"certification service provider" Electronic Signatures Legal Status of Qualified Electronic Signatures 1 Definition according to section 2, paragraph 8 of the Electronic Signatures Act: "certification service provider" means a natural or legal person who issues qualified certificates or qualified time stamps. Electronic Signatures

Electronic Signatures 2 Legal Status What is different about qualified signatures? - Validity model (sections 16 and 19 of the Electronic Signatures Act) - Algorithms (specified annually) - Hardware compulsory (non-repudiation) - Long-term verifiability (at least 5/35 years) National root certificate for accredited certification service providers only - Quality mark for accredited certification service providers only Electronic Signatures

Recognised evaluation and certification bodies Recognises BSI debis Section IS 15 Electronic Signatures Recognised evaluation and certification bodies Recognises BSI debis TÜVIT Publishes Operates Federal Gazette/ RegTP Official Gazette/Internet Accredits Accredits Evaluation and certification bodies Proposes Certify compliance with the Electronic Signatures Act and Ordinance National root certification authority Products Algorithms Algorithms Certifies Competent Authority's keys Certification service providers Security concept - Products - Management - Staff, etc Certification service providers Certification service providers Technical components - Signature creation device Directory service Time stamp service - Key generator, etc Signature key holders

Electronic Signatures 4 Legal Status Enhanced quality through voluntary accreditation Enhance the level of the certification services to be provided towards the levels of trust, security and quality demanded by the evolving market. Electronic Signatures Directive, Recital 11 = Secure procedures, archivability, availability, etc Voluntary accreditation Article 2, paragraph 13 of the Electronic Signatures Directive Section 15 of the Electronic Signatures Act = Permission, setting out rights and obligations for the provision of certification services and granted at the request of the certification service provider concerned by the competent body. The certification service provider is not entitled to exercise the rights and obligations stemming from the permission until it has received the permission. Competent body Right to operate as accredited provider Permission Application Electronic Signatures

Electronic Signatures 5 Legal Status EU Directive for Electronic Signatures Continental European Approach Anglo-Saxon Approach Prevention through comprehensive pre-implementation checks for - products, technical, administrative and organisational aspects of certification activities, and reliability and specialised knowledge of staff. Ensuring adequate minimum level of - competition in the market, and - liability. Liability depends on - ability and willingness to assume liability in cases of damage, and - recognised cases of damage. Development costs (evaluation of products and security concepts) More time-intensive in initial stages "Teething problem" Long-term problem Electronic Signatures

Legal Status Implementation in the Electronic Signatures Act 6 Legal Status Implementation in the Electronic Signatures Act Unregulated area – section 1(2) Qualified electronic signatures (section 2 paragraph 3) - Certification service providers: Certification service providers granted accreditation (can be made mandatory in the public sector) Certification service providers subject to supervision Legal status: equivalence with handwritten signatures (section 126a of the Civil Code) Unregulated area – section 1(2) Electronic Signatures

electronic signatures Electronic Signatures 7 Legal Status "Equivalence" of electronic signatures Time horizon Electronic Signatures Ordinance 16 November 2001 Amendment of Formal Requirements Act 1 August 2001 Electronic Signatures Act 22 May 2001 2001 Amendment of legislation requiring writing as the legal form 2000 Evaluation of products, procedures and acceptance bodies 1998 Developmental stage (Act and Ordinance) 1996 Electronic Signatures