<div dir="ltr">Thanks for the clarification. I do not know how it works in the USA but in Spain, AFAIK, the following statement would be declared invalid if tha national law <span style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:13px">says CAs are liable</span> :"<span style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:15px">Even if national law says we could be liable for our mistakes, you agree that we don’t have to pay you anything (we disclaim our liability to $0).</span>"<div><br></div><div>I can not believe that a private organizaton can jump national laws. It is like a gun maker says "<span style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:15px">Even if national law says you can not kill, you can kill with our guns.</span>"</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><span style="color:rgb(136,136,136)">-- </span><br style="color:rgb(136,136,136)"><div dir="ltr"><font color="#999999" style="color:rgb(136,136,136)"><b>Chema López</b></font><div><font color="#999999"><b>Gestor de Proyectos - Departamento Técnico</b></font></div><div style="color:rgb(136,136,136)"><font color="#999999"><b>AC Firmaprofesional, S.A.</b></font><br></div><div style="color:rgb(136,136,136)"><br></div><div style="color:rgb(136,136,136)"><font color="#999999">Edificio ESADECREAPOLIS - 1B13</font></div><div style="color:rgb(136,136,136)"><font color="#999999">08173 Sant Cugat del Vallès, Barcelona. </font></div><div style="color:rgb(136,136,136)"><font color="#999999">T. 934 774 245</font></div><div style="color:rgb(136,136,136)"><font color="#999999">M. 666 429 224</font></div><div style="color:rgb(136,136,136)"></div></div></div></div></div>
<br><div class="gmail_quote">2014-11-13 16:08 GMT+01:00 <a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a> <span dir="ltr"><<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">I should clarify – in the US at least, national law may say “A CA can be liable for mistakes”, but national law may ALSO say “But a CA may “disclaim” any responsibility for
its liability to $0”. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">So CAs today often say in their CPS and Subscriber Agreements “Even if national law says we could be liable for our mistakes, you agree that we don’t have to pay you anything
(we disclaim our liability to $0).” The BRs allow this today. The EV Guidelines today say that a CA can’t diaclaim its liability “<u>for legally recognized and provable claims to a monetary amount less than two thousand US dollars ($2,000)</u> per Subscriber
or Relying Party <u>per EV Certificate.</u>” <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">I’m just suggesting we change the BRs to say the same thing about DV and OV certs as the EV Guidelines say about EV certs – CAs must accept $2,000 liability, but can disclaim
(avoid) liability for more than that.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:me@chemalogo.com" target="_blank">me@chemalogo.com</a> [mailto:<a href="mailto:me@chemalogo.com" target="_blank">me@chemalogo.com</a>]
<b>On Behalf Of </b>Chema López González<br>
<b>Sent:</b> Thursday, November 13, 2014 5:28 AM<br>
<b>To:</b> Kirk Hall (RD-US)<br>
<b>Cc:</b> CABFPub (<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>)<br>
<b>Subject:</b> Re: [cabfpub] Second new BR on Financial Responsibility -- Limit on disclaimer of liability for DV and OV certs<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">I do not see the point to this proposal. As you say, Kirk, <span style="font-family:"Calibri","sans-serif";color:black">
if applicable national law says they are liable, clauses like "liability for DV and OV certs is $0" are declare invalid (not applicable), in case there is a lawsuit.</span><u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">BRs</span><u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="color:#888888">-- </span><u></u><u></u></p>
<div>
<p class="MsoNormal"><b><span style="color:#888888">Chema López</span></b><u></u><u></u></p>
<div>
<p class="MsoNormal"><b><span style="color:#999999">Gestor de Proyectos - Departamento Técnico</span></b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:#999999">AC Firmaprofesional, S.A.</span></b><span style="color:#888888"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#999999">Edificio ESADECREAPOLIS - 1B13</span><span style="color:#888888"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#999999">08173 Sant Cugat del Vallès, Barcelona. </span><span style="color:#888888"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#999999">T. 934 774 245</span><span style="color:#888888"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#999999">M. 666 429 224</span><span style="color:#888888"><u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">2014-11-05 1:03 GMT+01:00 <a href="mailto:kirk_hall@trendmicro.com" target="_blank">
kirk_hall@trendmicro.com</a> <<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a>>:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal" style="text-autospace:none">
In a previous email, I gave the background for two possible new Financial Responsibility Baseline Requirement rules relating to CA Financial Responsibility, and I offered a possible ballot in the previous email relating to minimum capital requirements.
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
This email proposes a possible second Financial Responsibility requirement for preliminary discussion – in this case, greater potential liability among CAs to their customers and relying parties for certificate mis-issuance.<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
The BRs and EV Guidelines include a number of sections relating to CA liability:<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
Required Warranties to Subscribers (BR Sec. 7, EVGL Sec. 7)<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
Liability to Subscribers and Relying Parties (BR 18.1, EVGL 18)<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
Permitted *<u>Limitation of Liability</u>* to Subscribers and Relying Parties (BR 18.1, EVGL 18)<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
Indemnification of Application Software Suppliers (BR 18.2)<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
The required warranties under the BRs and EVGL are somewhat different. However, the Liability / Limitation of Liability sections of the BRs and EVGL are basically the same
<i><u>except</u></i> that the BRs allow the CA to limit its general liability to subscribers and relying parties to -$ZERO-, while the EVGL do not allow CAs to limit their general liability to less than
<u>$2,000</u> per certificate. Here is how EVGL 18 reads:<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
<b>EVGL Section 18. Liability and Indemnification</b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
<b> </b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">
CAs MAY limit their liability as described in Section 18 of the Baseline Requirements
<u>except that a CA MAY NOT limit its liability to Subscribers or Relying Parties for legally recognized and provable claims to a monetary amount less than two thousand US dollars ($2,000)</u> per Subscriber or Relying Party
<u>per EV Certificate</u>.<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<i><u>Here is what I would propose</u></i> for discussion in the Forum as a possible second Financial Responsibility ballot:<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<u></u><u></u></p>
<p style="margin-bottom:0in;margin-bottom:.0001pt;text-autospace:none"><span style="font-family:Symbol">·</span><span style="font-size:7.0pt">
</span>Change Section 18 of the Baseline Requirements so that the current $2,000 minimum liability figure for EV certificates applies to
<i><u>all</u></i> types of certs (DV, OV, EV, and any other type of cert covered by the BRs). This means that CAs could no longer limit their general liability for DV and OV certs to $0.<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
I think the reasons for this proposed change are self-evident – it means that all CAs are financially responsible for all their certificate offerings (not just EV certs). This rule change would not create any new basis for CA legal liability – CAs would only
be liable to subscribers and relying parties if applicable national law says they are liable, the same as today. However, the change would prohibit CAs from disclaiming
<u>all</u> liability for the DV and OV certs they issue. Today, most CAs say their liability for DV and OV certs is capped at $0; after this ballot, that figure would $2,000 or any higher figure the CA chooses.<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
There have been very few claims against CAs over the past 10-15 years that I’m aware of, and some CAs already offer extra warranty protection. But this potential ballot would be a way of making CAs step up and take at least some potential general liability
for all their products, which is a good thing for the public and add to financial responsibilty.
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
As a side benefit, I believe CAs could also get some good media coverage from a step like this (we would deserve it), and a BR change may help the public to value digital certificates more if they know CAs have agreed to be financially responsible for their
products.<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
Any preliminary comments?<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt;font-family:"Bradley Hand ITC";color:#0f243e">Kirk R. Hall</span></i></b><u></u><u></u></p>
<p class="MsoNormal">Operations Director, Trust Services<u></u><u></u></p>
<p class="MsoNormal">Trend Micro<u></u><u></u></p>
<p class="MsoNormal"><a href="tel:%2B1.503.753.3088" target="_blank">+1.503.753.3088</a><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<table border="0" cellpadding="0">
<tbody>
<tr>
<td style="background:white;padding:.75pt .75pt .75pt .75pt">
<table border="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<pre>TREND MICRO EMAIL NOTICE<u></u><u></u></pre>
<pre>The information contained in this email and any attachments is confidential <u></u><u></u></pre>
<pre>and may be subject to copyright or other intellectual property protection. <u></u><u></u></pre>
<pre>If you are not the intended recipient, you are not authorized to use or <u></u><u></u></pre>
<pre>disclose this information, and we request that you notify us by reply mail or<u></u><u></u></pre>
<pre>telephone and delete the original message from your mail system.<u></u><u></u></pre>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div>
</div><div class="HOEnZb"><div class="h5">
<table><tbody><tr><td bgcolor="#ffffff"><font color="#000000"><pre><table><tbody><tr><td><pre>TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></tbody></table></pre></font></td></tr></tbody></table></div></div></blockquote></div><br></div>