According to the Indian laws, licensed Certifying Authorities (CA) have to publish their Certification Practice Statement (CPS) based on which the license is granted. It is inevitable that the contents of the CPS should be known to the Digital Certificate Applicants as well. Hence it is considered mandatory that CPS is published in a public website along with a repository of Certificates issued and the details of revoked certificates. Most of the CAs are however not following the rules in letter and spirit. The repositories and revocation lists are not updated on the fly and not available online in a manner that the standard browsing and e-mail clients can pick up the information in an automatic search process.

Now MTNL the latest CA offering Digital Certificates to the public has come out with its CPS on its website.

The CPS document is however published with a legal notice stating as follows:

LEGAL NOTICE

Unauthorized access to and use of this document is prohibited by law. Any individual attempting unauthorized access, copying, distributing, or exploiting information within this document will be subjected to legal prosecution. The MTNLTRUSTLINE operations, including the policies and procedures, the terms and conditions, shall be governed by relevant Indian Laws in force.

The wordings used here include "attempting unauthorized access" depicts the classification of the document as an extremely sensitive document.

In fact since the site does not describe what is "Unauthorized Access" when the site itself is a public website and the document is available to any one who accesses the URL  http://www.mtnltrustline.com/repository/mtnlTrustLine-CPS.pdf . There is no information about how to obtain authorization before clicking on the link which will immediately download the PDF document into the user's computer.

Also unless a person downloads the document and copies it to his computer, he is not aware of the legal notice. This is like a "Shrink Wrapped Contract" which creates a liability without adequate notice.

Since the document is in PDF format and is a heavy file (5.32 MB) it can be read conveniently only after downloading. Online browsing will be difficult and may cause the computer to hang. Hence every user may be violating the terms of the notice the moment he downloads the copy onto his computer.

It is difficult to understand and appreciate the need for the legal notice and why MTNL thinks it is authorized to place such restrictions on the document.

CPS is essentially a public document and every member of the public is entitled to know what is the CPS of MTNL before considering application for a digital certificate. In fact it should be considered legally mandatory for any CA to make the document freely available to public not only on downloadable form but also otherwise.

Just as the  Memorandum and Articles of Association of any registered society or company needs to be made available to members at a nominal cost, it is necessary to make the CPS available in print form to all buyers at a nominal cost besides making the free copy available for down load and online browsing.

This being a legal document, MTNL does not have the normal copyright available to literary work and the document needs to be read, copied , distributed, understood and analysed by the public. Application for CA license should be construed as an implied consent to place the document in the public domain.

I request the Controller to advise MTNL to remove the legal notice barring the copying and distribution of the document. Controller should also clarify with a notification that CPS is a public document and no restrictions can be placed on the document being copied or distributed since it is a document in the public domain. No Copyrightable right should be recognized in the document since any way this document is not of any commercial use except to other applicants for license as CAs.

Naavi

October 10 2004

[Comments Welcome]

 

 

For Structured Online Courses in Cyber laws, Visit Cyber Law College.com