation device. CHAPTER THREE: REGISTRATION Registrar of certification authorities 9. (a) From among the staff of his Ministry the Minister shall appoint a person with the qualifications of a Magistrates Court judge to be Registrar. (b) The Registrar shall keep a Register, in which he shall register certification authorities and foreign certification authorities under the provisions of this Law; the Register shall be open for inspection by the public. (c) The Registrar shall supervise the certification authorities under the provisions of this Law. Application to register a certification authority 10. (a) Applications to register certification authorities in the Register shall be submitted to the Registrar and shall include all the following: (1) the applicant's name, the name of the candidate for the position of manager of the certification authority, the identifying particulars and addresses of each of them; if the applicant is a body corporate then the application shall also include the documents on the basis of which the body corporate was incorporated or on the basis of which it operates, the names of the controlling members of the body corporate and the names of the Directors and their identifying particulars and addresses; for this purpose, "control" as defined in the Securities Law , and 4

5 (b) (c) every term in the said definition shall be interpreted according to the said Law; (2) particulars of the applicant's other occupations; (3) additional particulars prescribed by the Minister. Documents showing that the conditions for registration spelled out in section 11 have been complied with shall be attached to the application. The Registrar may require the applicant for registration to supply any additional information or documents that are necessary for the examination of the application. Conditions for registration of certification authority 11. (a) The Registrar shall register in the Register any applicant that complies with the provisions under this Law and with all the following: (1) it is an Israel citizen or an Israel resident, a body corporate incorporated in Israel, a body corporate or other public body set up by an enactment, its place of business and activity being in Israel, and one of its purposes is to conduct the business or activity of a certification agent; (2) it has reliable hardware and software systems, which give it reasonable protection against penetration, disturbance, interference or damage to the computer or computer material, and which provide a reasonable level of availability and reliability; (3) it deposited a bank guaranty or other suitable collateral, or it insured itself with an insurer, as defined in the Insurance Business (Control) Law , all as the Registrar prescribed, to secure compensation for anybody injured in consequence of any act or omission by the certification authority; (4) it registered the databases of electronic certificates said in section 18(c) as databases under the Protection of Privacy Law ; (5) the applicant for registration and the candidate for manager of the certification authority hadnot been found guilty of an offense; if the applicant is a body corporate the Directors and controlling members of the body corporate have not been found guilty of an offense; in this paragraph: "found guilty of an offense" including a person against whom an indictment has been brought and final judgment of him has not yet been pronounced; "offense" an offense, which because of its nature, 5

6 (b) severity or circumstances makes it inappropriate for the applicant to be registered as a certification authority; "control" as defined in section 10. The Registrar may set additional conditions for the registration and he may set restrictions on the activity of the certification authority in respect of the scope or category of activity, inter alia in consideration also of the applicant's other activities. Approval of a certification authority's signature certification device 12. The Minister may prescribe that the Registrar certify, by his secure electronic signature, the signature certification devices of the certification authorities; the Minister shall prescribe the manner of certification and its particulars in regulations under this section. Reporting changes to the Registrar 13. If any change occurs in any of the particulars reported under sections 10 or 11, then the applicant or the certification authority, as the case may be, shall so report to the Registrar within 15 days after he became aware of the change. Cancellation of the registration of a certification authority or suspension of its effect 14. (a) If the Registrar learns that a certification authority does not comply with any of the provisions under this Law, then he shall demand that the certification authority correct whatever requires correction, and he may after he has given the certification authority an opportunity to present its arguments suspend the effect of its registration in the Register for a period of not more than 30 days, or he may strike it off the Register. (b) If the Registrar suspended the effect of a certification authority's registration in the Register under the provisions of subsection (a), and if at the end of the suspension period he finds that whatever required correction has not been corrected, then he may extend the suspension period for an additional 30 days; if the Registrar finds, at the end of the extension period, that whatever required correction has not been corrected, then the Registrar shall strike the certification authority off the Register. (c) The Registrar shall publish a notice of a suspension or a striking off under this section in the manner prescribed by the Minister. Change of circumstances 15. (a) If the Registrar learns that a certification authority's hardware or 6

7 (b) (c) software system no longer complies with the conditions said in section 11(a)(2), then he may order that certification authority to adapt it to the said conditions within a period that he shall set. If the Registrar concludes that circumstances have changed to an extent that requires the collateral or the insurance deposited under the provisions of section 11(a)(3) to be changed, then he may order the collateral or the insurance to be changed within a period that he shall set. If a certification authority did not comply with the Registrar's orders under subsections (a) or (b), then he may suspend the effect of its registration in the Register or strike it off the Register under the provisions of section Repealed. Powers of the Registrar 17. (a) In order to exercise his responsibilities, the Registrar or the State employee empowered by him for that purpose in writing (in this section: the Registrar) may supervise the activities of certification authorities as follows: (1) demand from any person connected to the matter that he deliver to him information and documents that relate to the activity of the certification authority; (2) enter, after he has identified himself, the place where a certification authority operates and carry out examinations there; however, the Registrar shall not enter a place that only serves for residential purposes, except by a Court order; (3) penetrate computer material and make an output in the course of the said penetration, on condition that the said acts is only performed by an officer skilled in the performance of these acts; (4) seize any object, including documents, if he is satisfied that that is necessary in order to assure implementation of this Law or in order to prevent the violation of any of its provisions; the following provisions shall apply to the seizure of an object that is a computer or computer material: (a) the Registrar shall copy the computer material and leave the original in the possession of its owner; (b) if the Registrar believes that leaving the original of the computer material in the possession of its owner is liable to have an adverse effect on the supervision or on its results, then he shall seize the original and leave 7

8 (b) (c) a copy in the possession of its owner; (c) if the Registrar believes that copying the computer material or leaving it in the possession of its owner is liable to have an adverse effect on the supervision or on its results, then he shall seize the computer material without copying it; (d) the Registrar shall not take action under the provisions of subparagraph (c) and he shall not seize any object that is a computer or a computer component, unless he was given a Court order; (e) the Court shall make an order under this section only if it is satisfied that the seizure is essential for implementation of the supervision; the effect of a said order shall not be for longer than 48 hours, and for this purpose Sabbaths and holidays shall not be taken into account; the Court may extend the effect of the order after it has given the owner an opportunity to present his arguments. The Registrar shall authorize a person under the provisions of subsection (a) only if all the following conditions have been met: (1) the Israel Police did not object to the appointment because of considerations of public security; (2) he is skilled in the performance of acts of penetration into computer material and the production of outputs in the course of such penetration; (3) he received appropriate training, as the Minister prescribed. If the Registrar acted in compliance with the provisions of this section, then the following provisions shall apply: (1) the Registrar shall draw up a list of all the objects seized in the performance of the supervision and of the places where they were found; (2) the certification authority or a person on its behalf shall be allowed to be present when the supervision is carried out and he shall be given a copy of the list of objects that were seized; (3) the Magistrates Court, within whose jurisdiction an object was seized, may on application by the Registrar or on application by a person who claims a right in the object order that the object be handed over to the person who claims a right to it, or to some other person who will deal with it differently, as the Court shall order, and all that on the conditions it shall prescribe; (4) a seized object shall be returned as soon as possible and no 8

9 later than 15 days after it was seized. CHAPTER FOUR: CERTIFICATION AUTHORITY Activity of certification authority 18. (a) A certification authority may issue to a certain person on his application (hereafter: the applicant) an electronic certificate, which certifies that a certain signature verification device belongs to him. (b) A certification authority shall issue an electronic certificate only after it has taken reasonable steps to identify the applicant, to examine the signature verification device in his possession and to check whether the particulars in the application for issuing the certification are correct and complete. (c) The certification authority shall keep a data base of electronic certificates issued by it, as well as a data base of canceled electronic certificates, according to the provisions of this Law. (d) For the performance of its functions the certification authority shall only use reliable hardware and software systems, which provide reasonable protection against penetration, disturbance, interference or damage to the computer or computer material, and which provide a reasonable level of availability and reliability. Particulars of an electronic certificate 19. (a) The certification authority shall include at least the following particulars in an electronic certificate: (1) the name and ID number of the holder of the electronic certificate, or another particular that identifies him, as the Minister prescribed; (2) certification that the signature verification device of the holder of the certification was examined; (3) the serial number of the electronic certificate in the data base that it keeps; (4) a statement of the manner in which the holder of the certification was identified; (5) a statement of the dates when the certification goes into effect and when it lapses; (6) the name and address of the certification authority and that it is registered in the Register; (7) the secure electronic signature of the certification authority; (8) information about restrictions on the uses permitted under the certification, if any, and if there is a limit on the amount 9

10 (b) of the transactions, in respect of which the certification may be used a statement of that amount; (9) information about limits on the liability of the certification authority, if any; (10) reference to the data base of canceled electronic certificates, as said in section 18(c). The Minister may with approval by the Knesset Scientific and Technological Research and Development Committee prescribe additional particulars that shall be included in an electronic certificate. Cancellation of electronic certificate 20. (a) A certification authority shall cancel an electronic certificate in each of the following cases: (1) on application by the holder of the certificate, immediately after the application was received and the applicant's identity was verified; (2) immediately after the certification authority learns that any of the particulars included in the certificate are not correct, or that the certificate's credibility was otherwise infringed, or that there is a fault in the secure electronic signature of the holder of the certificate; (3) because the holder of the certificate died, and if it is a body corporate because an order for its liquidation was issued, immediately after notice thereof was received, on condition that the certification authority is satisfied that the notice is credible; (4) immediately after the certification authority learns of any fault in its secure electronic signature or in its hardware or software systems, such as can infringe the reliability of its signature or that of the electronic certificates which it issues. (b) Immediately after the cancellation of an electronic certificate the certification authority shall so inform the holder of the certificate and record the cancellation in the Register said in section 18(c), in a manner prescribed by the Minister. Responsibility of certification authority 21. (a) A certification authority shall not bear any responsibility for any damage caused in consequence of trust placed in an electronic certificate issued by it, if it proves that it took all reasonable steps to comply with its obligations under this Law. (b) If a certification authority set restrictions on the categories of use of a certificate or on the amounts of transactions in respect of which a certificate may be used, then the certification authority 10

11 shall not bear any responsibility for any damage caused in consequence of use in excess of the restriction, on condition that it specified that restriction on the certificate under the provisions of section 19; the provisions of this section shall not derogate from the right of a certification authority to set additional restrictions on its responsibility, subject to any statute. CHAPTER FIVE: MISCELLANEOUS Electronic certificate of a foreign certification authority 22. (a) The Registrar may recognize an authority that certifies electronic signatures and operates abroad as a certification authority, on condition that he concluded that it meets conditions that are similar to those met by whoever applies for registration as a certification authority under this Law; if the Minister set additional conditions under subsection (d) on condition that it meets the said additional conditions. (b) The Registrar shall register the foreign certification authorities, which he recognized as said in subsection (a), in the Register. (c) An electronic certificate issued by a foreign certification authority, which was recognized by the Registrar and registered by him under this section, shall be treated like an electronic certificate issued by a certification authority in Israel under this Law. (d) The Minister may prescribe what constitutes similar conditions for the purposes of subsection (a), and also additional conditions for the recognition of a foreign certification authority under this section. State authorities 23. The Minister of Justice may with approval by the Knesset Constitution, Law and Justice Committee prescribe special conditions for the transmission of electronic messages signed with electronic signatures to and from State authorities. Implementation and regulations 24. (a) The Minister of Justice is charged with the implementation of this Law, he may make regulations for its implementation, and he may also prescribe (1) fees for registration in the Register and for its inspection; (2) particulars to be included in the Register and provisions on the manner in which the Register shall be kept; (3) ways of inspecting the Register, also by electronic communications and on the Government's Internet site; (4) provisions on insurance, bank guaranties or other surety, 11

12 including the type of surety, amounts, ways of depositing, changing and foreclosing it, under sections 11(a)(3) and 15(b); (5) additional conditions for the registration of certification authorities, provisions on the type and manner of restrictions on their activity and requirements in respect of the manner of their activity, under section 11; (6) provisions on the management of data bases of valid electronic certificates and of canceled or suspended electronic certificates, including the matter of their inspection, how long electronic certificates are to be kept in the data base and how they are to be kept, under sections 14, 18 and 20; (7) particulars of the application for an electronic certificate under section 18; (8) particulars of the information, which a certification authority must give to holders of signature creation devices, also about the risks involved in the use of a certified electronic signature, and on the obligations incumbent under this Law on the holder of the signature creation device; (9) categories of systems which are assumed to be reliable hardware and software systems under sections 11, 15 and 18, and also categories of electronic signatures which are assumed to constitute secure electronic signatures; (10) ways of identifying an applicant and of examining the signature creation devices in his possession, for the receipt of an electronic certificate, under section 18; (11) particulars to be included in an electronic certificate and how they are to be presented, under section 19; (12) conditions for the recognition of a foreign certification authority, under section 22(d). (b) (1) Regulations under subsection (a)(1) to (8) shall be made with approval by the Knesset Constitution, Law and Justice Committee; (2) Regulations under subsection (a)(9) to (12) shall be made with the approval of the Knesset Scientific and Technological Research and Development Committee. Saving of statutes 25. The provisions of this Law shall add to and not derogate from the provisions of any statute. Must make regulations 12

13 26. The first regulations under sections 2(b) and 6(b) shall be presented for approval by the Knesset Constitution, Law and Justice Committee within four months after the publication of this Law. (This Law was published on April 4, 2001 Tr.) Effect 27. This Law shall go into effect six months after its publication. 13

14 SCHEDULE ONE (Section 2(b)) 1. The Inheritance Law , in respect of wills, memoranda of oral wills, inheritance orders, probate and inheritance and probate orders; 2. the Trust Law , in respect of writs of endowment; 3. the Notaries Law and the Notaries regulations , in respect of signatures before a notary and the signatures of notaries; 4. section 91 of the Chamber of Advocates Law , in respect of powers of attorney; 5. the Real Estate Regulations (Management and registration) , in respect of applications for registration or for the cancellation of registration and for transaction deeds; 6. the Surrogate Motherhood Agreements Regulations (Approval of Agreement and Status of Newborn) (Notices, Applications and Orders) , in respect of notices and applications; 7. the Adoption of Children Law and regulation 272 of the Law Procedure Regulations , in respect of a parent's consent to adoption; 8. Rules and Professional Guidelines for Activity of an Accredited Amuta under the Adoption of Children Law , in respect of notifications and professional opinions; 9. Banking Rules (Service to Customers) (Fair Disclosure and Delivery of Documents) , in respect of agreements between banking corporations and their clients; 10. any statute, in respect of which a person's signature on an affidavit is required, other than statutes under which an affidavit is submitted to a Court; 11. the Debit Cards Law , in respect of debit card contracts. SCHEDULE TWO (Section 6(b)) 1. Judgments of Courts, Tribunals or any judicial or quasi judicial instance set up under a statute, unless a different provision is made in any statute; 2. bills, under the Bills of Exchange Ordinance; 3. bearer share certificates. 14