Category Archives: Law: Internet Law

French agency caught minting SSL certificates impersonating Google:

The secure sockets layer (SSL) credentials were digitally signed by a valid certificate authority, an imprimatur that caused most mainstream browsers to place an HTTPS in front of the addresses and display other logos certifying that the connection was the one authorized by Google. In fact, the certificates were unauthorized duplicates that were issued in violation of rules established by browser manufacturers and certificate authority services.

The certificates were issued by an intermediate certificate authority linked to the Agence nationale de la sécurité des systèmes d’information, the French cyberdefense agency better known as ANSSI. After Google brought the certificates to the attention of agency officials, the officials said the intermediate certificate was used in a commercial device on a private network to inspect encrypted traffic with the knowledge of end users, Google security engineer Adam Langley wrote in a blog post published over the weekend. Google updated its Chrome browser to reject all certificates signed by the intermediate authority and asked other browser makers to do the same. Firefox developer Mozilla and Microsoft, developer of Internet Explorer have followed suit. ANSSI later blamed the mistake on human error. It said it had no security consequences for the French administration or the general public, but the agency has revoked the certificate anyway.

An intermediate certificate authority is a crucial link in the “chain of trust” that’s key in connections protected by SSL and its successor protocol, known as transport layer security (TLS). Because intermediate certificates are signed by a root certificate embedded in the browser, they have the ability to mint an unlimited number of digital certificates for virtually any site. The individual certificates will be accepted by default by most browsers.

Maybe it’s time to dust off and update my article on digital signatures and digital certificates, The Essential Role of Trusted Third Parties in Electronic Commerce, 75 Ore. L. Rev. 49 (1996). I think this was the first article published in a US law review on the topic, and even though it’s held up well, there have been many developments in nearly 20 years. On the other hand, there are three new papers I need to finish first…

Over the weekend I attended parts of a great symposium put on by the Miami Law Review on social media and the law.

The Law Review had drafted me to moderate a panel on “Will You Have a Digital Afterlife?” It was an interesting experience: the estate planning/probate version of privacy issues is a sort of funhouse mirror version of how I usually think about digital privacy: everything I recommend to people — e.g. strong passwords, strong encryption — can make digital probate more difficult.

The first complication is that we may not know with much certainty what the decedent wanted. Did he want the heirs to have full access to his encrypted hard drive? What if there’s a porn collection?

Second, how about the email account — it may have important information about what bills need to be paid, but it might also have a secret correspondence with far-out political groups or a mistress that the decedent might not have wanted the survivors to see. Online social media accounts have additional complexities as some providers take the view that the contract terminates with death and thus make no attempt to preserve, or may even flush, the contents. Others have contract terms of service that routinely deny access to surviving family members, if only because that blanket rule may make life easier for the provider.

Laws prohibiting various sorts of unauthorized access, written with the living in mind, add another level of complexity as innocent attempts by family members to find out about the credit card bill or the phone bill may amount — in formal terms at least — to criminal actions punishable (in theory) like the worst forms of hacking; computer intermediaries (and lawyers!) may justly be nervous about enabling such access without clear advance directives from the deceased.

The panelists — Christina L. Kunz, James Lamm, Michael J. Mcguire, and Damien A. Riehl — did an excellent job of introducing this complex area of law to an audience composed mostly of neophytes like me.

I came away from James Lamm’s talk, for example, persuaded that I should execute an ‘Authorization and Consent for Release of Electronically Stored Information’ and also add a codicil to my will that covers access to electronic material stored in the cloud or elsewhere.

James Lamm, by the way, blogs at Digital Passing.

[Note (2/21): edited to conform to a very polite copyright-related request from Mr. Lamm. You’ll have to wait for his article, or consult him, for more details.]