The Controller of Certifying Authorities

In one line

The Controller of Certifying Authorities is the regulator at the top of India's trust chain: it licenses the Authorities, certifies their public keys, and lays down the standards they work to.

In the wording a student can write in an exam: section 17 of the Information Technology Act, 2000 empowers the Central Government by notification to appoint a Controller of Certifying Authorities together with Deputy Controllers, Assistant Controllers, other officers and employees, the Controller discharging his functions subject to the general control and directions of the Central Government; and section 18 lists fourteen functions the Controller may perform, of which supervision of Certifying Authorities, certifying their public keys, laying down standards and maintaining a public database of disclosure records are the principal ones.

Why there is a regulator at all

Because section 5 accepts only a prescribed method, and somebody has to stand behind the method. Chapter 300 works section 5, and chapter 260 explains the problem it leaves: a public key is a number and the certificate binding it to a person is only as good as the person who issued it.

So the Act builds a chain of trust with three links. The subscriber holds a key. A Certifying Authority certifies that the key is the subscriber's. And the Controller certifies that the Certifying Authority is what it says it is, and supervises it.

The Controller sits at the top of that chain and operates the Root Certifying Authority of India. Every licensed Certifying Authority's public key is certified by the Root, so a relying party who trusts the Root can verify any certificate issued in the country.

That is why the office is a regulator and not merely a registrar. It licenses, it standardises, it inspects, and it can shut an Authority down.

Section 17: the office

Section 17(1): "The Central Government may, by notification in the Official Gazette, appoint a Controller of Certifying Authorities for the purposes of this Act and may also by the same or subsequent notification appoint such number of Deputy Controllers, Assistant Controllers, other officers and employees as it deems fit."

Section 17(2): "The Controller shall discharge his functions under this Act subject to the general control and directions of the Central Government."

Section 17(3): "The Deputy Controllers and Assistant Controllers shall perform the functions assigned to them by the Controller under the general superintendence and control of the Controller."

Section 17(4) leaves qualifications, experience and terms of service to be prescribed. Section 17(5) provides for a head office and branch offices at places the Central Government specifies. Section 17(6): "There shall be a seal of the Office of the Controller."

Two observations that matter for an answer.