Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From a theoretical standpoint, the very notion of an electronic notary - ENotary implies a host of problems related to biometrics, signature revocation, timestamping, keeping a reliable electronic journal of notarial acts etc. While it is instructive to learn about those (there are some - but not all - answers in the Model Notary Act of 2010 ), my question is simpler: what are the procedures applied to audit compliance of ENotaries and how do they compare to the ones used in other industries (say, PCI DSS etc.)?

Clarification #1: yes, I know there are few lawyers here... no need to prefix your answers with the five-letter abbreviation.

Clarification #2: answers don't have to be US-centric.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

In some countries, there is a specific legal framework for such things; of course, every country has its own... In France, it is the Référentiel Général de Sécurité, which feeds on Common Criteria. The gist of the thing: the relevant administrative organization (the ANSSI) publishes a Target of Evaluation which describes all the features that a given service should have. This covers things like the precision of the clock of the time stamp authority, the process used to control physical access to servers, the background checks of the criminal and debt records of people who have developed the code, the compliance to relevant standards, and so on.

An organization who wishes to get its system "certified" then hires an independent audit firm, which verifies that the system complies with the rules in the ToE. It then talks to the ANSSI, which does a few verifications itself (in particular that the audit firm is indeed independent and trustworthy), then finally grants a formal recognition of the system as being compliant. This links to a set of local laws which more or less mean that when a certified notary system is used, the notarized documents are presumed valid, and if someone wants to contest their validity, then he has to bring proof elements (i.e. the burden of proof is on who contests rather than on who asserts).

It takes several months, a substantial amount of money (dozens of thousands of dollars), and a terrifying lot of paperwork.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.