Checklist

• Demand practical answers to primary questions: “Why, exactly, do I need any security before I can contract online? Which security items do I need?”

• Ask whether the security items you select will enable your system to tell you

  • What was agreed?

  • When was it agreed?

  • Who agreed to it?

• Put security into your data. It’s not enough to secure the transport-channel.

• Secure your private key.

• Be legally critical of digital certificates. Legally, a “stand-alone” digital certificate is not the same as a “corroborative” digital certificate. Legally, neither is the same as a “disposable” digital certificate.

• Deploy SAML critically. SAML is useful, but it is legally neutral. Do not commit the cardinal legal error of believing that SAML can intervene to confer parity of legal status on a disparate range of weak and strong prior authentication methods.

• Ignore anyone who either enthuses about or dismisses law or legal security in categorical or alarmist terms.