BERMUDA- ELECTRONIC COMMERCE SECURITY ACT.
ARTICLE 1. SHORT TITLE; PURPOSE
Section 1-101. Short title. This Act may be cited as the Electronic Commerce Security Act.
Section 1-105. Purposes and construction. This Act shall be construed consistently with what is commercially reasonable under the circumstances and to effectuate the following purposes:
(1) To facilitate electronic communications by means of reliable electronic records.
(2) To facilitate and promote electronic commerce, by eliminating barriers resulting from uncertainties over writing and signature requirements, and promoting the development of the legal and business infrastructure necessary to implement secure electronic commerce.
(3) To facilitate electronic filing of documents with State and local government agencies, and promote efficient delivery of government services by means of reliable electronic records.
(4) To minimize the incidence of forged electronic records, intentional and unintentional alteration of records, and fraud in electronic commerce.
(5) To help to establish uniformity of rules and standards regarding the authentication and integrity of electronic records.
(6) To promote public confidence in the integrity and reliability of electronic records and electronic commerce.
Section 1-110. Variation by agreement. As between parties involved in generating, sending, receiving, storing, or otherwise processing electronic records, the applicability of provisions of this Act may be waived by agreement of the parties, except for the provisions of Sections 10-140, 15-210, 15-215, 15-220, and subsection (b) of Section 10-130 of this Act.
ARTICLE 5. ELECTRONIC RECORDS AND SIGNATURES GENERALLY
Section 5-105. Definitions. “Asymmetric cryptosystem” means a computer-based system capable of generating and using a key pair consisting of a private key for creating a digital signature and a public key to verify the digital signature.
“Certificate” means a record that at a minimum:
(a) identifies the certification authority issuing it;
(b) names or otherwise identifies its subscriber or a device or electronic agent under the control of the subscriber;
(c) contains a public key that corresponds to a private key under the control of the subscriber;
(d) specifies its operational period; and
(e) is digitally signed by the certification authority issuing it.
“Certification authority” means a person who authorizes and causes the issuance of a certificate.
“Certification practice statement” is a statement published by a certification authority that specifies the policies or practices that the certification authority employs in issuing, managing, suspending, and revoking certificates and providing access to them.
“Correspond”, with reference to keys, means to belong to the same key pair.
“Digital signature” means a type of electronic signature created by transforming an electronic record using a message digest function and encrypting the resulting transformation with an asymmetric cryptosystem using the signer’s private key such that any person having the initial untransformed electronic record, the encrypted transformation, and the signer’s corresponding public key can accurately determine whether the transformation was created using the private key that corresponds to the signer’s public key and whether the initial electronic record has been altered since the transformation was made. A digital signature is a security procedure.
“Electronic” includes electrical, digital, magnetic, optical, electromagnetic, or any other form of technology that entails capabilities similar to these technologies.
“Electronic record” means a record generated, communicated, received, or stored by electronic means for use in an information system or for transmission from one information system to another.
“Electronic signature” means a signature in electronic form attached to or logically associated with an electronic record.
“Information” includes data, text, images, sound, codes, computer programs, software, databases, and the like.
“Key pair” means, in an asymmetric cryptosystem, 2 mathematically related keys, referred to as a private key and a public key, having the properties that (i) one key (the private key) can encrypt a message that only the other key (the public key) can decrypt, and (ii) even knowing one key (the public key), it is computationally unfeasible to discover the other key (the private key).
“Message digest function” means an algorithm that maps or translates the sequence of bits comprising an electronic record into another, generally smaller, set of bits (the message digest) without requiring the use of any secret information such as a key, such that an electronic record yields the same message digest every time the algorithm is executed using such record as input and it is computationally unfeasible that any 2 electronic records can be found or deliberately generated that would produce the same message digest using the algorithm unless the 2 records are precisely identical.
“Operational period of a certificate” begins on the date and time the certificate is issued by a certification authority (or on a later date and time certain if stated in the certificate) and ends on the date and time it expires as noted in the certificate or is earlier revoked, but does not include any period during which a certificate is suspended.
“Person” means an individual, corporation, business trust, estate, trust, partnership, limited partnership, limited liability partnership, limited liability company, association, joint venture, government, governmental subdivision, agency, or instrumentality, or any other legal or commercial entity.
“Private Key” means the key of a key pair used to create a digital signature.
“Public key” means the key of a key pair used to verify a digital signature.
“Record” means information that is inscribed, stored, or otherwise fixed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form.
“Repository” means a system for storing and retrieving certificates or other information relevant to certificates, including information relating to the status of a certificate.
“Revoke a certificate” means to permanently end the operational period of a certificate from a specified time forward.
“Rule of law” means any statute, ordinance, common law rule, court decision, or other rule of law enacted, established or promulgated by the State of Illinois, or any
Agency, commission, department, court, other authority or political subdivision of the State of Illinois.
“Security procedure” means a methodology or procedure used for the purpose of
(1) Verifying that an electronic record is that of a specific person or
(2) Detecting error or alteration in the communication, content, or storage of an electronic record since a specific point in time. A security procedure may require the use of algorithms or codes, identifying words or numbers, encryption, answer back or acknowledgment procedures, or similar security devices.
“Signature device” means unique information, such as codes, algorithms, letters, numbers, private keys, or personal identification numbers (PINs), or a uniquely configured physical device, that is required, alone or in conjunction with other information or devices, in order to create an electronic signature attributable to a specific person.
“Signed” or “signature” includes any symbol executed or adopted, or any security procedure employed or adopted, using electronic means or otherwise, by or on behalf of a person with intent to authenticate a record.
“State agency” means and includes all officers, boards, commissions, courts, and agencies created by the Illinois Constitution, whether in the executive, legislative or judicial branch, all officers, departments, boards, commissions, agencies, institutions, authorities, universities, bodies politic and corporate of the State; and administrative units or corporate outgrowths of the State government which are created by or pursuant to statute, other than units of local government and their officers, school districts and boards of election commissioners; all administrative units and corporate outgrowths of the above and as may be created by executive order of the Governor.
“Subscriber” means a person who is the subject named or otherwise identified in a certificate, who controls a private key that corresponds to the public key listed in that certificate, and who is the person to whom digitally signed messages verified by reference to such certificate are to be attributed.
“Suspend a certificate” means to temporarily suspend the operational period of a certificate for a specified time period or from a specified time forward.
“Trustworthy manner” means through the use of computer hardware, software, and procedures that, in the context in which they are used:
(a) can be shown to be reasonably resistant to penetration, compromise, and misuse;
(b) Provide a reasonable level of reliability and correct operation;
(c) are reasonably suited to performing their intended functions or serving their intended purposes;
(d) comply with applicable agreements between the parties, if any; and
(e) adhere to generally accepted security procedures.
“Valid certificate” means a certificate that a certification authority has issued and that the subscriber listed in the certificate has accepted.
“Verify a digital signature” means to use the public key listed in a valid certificate, along with the appropriate message digest function and asymmetric cryptosystem, to evaluate a digitally signed electronic record, such that the result of the process concludes that the digital signature was created using the private key corresponding to the public key listed in the certificate and the electronic record has not been altered since its digital signature was created.
Section 5-110. Legal recognition. Information, records, and signatures shall not be denied legal effect, validity, or enforceability solely on the grounds that they are in Electronic form.
Section 5-115. Electronic records.
(a) Where a rule of law requires information to be “written” or “in writing”, or provides for certain consequences if it is not, an electronic record satisfies that rule of law.
(b) The provisions of this Section shall not apply:
(1) when its application would involve a construction of a rule of law that is clearly inconsistent with the manifest intent of the lawmaking body or repugnant to the context of the same rule of law, provided that the mere requirement that information be “in writing”, “written”, or “printed” shall not by itself be sufficient to establish such intent;
(2) to any rule of law governing the creation or execution of a will or trust, living will, or healthcare power of attorney; and
(3) to any record that serves as a unique and transferable instrument of rights and obligations including, without limitation, negotiable instruments and other instruments of title wherein possession of the instrument is deemed to confer title, unless an electronic version of such record is created, stored, and transferred in a manner that allows for the existence of only one unique, identifiable, and unalterable original with the functional attributes of an equivalent physical instrument, that can be possessed by only one person, and which cannot be copied except in a form that is readily identifiable as a copy.
Section 5-120. Electronic signatures.
(a) Where a rule of law requires a signature, or provides for certain consequences if a document is not signed, an electronic signature satisfies that rule of law.
(b) An electronic signature may be proved in any manner, including by showing that a procedure existed by which a party must of necessity have executed a symbol or security procedure for the purpose of verifying that an electronic record is that of such party in order to proceed further with a transaction.
(c) The provisions of this Section shall not apply:
(1) when its application would involve a construction of a rule of law that is clearly inconsistent with the manifest intent of the lawmaking body or repugnant to the context of the same rule of law, provided that the mere requirement of a “signature” or that a record be “signed” shall not by itself be sufficient to establish such intent;
(2) to any rule of law governing the creation or execution of a will or trust, living will, or healthcare power of attorney; and
(3) to any record that serves as a unique and transferable instrument of rights and obligations including, without limitation, negotiable instruments and other instruments of title wherein possession of the instrument is deemed to confer title, unless an electronic version of such record is created, stored, and transferred in a manner that allows for the existence of only one unique, identifiable, and unalterable original with the functional attributes of an equivalent physical instrument, that can be possessed by only one person, and which cannot be copied except in a form that is readily identifiable as a copy.
Section 5-125. Original.
(a) Where a rule of law requires information to be presented or retained in its original form, or provides consequences for the information not being presented or retained in its original form, that rule of law is satisfied by an electronic record if there exists reliable assurance as to the integrity of the information from the time when it was first generated in its final form, as an electronic record or otherwise.
(b) The criteria for assessing integrity shall be whether the information has remained complete and unaltered, apart from the addition of any endorsement or other information that arises in the normal course of communication, storage and display. The standard of reliability required to ensure that information has remained complete and unaltered shall be assessed in the light of the purpose for which the information was generated and in the light of all the relevant circumstances.
(c) The provisions of this Section do not apply to any record that serves as a unique and transferable instrument of rights and obligations including, without limitation, negotiable instruments and other instruments of title wherein possession of the instrument is deemed to confer title, unless an electronic version of such record is created, stored, and transferred in a manner that allows for the existence of only one unique, identifiable, and unalterable original with the functional attributes of an equivalent physical instrument, that can be possessed by only one person, and which cannot be copied except in a form that is readily identifiable as a copy.
Section 5-130. Admissibility into evidence.
(a) In any legal proceeding, nothing in the application of the rules of evidence shall apply so as to deny the admissibility of an electronic record or electronic signature into evidence:
(1) on the sole ground that it is an electronic record or electronic signature; or
(2) on the grounds that it is not in its original form or is not an original.
(b) Information in the form of an electronic record shall be given due evidentiary weight by the trier of fact. In assessing the evidential weight of an electronic record or electronic signature where its authenticity is in issue, the trier of fact may consider the manner in which it was generated, stored or communicated, the reliability of the manner in which its integrity was maintained, the manner in which its originator was identified or the electronic record was signed, and any other relevant information or circumstances.
Section 5-135. Retention of electronic records.
(a) Where a rule of law requires that certain documents, records or information be retained, that requirement is met by retaining electronic records of such information in a trustworthy manner, provided that the following conditions are satisfied:
(1) the electronic record and the information contained therein are accessible so as to be usable for subsequent reference at all times when such information must be retained;
(2) the information is retained in the format in which it was originally generated, sent, or received or in a format that can be demonstrated to represent accurately the information originally generated, sent or received; and
(3) such data as enables the identification of the origin and destination of the information, the authenticity and integrity of the information, and the date and time when it was sent or received, if any, is retained.
(b) An obligation to retain documents, records or information in accordance with subsection (a) does not extend to any data the sole purpose of which is to enable the record to be sent or received.
(c) Nothing in this Section shall preclude any State agency from specifying additional requirements for the retention of records that are subject to the jurisdiction of such agency.
Section 5-140. Electronic use not required. Nothing in this Act shall be construed to:
(1) require any person to create, store, transmit, accept, or otherwise use or communicate information, records, or signatures by electronic means or in electronic form; or
(2) prohibit any person engaging in an electronic transaction from establishing reasonable requirements regarding the medium on which it will accept records or the method and type of symbol or security procedure it will accept as a signature.
Section 5-145. Applicability of other statutes or rules.
Notwithstanding any provisions of this Act, if any other statute or rule requires approval by a State agency prior to the use or retention of electronic records or the use of electronic signatures, the provisions of that other statute or rule shall also apply.
ARTICLE 10. SECURE ELECTRONIC RECORDS AND SIGNATURES
Section 10-105. Secure electronic record.
(a) If, through the use of a qualified security procedure, it can be verified that an electronic record has not been altered since a specified point in time, then such electronic record shall be considered to be a secure electronic record from such specified point in time to the time of verification, if the relying party establishes that the qualified security procedure was:
(1) Commercially reasonable under the circumstances;
(2) Applied by the relying party in a trustworthy manner; and
(3) reasonably and in good faith relied upon by the relying party.
(b) A qualified security procedure for purposes of this Section is a security procedure to detect changes in the content of an electronic record that is:
(1) previously agreed to by the parties; or
(2) certified by the Secretary of State in accordance with Section 10-135 as being capable of providing reliable evidence that an electronic record has not been altered.
Section 10-110. Secure electronic signature.
(a) If, through the use of a qualified security procedure, it can be verified that an electronic signature is the signature of a specific person, then such electronic signature shall be considered to be a secure electronic signature at the time of verification, if the relying party establishes that the qualified security procedure was:
(1) commercially reasonable under the circumstances;
(2) applied by the relying party in a trustworthy manner; and
(3) reasonably and in good faith relied upon by the relying party.
(b) A qualified security procedure for purposes of this Section is a security procedure for identifying a person that is:
(1) previously agreed to by the parties; or
(2) certified by the Secretary of State in accordance with Section 10-135 as being capable of creating, in a trustworthy manner, an electronic signature that:
(A) is unique to the signer within the context in which it is used;
(B) can be used to objectively identify the person signing the electronic record;
(C) was reliably created by such identified person, (e.g., because some aspect of the procedure involves the use of a signature device or other means or method that is under the sole control of such person), and that cannot be readily duplicated or compromised; and
(D) is created, and is linked to the electronic record to which it relates, in a manner such that if the record or the signature is intentionally or unintentionally changed after signing the electronic signature is invalidated.
Section 10-115. Commercially reasonable; reliance.
(a) The commercial reasonableness of a security procedure is a question of law to be determined in light of the purposes of the procedure and the commercial circumstances at the time the procedure was used, including the nature of the transaction, sophistication of the parties, volume of similar transactions engaged in by either or both of the parties, availability of alternatives offered to but rejected by either of the parties, cost of alternative procedures, and procedures in general use for similar types of transactions.
(b) Whether reliance on a security procedure was reasonable and in good faith is to be determined in light of all the circumstances known to the relying party at the time of the reliance, having due regard to the:
(1) information that the relying party knew or should have known of at the time of reliance that would suggest that reliance was or was not reasonable;
(2) the value or importance of the electronic record, if known;
(3) any course of dealing between the relying party and the purported sender and the available indicia of reliability or unreliability apart from the security procedure;
(4) any usage of trade, particularly trade conducted by trustworthy systems or other computer-based means; and
(5) whether the verification was performed with the assistance of an independent third party.
Section 10-120. Presumptions.
(a) In resolving a civil dispute involving a secure electronic record, it shall be reputably presumed that the electronic record has not been altered since the specific point in time to which the secure status relates.
(b) In resolving a civil dispute involving a secure electronic signature, it shall be rebuttably presumed that the secure electronic signature is the signature of the person to whom it correlates.
(c) The effect of presumptions provided in this Section is to place on the party challenging the integrity of a secure electronic record or challenging the genuineness of a secure electronic signature both the burden of going forward with evidence to rebut the presumption and the burden of persuading the trier of fact that the nonexistence of the presumed fact is more probable than its existence.
(d) In the absence of a secure electronic record or a secure electronic signature, nothing in this Act shall change existing rules regarding legal or evidentiary rules regarding the burden of proving the authenticity and integrity of an electronic record or an electronic signature.
Section 10-125. Creation and control of signature devices. Except as otherwise provided by another applicable rule of law, whenever the creation, validity, or reliability of an electronic signature created by a qualified security procedure under Section 10-105 or 10-110 is dependent upon the secrecy or control of a signature device of the signer:
(1) the person generating or creating the signature device must do so in a trustworthy manner;
(2) the signer and all other persons that rightfully have access to such signature device must exercise reasonable care to retain control and maintain the secrecy of the signature device, and to protect it from any unauthorized access, disclosure, or use, during the period when reliance on a signature created by such device is reasonable;
(3) in the event that the signer, or any other person that rightfully has access to such signature device, knows or has reason to know that the secrecy or control of any such signature device has been compromised, such person must make a reasonable effort to promptly notify all persons that such person knows might foreseeably be damaged as a result of such compromise, or where an appropriate publication mechanism is available (which, for State agencies, may include the official newspaper designated pursuant to Section 4 of the Illinois Purchasing Act where appropriate), to publish notice of the compromise and a disavowal of any signatures created thereafter.
Section 10-130. Attribution of signature.
(a) Except as provided by another applicable rule of law, a secure electronic signature is attributable to the person to whom it correlates, whether or not authorized, if:
(1) the electronic signature resulted from acts of a person that obtained the signature device or other information necessary to create the signature from a source under the control of the alleged signer, creating the appearance that it came from that party;
(2) the access or use occurred under circumstances constituting a failure to exercise reasonable care by the alleged signer; and
(3) the relying party relied reasonably and in good faith to its detriment on the apparent source of the electronic record.
(b) The provisions of this Section shall not apply to transactions intended primarily for personal, family, or household use, or otherwise defined as consumer transactions by applicable law including, but not limited to, credit card and automated teller machine transactions except to the extent allowed by applicable consumer law.
Section 10-135. Secretary of State Authority to certify security procedures.
(a) A security procedure may be certified by the Secretary of State, as a qualified security procedure for purposes of Sections 10-105 or 10-110, following an appropriate investigation or review, if:
(1) the security procedure (including any technology and algorithms it employs) is completely open and fully disclosed to the public, and has been so for a sufficient length of time, so as to facilitate a comprehensive review and evaluation of its suitability for the intended purpose by the applicable information security or scientific community; and
(2) the security procedure (including any technology and algorithms it employs) has been generally accepted in the applicable information security or scientific community as being capable of satisfying the requirements of Section 10-105 or 10-110, as applicable, in a trustworthy manner.
(b) In marketing a determination regarding whether the security procedure including any tech technology and algorithms it employs) has been generally accepted in the applicable information security or scientific community, the Secretary of State shall consider the opinion of independent experts in the applicable field and the published findings of such community, including applicable standards organizations such as the American National Standards Institute (ANSI), International Standards Organization (ISO), International telecommunications Union (ITU), and the National Institute of Standards and Technology NIST).
(c) Such certification shall be done through the adoption of rules in accordance with the provisions of the Illinois Administrative Procedure Act and shall specify a full and complete identification of the security procedure, including requirements as to how it is to be implemented, if appropriate.
(d) The Secretary of State may also decertify a security procedure as a qualified security procedure for purposes of Sections 10-105 or 10-110 following an appropriate investigation or review and the adoption of rules in accordance with the provisions of the Illinois Administrative Procedure Act if subsequent developments establish that the security procedure is no longer sufficiently trustworthy or reliable for its intended purpose, or for any other reason no longer meets the requirements for certification.
(e) The Secretary of State shall have exclusive authority to certify security procedures under this Section.
Section 10-140. Unauthorized use of signature device.
(a) No person shall knowingly or intentionally access, copy, or otherwise obtain possession of or recreate the signature device of another person without authorization for the purpose of creating, or allowing or causing another person to create, an unauthorized electronic signature using such signature device. A person convicted of a violation of this subsection shall be guilty of a Class A misdemeanor.
(b) No person shall knowingly alter, disclose, or use the signature device of another person without authorization, or in excess of lawful authorization, for the purpose of creating, or allowing or causing another person to create, an unauthorized electronic signature using such signature device . A person convicted of a violation of this subsection shall be guilty of a Class 4 felony. A person convicted of a violation of this subsection who has previously been convicted of a violation of this subsection or Section 15-210 shall be guilty of a Class 3 felony. A person who violates this Section in furtherance of any scheme or artifice to defraud in excess of $50,000 shall be guilty of a Class 2 felony.
ARTICLE 15. EFFECT OF A DIGITAL SIGNATURE
