What is clear, however, is that under the current DISA plan, outside contractors can serve as ECAs, even if they are not certified. But because DISA is using largely industry-standard benchmarks for certification, it is logical that CAs could meet industry benchmarks for security without gaining DISA certification. By allowing contractors to use non-certified CAs, DISA unfortunately may undercut its own certification process. Ultimately, the DOD certification process could die of irrelevance. Another potentially troubling aspect of DISA's system is DISA's approach to liability for lost or compromised messages.
DISA explicitly disavows all liability.
Where contractors can control their CAs, it is logical for those contractors to bear the risk of failures in their CAs. Contractors and agencies embarking on PKI also should recognize that encryption carries with it costs and responsibilities. Having a public key to distribute is much like having a driver's license. Before allowing users to embark on encrypted commerce, agencies and companies should ensure that their users know the rules of the new electronic highway of electronic commerce.