1-3500-11305-1
STATE OF MINNESOTA
OFFICE OF ADMINISTRATIVE HEARINGS
FOR THE OFFICE OF THE SECRETARY OF STATE
In the Matter of the Proposed Permanent REPORT OF THE
Rules Governing Electronic Authentication, ADMINISTRATIVE LAW JUDGE
Minnesota Rules Chapter 8275
The above-entitled matter came on for hearing before Administrative Law Judge George A. Beck at 9:00 a.m. on October 6, 1998, in Room 10, State Office Building, 100 Constitution Avenue, St. Paul, Minnesota 55155-1299.
This Report is part of a rulemaking proceeding held pursuant to Minn. Stat. §§ 14.131 to 14.20 (1996), to hear public comment, to determine whether the Minnesota Secretary of State (“Secretary”) has fulfilled all relevant substantive and procedural requirements of the law applicable to the adoption of the rules, whether the proposed rules are needed and reasonable, and whether or not modifications of rules proposed by the Secretary after initial publication are impermissible, substantial changes.
Amy V. Kvålseth, Assistant Attorney General, 525 Park Street, Suite 500, St. Paul, Minnesota 55103-2106, appeared on behalf of the Secretary of State at the hearing.
Approximately 12 persons attended the hearing. Eight persons signed the hearing register. The hearing continued until all interested person, groups or associations had an opportunity to be heard concerning the proposed amendments to these rules.
The record remained open for twenty calendar days following the hearing, until October 26, 1998, for the submission of written comments. During the initial comment period, the Administrative Law Judge (“ALJ”) received one written comment from an interested person. The Secretary responded to the one comment in a letter addressed to the ALJ dated October 22, 1998. Pursuant to Minn. Stat. § 14.15, subd. 1, five working days were allowed for the filing of responsive comments. No comments were submitted during the responsive period. The record closed for all purposes on November 2, 1998.
This Report must be available for review to all affected individuals upon request for at least five working days before the agency takes any further action on the rule(s). The Secretary may then adopt a final rule or modify or withdraw its proposed rule. If the Secretary makes changes in the rule other than those recommended in this report, it must submit the rule with the complete hearing record to the Chief Administrative Law Judge for a review of the changes prior to final adoption. Upon adoption of a final rule, the Secretary must submit it to the Revisor of Statutes for a review of the form of the rule. The Secretary must also give notice to all persons who requested to be informed when the rule is adopted and filed with the Secretary of State.
Based upon all the testimony, exhibits, and written comments, the Administrative Law Judge makes the following:
1. On September 8, 1997, the Secretary published a Request for Comments on planned rules governing the Minnesota Electronic Authentication Act. The Request for Comments was published at 22 St. Reg. 405 (1997).[1]
2. On July 31, 1998, the Secretary requested the scheduling of a rules hearing date, requested prior approval of the Secretary’s Notice Plan, and filed the following documents with the Chief Administrative Law Judge:
(a) the Dual Notice proposed to be issued;
(b) a copy of the proposed rules certified as to form by the Revisor of Statutes; and
(c) a draft of the Statement of Need and Reasonableness ("SONAR”).
3. The Secretary mailed a copy of the SONAR to the Legislative Reference Librarian on August 19, 1998.[2] On August 19, 1998, the Secretary mailed the Dual Notice of Hearing to all persons and associates who had registered their names with the agency for the purpose of receiving such notice.[3] The Secretary also posted on the Secretary of State website the dual notice, the proposed rules, and the SONAR to the persons and associations identified in the Secretary’s notice plan.[4] The Secretary received over twenty-five signatures from persons requesting a hearing be held on this matter.[5] On October 2, 1998, the Secretary mailed to persons who requested a hearing a notice stating that a hearing would be held on this rulemaking.[6]
4. On August 24, 1998, a copy of the proposed rules and the Dual Notice of Hearing were published at 23 St. Reg. 449 (1998).
5. On the day of the hearing, the Secretary placed the following documents into the record:
(a) Request for Comments published at 22 State Register 405; an approval letter, dated August 25, 1998, from Administrative Law Judge Allan Klein, regarding the Additional Notice Plan; and Certificate of Mailing the Request for Comments (Exhibit A);
(b) Proposed Permanent Rules Governing Electronic Authentication (Exhibit B);
(c) SONAR (Exhibit C);
(d) Certificate of Mailing the SONAR to the Legislative Reference Library (Exhibit D);
(e) Dual Notice: Notice of Intent to Adopt Rules without a Public Hearing unless 25 or more Person Request a Hearing, and Notice of Hearing if 25 or more Requests for Hearing are Received (as mailed) (Exhibit E);
(f) Proposed Permanent Rules Governing Electronic Authentication (as published in the State Register) (Exhibit F);
(g) Certificate of Mailing the Dual Notice (U.S. Mail) (Exhibit G);
(h) Certificate of Mailing the Dual Notice (Interoffice Mail) (Exhibit H);
(i) Certificate of Mailing List (Exhibit I);
(j) Certificate of Posting of the Dual Notice (additional notice) (Exhibit J);
(k) written comments (Exhibit K);
(l) Rulemaking Advisory Committee Participants (Exhibit L);
(m) cover letter to the State Law Library (Exhibit M);
(n) hearing requests (Exhibit N);
(o) duplicate hearing requests (Exhibit O);
(p) withdrawal of hearing request (Exhibit P);
(q) Certificate of Mailing Notice of Hearing (Exhibit Q);
(r) digital signature diagram (Exhibit R); and
(s) Proposed Modification to Proposed Permanent Rules Governing Electronic Authentication (Exhibit S).
(t) Letter to the Administrative Law Judge, dated October 22, 1998, from the Office of the Secretary responding to written comments made on the day of the Hearing, marked as Public Exhibit 1
(Exhibit T).
6. This rulemaking proceeding involves rules proposed by the Secretary of State of Minnesota governing electronic authentication. In 1997, the legislature adopted the Minnesota Electronic Authentication Act, Minnesota Statutes, chapter 325K.[7] The Act is designed to facilitate commerce by means of reliable electronic messages, to minimize the incidence of forged digital signatures and fraud in electronic commerce, to implement international standards created to ensure reliability and authenticity of electronic messages and to establish uniform rules with other states in this area.[8] The purpose of the Secretary’s proposed rules is to create the standard for licensing and recognition, and to provide for the regulation of these two types of entities.
7. The Secretary cites Minn. Stat. ch. 325K and subdivisions therein as the source of its authority to adopt and modify rules. Minn. Stat. § 325K.03, subd. 3 requires the Secretary to adopt rules:
(a) to govern licensed certification authorities, their practice, and the termination of a certification authority’s practice;
(b) to determine an amount reasonably appropriate for a suitable guaranty, in light of the burden a suitable guaranty places upon licensed certification authorities and the assurance of quality and financial responsibility it provides to persons who rely on certificates issued by licensed certification authorities;
(c) to specify reasonable requirements for the form of certificates issued by licensed certification authorities, in accordance with generally accepted standards for digital signature certificates;
(d) to specify reasonable requirements for recordkeeping by licensed certification authorities;
(e) to specify reasonable requirements for the content, form, and sources of information of certification authority disclosure records, the updating and timeliness of the information, and other practices and policies relating to certification authority disclosure records;
(f) to specify the form of the certification practice statement; and
(g) otherwise give effect to and implement this chapter.
8. The proposed rules are limited to the areas identified in Minn. Stat. § 325K.03, subd. 3. The Administrative Law Judge finds that the Secretary has the statutory authority to adopt the proposed rule amendments.
9. Under Minn. Stat. § 14.14, subd. 2, and Minn. R. 1400.2100, one of the determinations which must be made in a rulemaking proceeding is whether the agency has established the need for and reasonableness of the proposed rule by an affirmative presentation of facts. In support of a rule, the Secretary may rely on legislative facts, namely general facts concerning questions of law, policy and discretion, or it may simply rely on interpretation of a statute, or stated policy preferences.[9] The Secretary prepared a Statement of Need and Reasonableness (SONAR) in support of the proposed rules
Whether a rule is reasonable is determined from the rulemaking record and whether the record demonstrates the rule has a rational basis or is arbitrary. Minnesota case law has equated an unreasonable rule with an arbitrary rule.[10] Arbitrary or unreasonable agency action is action without consideration and in disregard of the facts and circumstances of the case.[11] A rule is generally found to be reasonable if it is rationally related to the result that the governing statute seeks to achieve.[12] The Minnesota Supreme Court has further defined the Secretary’s burden in adopting rules by requiring it to “explain on what evidence it is relying and how the evidence connects rationally with the agency’s choice of action to be taken.”[13] The Secretary is entitled to make choices between possible approaches as long as the choice it makes is rational. Generally, it is not the proper role of the Administrative Law Judge to determine which policy alternative presents the “best” approach since this would invade the policy-making discretion of the Secretary. Rather, the question is whether the choice made by the Secretary is one a rational person could have made.[14]
In addition to need and reasonableness, the Administrative Law Judge must also assess whether the Secretary complied with the rule adoption procedure. The ALJ must also determine whether the rule grants undue discretion, and whether the Board has statutory authority to adopt the rule. Finally, it is the ALJ’s duty to assess whether the rule is unconstitutional or illegal, whether the rule constitutes an undue delegation of authority to another entity, or whether the proposed language is not a rule.[15]
Where, as here, changes have been proposed to the rules after publication of the rule language in the State Register, the Administrative Law Judge must determine if the new language in substantially different from that which was originally proposed.[16] The standards to determine if the new language is substantially different are found in Minn. Stat. § 14.05, subd. 2 (1996).
10. Minn. Stat. § 14.111 imposes an additional notice requirement when rules are proposed that affect farming operations. The Secretary made no mention of the statute or whether it applies in this rulemaking. The statute reads:
14.111 Farming operations.
Before an agency adopts or repeals rules that affect farming operations, the agency must provide a copy of the proposed rule change to the commissioner of agriculture, no later than 30 days prior to publication of the proposed rule in the State Register.
A rule may not be invalidated for failure to comply with this section if an agency has made a good faith effort to comply.[17]
The proposed rules do not impose restrictions or have a direct impact on any aspect of farming operations. The Administrative Law Judge finds that the proposed rule change will not impact farming operations in Minnesota, and finds that no additional notice is required.
Classes of Persons Affected by the Proposed Rules
11. Minn. Stat. § 14.131 requires an agency adopting rules to include in its SONAR:
(1) a description of the classes of persons who probably will be affected by the proposed rule, including classes that will bear the costs of the proposed rule and classes that will benefit from the proposed rule;
(2) the probable costs to the agency and to any other agency of the implementation and enforcement of the proposed rule and any anticipated effect on state revenues;
(3) a determination of whether there are less costly methods or less intrusive methods for achieving the purpose of the proposed rule;
(4) a description of any alternative methods for achieving the purpose of the proposed rule that were seriously considered by the agency and the reasons why they were rejected in favor of the proposed rule;
(5) the probable costs of complying with the proposed rule; and
(6) an assessment of any differences between the proposed rule and existing federal regulations and a specific analysis of the need for and reasonableness of each difference.
In its SONAR, the Secretary listed the six factors from the statute and provided the agency’s response. The Secretary also included a seventh paragraph stating how the agency developed the proposed rules to comply with the legislative policy supporting performance-based regulatory systems as set forth in Minn. Stat. § 14.002.[18] With regard to the first factor, the Secretary states that those persons affected by the proposed rules include anyone in Minnesota who chooses to use the provisions of the Electronic Authentication Act. Anyone may take advantage of the provisions of the Act, but all parties to a transaction must agree that the Act will apply to their transaction. The Secretary provides that the cost to the State will be transferred to companies that will become licensed certification authorities and recognized repositories. The companies will, in turn, pass the costs on to subscribers or those who use digital technology. The Secretary submits that the users of the technology will benefit from the proposed rules because the rules will make electronic commerce more secure.
12. The Secretary anticipates that the costs to implement Minnesota’s Electronic Authentication Act will be a one-time cost of $50,000, the amount of the appropriation. It is also anticipated there will be little to no actual continuing or ongoing costs because the fees charged for the licenses will offset the ongoing costs. Any enforcement costs incurred by the Secretary will be assessed against the party whose conduct causes an investigation and administrative hearing to occur. The Secretary contends that state revenues will indirectly benefit from chapter 325K and the proposed rules because transactions will take less time to prepare, send, receive, and process. No other agencies are involved in implementing or enforcing chapter 325K or the proposed rules.
13. In regard to the third factor, the Secretary points out that although other technology may be available for authentication, chapter 325K designates a particular type of technology (asymmetric crytosystem) as having a statutory presumption of validity.[19] The $100,000 figure was reached as an appropriate amount for a required suitable guaranty. It was determined this amount was high enough to provide sufficient protection to the public obtaining certificates, and low enough to avoid unnecessary burdens on certification authorities who want to be licensed in Minnesota. Another cost is the requirement for working capital. After input from the advisory committee, the Secretary determined that working capital was necessary to develop the trust needed to make electronic commerce successful. It was also determined that working capital needed audited financial statements in order to be beneficial. Finally, the Secretary considered the CobiT standard instead of the National Institute for Standards in Technology (NIST) as a supporting system for the issuance of certificates. Because the CobiT standard required development by each individual certification authority, there would be a lack of uniformity that the NIST could provide. The NIST was also adopted by other states, such as the State of Washington, which have implemented electronic authentication acts.
14. The purpose of the proposed rules is to create the standards for licensing and recognition, and to provide for the regulation of these two types of entities. Alternative methods considered by the Secretary for achieving this purpose are mentioned above, as are the reasons why they were rejected.
15. The Secretary states that the primary costs of complying with the proposed rules include a $500 license fee for obtaining a certificate, a cost range of $1,000 to $10,000 for providing a suitable guaranty of $100,000, $2,000 to document working capital, and a business registration fee ranging from $25 to $200. Also, if another agency or governmental unit opts to make use of digital signature technology, start-up and transaction costs would be incurred.
16. There are no existing federal regulations in the area of electronic authentication and, therefore, there are no differences to compare.
17. The Secretary included a seventh factor in its SONAR describing how the Office has complied with Minn. Stat. § 14.002 in developing the proposed rules. Minn. Stat. § 14.002 states that when rules are developed, they must “emphasize superior achievement in meeting the agency’s regulatory objectives and maximum flexibility for the regulated party in meeting those goals.” The Secretary included the four specific purposes of Minnesota’s Electronic Authentication Act and stated that these purposes are the regulatory objectives for adopting the rules. In regard to providing flexibility to the regulated party, the Secretary points again to the Office’s consideration of and final decision to require working capital supported by audited financial statements, and the amount of the working capital. The Secretary’s decision to require these items was initiated by the need to develop trust in the field of electronic commerce. In order to create trust, the Secretary also noted that part of the proposed rule governing the qualifications of operative personnel. The Secretary points out that certification authorities publish the standards they use to conduct background checks, test knowledge level, etc. of their operative personnel. This allows the public to choose the services of a certification authority that meet their needs.
Analysis of the Proposed Rules
18. Five individuals submitted comments to the Secretary regarding the proposed rules, either in written form or via telephone.[20] The Secretary responded to these comments by proposing modifications to the proposed permanent rules.[21] At the Hearing, these modifications were well received by those in attendance, and comments made at the Hearing were in support of the proposed rules and proposed modifications. Because public comment was positive, there is no need for the Administrative Law Judge to include a rule-by-rule analysis of the proposed rules.
Based on the foregoing Findings of Fact, the Administrative Law Judge makes the following:
CONCLUSIONS
1. The Secretary of State of Minnesota gave proper notice in this matter.
2. The Secretary has fulfilled the procedural requirements of Minn. Stat. § 14.14 and all other procedural requirements of law or rule.
3. The Secretary has demonstrated its statutory authority to adopt the proposed rules, and has fulfilled all other substantive requirements of law or rule within he meaning of Minn. Stat. §§ 14.05, subd. 1; 14.15, subd. 3; and 14.50 (i) and (ii).
4. The Secretary has demonstrated the need for and reasonableness of the proposed rules by an affirmative presentation of facts in the record within the meaning of Minn. Stat. §§ 14.14, subd. 4; and 14.50 (iii).
5. The additions or modifications to the proposed rules suggested by the Secretary after publication of the proposed rules in the State Register do not constitute substantially different language within the meaning of Minn. Stat. §§ 14.05, subd. 2; and 14.15, subd. 3.
6. Any Findings which might properly be termed Conclusions and any Conclusions which might properly be termed Findings are adopted as such.
7. A Finding or Conclusion of need and reasonableness in regard to any particular rule subpart does not preclude and should not discourage the Secretary from further modification of the proposed rules based upon an examination of the public comments, provided that the rule finally adopted is based upon facts as appearing in this rule hearing record.
Based on these Conclusions, the Administrative Law Judge makes the following:
RECOMMENDATION
IT IS HEREBY RECOMMENDED that the proposed rules be adopted.
Dated this _______ day of November, 1998.
________________________________
GEORGE A. BECK
Administrative Law Judge
Reported: Taped, No Transcript Prepared
[1] Exhibit A.
[2] Exhibit D.
[3] Exhibit G.
[4] Exhibit J.
[5] Exhibit N.
[6] Exhibit Q.
[7] 1997 Minn. Laws ch. 178.
[8] Minn. Stat. § 325K.02 (Supp. 1997).
[9] Manufactured Hous. Inst. v. Petterson, 347 N.W.2d 238, 244 (Minn. 1984); Mammenga v. Department of Human Serv., 442 N.W.2d 786 (Minn. 1989).
[10] In re Hanson, 275 N.W.2d 790 (Minn. 1978); Hurley v. Chaffee, 231 Minn. 362, 367, 43 N.W.2d 281, 284 (1950).
[11] Greenhill v. Bailey, 519 F.2d 5, 19 (8th Cir. 1975).
[12] Mammenga v. Department of Human Serv., 442 N.W.2d at 789-90; Broen Mem’l Home v. Minnesota Dept. of Human Serv., 364 N.W.2d 436, 444 (Minn. Ct. App. 1985).
[13] Manufactured Hous. Inst. v. Petterson, 347 N.W.2d at 244.
[14] Federal Sec. Adm’r v. Quaker Oats Co., 318 U.S. 218, 233 (1943).
[15] Minn. R. 1400.2100.
[16] Minn. Stat. § 14.15, subd. 3.
[17] Minn. Stat. § 14.111.
[18] 1998 Minn. Laws, ch. 303, §§ 1 and 4.
[19] Minn. Stat. § 325K.01, subds. 3,11, and 17.
[20] Exhibit K.
[21] Exhibit S.