FAQ: How to Terminate CAcert Membership

How Termination of an Account affects the WoT

By creating an account on the main website www.cacert.org you have to agree to the CAcert Community Agreement (CCA).
This CCA includes the definitions of Risks/Liabilities/Obligations and the binding to the CAcert's internal Arbitration forum.
By leaving CAcert, this CAcert Community Agreement has to be terminated.
Termination of the CCA can only be ruled by Arbitration.
On start working with your account using the CAcert services by issueing certificates or getting assurances, becoming an Assurer, assure others. you start building up a framework of reliance, where the Community relys on. This is the so called Web Of Trust (WoT).
On your termination request, all these reliances have to be revoked, cancelled or fade out.
Dependent on your activities you have build up more or less reliances where other Community members may RELY.
So your termination request becomes disputing as long reliances persists.
Therefor, the termination process has to go thru Arbitration.

Dependencies between Termination and Reliances

Action	Reliance x1)	How to terminate
Create an Account	Low	File Dispute
Issueing Certificates	High	Revoke Certificates
Receiving Assurances	Low	user record still remains
Becoming Assurer	Low	Revoke CATS test results
Assure others	High	fade out, transfer collected CAP forms to CAcert

x1) Reliance ... by other Community Members
So there is a difference between creating an account and doing nothing, or creating an account and start using the full services upto becoming Assurer and assure others
The main two topics an Arbitrator has to review
1. User has created certificates, this includes Client Certificates, Server Certificates, signing GPG/PGP keys
2. User has become Assurer and started Assure others
There are also other topics an Arbitrator reviews, like
- exists running/open dispute filings by the user as Claimant or Respondent in other Arbitration cases ?
- has the user moved or has started moving into a role with other relations and reliances
  1. Is Organisation Admin ?
  2. Is Organisation Assurer ?
  3. Is TTP-Admin ?
  4. Is Infrastructure Admin ? and probably more ...
- Has the user requested for Code-Signing ?

How to Terminate ?

You have to start your Termination Request by filing a dispute to SUPPORT <support AT cacert SPAMFREE DOT org>
Write an email to Support with the subject 'Dispute filing: Account Removal'
If you write the email from another account than the primary email address in your account, add your primary email address into the text body
After sending the mail, a Case Manager and Arbitrator will pickup your case and will contact you with the initial notification, that the Arbitration process starts.
So here you have to confirm your request.
If you don't confirm your termination request, the process continues automaticly after about 14 days with the discovery process by the Arbitrator
- proposal HaVe: If you don't confirm your termination request, the request is cancelled.
- (u60) cancel request runs into the problem, that leaving user do no longer takes care about the accounts, so process has to continue - at least account to lock, certs to revoke (see reliance)
It needs a few days, to collect all the informations, so an Arbitrator can finish the process by writing his ruling.
The Arbitrators ruling covers all the reliances, that were made in the users activity using his account

Is there no other way possible ?

Collecting the informations of reliances is a process, that can only ordered by an Arbitrator, dependent on the Security Policy and Security Manual, especialy if High level reliances were made.

All Terminate my Account requests have to go thru Arbitration.

How the Reliance impact can be solved ?

As seen before on the other topics, a user can build up reliances in his time using an account. Each of the reliances must be solved before Termination can succeed. For each reliance topic there are different solutions.
Certificates issued
- The easiest way is to revoke all certificates. A grace period of 3 months has to be passed, before Termination can succeed.
- Revocation of certificates can be easily handled by the user itself, by going onto his account, select the appropiate menu selections and click revoke this certificate
- In Arbitration process, an Arbitrator has to order a Support-Engineer to revoke all certificates.
Assurances received
- The reliance build to other members is low, but there are relations, that may affect the WoT.
  - The Assurer assured the user, and therefor buildup experience in Assurance process. This is reflected by adding experience points onto the Assurers account. So the Assurance received has a relation onto the experience points the Assurer received. Removing the users account, leaves an orphan record in the Assurers assurances given list. So therefor, the user record cannot be deleted completely.
  - To take into account, that the user has a valid interest to get his membership terminated and all user identifiable informations gets removed or anonymized, the practicle way in handling this situation is, that at first step, the user accounts data has to be anonymized completely - Names, DoB, locations, settings, Email address(es), Domains added and so forth, to be removed or completely anonymized. The email address and Name fields to be replaced with the Arbitration case number. These are the steps, that are defined in the "Delete Account" procedure for SE's, ordered by an Arbitrator.
  - At the end of the process, the account record remains in the system, but all user identifiable data has been removed / replaced / anonymized, so there is no user identifiable data left in the system.
Becoming an Assurer
- Becoming an Assurer means only, the user has received at least 100 Assurance points and passed the CATS test.
- This has no impact onto the WoT, but allows the user to start giving Assurances or request for the Code-Signing flag (-> potential code-signing started? This is handled thru revoking all certs.)
To be Assurer, Assurances given
- This topic has a high impact onto the WoT, as within each Assurance given, the Assurer makes an Assurance Statement to the Community "This user's identity I have verified and my reliance into the users identity is reflected by my given assurance points"
- This assurance statement is documented by a CAP form.
- If there is a problem regarding assurees identity or with his certs, a dispute has to be filed and an Arbitrator may request informations from the Assurers about the users identity. Often this is requested by Arbitrators with a CAP form scan.
- Terminating and leaving means, that no Arbitrator in the future arbitration can request informations from the Assurer, as he has left the Community.
- Therefor, as a practicle solution, the Arbitrator in the "Delete my Account" request initiated by an Assurer, sends a request to the user, to send-in all his CAP forms, to put all the CAP forms into an envelope and seal them.
- So in a future arbitration case, another Arbitrator can contact the Arbitrator who handled the "Delete my Account" case, and can request the informations that are available by the CAP form.
- Each Assurers obligation is to keep the CAP forms for 7 years, and destroy them after that period.
- So as a practicle solution, the CAP forms moves from the Assurers possession into the Arbitrators possession, who handles the "Delete my Account" arbitration case.
- WoT is saved.
- The Assurers account record handling is similiar to the Assurances received handling, by anonymize all user identifiable data in the users record, and leave the record, but without any user identifiable data in the system, except the Assurances given records. These records may impact another users Assurance points level (50 Assurance points = you can issue certificates with your name in it, 100 Assurance points = requesting code-signing, pass the CATS test, becoming an Assurer). By removing these records, this may impact several other users, loosing Assurance points, fall under a certain level. To prevent this from happening, the Assurance record has to be kept. After handling thru the "Delete my Account" procedure for SE's, other users sees the arbitration case number as the Assurers name. Problem solved.

Food for Thought

Think off your decision to leave ?

rethinking "keep your account open"
- not using the services today does not mean you cannot use the services in a year or two

What does Remove Me mean ?

the sample of "remove me" in the mailing list
- "remove me" is misleading if posted in mailing list
- "remove me" in mailing list means "unsubscribe" but this is not to terminate the CCA
- "remove me" but can also mean, "please remove my account"
so, please to be precise of what you want to have to be removed ...

CategoryCustom