LLM Group 5 Criminal Law and Criminal Administration Penal Laws 2018 Question Paper with Solutions

That scheme has a gap at its centre. A public key is a string of characters. Nothing in it says whose key it is. A stranger relying on a signature must be able to obtain, from a source he can trust, an assurance that this public key belongs to that person. That assurance is the Electronic Signature Certificate, issued under section 35 by a Certifying Authority.

The Certifying Authority is therefore the pivot of the whole statute, and the question immediately arises who licenses and supervises it. That is the Controller.

Who the Controller is

Section 17(1) provides that the Central Government may, by notification in the Official Gazette, appoint a Controller of Certifying Authorities for the purposes of the Act, and may also appoint such number of Deputy Controllers, Assistant Controllers, other officers and employees as it thinks fit.

• (d) specifying the qualifications and experience which employees of a Certifying Authority should possess;
• (e) specifying the conditions subject to which the Certifying Authorities shall conduct their business;
• (f) specifying the contents of written, printed or visual materials and advertisements that may be distributed or used in respect of an electronic signature certificate and the public key;
• (g) specifying the form and content of an electronic signature certificate and the key;
• (h) specifying the form and manner in which accounts shall be maintained by the Certifying Authorities;
• (i) specifying the terms and conditions subject to which auditors may be appointed and their remuneration;
• (j) facilitating the establishment of any electronic system by a Certifying Authority, solely or jointly with others, and regulating such systems;
• (k) specifying the manner in which the Certifying Authorities shall conduct their dealings with the subscribers;
• (l) resolving any conflict of interests between the Certifying Authorities and the subscribers;

Licensing, sections 21 to 26. Section 21 provides that a person may apply to the Controller for a licence to issue electronic signature certificates, and that no licence shall be granted unless the applicant fulfils the prescribed requirements of qualification, expertise, manpower, financial resources and infrastructure. Section 22 governs the application, section 23 renewal, section 24 the grant or rejection after giving the applicant a reasonable opportunity, section 25 suspension of a licence on the grounds stated, and section 26 the publication of notice of suspension or revocation in the database and, where appropriate, in the Official Gazette.

Recognition of foreign authorities, section 19. With the previous approval of the Central Government and by notification, the Controller may recognise any foreign Certifying Authority for the purposes of the Act, and may revoke the recognition for recorded reasons if the conditions of recognition are not complied with.

Delegation, section 27. The Controller may, in writing, authorise a Deputy Controller, an Assistant Controller or any officer to exercise any of his powers.

Interception, section 69. The power to issue directions for interception, monitoring or decryption is vested in the Central or a State Government or an officer specially authorised, not in the Controller as such.

The offences that protect the office

Three offences protect the certification scheme the Controller regulates. Section 71 punishes a person who makes any misrepresentation to, or suppresses any material fact from, the Controller or a Certifying Authority for obtaining a licence or a certificate, with two years or fine up to one lakh rupees or both. Section 73 punishes publishing an electronic signature certificate knowing that the Certifying Authority listed has not issued it, or that the subscriber listed has not accepted it, or that it has been revoked or suspended, on the same scale. Section 74 punishes knowingly creating, publishing or making available such a certificate for a fraudulent or unlawful purpose, again with two years or one lakh or both.

Shreya Singhal v. Union of India, (2015) 5 SCC 1, though decided on other provisions, is instructive by analogy. The Supreme Court upheld section 69A, the blocking power, precisely because it is confined to identified grounds, requires reasons in writing and is subject to procedural safeguards in rules, while striking down section 66A for vagueness. The Controller's powers under sections 28 and 29 are of the same kind, exercisable on a stated suspicion of contravention and for a stated purpose, which is what keeps them defensible.

The Certifying Authority's duties, the subscriber's, and what a court makes of them

The Controller's functions are only half of the arrangement. The other half is the duties he enforces, and an answer that sets them out shows why the office exists.

On the subscriber, Chapter VIII. Section 40 requires a subscriber whose certificate lists a public key to generate the key pair by the applicable security procedure. Section 40A imposes the corresponding duty in respect of an electronic signature certificate. Section 41 governs acceptance of a certificate and provides that a subscriber who accepts one certifies to all who reasonably rely on it that he holds the private key and that all representations in the certificate are true. Section 42 is the operative duty: the subscriber shall exercise reasonable care to retain control of the private key and take all steps to prevent its disclosure, and if the key has been compromised he shall communicate the fact without any delay to the Certifying Authority, remaining liable until he does so.

What a court makes of the chain. The presumptions in the law of evidence attach only where the chain has been observed. Section 87 of the Bharatiya Sakshya Adhiniyam, 2023, replacing section 85C of the Indian Evidence Act, 1872, presumes that the information listed in an Electronic Signature Certificate is correct, except for information marked as unverified subscriber information, where the subscriber accepted the certificate.

Conclusion. The Controller of Certifying Authorities is an officer appointed by the Central Government under section 17, working under its general control, who sits at the root of the Act's trust infrastructure. His functions under section 18 are supervisory and regulatory: supervising Certifying Authorities, certifying their public keys, laying down standards, qualifications, conditions, forms, accounts and duties, resolving conflicts with subscribers, and maintaining a publicly accessible database of disclosure records. Beyond section 18 he licenses, renews, suspends and revokes under sections 21 to 26, recognises foreign authorities under section 19, investigates contraventions under section 28 with income tax powers, accesses computer systems under section 29 and issues binding directions under section 68, and sections 71, 73 and 74 punish those who deceive him or misuse the certificates his licensees issue.