Intellectual Property Law

Lithuania's Electronic Signatures and Certification Authorities.

By IBLS Editor

Lithuania, with a population of about 3,369,600 inhabitants and a per-capita GDP of $14,273, this relatively young democracy is an activate player of e-commerce.  Lithuania declared its independence from the Soviet Union in 1990 and in 2004 it became part of the European Union ("EU").  Approximately 70% of Lithuanian exports go to the EU and its export partners are as follows: Russia 12.8%, Latvia 11.1%, Germany 8.6%, Estonia 6.5%, Poland 6.1%, Netherlands 4.8%, Sweden 4.5%, UK 4.4%, US 4.3%, Denmark 4.2%, France 4.2%.  This article provides an overview of how the certification authorities are regulated in Lithuania according to their law on electronic signatures. 

Lithuania enacted its Electronic Signature Law ("ESL") in 2000.  Subsequently, ESL was updated in 2002 to make it compatible with EU regulations on electronic signatures.  According to Lithuanian ESL, electronic signatures will have the same legal effect as any hand-written signature and constitute admissible evidence in court proceedings.  The 2002 update determined that the Information Society Development Committee ("IS Committee") is the regulatory body supervising electronic signatures in Lithuania.  Thus, electronic signature is Lithuania are regulated by the ESL and regulations from the IS Committee.

The ESL establishes the requirements for valid electronic signatures, rules regarding the certification authorities, the rights and responsibilities of the electronic signature users, and the authority of the government regulatory bodies; including the IS Committee. 

The IS Committee regulates the following:

1. requirements for the certification-service providers that issue qualifying;

2. procedures for the registration of service providers issuing qualifying certificates;  

3. requirements for signature equipment;

4. requirements for electronic signature supervision;

5. procedures for signature verification;

6. procedures for time-stamping services;

7. requirements and procedure of voluntary accreditation for certification-service-     providers;

Among the issues covered by the ESL, regulations on the certificate authorities ("CA") are one of the most relevant.  It is important to note that in Lithuania, there are two types of CAs; accredited and no accredited CAs.   Only accredited CAs may issue 'qualified certificates.'    

The main function of the CAs in Lithuania is to receive, consider, and issue, when appropriate, qualified-certifications. Third parties, especially foreign third parties, rely on the CAs to verify the existence of subscriber's registered-signatures. Time stamps in Lithuania are conferred by the CAs according to the rules established by the IS Committee. 

The rules about CAs in Lithuania confer reciprocity to qualified certificates issued by foreign CAs provided that some requirements are met: 1. that the foreign CA is admitted in the European Union; or 2. that the foreign CA is accredited in Lithuania and the EU, and that the CA complies with the requirements to issue qualified certificates. 

Once the applicant complies with all requirements, the CA grants the applicant a certificate.  Then, the applicant will be considered a subscriber and is issued a private and a public key.   The private key is only given to the subscriber that was issued a qualified certificate.   Private keys are not transferable.

The certificate issued by the CA in Lithuania may be suspended for the following reasons:

1.  When the subscriber so requests;

2.  when suspension is requested by law enforcement authorities to prevent crime;

3.  when some information in the certificate is inaccurate or wrong;

4. when the security of the private key is compromised.

Suspended certificates may be reinstated when the applicant requests reinstatement if suspension occurred by the applicant's request. Suspensions requested by law enforcement requests may be reinstated by the reinstatement request from the same law enforcement authority.  If suspension occurred due to inaccuracy of information or when the private key was compromised, the applicant may request reinstatement within the following 30 days and the applicant must prove that there is no inaccurate information and that the private key is secured.  If the applicant does not act within the following 30 days from the day of suspension, the certificate will be revoked. 

CAs in Lithuania may revoke conferred certificates when the subscriber requests revocation; when the subscriber submitted false information when obtaining its certificate; when the certificate was issued in violation of the law of electronic signatures; when the validity of the certificate has elapsed; when the private key security was compromised; when the subscriber dies or becomes mentally incompetent; and for other reasons prescribed by law. 

According to the most recent report, Lithuania has 1,083 million Internet users and 1,301 million Internet hosts.  These facts combined with facts about Lithuania's fast-growing economy and its exports to the EU make Lithuania an interesting e-commerce hub.   

Full post as published by IBLS Internet Law Blog on May 27, 2008 (boomark / email).