'Safe' Web seal requires rigorous checks

Beginning next month, version 7 of Microsoft Corp.'s Internet Explorer browser will start flagging certain e-commerce and banking sites as green for "safe." The browser will look for an extended-validation certificate issued by any number of vendors.

To qualify, vendors such as VeriSign Inc. and Comodo will be required to make extensive checks before approving such certificates. They also will have to undergo independent auditing through WebTrust, a service run by trade groups for certified public accountants.

Under the latest, 65-page draft guidelines, verification requirements include:

_ Legal existence and identity. The certificate vendor must make sure that the business is legally recognized and that the formal name matches government records, through databases and other means. The vendor also must verify any alternative operating names that differ from the legal name.

_ Physical existence. The vendor must check government records to make sure addresses in those records and in the certificate application match. When there is no match, a site visit is required, documenting such things as whether a permanent sign is present and whether the office is more than a mailbox. Photos are required showing the site's exterior and the interior reception area or workspace.

_ Telephone number. The vendor must verify that the phone number provided is the primary one for the business, using such techniques as calling it directly and checking phone directory listings. In some cases, the vendor must make sure the main phone number is not a mobile phone.

_ Domain name. To ensure the business owns and controls the domain name, the vendor must use techniques such as checking registration records, known as the Whois database, and asking the company to make an agreed-upon change to the Web site under that domain name.

_ Individual's authorization. The vendor must verify that the individual requesting the certificate works for the company _ for instance, by contacting its human resources department. The vendor must also verify the individual's authority to make the request, generally by obtaining written documentation.

For some verifications, exemptions are permitted with a letter from a lawyer, notary or accountant. The guidelines include procedures for verifying authenticity.

Businesses in existence for less than three years may be required to also produce evidence they have a valid bank account. Additional checks are required for banks and other companies deemed to be high-risk targets for scams.

Because many of the steps rely upon government filings, general partnerships, unincorporated associations, sole proprietorships and individuals are currently barred from getting these certificates.

For that reason, a consortium of certificate vendors and browser makers rejected the draft in November, although Microsoft and some vendors believe the standards are good enough to proceed anyhow.