Reflections on the legal recognition of blockchain timestamping by the Italian lawmaker
Propriété intellectuelle et TIC - Propriété intellectuelle et TIC
27/03/2019
It’s official: Italian positive law now includes a measure enshrining blockchain timestamping. However, the wording of this text does not settle all of the questions that arise surrounding blockchain evidence; far from it. Explanations by Alice Barbet-Massin, PhD candidate, University of Lille, CNRS, UMR 8026-CERAPS, legal expert at August Debouzy.
The combination of encryption methods and the peer-to-peer network, components of blockchain protocols, provide a certain level of reliability to the data recorded therein. Cost, speed, unlimited storage duration, "universal evidence“ that could be allowed by all courts, immutability of the registers, are all advantages attributed to this evidence kept in the blockchain.
Blockchain protocols include timestamping functions that make it possible to set the date and time of recorded data. In this respect,blockchain timestamping introduces temporal elements on two levels:
in terms of the time and date of entry of the transaction in the blockchain; and
in terms of the time and date of validation of the transaction block.
Legal recognition of this blockchain timestamping began with law no. 12/19 dated January 11, 2019 relative to the support and simplification of enterprises and public administration, which took effect in Italy on February 13, 2019. It seeks to enshrine the legal effects of “blockchainelectronic timestamping” as evidence, but it remains quiet on a certain number of technical and legal points.
Lastly, the study of this law will be an opportunity to establish the state of the art in foreign laws regarding blockchain evidence, compared to French law.
An enshrinement of the legal effects of "blockchain electronic timestamping" in Italian law
Article 8 ter, 3° of the Italian law relative to the support and simplification of enterprises and public administration introduces “blockchain electronic timestamping". It thus sets out that "the storage of a digital document using technologies based on distributed registers produces the legal effects of electronic timestamping (set out by Article 41 of the eIDAS regulation)“ (Article 41 of the eIDAS Regulation targets three effects produced by electronic timestamping: “1. An electronic time stamp shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic time stamp. 2. A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound. 3. A qualified electronic time stamp issued in one Member State shall be recognised as a qualified electronic time stamp in all Member States.”).
This article on the one hand confirms the legal effects of the "blockchain electronic timestamping" of data. Without using the reasoning of a prior legal qualification, the Italian lawmaker grants "blockchain electronic timestamping" the effects of the timestamping targeted by the eIDAS Regulation by the reference to Article 41, which addresses these effects.
Furthermore, still in reference to Article 41, the legal admissibility of this evidence is indirectly allowed. Timestamping cannot be refused if it does not meet the requirements of qualified electronic timestamping. The principle of nondiscrimination, implied by the eIDAS regulation, here is applicable to blockchain electronic timestamping. It consists of accepting, on the one hand, that electronic timestamping is legally allowed on the same grounds as traditional timestamping, and on the other hand, that it will also be allowed if it takes the form of simple (and not qualified) electronic timestamping. It is on this last point that the principle of nondiscrimination applies concretely to "blockchain electronic timestamping", which is electronic in essence, but will not necessarily be qualified electronic timestamping.
As a reminder, two types of electronic timestamping are set out by the eIDAS regulation:
simple electronic timestamping: a method that makes it possible to certify that data indeed existed at a given moment (Reg. no. 910/2014, July 23, 2014, called eIDAS, point 33: “data in electronic form which binds other data in electronic form to a particular time establishing evidence that the latter data existed at that time”);
qualified electronic timestamping: a similar method, but which must meet the conditions set out by Article 42 of the eIDAS Regulation, namely:
binding the date and time to data in such a manner as to reasonably preclude the possibility of the data being changed undetectably;
being based on an accurate time source linked to Coordinated Universal Time; and
being signed using an advanced electronic signature or sealed with an advanced electronic seal of the qualified trust service provider, or by some equivalent method.
The qualified electronic timestamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data (Reg. no. 910/2014, July 23, 2014, Art. 41.2).
Thus, the difference between these two timestamps essentially lies in:
the participation of an accredited certifying third party in the qualified timestamp method; and
the effect of the qualified timestamp, which, in terms of the burden of proof, establishes a simple presumption of the accuracy of the date and time and integrity of the data; this presumption may be reversed.
For the time and in the absence of qualified trust service provider intervention in public blockchains, the blockchain timestamp recognized as evidence in Italian positive law only appears to be able to serve as simple electronic timestamp. This evidence will produce simple effects and will be allowed by the judge under the aforementioned principle of nondiscrimination.
Regarding private blockchains, the manager may contractually provide the obligation to involve a trusted third party to benefit from the greater probative value of “qualified blockchain electronic timestamp” under the date and time presumption of accuracy, and integrity of the data (see the possibility under French law of establishing a convention of proof: C. civ., art. 1368).
Let us lastly specify that this provision does not expressly mention the "blockchainsignature", central method allowing a user to perform a transaction via the blockchain. Indirectly, it thus precludes the possible analogy to the electronic signature set out by the eIDAS Regulation.
A deficient text to be clarified
Whether through implementing decrees or the courts, a certain number of technical and legal elements will need to be clarified (legal practice may reveal the field of possibilities regarding blockchain evidence: Canas S., Blockchain et preuve : le point de vue du magistrat, Dalloz IP/IT, Feb. 2019, p. 82).
Additional technical precisions.- The Italian law refers to “document storage" using the blockchain technology. Technically, on a public blockchain, the space in a transaction to anchor data is limited (80 bytes). Indeed, the initial purpose of the latter is not to serve as a base for storing data. It is the “hash” of a datum that is stored. In practice, the "hash of hash" is anchored in a transaction to make it possible to group together all of the documents and reduce the cost of anchoring a single transaction. It is thus a matter of elucidating the meaning that the lawmakers wished to give the term "storage” of the document.
Lastly, this law does not indicate the expected security level of the "technologies based on distributed registers", in particular regarding the algorithms used and the nature of the targeted blockchains. The SHA 256 hash algorithm currently used in the majority of protocols could be broken and become less reliable (collision risks). Furthermore, vulnerable to cyber attacks, the many interface platforms that propose solutions for anchoring documents may also raise questions.
The necessary legal precisions.- The hash of the document, which is not mentioned but to which reference is made by the "document storage", must be given a legal qualification (perfect or imperfect writing). This will in particular involve whether it is necessary to keep the original document.
In France, the copy regime set out in Article 1379 of the Civil Code allows the parties to choose not to keep the original, but only the copy. With the blockchain hash, the issue lies in the fact that the original should be supplied to verify the hash when a dispute arises. This therefore assumes keeping the original document outside the blockchain.
This article does not explain the cases in which the blockchain timestamping does not involve a certifying third party. These precise cases are pursued by the users of public protocols who anchor data, not wishing for intermediation by a trusted third party.
Additionally, the value that will be given to the date of the blockchain timestamp is not indicated. For example, in French law, in some cases targeted by Article 1377 of the Civil Code, a "definite date“ is given to situations or deeds (date on which it is recorded, date of death of the signatory, date where its substance is recorded in an authentic deed. This date for blockchain timestamping could be the date of the existence of the document a given moment (see what was proposed for amendment no. 1317 to the draft of the PACTE Act relative to the growth and transformation of enterprises, see TA AN no. 1088, 2018-2019, amendment no. 1317 and Loi PACTE et preuve blockchain : premier petit pas vers une reconnaissance par le Parlement ?, Actualités du droit, Sept. 13, 2018; see also another amendment filed by Jean-Michel Mis, this time in the context of the bill on planning for the justice system: TA AN no. 1349, 2018-2019, amendment no. CL380; this amendment proposed to modify Article 1358 of the Code civil in this sense: “To that end, any digital file recorded on a public or private shared electronic recording device is considered proof of its existence and its date, until proven otherwise, as long as it meets the conditions defined by decree"). It is a matter of recognizing the existence of the content at a given moment and not the proof of the content itself, which cannot be verified. Several dates may, however, be adopted: that of the time and date of the anchoring of the transaction document (with an offset time for its validation in the bitcoin blockchain) or that of the timestamping of the block. That of the timestamping of the block and thus of the validation of the transaction would clearly be of more interest.
Expected revisions of the eIDAS Regulation
According to the teleological interpretation of the eIDAS Regulation, the latter was written according to a philosophy of technological neutrality, guaranteeing the pluralism of the solutions and the upgradability of the techniques ("It is foreseeable that innovation may lead to new technologies that may ensure an equivalent level of security for time stamps"; to that end, see: point 62 of the eIDAS Regulation: “In order to ensure the security of qualified electronic time stamps, this Regulation should require the use of an advanced electronic seal or an advanced electronic signature or of other equivalent methods. It is foreseeable that innovation may lead to new technologies that may ensure an equivalent level of security for time stamps. Whenever a method other than an advanced electronic seal or an advanced electronic signature is used, it should be up to the qualified trust service provider to demonstrate, in the conformity assessment report, that such a method ensures an equivalent level of security and complies with the obligations set out in this Regulation.”)
It is in this context that the eIDAS Regulation should be adapted to blockchain timestamping to account fully for its reliability, avoid the involvement of a certifying third party or experts needing to extend the procedure and involving significant costs (G’Sell F., France stratégie, Les enjeux des blockchains, June 21, 2018, p. 108). An approximate period of one and a half years could be considered to reflect these revisions and adopt them (see Article 294 of the TFUE relative to the ordinary legislative procedure by the European Parliament and the Council, which lays out, from end to end, a maximum theoretical period of 14 months).
To account for specificities of timestamping as well as the blockchain signature, it will probably eventually be necessary to specify—while at least keeping some neutrality—the technical conditions according to which these methods are recognized, while considering technical standards of the AFNOR type (TC 307; https://normalisation.afnor.org/actualites/bientot-normes-iso-blockchain/, viewed on Feb. 18, 2019).
Furthermore, it would be timely to incorporate the cases that would grant a significant probative force greater than the first degree of signature and simple electronic timestamping. For example, this could be the use of the bitcoin and ethereum public protocols, which, without possible modifications, guarantee the integrity of the date and time of the data recorded in the blockchain.
A foreign law at the forefront of French law
In parallel with Italy, some states in the United States have moved forward on these legal issues relative to blockchain evidence. In Tennessee, documents protected by blockchain are considered electronic documents and the cryptographic signature produced and stored by the blockchain in electronic form is considered an electronic signature (Tennessee, Bill no. 1662, March 22, 2018, which modifies the "Tennessee Uniform Electronic Transactions Act"). In Nevada, the "Nevada Uniform Electronic Transactions Act" was modified by the "Nevada Blockchain Statutes", enacted on June 5, which consider recordings in the blockchain to be electronic documents. The State of Vermont indicates that blockchain documents can be auto-authenticated under Vermont law 902 on evidence (L. 12 V.S.A. §, Article 1913 enacted on June 2, 2016).
In any case, general law in France suffices to make analogies with the existing legal categories, and there would not be any real difficulties for the judge to be inclined to accept this blockchain evidence when the requested evidence is free (see cases where the evidence is provided by all means (proof of a fact, deeds relative to a sum less than or equal to 1500 euros, evidence in criminal matters, evidence in commercial matters). Outside these cases, however, uncertainties—understood by the lawmaker—remain. The La Raudière/Mis report in fact raises that "in the current state of the law, no text determines the legal scope of the elements recorded on a technical protocol. Since it is not among the grounds of evidence currently legally recognized, the judge is responsible for determining their probative value, in light of the circumstances in the matter at hand” (Assemblée nationale, Mission d'information sur les chaînes de blocs (blockchain), rapp., Dec. 14, 2018, p. 91). The lawmaker therefore works with general recognition of the data recorded in the blockchain (see in particular amendment no. 1317 to the “PACTE” bill, which laid out adding a 2nd paragraph to Article 1358 of the Civil Code on the freedom of evidence regarding legal facts: TA AN no. 1088, 2017-2018, amendments no. 1317, no. 773, no. 1309, no. 434; the idea was put forth that all data recorded in the public or private blockchain should be considered proof of its existence and its date until proven otherwise) and calls for elucidation to strengthen the probative value of the blockchains (Assemblée nationale, Mission d'information sur les chaînes de blocs (blockchain), rapp., Dec. 14, 2018, p. 90).
For the ministry of justice, the blockchain evidence should be secured by establishing a form of "certification" of the protocols (Assemblée nationale, Mission d'information sur les chaînes de blocs (blockchain), rapp., Dec. 14, 2018, p. 92). This would make it possible to guarantee the intangibility of the data recorded in the blockchain. Likewise, it would be possible to consider establishing an optional labeling system for the blockchains by the ANSSI, the same way as that of the CNIL, regarding the compliance of the products and procedures with respect to the handling of personal information.
The possible convergence of libertarian thinking and the law must therefore be carefully considered by French and foreign lawmakers. In the field of blockchain evidence, “Code with law is security”, like these first texts guaranteeing, with security, the effects of the processes derived from the blockchain as evidence.
En poursuivant votre navigation sur ce site, vous acceptez l'utilisation de cookies pour vous proposer des contenus et services adaptés.
En savoir plus
-
Refuser
Accepterx
