Mr. Larry Marchese, E-signature consultant, USAID Economic Policy Reform and Competitiveness

1. Mongolian Digital Signature Law
Gateway to the digital economy
23 May, 2010
Ulaanbaatar, Mongolia
Larry Marchese
EPRC Consultant
Business Council of Mongolia
Executive Briefing

2. BCM executive Briefing
Agenda
• Digital signature legal impact
• Public Key Infrastructure (PKI) technology
• Digital signature business strategy & opportunity
• How BCM can assist EPRC

3. Digital signature law & PKI technology are inseparable...must comply
with global standards
glolegislated
• Electronic signature: any representation
in electronic form used to express legal
intent:
– Printed name on an e-mail
– Digitized copy of hand written
signature
– Biometric mark
– Sound & image
– Digital signature
• Digital signature: specific type of
electronic signature based on public-key
infrastructure (PKI) technology:
– global standard for secure e-commerce
& e-government transactions.
– PKI encrypted digital signatures are
virtually impossible to forge if properly
implemented.
Key legal points:
• Electronic signatures as legally
binding as hand written signatures,
official seals & stamps.
• Parliamentary review of GOM draft
e-Signature may begin in October.
– GOM law not compliant with global
legal & PKI standards
• Revised e-Signature law:
– Complies with global legal & PKI
standards
– EPRC needs BCM support for
revised e-signature law

4. Digital signature law & PKI technology are inseparable...must
comply with global standards
Public Key Infrastructure (PKI):
• PKI is the technology behind
digital signatures; enables the
user to encrypt data, digitally
sign electronic documents,
and authenticate user identity.
• PKI technology enabled by proven
cryptographic algorithms, IT
equipment, policy, procedures &
skilled people to satisfy global e-
Signature legal requirements:
– Identification
• Who am I doing business with?
– Authentication
• How do I know this is you?
– Confidentiality
• Can anyone else see this?
– Non-Repudiation
• Is this transaction legally
binding?

5. PKI fits between network & security computing infrastructure, and will be
legislated under Mongolian law...
Network SecurityPKI
Where PKI fits…

6. Digital certificates open the gateway to e-commerce, e-
government & the global digital economy...
• Digital certificates: electronic
documents that identify the
holder...like a passport or drivers
license in the physical world.
Digital certificates include a
digital signature using public-
key infrastructure (PKI).
• Certificate Authority (CA) –
trusted third party enterprise that
issues encrypted digital
certificates to end users and
manages certificate life-cycle
including issuance, revocation,
expiry and renewal.
• How your company will
benefits from d-SIGN law :
– Electronic payments
– Electronic funds transfer
– Secure e-mail
– Electronic data transfer
– Intranet and Extranet
applications
– Virtual Private Networks
(VPN)
– Enterprise software
applications

7. EPRC strategy for Mongolian Certificate Authority...regulated
monopoly with PPP structure
Mongolian Law on
Concessions
(January 2010)
•Regulates granting investors concessions over
state & local property
• Appoints regulatory authority
• Encourages global joint ventures
• Article 17 grants concessions based on direct
contract agreement, not public tender,when:
• tender jeopardizes national security
•investor-owned intellectual property
required for operation
•Both conditions apply to CA operation
PPP-Monopoly Model

8. Mongolian Certificate Authority...new business opportunity in an
untapped, competitor-free market
•Utilize Mongolian Concession
Law to form regulated monopoly
• CRC regulates CA operations
per e-SIGN Law
• Leverage NDC investment &
secure facility as equity stake
• Private investors & GoM
form equity joint venture
• Attract global Certificate
Services Provider partner
•Negotiate CSP services &
revenue split
PPP-Monopoly Model
EPRC Strategy:
Mitigate risk by establishing
single national CA

9. How BCM member companies can support e-signature law
passage and Mongolian CA formation

10. BCM Executive Briefing
• QUESTIONS & Comments?

11. Back pocket slides

12. A closer look at PKI infrastructure
Digital signature process
• Digital signatures are based on public-key
cryptography: two (2) compliementary keys that
encrypt and decrypt electronic documents.
• These keys are used in pairs of matched “private”
and “public” keys.
• Every user in a PKI system has a key pair consisting
of a public & private key:
• Public key is openly available to everyone looking for it
• Private key is kept secret by its owner

13. A closer look at PKI infrastructure
Digital signature process
When you digitally sign a document you do three (3) things:
• You confirm that you signed the document
• You insure the integrity of the document contents
• You legally bind yourself to the signing activity – only you
could have signed the document
– you cannot later say that you did not sign the document while still keeping
your private key.
– you cannot legally repudiate your signature

14. A closer look at PKI infrastructure
Digital certificate contents
• All certificate are unique and
contain:
– Certificate holder’s name
– Serial number
– Certificate expiration
(validity) dates
– The holder’s public key used
for authentication &
encryption
– The CA’s digital signature to
validate the holder’s identify

15. National Certificate Authority
Mongolian CA business strategy drives profitable growth
•CA business model & strategy nottechnology
determine CA target market, customers and
services
• CA business model will position Mongolian CA
as a full-service security services & solutions
provider:
• Digital certificates & services
• Tailored SSL security solutions
• Web hosting
• Central clearing house services
• Checks & credit card transactions
• e-Commerce & e-Government platforms
CA Business strategy
CA Lines of Business (LOB)