Change of Root ownership structure

[Arnold...@t-systems.com]

This message is addressed to the CA/Browser community in relation to the request for transfer of root ownership. The root ownership will change from "T-Systems International GmbH" to "Deutsche Telekom Security GmbH". Both units are 100% subsidiary of the "Deutsche Telekom AG". In accordance with the Mozilla Root Store Policy<https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/> (section 8.1), we would like to inform you and wish to start a public discussion.

The internal ownership structure of the two public roots "T-TeleSec GlobalRoot Class 2" and "T-TeleSec GlobalRoot Class 3" from T-Systems International GmbH is planned to change on July 1, 2020. The ownership will remain within the company "Deutsche Telekom AG". The CA's operation team, Root decision makers and Top Level Management will not change. There will be no material or technical location changes. It is planned to transfer via spin-off agreement.

Some information concerning the new company for security, "Deutsche Telekom Security GmbH":
Deutsche Telekom Security GmbH
Bonner Talweg 100
53113 Bonn
The company is based at the Bonn District Court (Amtsgericht Bonn), under HRB 15241.
The spin-off and transfer of the Security subordinate operation as an operational business (contracts, employees, property, etc.) from T-Systems International GmbH to Deutsche Telekom Security GmbH is planned for July 1, 2020.
This will become effective once the secession has been entered in the commercial register.

We plan to update and publish our CP/CPS documents for the time the changes become effective. At the moment there are no anticipated changes to the CP/CPS updates for July 1, 2020 other than the new organization name and address.

We will inform you once the transition has been finalized in accordance with the German Reorganization and Transformation Act (UmwG). The projected date is July 1, 2020.

Please contact us if you have any questions or if more information is needed.

Best regards,
T-Systems Root Team

[Pedro Fuentes]

Hello Arnold,
as we did recently an ownership change, I'm interested on how yours is arranged.

I'd have some questions:
- Would this imply the change of ownership of all the subordinates too or some will remain owned by T-Systems?
- You mention that the ownership change already has a date (July, 1st). What is your compliance plan, to ensure that the new owner is aligned with the Root Program Policies (i.e. Webtrust audit or similar).

Thanks,
Pedro

[Arnold...@t-systems.com]

Hello Pedro,

In response to your questions:
Yes, the ownership of all Root and Subordinate CAs of "T-Systems International GmbH" will be changed to "Deutsche Telekom Security GmbH".
Since the change of ownership is between two 100%-subsidiaries of the "Deutsche Telekom AG" and does not involve any changes to physical locations, personnel, procedures or material, the actual change is mainly only on paper, replacing the name "T-Systems International GmbH" with "Deutsche Telekom Security GmbH" in the corresponding documents as well as updating contracts with suppliers etc.
Also, the auditors have been informed of the upcoming change.

Kind regards,
Arnold



-----Ursprüngliche Nachricht-----
Von: dev-security-policy <dev-security-...@lists.mozilla.org> Im Auftrag von Pedro Fuentes via dev-security-policy
Gesendet: Montag, 27. April 2020 09:44
An: mozilla-dev-s...@lists.mozilla.org
Betreff: Re: Change of Root ownership structure

_______________________________________________
dev-security-policy mailing list
dev-secur...@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy

[Pedro Fuentes]

Thanks, Arnold.

Our change was more complex, so we had to go to a more cumbersome process, including audits of the ownership receiving party.

What I guess it's required now is an explicit confirmation from Mozilla to say if such a direct transfer to an entity not member of the program is compliant with section 8.1 of the policy.

[Wayne Thayer]

Thank you for making this announcement Arnold. This change of legal
ownership is covered by section 8.1 of the Mozilla Root Store Policy,
including the following statement:

If the receiving or acquiring company is new to the Mozilla root program,
> it must demonstrate compliance with the entirety of this policy and there
> MUST be a public discussion regarding their admittance to the root program,
> which Mozilla must resolve with a positive conclusion in order for the
> affected certificate(s) to remain in the root program.
>

Technically I believe the statement above applies to this situation, so I
would like to formally begin the discussion period for this change in legal
ownership of the T-Systems CA by requesting additional thoughtful and
constructive feedback from the community. I will plan to keep the
discussion period open for a minimum of 3 weeks.

T-Systems has already indicated that no changes to their CP/CPS are planned
aside from the company name.

I believe that the plan described by T-Systems is compliant with Mozilla
policy.

- Wayne

[Wayne Thayer]

Given that no other concerns have been raised, I consider this request to
have been "resolved with a positive conclusion" as required by Mozilla
policy section 8.1.

Arnold: please update the information in CCADB (or ask Kathleen if you are
unable) when this change takes effect.

- Wayne