<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Bradley Hand ITC";
panose-1:3 7 4 2 5 3 2 3 2 3;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML con formato previo Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Texto de globo Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:10.0pt;
margin-left:36.0pt;
mso-add-space:auto;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0cm;
margin-right:0cm;
margin-bottom:10.0pt;
margin-left:36.0pt;
mso-add-space:auto;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EstiloCorreo18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.HTMLconformatoprevioCar
{mso-style-name:"HTML con formato previo Car";
mso-style-priority:99;
mso-style-link:"HTML con formato previo";
font-family:"Consolas","serif";}
span.EstiloCorreo21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.TextodegloboCar
{mso-style-name:"Texto de globo Car";
mso-style-priority:99;
mso-style-link:"Texto de globo";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1537039921;
mso-list-type:hybrid;
mso-list-template-ids:-1293886454 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=ES link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Well, this 2000 $ is another type of doing business of the US companies in which they indicates the máximum you can claim in case of an issue. I´m not very familiar with EU laws, but don´t think we work that way and don´t know how many EU CAs offer that option.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Again, don´t know/think this fits into the EU<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:9.75pt'><b><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif";color:black'>Iñigo Barreira</span></b><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif";color:black'><br>Responsable del Área técnica<br><a href="mailto:i-barreira@izenpe.net">i-barreira@izenpe.net</a><o:p></o:p></span></p><p class=MsoNormal><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif";color:black'>945067705</span><span lang=ES-TRAD style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span lang=ES-TRAD style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><img border=0 width=585 height=111 id="Imagen_x0020_1" src="cid:image001.png@01CFF8E6.97702770" alt="Descripción: cid:image001.png@01CE3152.B4804EB0"></span><span lang=ES-TRAD style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal style='line-height:9.75pt'><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif";color:#888888;mso-fareast-language:ES-TRAD'>ERNE! Baliteke mezu honen zatiren bat edo mezu osoa legez babestuta egotea. Mezua badu bere hartzailea. Okerreko helbidera heldu bada (helbidea gaizki idatzi, transmisioak huts egin) eman abisu igorleari, korreo honi erantzuna. KONTUZ!</span><span style='color:#888888;mso-fareast-language:ES-TRAD'><br></span><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif";color:#888888;mso-fareast-language:ES-TRAD'>ATENCION! Este mensaje contiene informacion privilegiada o confidencial a la que solo tiene derecho a acceder el destinatario. Si usted lo recibe por error le agradeceriamos que no hiciera uso de la informacion y que se pusiese en contacto con el remitente.</span><span style='font-size:12.0pt;color:navy;mso-fareast-language:ES-TRAD'><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>De:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>En nombre de </b>kirk_hall@trendmicro.com<br><b>Enviado el:</b> miércoles, 05 de noviembre de 2014 1:03<br><b>Para:</b> CABFPub (public@cabforum.org)<br><b>Asunto:</b> [cabfpub] Second new BR on Financial Responsibility -- Limit on disclaimer of liability for DV and OV certs<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US>In a previous email, I gave the background for two possible new Financial Responsibility Baseline Requirement rules relating to CA Financial Responsibility, and I offered a possible ballot in the previous email relating to minimum capital requirements. <o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US>This email proposes a possible second Financial Responsibility requirement for preliminary discussion – in this case, greater potential liability among CAs to their customers and relying parties for certificate mis-issuance.<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US>The BRs and EV Guidelines include a number of sections relating to CA liability:<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US>Required Warranties to Subscribers (BR Sec. 7, EVGL Sec. 7)<o:p></o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US>Liability to Subscribers and Relying Parties (BR 18.1, EVGL 18)<o:p></o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US>Permitted *<u>Limitation of Liability</u>* to Subscribers and Relying Parties (BR 18.1, EVGL 18)<o:p></o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US>Indemnification of Application Software Suppliers (BR 18.2)<o:p></o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US>The required warranties under the BRs and EVGL are somewhat different. However, the Liability / Limitation of Liability sections of the BRs and EVGL are basically the same <i><u>except</u></i> that the BRs allow the CA to limit its general liability to subscribers and relying parties to -$ZERO-, while the EVGL do not allow CAs to limit their general liability to less than <u>$2,000</u> per certificate. Here is how EVGL 18 reads:<o:p></o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><b><span lang=EN-US>EVGL Section 18. Liability and Indemnification<o:p></o:p></span></b></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><b><span lang=EN-US><o:p> </o:p></span></b></p><p class=MsoNormal style='margin-left:36.0pt;text-autospace:none'><span lang=EN-US>CAs MAY limit their liability as described in Section 18 of the Baseline Requirements <u>except that a CA MAY NOT limit its liability to Subscribers or Relying Parties for legally recognized and provable claims to a monetary amount less than two thousand US dollars ($2,000)</u> per Subscriber or Relying Party <u>per EV Certificate</u>.<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='text-autospace:none'><i><u><span lang=EN-US>Here is what I would propose</span></u></i><span lang=EN-US> for discussion in the Forum as a possible second Financial Responsibility ballot:<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoListParagraph style='margin-bottom:0cm;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-18.0pt;line-height:normal;mso-list:l0 level1 lfo2;text-autospace:none'><![if !supportLists]><span lang=EN-US style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span lang=EN-US>Change Section 18 of the Baseline Requirements so that the current $2,000 minimum liability figure for EV certificates applies to <i><u>all</u></i> types of certs (DV, OV, EV, and any other type of cert covered by the BRs). This means that CAs could no longer limit their general liability for DV and OV certs to $0.<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US>I think the reasons for this proposed change are self-evident – it means that all CAs are financially responsible for all their certificate offerings (not just EV certs). This rule change would not create any new basis for CA legal liability – CAs would only be liable to subscribers and relying parties if applicable national law says they are liable, the same as today. However, the change would prohibit CAs from disclaiming <u>all</u> liability for the DV and OV certs they issue. Today, most CAs say their liability for DV and OV certs is capped at $0; after this ballot, that figure would $2,000 or any higher figure the CA chooses.<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US>There have been very few claims against CAs over the past 10-15 years that I’m aware of, and some CAs already offer extra warranty protection. But this potential ballot would be a way of making CAs step up and take at least some potential general liability for all their products, which is a good thing for the public and add to financial responsibilty. <o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US>As a side benefit, I believe CAs could also get some good media coverage from a step like this (we would deserve it), and a BR change may help the public to value digital certificates more if they know CAs have agreed to be financially responsible for their products.<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-US>Any preliminary comments?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><b><i><span lang=EN-US style='font-size:14.0pt;font-family:"Bradley Hand ITC";color:#0F243E'>Kirk R. Hall<o:p></o:p></span></i></b></p><p class=MsoNormal><span lang=EN-US>Operations Director, Trust Services<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Trend Micro<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>+1.503.753.3088<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><table class=MsoNormalTable border=0 cellpadding=0><tr><td style='background:white;padding:.75pt .75pt .75pt .75pt'><table class=MsoNormalTable border=0 cellpadding=0><tr><td style='padding:.75pt .75pt .75pt .75pt'><pre><o:p> </o:p></pre><pre>TREND MICRO EMAIL NOTICE<o:p></o:p></pre><pre>The information contained in this email and any attachments is confidential <o:p></o:p></pre><pre>and may be subject to copyright or other intellectual property protection. <o:p></o:p></pre><pre>If you are not the intended recipient, you are not authorized to use or <o:p></o:p></pre><pre>disclose this information, and we request that you notify us by reply mail or<o:p></o:p></pre><pre>telephone and delete the original message from your mail system.<o:p></o:p></pre></td></tr></table></td></tr></table><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></div></body></html>