A4-0189/98

Resolution on the communication from the Commission to the Council, the European Parliament, the Economic and Social Committee and the Committee of the Regions on ensuring security and trust in electronic telecommunication - towards a European framework for digital signatures and encryption (COM(97)0503 - C4-0648/97)

The European Parliament,

- having regard to the Commission communication (COM(97)0503 - C4-0648/97),

- having regard to its resolution of 19 September 1996 on the recommendation to the European Council on Europe and the global information society and on the Commission communication 'Europe's way to the information society: an action plan' ((OJ C 320, 28.10.1996, p. 164.)), in particular paragraph 106 thereof,

- having regard to the results of the European Ministerial Conference 'Global information networks: realizing the potential', which took place in Bonn from 6 to 8 July 1997,

- having regard to the STOA interim study: 'An appraisal of the technologies of political control¨, and in particular to the alarming information on developments in network communications-related surveillance technology,

- having regard to the report of the Committee on Legal Affairs and Citizens' Rights and the opinions of the Committee on Economic and Monetary Affairs and Industrial Policy and the Committee on Culture, Youth, Education and the Media (A4-0189/98),

A. whereas electronic communication raises three specific problems: authentication of a message, the integrity of the message transmitted and confidentiality,

B. whereas the need for legislation on authentication has been recognized in all Member States of the EU; whereas in eight Member States legislation has already been adopted or is in preparation,

C. whereas electronic commerce and many other applications of the information society will only develop if confidentiality can be guaranteed in a user-friendly and cost-efficient way; whereas, however, the law enforcement authorities and national security agencies fear that further use of encryption could impede them in the fight against crime,

1. Shares the Commission's view that electronic commerce will become one of the key factors in the development of the global information society but points out that the technology discussed in the Commission communication will become increasingly important for people in their everyday lives and not just for commerce;

2. Considers that, with regard to the problem of authentication and integrity of data, for which digital signatures can provide a solution, it is necessary to create a legal framework at European level to ensure mutual trust in digital signatures and confidentiality and to encourage the development of a range of certification arrangements that will suit different applications, particularly in electronic commerce and in electronic communication between public bodies and citizens; the legal framework must be designed primarily to abolish national restrictions on certification;

3. Considers that the necessary steps should be taken to remove obstacles to the use of digital signatures in the legal system, industry and public administration; therefore calls for digital and conventional signatures to have the same status in law;

4. Enjoins European Union Institutions to lead the way in the use of digital signatures in communications with each other and with third parties so as to increase public acceptance of and trust in digital signatures and electronic communication in general;

5. Assumes that a technical solution can be found to both the problem of ensuring the integrity of communications and that of authentication, so that no particular action is required at Community level;

6. Considers that, with regard to the issue of ensuring confidentiality, the main priority at this stage must be to make encryption technologies available to all those using electronic communication, but that at the same time the legitimate interests of law enforcement should be taken into account;

7. Emphasizes, however, the potential benefits offered by the new communication technologies on strengthening European civil society through the development of a European and global public space, and therefore calls on the Commission to inform it of any observations relating to abuse of communications systems, especially through interception, for the purposes of illegitimate surveillance of citizens and individuals in the EU;

8. Calls on the Commission and the Member States to press ahead with dialogue and agreements at international level to allow the creation of a worldwide virtual economic area through common technical standards and mutual recognition;

9. Considers that, with a view to the single market, the regulation on dual-use goods should be amended to the effect that internal Community checks on encryption products are abolished, so that there is freedom of circulation for such products;

10. Calls on the Member States, during the discussions concerning the Wassenaar Agreement and the forthcoming proposal for the amendment of the regulation on dual-use goods, to advocate that the list of encryption products subject to export restrictions be reduced to a strict minimum and that, consequently, no new restrictions should be introduced;

11. Stresses the importance of international dialogue between the European Union and various international organizations such as the Organization for Economic Cooperation and Development (OECD), the United Nations (UN), the International Telecommunications Union (ITU), the International Chamber of Commerce (ICC) and the World Trade Organization (WTO), to avoid a situation in which regulations form a barrier to trade with major trading partners, and underlines the need for reciprocity in the treatment of the European Union by other trading partners;

12. Believes that it is necessary for the further development of electronic commerce to engender sufficient user confidence and to formulate rules with regard to the legal reliability of, inter alia, identification, validity in law of contracts, integrity and communications;

13. Stresses that general rules must be established leading on the one hand to greater confidence in electronic commerce, while on the other hand remaining flexible and open enough to allow for new technological developments, for example in the field of biometrics, to act as an incentive for the development of electronic commerce: this would then provide a basis for the establishment of technical specifications by the industry in the form of standards and the like;

14. Considers that one aim should be the legal recognition of digital signatures, their admission as evidence in legal procedures and equivalence with written forms being two of the main basic principles;

15. Stresses the importance of mutual recognition by the Member States of digital signatures and consequently underlines the importance of drawing up 'essential requirements' at European level for digital signatures, allowing Member States to set higher standards provided that such additional standards are proportional and do not obstruct the importation of goods and services from other Member States;

16. Believes that the system of 'essential requirements' will make it possible for Member States on the one hand to generate confidence in the quality and reliability of the certification regulations and on the other to allow them to decide whether or not to operate a system of permits in this field;

17. Hopes at all events that the directive on digital signatures will provide for so-called cross-border certification, possibly with an authority to which third parties from other Member States can apply for a guarantee that certification has taken place in the Member State concerned;

18. Believes that Community conditions must be laid down for the setting up and operation of certification bodies, with an obligation to register and to be independent with regard to the parties to which certificates are granted: it is recommended that each Member State should have at least one accrediting body to supervise compliance with these conditions in an objective, non-discriminatory and transparent way, since this will increase confidence in the market and will also benefit the international investment climate;

19. Notes that rapid technological development of electronic commerce and, in connection with this, the proliferation of new services mean that there is no uniform model for the location of certification functions - such as the verification of identity, the granting of certificates, the cancellation of certificates and the registration of the point in time at which electronic contracts are concluded - in one or several organisations, making it desirable for the time being to allow the process to crystallize;

20. Emphasizes that legal rules on access to keys should not be introduced, as the measure is not commensurate with the expected result, particularly in view of the increased possibility of misappropriation of the keys, invasion of personal privacy, cost, and lack of efficacy;

21. Believes that adequate funds must be earmarked in the European Union's Fifth Framework Programme for Research and Development to give the European industry an incentive to make a greater effort in field of cryptography, and in the field of standardisation and products which are interoperable with American standards, or have a common interface with them;

22. Encourages all sectors of society, and particularly European industry, to develop common standards in this field not only at national but also at international level, bearing in mind the importance of ensuring that such standards comply with best practice and the state of the art;

23. Considers that electronic commerce may become one of the driving forces behind the development of the global information society. However, the lack of security and trust on open networks poses a threat to this new 'virtual' economic space, a source of great potential for job creation;

24. Stresses the fact that European Union action is essential in order to establish a set of common rules which facilitates the free movement of goods and services and electronic commerce on the Internet, whilst ensuring the security of encryption technologies and the recognition of digital signatures and encryption amongst Member States. Such recognition will serve to develop the services on offer in the Community and the legal regulation within the European Union of certification authorities, whose monitoring activities will, inter alia, help establish respect for copyright and for the protection of privacy on the one hand, and a climate of trust on the other;

25. Believes that establishing a European framework for encryption does indeed have its merits, despite the controversy surrounding illicit use, since such a framework would play an important role in developing electronic commerce and guaranteeing the fundamental right to privacy and to communication without interference, as enshrined in the constitutions of the Member States, Article 12 of the Universal Declaration of Human Rights and Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms;

26. Recalls that electronic communication transcends the geographical confines of the European Union, and that, for that reason, adopting a harmonized Community system with regard to digital signatures and encryption should also lead the Community to take the initiative in negotiations and dialogue with other international bodies such as the OECD and the WTO;

27. Supports the programmes introduced by the Commission, especially INFOSEC II, and the research projects under the 5th framework programme (1998-2002) on electronic commerce, particularly on techniques designed to improve the protection of privacy and personal information;

28. Instructs its President to forward this resolution to the Commission and the Council.