Question & AnswerQ&A (EXECUTIVE ORDER NO. 810)
The primary purpose of Executive Order No. 810 is to institutionalize the certification scheme for digital signatures in the Philippines and to direct the application of digital signatures in e-government services to ensure security, confidentiality, authenticity, integrity, and non-repudiation in electronic transactions.
Digital signature is defined as an electronic signature consisting of a transformation of an electronic document or electronic data message using an asymmetric or public cryptosystem such that one can determine whether it was created using the private key corresponding to the public key and whether the document was altered after the transformation.
The National Computer Center (NCC) under the Commission on Information and Communications Technology (CICT) is designated as the Root Certification Authority (CA).
The Root CA operates the Root CA system, issues and manages certificates to accredited government and private CAs, develops and prescribes technical standards for digital signatures, ensures interoperability of digital certification technology, provides technical expertise for assessments, supports international cooperation, and resolves disputes related to digital certificates.
The NCC is also designated as the Government CA. It issues certificates for government transactions, publishes certificates and Certificate Revocation Lists (CRL), and handles certificate revocation requests from certificate owners.
RAs, typically government agencies providing e-government services, identify and register users, transmit certificate requests to the Government CA, validate certificates and CRLs, and request revocation of certificates when necessary.
The Department of Trade and Industry (DTI), through its Philippine Accreditation Office (PAO), is designated as the accreditation and assessment body for CAs.
DTI issues criteria and guidelines for accreditation, accredits CAs, conducts regular assessments, revokes or suspends licenses for non-compliance, creates advisory and other necessary committees, and ensures security and interoperability of digital signatures systems.
All government agencies and instrumentalities providing electronic services must require the use of digital signatures to ensure confidentiality, authenticity, integrity, and non-repudiation of electronic transactions.
Priority government agencies must comply within two years from the issuance of the Executive Order; other agencies have three years to comply.
NCC as Root and Government CA may charge fees to recover at least the full cost of services. Government RAs may also charge fees or assume costs subject to contractual arrangements. Fees imposed must follow existing government memoranda governing fees, and private CA fees are market-driven but should be just and reasonable.
The Department of Trade and Industry (DTI) is tasked to promote the application of digital signatures in ICT systems of the private sector, particularly in critical services requiring high security, confidentiality, integrity, and non-repudiation of electronic transactions.
Disputes arising from accreditation of CAs, issuance and use of digital certificates, and related issues shall be resolved by the respective designated agencies according to their formulated rules and regulations.
An interim personnel complement may manage and operate the Root CA, Government CA, and perform RA functions. Personnel can be detailed, reassigned, or seconded per Civil Service rules. NCC will assume the role of private ACA until a private ACA becomes operational.
The Executive Order took effect immediately upon its signing on June 15, 2009.