The project plans to interview over 40 private and public organisations, drawn from the UK and mainland Europe, that are concerned, either now or in the future, with the provision, use, audit or regulation of Trusted Third Party Services. At the time of writing this paper, just over half of the interviews have been conducted and the project team is beginning to get a feeling for the results. Most importantly, the need to take seriously responsibility and liability is paramount for many organisations and possibly even fundamental to the issue of trust. A fundamental view is that trustworthiness is a black and white issue. Either a service can be trusted absolutely, or it cannot.
Absolute trust is independent of the actual level of security risk involved.
This implies that a means to continually evaluate, counter, mitigate and otherwise manage risk needs to be in place. The concept of absolute trust , of course, is a fundamental principle of business rather than a scientific principle. In practice, that responsibility will be delegated to their staff and, in the case of electronic commerce, some aspects may even be delegated to their customers and other service providers as well. For example, in the Insurefast case, certification and registration authority services could be provided by some third party organisation and Insurefast customers would have to take responsibility for the security of their private keys. The collapse of Barings is, of course, a classic example of what can happen if the basic principles of delegation are ignored.