Davis Polk & Wardwell
April 5, 2004
Mr. Jonathan G. Katz
Re: File Number S7-14-04
Dear Mr. Katz:
We appreciate the opportunity to respond to the request for comments on the proposed rule change, S7-14-04, Mandated Electronic Filing for Form ID, (the Proposed Rule).
Davis Polk routinely prepares and submits Form ID applications on behalf of our clients; in the last four years, we have submitted over 500 Form IDs. Our comments are based on this experience.
Initially, the Proposed Rule would require applicants to fax a notarized document containing the same information as the Form ID. Assuming the notarized document is a copy of the Form ID, with the passphrase redacted, the Commission staff will have to physically match up the faxed document with the electronic document and proofread both documents to confirm they contain identical information. The mechanics of this proposed process are laborious. If the notarized document is not a copy of the Form ID with the information arranged in the same pattern, this process becomes much more labor intensive.
Faxing a notarized document to authenticate identity is at best a half-measure, and at worst only serves to promote a false sense of security. In a digital age with readily available inexpensive document scanners and software, anyone intent on creating a notarized document for the purpose of satisfying this requirement would have little challenge in doing so. There is no cost-effective way for Commission staff to confirm the authenticity of a faxed document.
The release further states, We expect that eventually we will replace this procedure with a requirement that applicants use a certificate from a certification authority to authenticate their Form ID filings. While this would seem to be a useful procedure, no indication is provided of what Class of certificate would be required.
According to the current VeriSign Certification Practice Statement (CPS), version 2.2, Class 1 authentication does not provide assurances of identity (i.e. that a Subscriber is who he or she claims to be). Obviously, this Class certificate would not be consistent with the Commissions goal of authentication.
More advanced Classes of certificates (Class 2 and Class 3) confirm identity and guarantee nonrepudiation using information residing in approved identity proofing services, such as credit reporting agencies, or require personal appearances. These Classes of certificates do provide assurance of identity, but raise concerns of privacy and expense.
There are other issues and opportunities the Proposed Rule raises, and until a more comprehensive solution is formulated, the Commission might consider interim options, such as utilizing the existing network of law firms, financial printers, and other professional groups who have both an ongoing relationship with many of the issuers, and a wide presence who can vouch for new applicants.
Please feel free to contact me at (212) 450-4519 if the staff would like to discuss any of these points in greater detail.
Richard K. Bonaparte