The Controller and the Certifying Authorities

In one line

A Controller of Certifying Authorities appointed by the Central Government licenses, supervises, inspects and can suspend or revoke the private bodies that issue electronic signature certificates, and may search a computer system on reasonable suspicion of a contravention of this Chapter.

In the wording a student can write in an exam: by section 17(1) of the Information Technology Act, 2000 the Central Government may by notification appoint a Controller of Certifying Authorities for the purposes of the Act, and by section 18 the Controller exercises supervision over the activities of the Certifying Authorities, certifies their public keys and lays down the standards they must maintain.

Why a regulator was necessary

A signature is only as good as the body that vouches for the key. The whole scheme of section 3 depends on a public key being reliably tied to a named subscriber, and somebody has to guarantee that link.

The Act chose licensing rather than State issue. Private bodies do the certifying, and a public officer licenses and supervises them. That choice is why Chapter VI is long and why so much of it is about conditions, inspections and revocation.

And it is why section 20 is gone. As enacted, section 20 made the Controller the repository of all digital signature certificates. It was omitted by Act 10 of 2009 with effect from 27 October 2009, and the repository duty moved to the Certifying Authority itself by the new clause (ca) of section 30.

The Controller

Section 17, appointment. The Central Government may by notification appoint a Controller of Certifying Authorities, and such number of Deputy Controllers, Assistant Controllers, other officers and employees as it thinks fit. The Controller acts subject to the general control and directions of the Central Government; the Deputies and Assistants act under his general superintendence and control. Qualifications, experience and terms of service are prescribed by the Central Government. The head office and branch offices are at places the Central Government specifies, and the office has a seal.

Section 18, functions. The Controller may:

(a) exercise supervision over the Certifying Authorities; (b) certify their public keys; (c) lay down the standards they must maintain; (d) specify the qualifications and experience of their employees; (e) specify the conditions of their business; (f) specify the contents of written, printed or visual material and advertisements about certificates and public keys; (g) specify the form and content of a certificate and the key; (h) specify how their accounts are kept; (i) specify the terms on which auditors are appointed and paid; (j) facilitate and regulate electronic systems established by them; (k) specify how they deal with subscribers; (l) resolve conflicts of interest between Authority and subscriber; (m) lay down their duties; and (n) maintain a public database of every Authority's disclosure record.