From 87ee92e63407614b72bf5450bfe3604ddf695a6b Mon Sep 17 00:00:00 2001 From: Wytze van der Raay Date: Fri, 29 Aug 2014 14:39:28 +0000 Subject: [PATCH] Fix for https://bugs.cacert.org/view.php?id=1293 "Replace CCA document with new DRAFT version" --- www/policy/CAcertCommunityAgreement.php | 1087 ++++++++++++----------- 1 file changed, 584 insertions(+), 503 deletions(-) diff --git a/www/policy/CAcertCommunityAgreement.php b/www/policy/CAcertCommunityAgreement.php index 3106eb1..17065f1 100644 --- a/www/policy/CAcertCommunityAgreement.php +++ b/www/policy/CAcertCommunityAgreement.php @@ -1,512 +1,593 @@ - - - -CAcert Community Agreement +'?> + + + + + CAcert Community Agreement + + + +
+ + + + + + +
+ Name: CCA COD9
+ Status: POLICY p20080109.1
+               DRAFT p20140709
+ Editor: Benedikt
+ Licence: CC-by-sa+DRP
+ + 		+ CCA Status - POLICY + + +
+ CCA Status - DRAFT + +
+
+ +

CAcert Community Agreement

+ +

0. Introduction

+ +

This agreement is between you, being a registered member ("Member") within + CAcert's community at large ("Community") and CAcert Incorporated ("CAcert"), + being an operator of services to the Community.

+ +

0.1 Terms

+ +
    +
  1. "CAcert" means CAcert Inc., a non-profit Association of Members + incorporated in New South Wales, Australia. Note that Association Members + are distinct from the Members defined here.
    2. + +
  2. "Member" means you, a registered participant within CAcert's Community, + with an account on the website and the facility to request certificates. + Members may be individuals ("natural persons") or organisations ("legal + persons").
    3. + +
  3. "Organisation" is defined under the Organisation Assurance programme, + and generally includes corporations and other entities that become Members + and become Assured.
    4. + +
  4. "Community" means all of the Members that are registered by this + agreement and other parties by other agreements, all being under CAcert's + Arbitration.
    5. + +
  5. "Non-Related Person" ("NRP"), being someone who is not a Member, is not + part of the Community, and has not registered their agreement. Such people are offered the NRP-DaL another agreement allowing + the USE of certificates.
    6. + +
  6. "Non-Related Persons - Disclaimer and Licence" + ("NRP-DaL"), another agreement that is offered to persons outside the + Community.(withdrawn)
    7. + +
  7. "Arbitration" is the Community's forum for resolving disputes, or + jurisdiction.
    8. + +
  8. "Dispute Resolution Policy" ("DRP" => COD7) is the policy and rules + for resolving disputes.
    9. + +
  9. "USE" means the act by your software to conduct its tasks, + incorporating the certificates according to software procedures.
    10. + +
  10. "RELY" means your human act in taking on a risk and liability on the + basis of the claim(s) bound within a certificate.
    11. + +
  11. "OFFER" means the your act of making available your certificate to + another person. Generally, you install and configure your software to act + as your agent and facilite this and other tasks. OFFER does not imply + suggestion of reliance.
    12. + +
  12. "Issue" means creation of a certificate by CAcert. To create a + certificate, CAcert affixes a digital signature from the root onto a public + key and other information. This act would generally bind a statement or + claim, such as your name, to your key.
    13. + +
  13. "Root" means CAcert's top level key, used for signing certificates for + Members. In this document, the term includes any subroots.
    14. + +
  14. "CAcert Official Document" ("COD" => + COD3) in a standard format for describing the + details of operation and governance essential to a certificate authority. + Changes are managed and controlled. CODs define more technical terms. See + 4.2 for listing of relevant CODs. is an + official managed and controlled document (e. g. a Policy) of + CAcert.
    15. + +
  15. "Certification Practice Statement" ("CPS" => COD6) is the document + that controls details about operational matters within CAcert.
    16. +
+ +

1. Agreement and Licence

+ +

1.1 Agreement

+ +

You and CAcert both agree to the terms and + conditions in this agreement. Your agreement is given by but not limited to any of

+ + + +

Your agreement is effective from the date of the first event above that + makes this agreement known to you. This Agreement replaces and supercedes prior agreements, including the NRP-DaL. + supersedes any prior agreements.

+ +

1.2 Licence

+ +

As part of the Community, CAcert offers you these rights:

+ +
    +
  1. You may USE any certificates issued by CAcert.
    2. + +
  2. You may RELY on any certificate issued by CAcert, as explained and + limited by CPS (COD6).
    3. + +
  3. You may OFFER certificates issued to you by CAcert to Members for their + RELIANCE.
    4. + +
  4. You may OFFER certificates issued to you by CAcert to NRPs for their + USE, within the general principles of the Community.
    5. + +
  5. This Licence is free of cost, non-exclusive, and + non-transferrable.
    6. +
+ +

1.3 Your Contributions

+ +

You agree to a non-exclusive non-restrictive non-revokable transfer of + Licence to CAcert for your contributions. That is, if you post an idea or + comment on a CAcert forum, or email it to other Members, your work can be + used freely by the Community for CAcert purposes, including placing under + CAcert's licences for wider publication.

+ +

You retain authorship rights, and the rights to also transfer + non-exclusive rights to other parties. That is, you can still use your ideas + and contributions outside the Community.

+ +

Note that the following exceptions override this clause:

+ +
    +
  1. Contributions to controlled documents are subject to Policy on Policy + ("PoP" => COD1)
    2. + +
  2. Source code is subject to an open source licence regime.
    3. + +
  3. Personal data
    4. + +
  4. Postings under competing licenses if clearly + stated when posted
    5. +
+ +

1.4 Privacy

+ +

You give rights to CAcert to store, verify and + process and publish your data in accordance with policies in force. These + rights include shipping the data to foreign countries for system + administration, support and processing purposes. Such shipping will only be + done among CAcert Community administrators and Assurers.

+ +

Privacy is further covered in the Privacy Policy ("PP" => COD5).

+ +

2. Your Risks, Liabilities and Obligations

+ +

As a Member, you have risks, liabilities and obligations within this agreement.

+ +

2.1 Risks

+ +
    +
  1. A certificate may prove unreliable.
    2. + +
  2. Your account, keys or other security tools may be + lost or otherwise compromised.
    3. + +
  3. You may find yourself subject to Arbitration (DRP + => COD7).
    4. +
+ +

2.2 Liabilities

+ +
    +
  1. You are liable for any penalties as awarded + against you by the Arbitrator.
    2. + +
  2. Remedies are as defined in the DRP (COD7). An + Arbitrator's ruling may include monetary amounts, awarded against + you.
    3. + +
  3. Your liability is limited to a total maximum of + 1000 Euros.
    4. + +
  4. "Foreign Courts" may assert jurisdiction. These + include your local courts, and are outside our Arbitration. Foreign Courts + will generally refer to the Arbitration Act of their country, which will + generally refer civil cases to Arbitration. The Arbitration Act will not + apply to criminal cases.
    5. +
+ +

2.3 Obligations

+ +

You are obliged

+ +
    +
  1. to provide accurate information as part of + Assurance. You give permission for verification of the information using + CAcert-approved methods.
    2. + +
  2. to make no false representations.
    3. + +
  3. to submit all your disputes to Arbitration (DRP + => COD7).
    4. + +
  4. to assist the Arbitrator by truthfully providing + information, or with any other reasonable request.
    5. + +
  5. to not share your CAcert account.
    6. +
+ +

2.4 Principles

+ +

As a Member of CAcert, you are a member of the Community. You are further + obliged to work within the spirit of the Principles of the Community. These + are described in Principles of the + Community.

+ +

2.5 Security

+ +

CAcert exists to help you to secure yourself. You are primarily + responsible for your own security. Your security obligations include

+ +
    +
  1. to secure yourself and your computing platform (e. g. PC),
    2. + +
  2. to keep your email account in good working order,
    3. + +
  3. to secure your CAcert account (e. g., credentials such as username, + password),
    4. + +
  4. to secure your private keys, ensuring that they + are only used as indicated by the certificate, or by wider agreement with + others,
    5. + +
  5. to review certificates for accuracy, and
    6. + +
  6. when in doubt, notify CAcert,
    7. + +
  7. when in doubt, take other reasonable actions, such as revoking + certificates, changing account credentials, and/or generating new + keys.
    8. +
+ +

Where, above, 'secure' means to protect to a reasonable degree, in + proportion with your risks and the risks of others.

+ +

3. Law and Jurisdiction

+ +

3.1 Governing Law

+ +

This agreement is governed under the law of New South Wales, Australia, + being the home of the CAcert Inc. Association.

+ +

3.2 Arbitration as Forum of Dispute Resolution

+ +

You agree, with CAcert and all of the Community, that all disputes arising + out of or in connection to our use of CAcert services shall be referred to + and finally resolved by Arbitration under the rules within the Dispute + Resolution Policy of CAcert (DRP => COD7). The rules select a single + Arbitrator chosen by CAcert from among senior Members in the Community. The + ruling of the Arbitrator is binding and final on Members and CAcert + alike.

+ +

In general, the jurisdiction for resolution of disputes is within CAcert's + own forum of Arbitration, as defined and controlled by its own rules (DRP + => COD7).

+ +

We use Arbitration for many purposes beyond the strict nature of disputes, + such as governance and oversight. A systems administrator may need + authorisation to conduct a non-routine action, and Arbitration may provide + that authorisation. Thus, you may find yourself party to Arbitration that is + simply support actions, and you may file disputes in order to initiate + support actions.

+ +

3.3 Termination

+ +

You may terminate this agreement by resigning from + CAcert. You may do this at any time by writing to CAcert's online support + forum and filing dispute to resign. All services will be terminated, and your + certificates will be revoked. However, some information will continue to be + held for certificate processing purposes.

+ +

The provisions on Arbitration survive any + termination by you by leaving CAcert. That is, even if you resign from + CAcert, you are still bound by the DRP (COD7), and the Arbitrator may + reinstate any provision of this agreement or bind you to a ruling.

+ +

Only the Arbitrator may terminate this agreement + with you.

+ +

The CAcert Community Agreement is + terminated

+ +
    +
  1. based on a Policy Group decision following (PoP + => COD1). This terminates the Agreement with every member.
    2. + +
  2. with a ruling of the Arbitrator or the + completion of a termination process defined by an Arbitrator ruling (DRP + => COD7).
    3. + +
  3. by the end of existence of a member (i.e. death + in the case of individuals).
    4. +
+ +

A member may declare the wish to resign from CAcert + at any time by writing to support AT cacert.org. This triggers a + process for termination of this agreement with the member.

+ +

3.3a Consequences of + Termination

+ +

The termination discontinues the right to USE, + OFFER and CREATE personal certificates in any account of the former member. + Those certificates will be revoked and all services to the former member will + be terminated as soon as possible. However, some information will continue to + be held for certificate processing purposes.

+ +

The provisions on Arbitration for the time of + membership survive any termination. Former members are still bound by the DRP + (COD7), and the Arbitrator may reinstate any provision of this agreement or + bind them to a ruling.

+ +

As far as Organisations are concerned details are + also defined in the Organisation Assurance Policy (OAP => + COD11).

+ +

Every member learning about the death of a member + or termination of existence of a member should notify support AT + cacert.org.

+ +

3.4 Changes of Agreement

+ +

CAcert may from time to time vary the terms of this Agreement. Changes + will be done according to the documented CAcert policy for changing policies, + and is subject to scrutiny and feedback by the Community. Changes will be + notified to you by email to your primary address.

+ +

If you do not agree to the changes, you may terminate as above. Continued + use of the service shall be deemed to be agreement by you.

+ +

3.5 Communication

+ +

You are responsible for keeping your primary email + account in good working order and able to receive emails from + CAcert.

+ +

Notifications to CAcert are to be sent by email to the address support + AT cacert.org. You should attach a digital signature, but need not do so in the event of security or similar + urgency.

+ +

Notifications to you are sent by CAcert to the + primary email address registered with your account. You are responsible for + keeping your email account in good working order and able to receive emails + from CAcert.

+ +

Arbitration is generally conducted by + email.

+ +

4. Miscellaneous

+ +

4.1 Other Parties Within the + Community (withdrawn)

+ +

As well as you and other Members in the Community, CAcert + forms agreements with third party vendors and others. Thus, such parties will + also be in the Community. Such agreements are also controlled by the same + policy process as this agreement, and they should mirror and reinforce these + terms.

+ +

4.2 References and Other Binding Documents

+ +

This agreement is CAcert Official Document 9 (COD9) and + is a controlled document.

+ +

You are also bound by the Policies of the Community + under the control of Policy on Policy ("PoP" => COD1) and listed in + Controlled + Document List.

+ +
    +
  1. Certification + Practice Statement (CPS => COD6).
    2. + +
  2. Dispute + Resolution Policy (DRP => COD7).
    3. + +
  3. Privacy Policy + (PP => COD5).
    4. + +
  4. Principles of the + Community.
    5. +
+ +

Where documents are referred to as => COD x, + they are controlled documents under the control of Policy on Policies + (COD1).

+ +

This agreement and controlled documents above are + primary, and may not be replaced or waived except by formal policy channels + and by Arbitration.

+ +

Controlled documents are primary, and may not be replaced + or waived except by formal policy channels and Arbitration.

+ +

This agreement is controlled document COD9.

+ +

4.3 Informative References

+

The governing documents are in English. Documents may be translated for + convenience. Because we cannot control the legal effect of translations, the + English documents are the ruling ones.

+

You are encouraged to be familiar with the Assurer + Handbook, which provides a more readable introduction for much of the + information needed. The Handbook is not however an agreement, and is + overruled by this agreement and others listed above.

-

0. Introduction

- -

-This agreement is between -you, being a registered member ("Member") -within CAcert's community at large ("Community") -and CAcert Incorporated ("CAcert"), -being an operator of services to the Community. -

- -

0.1 Terms

-
  1. - "CAcert" - means CAcert Inc., - a non-profit Association of Members incorporated in - New South Wales, Australia. - Note that Association Members are distinct from - the Members defined here. -
  2. - "Member" - means you, a registered participant within CAcert's Community, - with an account on the website and the - facility to request certificates. - Members may be individuals ("natural persons") - or organisations ("legal persons"). -
  3. - "Organisation" - is defined under the Organisation Assurance programme, - and generally includes corporations and other entities - that become Members and become Assured. -
  4. - "Community" - means all of the Members - that are registered by this agreement - and other parties by other agreements, - all being under CAcert's Arbitration. -
  5. - "Non-Related Person" ("NRP"), - being someone who is not a - Member, is not part of the Community, - and has not registered their agreement. - Such people are offered the NRP-DaL - another agreement allowing the USE of certificates. -
  6. - "Non-Related Persons - Disclaimer and Licence" ("NRP-DaL"), - another agreement that is offered to persons outside the - Community. -
  7. - "Arbitration" - is the Community's forum for - resolving disputes, or jurisdiction. -
  8. - "Dispute Resolution Policy" ("DRP" => COD7) - is the policy and - rules for resolving disputes. -
  9. - "USE" - means the act by your software - to conduct its tasks, incorporating - the certificates according to software procedures. -
  10. - "RELY" - means your human act in taking on a - risk and liability on the basis of the claim(s) - bound within a certificate. -
  11. - "OFFER" - means the your act - of making available your certificate to another person. - Generally, you install and configure your software - to act as your agent and facilite this and other tasks. - OFFER does not imply suggestion of reliance. -
  12. - "Issue" - means creation of a certificate by CAcert. - To create a certificate, - CAcert affixes a digital signature from the root - onto a public key and other information. - This act would generally bind a statement or claim, - such as your name, to your key. -
  13. - "Root" - means CAcert's top level key, - used for signing certificates for Members. - In this document, the term includes any subroots. -
  14. - "CAcert Official Document" ("COD" => COD3) - in a standard format for describing the details of - operation and governance essential to a certificate authority. - Changes are managed and controlled. - CODs define more technical terms. - See 4.2 for listing of relevant CODs. -
  15. - "Certification Practice Statement" ("CPS" => COD6) - is the document that controls details - about operational matters within CAcert. -
- - -

1. Agreement and Licence

- -

1.1 Agreement

- -

-You and CAcert both agree to the terms and conditions -in this agreement. -Your agreement is given by any of -

- - - -

-Your agreement -is effective from the date of the first event above -that makes this agreement known to you. -This Agreement -replaces and supercedes prior agreements, -including the NRP-DaL. -

- - -

1.2 Licence

- -

-As part of the Community, CAcert offers you these rights: -

- -
  1. - You may USE any certificates issued by CAcert. -
  2. - You may RELY on any certificate issued by CAcert, - as explained and limited by CPS (COD6). -
  3. - You may OFFER certificates issued to you by CAcert - to Members for their RELIANCE. -
  4. - You may OFFER certificates issued to you by CAcert - to NRPs for their USE, within the general principles - of the Community. -
  5. - This Licence is free of cost, - non-exclusive, and non-transferrable. -
- -

1.3 Your Contributions

- - -

-You agree to a non-exclusive non-restrictive non-revokable -transfer of Licence to CAcert for your contributions. -That is, if you post an idea or comment on a CAcert forum, -or email it to other Members, -your work can be used freely by the Community for -CAcert purposes, including placing under CAcert's licences -for wider publication. -

- -

-You retain authorship rights, and the rights to also transfer -non-exclusive rights to other parties. -That is, you can still use your -ideas and contributions outside the Community. -

- -

-Note that the following exceptions override this clause: -

- -
  1. - Contributions to controlled documents are subject to - Policy on Policy ("PoP" => COD1) -
  2. - Source code is subject to an open source licence regime. -
- -

1.4 Privacy

- - -

-You give rights to CAcert to store, verify and process -and publish your data in accordance with policies in force. -These rights include shipping the data to foreign countries -for system administration, support and processing purposes. -Such shipping will only be done among -CAcert Community administrators and Assurers. -

- -

-Privacy is further covered in the Privacy Policy ("PP" => COD5). -

- -

2. Your Risks, Liabilities and Obligations

- -

-As a Member, you have risks, liabilities -and obligations within this agreement. -

- -

2.1 Risks

- -
  1. - A certificate may prove unreliable. -
  2. - Your account, keys or other security tools may be - lost or otherwise compromised. -
  3. - You may find yourself subject to Arbitration - (DRP => COD7). -
- -

2.2 Liabilities

- -
  1. - You are liable for any penalties - as awarded against you by the Arbitrator. -
  2. - Remedies are as defined in the DRP (COD7). - An Arbitrator's ruling may - include monetary amounts, awarded against you. -
  3. - Your liability is limited to - a total maximum of - 1000 Euros. -
  4. - "Foreign Courts" may assert jurisdiction. - These include your local courts, and are outside our Arbitration. - Foreign Courts will generally refer to the Arbitration - Act of their country, which will generally refer - civil cases to Arbitration. - The Arbitration Act will not apply to criminal cases. -
- -

2.3 Obligations

- -

- You are obliged -

- -
  1. - to provide accurate information - as part of Assurance. - You give permission for verification of the information - using CAcert-approved methods. -
  2. - to make no false representations. -
  3. - to submit all your disputes to Arbitration - (DRP => COD7). -
- -

2.4 Principles

- -

-As a Member of CAcert, you are a member of -the Community. - You are further obliged to - work within the spirit of the Principles - of the Community. - These are described in - Principles of the Community. -

- -

2.5 Security

-

-CAcert exists to help you to secure yourself. -You are primarily responsible for your own security. -Your security obligations include -

- -
  1. - to secure yourself and your computing platform (e.g., PC), -
  2. - to keep your email account in good working order, -
  3. - to secure your CAcert account - (e.g., credentials such as username, password), -
  4. - to secure your private keys, -
  5. - to review certificates for accuracy, - and -
  6. - when in doubt, notify CAcert, -
  7. - when in doubt, take other reasonable actions, such as - revoking certificates, - changing account credentials, - and/or generating new keys. -
- -

-Where, above, 'secure' means to protect to a reasonable -degree, in proportion with your risks and the risks of -others. -

- -

3. Law and Jurisdiction

- -

3.1 Governing Law

- -

-This agreement is governed under the law of -New South Wales, Australia, -being the home of the CAcert Inc. Association. -

- -

3.2 Arbitration as Forum of Dispute Resolution

- -

-You agree, with CAcert and all of the Community, -that all disputes arising out -of or in connection to our use of CAcert services -shall be referred to and finally resolved -by Arbitration under the rules within the -Dispute Resolution Policy of CAcert -(DRP => COD7). -The rules select a single Arbitrator chosen by CAcert -from among senior Members in the Community. -The ruling of the Arbitrator is binding and -final on Members and CAcert alike. -

- -

-In general, the jurisdiction for resolution of disputes -is within CAcert's own forum of Arbitration, -as defined and controlled by its own rules (DRP => COD7). -

- -

-We use Arbitration for many purposes beyond the strict -nature of disputes, such as governance and oversight. -A systems administrator may -need authorisation to conduct a non-routine action, -and Arbitration may provide that authorisation. -Thus, you may find yourself party to Arbitration -that is simply support actions, and you may file disputes in -order to initiate support actions. -

- -

3.3 Termination

-

-You may terminate this agreement by resigning -from CAcert. You may do this at any time by -writing to CAcert's online support forum and -filing dispute to resign. -All services will be terminated, and your -certificates will be revoked. -However, some information will continue to -be held for certificate processing purposes. -

- -

-The provisions on Arbitration survive any termination -by you by leaving CAcert. -That is, even if you resign from CAcert, -you are still bound by the DRP (COD7), -and the Arbitrator may reinstate any provision of this -agreement or bind you to a ruling. -

- -

-Only the Arbitrator may terminate this agreement with you. -

- -

3.4 Changes of Agreement

- -

-CAcert may from time to time vary the terms of this Agreement. -Changes will be done according to the documented CAcert policy -for changing policies, and is subject to scrutiny and feedback -by the Community. -Changes will be notified to you by email to your primary address. -

- -

-If you do not agree to the changes, you may terminate as above. -Continued use of the service shall be deemed to be agreement -by you. -

- -

3.5 Communication

- -

-Notifications to CAcert are to be sent by -email to the address -support at CAcert.org. -You should attach a digital signature, -but need not do so in the event of security -or similar urgency. -

- -

-Notifications to you are sent -by CAcert to the primary email address -registered with your account. -You are responsible for keeping your email -account in good working order and able -to receive emails from CAcert. -

- -

-Arbitration is generally conducted by email. -

- -

4. Miscellaneous

- -

4.1 Other Parties Within the Community

- -

-As well as you and other Members in the Community, -CAcert forms agreements with third party -vendors and others. -Thus, such parties will also be in the Community. -Such agreements are also controlled by the same -policy process as this agreement, and they should -mirror and reinforce these terms. -

- - -

4.2 References and Other Binding Documents

- -

-This agreement is CAcert Official Document 9 (COD9) -and is a controlled document. -

- -

-You are also bound by -

- -
  1. - - Certification Practice Statement (CPS => COD6). -
  2. - - Dispute Resolution Policy (DRP => COD7). -
  3. - - Privacy Policy (PP => COD5). -
  4. - - Principles of the Community. -
- -

-Where documents are referred to as => COD x, -they are controlled documents -under the control of Policy on Policies (COD1). -

- -

-This agreement and controlled documents above are primary, -and may not be replaced or waived except -by formal policy channels and by Arbitration. -

- -

4.3 Informative References

- -

-The governing documents are in English. -Documents may be translated for convenience. -Because we cannot control the legal effect of translations, -the English documents are the ruling ones. -

- -

-You are encouraged to be familiar with the -Assurer Handbook, -which provides a more readable introduction for much of -the information needed. -The Handbook is not however an agreement, and is overruled -by this agreement and others listed above. -

- -

4.4 Not Covered in this Agreement

- -

-Intellectual Property. -This Licence does not transfer any intellectual -property rights ("IPR") to you. CAcert asserts and -maintains its IPR over its roots, issued certificates, -brands, logos and other assets. -Note that the certificates issued to you -are CAcert's intellectual property -and you do not have rights other than those stated. -

+

Beside this Agreement and the Policies, there are other + documents, i. e. Policy Guides, Manuals and Handbooks, supporting and + explaining this Agreement and the Policies. These documents are not binding + and in doubt this Agreement and the Policies are valid.

+

4.4 Not Covered in this + Agreement (withdrawn)

+

Intellectual Property. This Licence does not + transfer any intellectual property rights ("IPR") to you. CAcert asserts and + maintains its IPR over its roots, issued certificates, brands, logos and + other assets. Note that the certificates issued to you are CAcert's + intellectual property and you do not have rights other than those stated.