-----BEGIN PGP SIGNED MESSAGE----- Dear cypherpunks: Professor Froomkin posted the following interesting questions to cyberia-L, and gave me permission to repost them here. Please direct any private replies to him <froomkin@law.miami.edu>. My apologies to those of you who hang out in both dens for having to see the same message twice. JMR [Forwarded message follows] I've been trying to work something out. (I've written these questions in the form of an exam because it's that time of year. In fact, I'm struggling with these in a paper I'm working on.) Carol runs a certificate authority (CA). She sells a certificate to Alice binding Alice's public key to her name and email address. In version (A) of the contract Carol posts the certificate on her web site. In version (B) of the contract Alice gets a floppy disk with the certificate. The certificate is in error (due to Alice's fraudulent or negligent misrepresentation to Carol). Bob relies on it to his detriment in a transaction with Alice. Assume Bob can show but for causation of his loss. Bob now wishes to sue Carol for negligent misrepresentation. He has, I think, three possible theories. 1) UCC. This turns on whether a certificate is a "good" or a "service". {Assume the answer is "service" for the rest of this hypo} 2) Contract. Bob has to show that he's an intended beneficiary under the restatement 2d test. This seems to be almost a theological question. Is the purpose of the certificate to give Alice a tool to induce Bob to transact, or to give Bob a benefit without which he will not transact? 3 )Tort of negligent misrepresentation. To make this especially exciting, let's assume all the action is in NY where the shadow of Cardozo still looms. NY retains a strong privity rule: You can only recover for a negligent misrepresentation if you are in privity of contract with the speaker. Question 1: If Bob is an intended beneficiary, is he in privity with Carol? (I think the answer is "yes"). Question 2: Are Bob's rights, or his status as an intended beneficiary, affected by whether the contract is form A or form B above? The classic cases, like Ultramares have the accountant's report spread around by the client. Suppose the accountant in Ultramares instead publishes the report on the Web -- what result? OK, now we change the facts. We're not in NY anymore, we are in a state that follows the restatement 2d rule in sec. 552. Question 3: Is Bob within the class of forseeable users entitled to recover for the tort of negligent misrepresentation as these terms are used in the restatement? Question 4: Is the certificate a good or a service? (I say it's a service, mostly, unless it makes no representations at all about its quality.) Extra credit: Look up http://www.verisign.com/netscape/legal.html and find the disclaimers in THE BIG TYPE. Do you know of any court that would enforce these? On a "good"? On a "service" provider? A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin@law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here. [End forwarded message] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMM+jfW1lp8bpvW01AQFe7QP/dlWbaICoo7lgtTZVsZvd4dvKx3LawfU9 FH8e78Tpo5ICgfKwBNNj6MlBgG7sxAu2LTqMHTTHkcuHksdNTZImJlnNs64phnK0 zBF7IqcT1BOBijWiFWdni+i62NGzppj0BKnyebmFivUbwmi4QGN3gLMxkvD94eWI TU7/+tFB/iI= =8JOv -----END PGP SIGNATURE-----