CertCo

~ the obit ~

In 2002, the year this company stopped answering its phone, I was eighteen and had never paid for anything over the internet. Hardly anyone around me had. The problem CertCo existed to solve, how a bank can vouch cryptographically for who you are and for how much money it will stand behind you, was being settled in rooms I did not know existed, for a kind of commerce that had not arrived in Turkey yet. It is a layer of the web almost nobody ever saw.

CertCo announced on 9 December 1996 that it had spun out of Bankers Trust as an independent company, operating from 55 Broad Street in New York with $30 million from Marsh & McLennan's risk capital arm, Addison Fischer and members of the Tisch family, with Bankers Trust keeping a stake. Peter Freund, one of its founders and a former senior managing director of the bank, became chairman. By the company's own account the idea went back to 1994 and to a group of Bankers Trust derivatives traders who thought high-value transactions could be made safe over open networks.

The thing that made CertCo matter arrived in March 1997. Visa and Mastercard had designed a payment protocol called SET, Secure Electronic Transaction, which was going to make card payment online cryptographically rigorous, and somebody had to run the certificate authority at the very top of it. CertCo won that contract with Spyrus. The technique it sold was key splitting: generate the root private key, then break it into fragments held by separate parties, so that no single room and no single person ever holds the whole thing. Freund's pitch was that other certificate authorities depended on physical security, on knowing who walked through the door, and that his did not need to.

~ the rap sheet ~

~ the banks build their own ~

In October 1998 eight of the largest banks in the world announced a joint venture to issue digital certificates to each other's corporate customers. ABN Amro, Bank of America, Bankers Trust, Barclays, Deutsche Bank, Chase Manhattan, Citibank and Hypo Vereinsbank put their names to it, the venture became Identrus, and the trade press quoted CertCo's chief executive as the man supplying the underlying technology. For about a year this looked like the future of online identity: not a software company selling certificates to anyone with a credit card, but the banking system extending the thing it had always sold, which is knowing who somebody is and being willing to say so in writing.

It did not convert into a business. By 2002 CertCo's own homepage described its software as a certified Identrus-compliant responder rather than the platform underneath, which is a long way down from supplying the consortium. The investor list by then ran through Deutsche Bank, Bank One, Four Partners and Cazenove, and the executive suite had turned over twice, with Virginia Gambale taking the chair in February 2000 and June Felix arriving as chief executive a fortnight later.

~ the last lawsuit ~

On 4 February 2002, CertCo sued PayPal in Delaware for infringing US patent 6,029,150, a payment-system patent applied for in October 1996 and granted in February 2000, whose named inventor was David Kravitz. PayPal was less than two weeks from its initial public offering. The suit was taken seriously enough to push the offering back, and PayPal's answer asked the court to find the case exceptional on the grounds that the patent had been sitting there for two years while PayPal operated in plain sight, and that the timing was the point.

On 25 April 2002, per PayPal's quarterly filing, CertCo agreed to drop the suit in exchange for what the filing calls an inconsequential payment and mutual releases. That is the last dated action anyone can find the company taking. Five years of building cryptographic trust infrastructure for the banking system ends with a patent claim against a startup, settled for a sum too small to disclose.

~ reading the end off the records ~

No trade publication marked the closure, so the ending has to be assembled from registries. The website stopped changing sometime between late January and late March 2002, and the frozen copy sits in the Internet Archive with its newest news item dated 23 October 2001 and a copyright line for 2002. On 24 July 2002 the United States Patent and Trademark Office recorded the CertCo application as abandoned, because nobody had answered an office action. The older registered mark was cancelled in March 2006 for the same species of silence, a missed declaration. New York State lists the Delaware corporation as inactive and the older limited liability company as technically still alive, never formally withdrawn in the thirty years since it was filed there.

The domain went to a parking page in December 2004 and is now an empty reply. There is a thriving Certco in Wisconsin, founded in 1930, which distributes groceries and shares nothing with the New York company except a name. SET itself was abandoned by the card networks within a few years, beaten by the simpler arrangement where the merchant takes your number over an encrypted connection and the bank sorts out the fraud afterward. CertCo built the rigorous version, and rigor was not what the market bought.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »