DIGITAL SIGNATURE ACT 1997

Digital Signature LAWS OF MALAYSIA REPRINT Act 562 DIGITAL SIGNATURE ACT 1997 Incorporating all amendments up to 1 January 2006 PUBLISHED BY THE COMMISSIONER OF LAW REVISION, MALAYSIA UNDER THE AUTHORITY OF THE REVISION OF LAWS ACT 1968 IN COLLABORATION WITH PERCETAKAN NASIONAL MALAYSIA BHD 2006 1 2 DIGITAL SIGNATURE ACT 1997 Date of Royal Assent … ... ... ... ... 18 June 1997 Date of publication in the Gazette ... ... ... 30 June 1997 PREVIOUS REPRINT First Reprint ... ... ... ... ... 2002 3 LAWS OF MALAYSIA Act 562 DIGITAL SIGNATURE ACT 1997 ARRANGEMENT OF SECTIONS P ART I PRELIMINARY Section 1. Short title and commencement 2. Interpretation P ART II THE COMMISSION AND THE LICENSING OF CERTIFICATION AUTHORITIES 3. Appointment of Commission 4. Certification authorities to be licensed 5. Qualifications of certification authorities 6. Functions of licensed certification authorities 7. Application for licence 8. Grant or refusal of licence 9. Revocation of licence 10. Appeal 11. Surrender of licence 12. Effect of revocation, surrender or expiry of licence 13. Effect of lack of licence 14. Return of licence 15. Restricted licence 16. Restriction on use of expression “certification authority” Laws of Malaysia 4 ACT 562 Section 17. Renewal of licence 18. Lost licence 19. Recognition of other licences 20. Performance audit 21. Exemption from performance audit P ART III REQUIREMENTS OF LICENSED CERTIFICATION AUTHORITIES 22. Activities of licensed certification authorities 23. Requirement to display licence 24. Requirement to submit information and particulars relating to business operations 25. Notification of change of information 26. Requirements as to advertisement PART IV DUTIES OF LICENSED CERTIFICATION AUTHORITIES AND SUBSCRIBERS CHAPTER 1 GENERAL REQUIREMENTS FOR LICENSED CERTIFICATION AUTHORITIES 27. Use of trustworthy systems 28. Disclosures on inquiry 29. Prerequisites to issuance of certificate to subscriber 30. Publication of issued and accepted certificate 31. Adoption of more rigorous requirements permitted 32. Suspension or revocation of certificate for faulty issuance 33. Suspension or revocation of certificate by order Digital Signature 5 CHAPTER 2 WARRANTIES AND OBLIGATIONS OF LICENSED CERTIFICATION AUTHORITIES Section 34. Warranties to subscriber 35. Continuing obligations to subscriber 36. Representations upon issuance 37. Representations upon publication CHAPTER 3 REPRESENTATIONS AND DUTIES UPON ACCEPTANCE OF CERTIFICATE 38. Implied representations by subscriber 39. Representations by agent of subscriber 40. Disclaimer or indemnity limited 41. Indemnification of licensed certification authority by subscriber 42. Certification of accuracy of information given CHAPTER 4 CONTROL OF PRIVATE KEY 43. Duty of subscriber to keep private key secure 44. Property in private key 45. Licensed certification authority to be fiduciary if holding subscriber’s private key CHAPTER 5 SUSPENSION OF CERTIFICATE 46. Suspension of certificate by issuing licensed certification authority 47. Suspension of certificate by Commission or court 48. Notice of suspension Laws of Malaysia 6 ACT 562 Section 49. Termination of suspension initiated by request 50. Alternate contractual procedures 51. Prohibition against false or unauthorized request for suspension of certificate 52. Effect of suspension of certificate CHAPTER 6 REVOCATION OF CERTIFICATE 53. Revocation on request 54. Revocation on subscriber’s death or dissolution 55. Revocation of unreliable certificates 56. Notice of revocation 57. Effect of revocation request on subscriber 58. Effect of notification on licensed certification authority CHAPTER 7 EXPIRATION OF CERTIFICATE 59. Expiration of certificate CHAPTER 8 RECOMMENDED RELIANCE LIMITS AND LIABILITY 60. Recommended reliance limit 61. Liability limits for licensed certification authorities PART V EFFECT OF DIGITAL SIGNATURE 62. Satisfaction of signature requirements 63. Unreliable digital signatures 64. Digitally signed message deemed to be written document 65. Digitally signed message deemed to be original document 66. Authentication of digital signatures 67. Presumptions in adjudicating disputes Digital Signature PART VI REPOSITORIES AND DATE/TIME STAMP SERVICES Section 68. Recognition of repositories 69. Liability of repositories 70. Recognition of date/time stamp services PART VII GENERAL 71. Prohibition against dangerous activities 72. Obligation of secrecy 73. False information 74. Offences by body corporate 75. Authorized officer 75 A. Enforcement by police officers 76. Power to investigate 77. Search by warrant 78. Search and seizure without warrant 79. Access to computerized data 80. List of things seized 81. Obstruction of authorized officer 82. Additional powers 83. General penalty 84. Recovery of procedural costs 85. No costs or damages arising from seizure to be recoverable 86. Institution and conduct of prosecution 87. Jurisdiction to try offences 88. Protection of Commission and officers 89. Power to exempt 90. Limitation on disclaiming or limiting application of Act 91. Regulations 92. Savings and transitional 7 8 Laws of Malaysia ACT 562 Digital Signature 9 LAWS OF MALAYSIA Act 562 DIGITAL SIGNATURE ACT 1997 An Act to make provision for, and to regulate the use of, digital signatures and to provide for matters connected therewith. [1 October 1998, P.U. (B) 397/1998] BE IT ENACTED by the Seri Paduka Baginda Yang di-Pertuan Agong with the advice and consent of the Dewan Negara and Dewan Rakyat in Parliament assembled, and by the authority of the same, as follows: PART I PRELIMINARY Short title and commencement 1. This Act may be cited as the Digital Signature Act 1997 and shall come into force on a date to be appointed by the Minister by notification in the Gazette, and the Minister may appoint different dates for different provisions of this Act. Interpretation 2. (1) In this Act, unless the context otherwise requires— “accept a certificate” means— (a) to manifest approval of a certificate, while knowing or having notice of its contents; or (b) to apply to a licensed certification authority for a certificate, without revoking the application by delivering notice of the revocation to the licensed certification authority, and obtaining a signed, written receipt from the licensed certification authority, if the licensed certification authority subsequently issues a certificate based on the application; 10 Laws of Malaysia ACT 562 “asymmetric cryptosystem” means an algorithm or series of algorithms which provide a secure key pair; “authorized officer” means an officer authorized under section 75; “certificate” means a computer-based record which— (a) identifies the certification authority issuing it; (b) names or identifies its subscriber; (c) contains the subscriber’s public key; and (d) is digitally signed by the certification authority issuing it; “certification authority” means a person who issues a certificate; “certification authority disclosure record” means an on-line and publicly accessible record which concerns a licensed certification authority which is kept by the Commission under subsection 3(5); “certification practice statement” means a declaration of the practices which a certification authority employs in issuing certificates generally, or employed in issuing a particular certificate; “certify” means to declare with reference to a certificate, with ample opportunity to reflect, and with a duty to apprise oneself of all material facts; *“Commission” means the Malaysian Communications and Multimedia Commission established under the Malaysian Communications and Multimedia Commission Act 1998 [Act 589]; “confirm” means to ascertain through diligent inquiry and investigation; “correspond”, with reference to keys, means to belong to the same key pair; *NOTE—Upon the commencement of Act A1121, previous references to the Controller of Certification Authorities (“Controller”) or any officer and servant appointed by the Controller, shall be construed as references to the Commission or its authorized officer—see section 19 of Act A1121. Digital Signature 11 “digital signature” means a transformation of a message using an asymmetric cryptosystem such that a person having the initial message and the signer’s public key can accurately determine— (a) whether the transformation was created using the private key that corresponds to the signer’s public key; and (b) whether the message has been altered since the transformation was made; “forge a digital signature” means— (a) to create a digital signature without the authorization of the rightful holder of the private key; or (b) to create a digital signature verifiable by a certificate listing as subscriber a person who either does not exist or does not hold the private key corresponding to the public key listed in the certificate; “hold a private key” means to be able to utilize a private key; “incorporate by reference” means to make one message a part of another message by identifying the message to be incorporated and expressing the intention that it be incorporated; “issue a certificate” means the act of a certification authority in creating a certificate and notifying the subscriber listed in the certificate of the contents of the certificate; “key pair” means a private key and its corresponding public key in an asymmetric cryptosystem, where the public key can verify a digital signature that the private key creates; “licensed certification authority” means a certification authority to whom a licence has been issued by the Commission and whose licence is in effect; “message” means a digital representation of information; “notify” means to communicate a fact to another person in a manner reasonably likely under the circumstances to impart knowledge of the information to the other person; 12 Laws of Malaysia ACT 562 “person” means a natural person or a body of persons, corporate or unincorporate, capable of signing a document, either legally or as a matter of fact; “prescribed” means prescribed by or under this Act or any regulations made under this Act; “private key” means the key of a key pair used to create a digital signature; “public key” means the key of a key pair used to verify a digital signature; “publish” means to record or file in a repository; “qualified certification authority” means a certification authority that satisfies the requirements under section 5; “recipient” means a person who receives or has a digital signature and is in a position to rely on it; “recognized date/time stamp service” means a date/time stamp service recognized by the Commission under section 70; “recognized repository” means a repository recognized by the Commission under section 68; “recommended reliance limit” means the monetary amount recommended for reliance on a certificate under section 60; “repository” means a system for storing and retrieving certificates and other information relevant to digital signatures; “revoke a certificate” means to make a certificate ineffective permanently from a specified time forward; “rightfully hold a private key” means to be able to utilize a private key— (a) which the holder or the holder’s agents have not disclosed to any person in contravention of this Act; and (b) which the holder has not obtained through theft, deceit, eavesdropping or other unlawful means; Digital Signature 13 “subscriber” means a person who— (a) is the subject listed in a certificate; (b) accepts the certificate; and (c) holds a private key which corresponds to a public key listed in that certificate; “suspend a certificate” means to make a certificate ineffective temporarily for a specified time forward; “this Act” includes any regulations made under this