[cabf_validation] [EXTERNAL]Re: Making progress on disclosures of data sources

[Kirk Hall]

It appears you don’t know the answer to your own question on Sweden – so, how will Google use the data on government corporate registry sources that CAs would be required to post under your proposal?

I doubt we will spend much time looking at the lists of other CAs.  Are you aware of any EV certificates that have actually been mis-issued to Swedish companies because of this (alleged) problem as to which agency is the correct one to use for EV validation of a corporation?

If you want to present specific (alleged) problems like Sweden – lets discuss that, and not some elaborate scheme for posting all corporate registry data, with timelines.  If Google is concerned about this issue – you have a big legal department, why don’t you research and present the answer?  Here’s a good starting point:

https://en.wikipedia.org/wiki/Swedish_Companies_Registration_Office
https://en.wikipedia.org/wiki/Financial_Supervisory_Authority_(Sweden)

Based on 30 seconds of Wikipedia research, looks like the winner is Bolagsverket for most companies, but maybe also Finansinspektionen for banks and financial institutions.  But I have never been involved in EV vetting of a Swedish company.  If our validation team were doing EV vetting for a Swedish company, they would do more research first than I just did – but in the end, it’s not very hard.

The idea of multiple government registries in a single company assigned to different company types would not surprise me – there are federally chartered banks in the US, as well as state chartered banks.  https://financial-dictionary.thefreedictionary.com/federally+chartered+banks   So it’s possible that BOTH government agencies in Sweden are correct, based on the type of corporation.  Maybe Buypass knows the answer for certain – they are based in Norway.

In Canada, corporations can be registered at either the federal level, or the provincial level – so there is no single correct answer for Canada – and there is no problem or conflict for the Forum to resolve concerning Canada.

OK, that’s Sweden and Canada.  Do you know of any other (alleged) problems concerning which government registry to consult in any country other than Sweden?

From: Ryan Sleevi <sleevi at google.com>
Sent: Wednesday, April 22, 2020 9:13 PM
To: Kirk Hall <Kirk.Hall at entrustdatacard.com>
Cc: CA/Browser Forum Validation SC List <validation at cabforum.org>; Doug Beattie <doug.beattie at globalsign.com>
Subject: Re: [EXTERNAL]Re: Making progress on disclosures of data sources

On Wed, Apr 22, 2020 at 10:40 PM Kirk Hall <Kirk.Hall at entrustdatacard.com<mailto:Kirk.Hall at entrustdatacard.com>> wrote:
Ha, Sweden. Which one is the correct registry to use?

That's exactly the sort of question that's good to solve collaboratively, and where this proposal helps move us towards.

To help answer this: What are the Incorporating Agencies and Registration Agencies that Entrust Datacard uses for Sweden, which it has evaluated against the criteria of the EV Guidelines? What about for other Jurisdictions?

This is not the first time we've discussed this issue<https://cabforum.org/pipermail/servercert-wg/2019-December/001517.html> as a way to solve real problems. Hopefully we can be more productive<https://cabforum.org/pipermail/servercert-wg/2019-December/001537.html> this time around.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/validation/attachments/20200423/7d0d40a2/attachment-0001.html>