Electronic signature

The term electronic signature has several meanings. In recent US law, influenced by ABA committee white papers and the National Conference of Commissioners on Uniform State Laws (NCCUSL), electronic signature means "an electronic sound, symbol, or process, attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record." This definition comes from the Uniform Electronic Transactions Act or "UETA" released by NCCUSL in 1999. The U.S. ESign Act of 2000 enacted on a federal level many of the core concepts of UETA. 46 US states, the District of Columbia, and the US Virgin Islands have enacted UETA.

The concept itself is not new. US and other common law contains references to telegraph signatures and faxed signatures, some as far back as the mid-19th century. For that matter, the text of, and comments to, US Federal Rules of Evidence 1001, 1002, and 1003, among others, give good support for the proposition that electronic records and signatures would be admissible in court.

There is confusion between the terms electronic signature and digital signature. Most, especially those with an information theory or cryptography background, use "digital signature" to refer to a digital signature protocol using cryptographic techniques, as is sometimes applied to an 'electronic document'. Many, however, use the terms interchangeably, leading to considerable confusion as cryptographic signature techniques are very different, whatever the term used, than other electronic signatures and have extremely different security properties. Since it the security properties which are of interest in signatures of all kinds, this is a very significant distinction. Digital signature is properly a subset of electronic signature.

In the European Union, the EU Directive on Electronic Signatures or the EU Electronic Signatures Directive was published in the EC Official Journal, as Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures (OJ No L 13 p.12 19/1/2000) .

History and Examples of Use

Beginning well before the US Civil War (ca 1860), Morse code was used to electronically send messages via telegraph, some of which involved agreement to contracts. An early acceptance of the enforceable validity of electronic signatures of this kind came from the New Hampshire Supreme Court in 1869. But it was the invention of electronic communication methods which brought electronic signatures into everyday use.

In the 1980’s, many companies and even some progressive individuals began using fax machines for high priority or time sensitive delivery of paper based documents. Although a signature in such cases was typically on a piece of physical paper, the image capturing process and the transmission of a copy of the signature was done electronically.

Courts in various jurisdictions have decided that enforceable electronic signatures can include agreements made via email, by entering a person identification number "PIN" into an ATM bank machine, 'signing' a credit/debit slip with a digital pen pad device at a sales counter,, acceptance of the terms of an End-User License Agreement via clickwrap when installing software, or by signing electronic documents online.

Legality of electronic signatures

Legal definitions

Various laws have been passed internationally to facilitate commerce by the use of electronic records and signatures in interstate and foreign commerce. The intent is to ensure the validity and legal effect of contracts entered into electronically. For instance,

ESIGN Act Sec 106 definitions

(2) ELECTRONIC- The term `electronic' means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities.

(4) ELECTRONIC RECORD- The term `electronic record' means a contract or other record created, generated, sent, communicated, received, or stored by electronic means.

(5) ELECTRONIC SIGNATURE- The term `electronic signature' means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.

GPEA Sec 1710 definitions

(1) ELECTRONIC SIGNATURE.—the term "electronic signature" means a method of signing an electronic message that—

(A) identifies and authenticates a particular person as the source of the electronic message; and

(B) indicates such person's approval of the information contained in the electronic message.

UETA Sec 2 definitions

(5) "Electronic" means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities.

(6) "Electronic agent" means a computer program or an electronic or other automated means used independently to initiate an action or respond to electronic records or performances in whole or in part, without review or action by an individual.

(7) "Electronic record" means a record created, generated, sent, communicated, received, or stored by electronic means.

(8) "Electronic signature" means an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.

Federal Reserve 12 CFR 202 definitions

refers to the ESIGN Act

Commodity Futures Trading Commission 17 CFR Part 1 Sec. 1.3 definitions

(tt) Electronic signature means an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.

Food and Drug Administration 21 CFR Sec. 11.3 definitions

(5) Digital signature means an electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.

(7) Electronic signature means a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature.

Legal Test of electronic signatures

In law, if a signature on a contract or other document is contested, the signature must meet certain tests before a court will uphold them if contested. These requirements vary by jurisdiction, but various sorts of signatures, some entirely electronic Telex addresses (for example, ABC Company sends a Telex to XYZ Company making an offer at a particular price. The offer was held to be binding when the 'signature' was challenged.), telegrams (for example, "I ACCEPT, SMITH" even though Smith never actually touched the telegraph key), and faxes of documents, even in some cases where the original was not signed by the sender.

A central question in such cases is forgery and spoofing of assent, and in these decisions, courts have held that forgery and spoofing can be in practice ruled out. Nevertheless, it is easily possible, for many electronic methods of signature, or imputed signature, to forge or spoof assent. The rapidly rising problem of identity theft illustrates the ease of such forgeries.

Often, businesses rely on other means to attempt to ensure an electronic signature is correct, including talking with the signing person directly or over the phone before an electronic signing, having an ongoing business relationship, and receiving payment or other indications of intent to do business that do not rely solely on a signed document. This is good business practice even in the paper world, as forgeries have been common there since time immemorial. Fraud is a common issue in all signature situations, and neither type of signature (paper or electronic) provides fully effective anti-fraud protections.

None of the electronic signatures in these examples are digital signatures in that there is no cryptographic assurance of the sender's identity, and no integrity check on the text received. However, all are electronic signatures, and all have been found legally binding in some circumstances.

Laws regarding use of electronic signatures

• Croatia - Zakon o elektronickom potpisu - nn 10/02
• U.S. - Electronic Signatures in Global and National Commerce Act
• U.S. - Uniform Electronic Transactions Act - adopted by 48 states
• U.S. - Digital Signature And Electronic Authentication Law
• U.S. - Government Paperwork Elimination Act (GPEA)
• U.S. - The Uniform Commercial Code (UCC)
• UK - s.7 Electronic Communications Act 2000
• European Union - Electronic Signature Directive (1999/93/EC)
• China - Law of the People’s Republic of China on Electronic Signature (effective April 1, 2005)
• Mexico - E-Commerce Act [2000]
• Costa Rica - Digital Signature Law 8454 (2005)
• Slovenia Slovene Electronic Commerce and Electronic Signature Act
• South Africa - The Electronic Communications and Transactions Act 25, 2002

Electronic Signature Vendors

iDentifi.eSign,DocuSign , ARX, Silanis, Sertifi, Yozons, EchoSign

Pseudo-legal use of imputed electronic signatures

Some web sites and software EULAs contain terms that assert that various electronic and other actions give rise to legally effective signatures. For example, a web page might announce that, by accessing the site at all, you have agreed to a certain set of terms and conditions. A software product might assert, in its packaging or on an early installation screen, that by using it you have agreed to licensing terms. These may or may not have been discernible prior to sale, and may or may not be completely displayed even at installation. Such licenses often include such restrictions as a prohibition of reviewing the product for publication (electronic or otherwise) without prior permission of the publisher/distributor, or prohibition on studying the product (i.e., reverse engineering) for an otherwise lawful purpose such as producing data files in a compatible format. Some such claims would appear to be contrary to patent law (which requires public disclosure as a condition of granting a patent) or to copyright law which does the same for works available to the public, or to contract law which requires informed knowing assent to reasonable contract terms as a condition of enforceability in court. Only if all such covered matters are trade secrets would many such clauses appear sustainable, but even so a condition of trade secrecy is maintenance of the secret by the holder. This may not be met in the case of a widely distributed product offered for sale to anyone.

The legal status of such claims is uncertain. In the US, only two states have adopted a new revision of the Uniform Commercial Code which authorize such licensing restrictions, with disclosure after purchase. The validity of such terms remains uncertain, despite the views of many EULA authors. Analogies to the physical world in which contracts and signatures are written, signed, and stored in tangible form suggest that analogous terms would not be acceptable. In the UK, Regulation 9 of the Electronic-Commerce (EC Directive) Regulations 2002 (SI 2002/2013) requires that a purchaser is able to determine in advance “the different technical steps to follow to conclude the contract.”

Cryptographic signatures

An electronic signature may incorporate a digital signature if it uses cryptographic methods to assure, at the least, both message integrity and authenticity. For example, a proposed contract accepted by a vendor and returned via email to the purchaser after being digitally signed. In fact, in modern practice, a digital signature of some text is always electronically processed in some sense, for the cryptographic mechanisms are impracticable without computers. In theory however, this is not required. Because of the use of message integrity mechanisms, any changes to a digitally signed document will be readily detectable if tested for, and the attached signature cannot then be taken as valid.

It is important to understand the cryptographic signatures are much more than an error checking technique akin to checksum algorithms, or even high reliability error detection and correction algorithms such as Reed-Solomon. These can offer no assurance that the text has not been tampered with, as all can be regenerated as needed by a tamperer. In addition, no message integrity protocols include error correction, for to do so would destroy the tampering detection feature.

Popular electronic signature standards include the OpenPGP standard supported by PGP and GnuPG, and some of the S/MIME IETF standards. All current cryptographic digital signature schemes require that the recipient have a way to obtain the sender's public key with assurances of some kind that the public key and sender identity properly belong together, and that message integrity measures (also digital signatures) which assure that neither the attestation nor the value of the public key can be surreptitiously changed. A secure channel is not typically required.

A digitally signed text may also be encrypted for protection during transmission, but this is not required when most digital signature protocols have been properly carried out. Confidentiality requirements will be the guiding consideration.

External links

• Introduction to cryptography from the PGP international website
• OpenOffice Electronic Signatures and Security specification (OpenOffice format), also in pdf format. Incorporates standards for document format and XML Digital Signatures. Includes a comparison of document signature software and features from Adobe (Acrobat), Microsoft (Word) and Mozilla.
• E-Sign Final Report (2005, European Union)
• ARX Facts About Digital Signatures
• Yozons electronic signature reference
• EchoSign e-signature backgrounder