Wed, Oct
2 New Articles

Legal Implications of Digital Signatures

Security - Other
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Before the arrival of the Internet as an open channel for business-to-business electronic commerce, parties to a commercial transaction normally created a vast paper trail to document the proceedings. While the paper trail itself created its own set of problems (such as the classic "battle of the forms"), the courts and commercial lawyers usually did not have to devote significant time and effort establishing the identity of the parties to the transaction. The paper trail provided the necessary verification and identification needed to confirm basic contractual details (e.g., that Able Company entered into a contract with Baker Manufacturing to purchase 100 widgets at $10 each, to be delivered to Able Company by January 10, 1995). One could easily determine the identity of the parties by simply reviewing the paper itself, including letterheads, logos, watermarks, handwritten signatures, initials, stamps, facsimile cover sheets, and facsimile header information, for example.

Parties seeking legal enforcement of paper-based commercial contracts could authenticate the content of a paper document or the validity of a signature on a given document through the testimony of witnesses, notaries public, records custodians, parties, or signature experts. They could use other documents containing writing samples at trial to prove the authenticity of a given signature. Original paper documents could be compared to copies to confirm that the copy was an accurate reproduction. The paper trail spoke for itself and was self-authenticating.

Why the Paper Trail?

Much of the commercial paper trail existed purely to satisfy the requirements of ancient, ritualistic contract law, which is the foundation of modern commercial law. For example, a doctrine known as the Statute of Frauds (now embodied in the Uniform Commercial Code) required that contracts for the sale of goods over $500 be in writing. To be enforceable, that writing had to be signed "by the party to be bound." Historically, commercial law envisioned a signing ritual where the contracting parties met face-to-face to review and sign the written agreement, the codification of the "bargain" the parties had struck. Most states have continued to honor the historical, ritualistic notions of contract in their commercial laws despite the adoption of the Uniform Commercial Code and rapid advances in technology, including facsimile machines, computers, electronic data interchange (EDI),

and, now, Internet-based electronic commerce. Courts in most jurisdictions have preferred tangible paper-based evidence of the contract. State and federal evidentiary law and rules have been slow to allow the admission of electronic mail and electronic information, in part because it was difficult to authenticate and did not fit the standard, age-old definitions applied to tangible objects of evidence. In addition, many consumer protection laws mandate the existence of certain tangible documents.

Enter Electronic Commerce

Business-to-business electronic commerce is conducted nearly anonymously through email, Web sites, and exchange of electronic information in various formats in real time. The paper trail is gone, replaced by streams of bits and bytes. There are no more face-to- face bargains, and there is no single paper contract that can be signed or brought into court to be enforced. The absence of a tangible written contract creates major legal problems regarding the "signed writing" requirements of existing commercial law.

Central to the legal problems of electronic commerce and electronic contracts are issues concerning authentication, integrity, and repudiation. Authentication refers to conclusively determining the identity of the sender of a given communication. In the legal context, authentication entails proving the identity of the parties to the contract or proving that one of those parties sent a given communication. Integrity refers to determining the accuracy and validity of the content of the communication. In the legal context, integrity can refer to proving the terms of the contract. Repudiation refers to a challenge to the authenticity of the communication. In the legal context, this is a denial by one of the contracting parties that it actually entered into the agreement or a challenge to the terms of the agreement itself. For example, the documents comprising an agreement with IBM might be written on IBM letterhead, which itself may have unique qualities (paper stock, watermarks, ink, logos, document control numbers, handwritten signatures of authorized agents, attorneys, etc.). The recipient of a document on authentic IBM letterhead with an authentic signature from an authorized IBM employee may reasonably rely on the authenticity and validity of the communication. Unlike paper documents, however, unencrypted electronic communications that are not digitally secured are easy to forge and alter absent some security mechanism. Given the ease with which many electronic mail systems and Internet sites can be invaded by hackers and unauthorized users, unsecured electronic communications lack the inherent authentication, integrity, and nonrepudiation qualities of paper-based communications.

Digital signature technology was created to provide the security mechanisms needed to address authentication, integrity, and repudiation issues. If a communication is sent with a digital signature, one can programmatically determine the identity of the sender by verifying the signature and digital certificate with the independent third-party Certifying Authority that issued the certificate. Digital signature technology also addresses the integrity issue, because the digital signature itself is unique to the content of each message sent by the sender: If the content of the digitally signed message has changed since the signing of the message, the recipient is notified by the software application performing the verification of the digital signature and certificate. In these respects, the digitally-signed communication is perhaps more reliable than older, paper-based evidence (such as facsimile transmissions), provided the sender or the Certifying Authority has not compromised the process. However, without legal changes giving digitally signed communications the same legal force and effect as their analog counterparts, the parties to an electronic transaction may not have a legally enforceable contract. In particular, while the digital signature technology vendors presume that the sender of a validated, digitally signed transaction cannot repudiate it, the law has not yet arrived at that conclusion.

State Action to Legitimize Digitally Signed Transactions

Lawmakers worldwide are beginning to address the issues of which electronic records will suffice as a "signed writing" in their jurisdictions and which digital signature technologies will serve as a legally recognizable substitute for a signature on the contract. Many entities have published guidelines for implementing electronic contracts and digital signature technologies, including the America Bar Association, the Internet Law and Policy Forum, and the United Nations Commission on International Trade Law (UNCITRAL). Many states are looking to the Uniform Electronic Transactions Act (UETA), drafted by the association that authored the Uniform Commercial Code (UCC), the National Conference of Commissioners on Uniform State Laws. The model UETA legislation contains the following basic provisions:

• A record or signature may not be denied legal effect or enforceability because it is in electronic form.

• A contract may not be denied legal effect or enforceability solely because an electronic record was used in its formation.

• If a law requires a record to be in writing, an electronic record satisfies the law.

• If a law requires a signature, an electronic signature satisfies the law.

The UETA model contains a number of other provisions designed to integrate digitally signed transmissions into the fabric of state law. The model legislation is technology-independent and does not specify criteria for any particular digital signature technology or any Certifying Authority. The UETA defines an electronic signature as "an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record."

Some states, such as Utah, have adopted detailed digital signature legislation, affecting a broad range of commercial transactions. The Utah legislation is based on the American Bar Association's Digital Signature Guidelines and provides for state-licensed Certifying Authorities (CAs), regulation of certificates issued by CAs, and delineation of duties for the various parties (CAs, subscribers, third parties, and key repositories). It also defines the legal validity of digital signatures.

Other states, such as Pennsylvania, have adopted the UETA model legislation nearly verbatim. California has adopted the UETA-style legislation with substantive modifications, including numerous exclusions, and specifies criteria for digital signatures to address security and trustworthiness concerns. Illinois has modeled its laws after provisions in the UNCITRAL Model Law on Electronic Commerce. Many states will have to harmonize the model legislation with existing consumer protection laws, which may require signed writings and tangible evidence of commercial contracts.

Finally, many states have enacted limited digital signature legislation pertaining to limited government transactions (such as corporation filings, tax filings, death certificate filings, UCC filings, and financial institution filings.)

Federal Legislation

Congress has also been bitten by the Internet regulation bug, and these interstate variances in the adoption of digital signature law have prompted Congress to act. In 1999, the House of Representatives passed H.R. 1714, the Electronic Signatures in Global and National Commerce Act. Figure 1 contains an excerpt from this bill, which is presently referred to the Senate. Figure 2 shows language regarding interstate commerce contained in the pending Senate bill 761, the Millennium Digital Commerce Act.

In prior sessions, Congress has passed other bills enabling various federal agencies to use digital signatures and electronic records in lieu of signed, written contracts.

Examples include the Government Paperwork Elimination Act (GPEA). Congress has also been adding digital signature provisions to various bills on a piecemeal basis. Past congressional efforts include the Electronic Financial Services Efficiency Act of 1997, Electronic Commerce Enhancement Act of 1997, and Digital Signature and Electronic Authentication Law (SEAL) of 1998.

As of this writing, a question that remains open is whether or to what extent these federal laws will pre-empt state laws. While the issue of pre-emption is complex, the basic question for the courts is whether Congress, in passing legislation, has manifested an intent to "occupy the field" for a particular area of law, precluding the various states from enacting law in that field. U.S. courts will have to address the preemption issue, especially given the broad scope of the proposed federal legislation and in light of Congress' right to use and extend its powers to regulate interstate commerce under the Commerce Clause of the U.S. Constitution.

International Efforts

The European Union, Argentina, Australia, Canada, Columbia, Denmark, Finland, France, Germany, India, Ireland, Italy, Japan, Malaysia, Netherlands, New Zealand, Russia, Singapore, Sweden, South Korea, and the United Kingdom have all recently undertaken studies and/or legislation regarding digital signature technologies in electronic commerce.

Privacy Rights Issues with Certifying Authorities?

Another growing concern is the lack of uniform laws regarding Certifying Authorities. Many groups have expressed concern that Certifying Authorities will not protect the privacy rights of their subscribers. Given that a Certifying Authority would, in essence, be privy to all digitally signed transactions undertaken by its subscribers, the concern is that Certifying Authorities could become unregulated data warehouses of private consumer information, including data trails from transactions. To that end, privacy rights groups favor limited data collection and disclosure by the Certifying Authorities, as well as a technologically neutral approach so that consumers can use multiple digital signature technologies to conduct their transactions.

A Binding Contract

Lawmakers worldwide are struggling to determine which digital signature technologies will receive legal recognition in their jurisdictions and which areas of law will require revision to permit the use of digital signatures in lieu of a paper-based signature in commercial transactions. Various states are adopting different approaches, as are various national governments. As of this writing, the various states and nations have not enacted uniform digital signature laws, and congressional action may slowly preempt state laws in this area. Given the rate of growth in electronic commerce, the infancy of digital signature technology and infrastructure, and the weaknesses of existing state and federal evidentiary and commercial laws, digital signature legislation will be a growing part of state, federal, and international legislative activity for the foreseeable future.

Figure 3 shows links that you can search for more information on digital contracts.

a) Prohibits a rule of law from denying the legal effect of certain instruments of electronic commerce on the ground that: (1) they are not in writing; or (2) they are not signed or affirmed by a signature if they have been signed or affirmed by electronic signature.

b) Upholds the legal effect of such instruments regardless of the type or method of electronic record or signature selected by the signatories. Emphasizes that this Act does not require a party to use or accept electronic records or signatures.

c) Cites circumstances in which an electronic record satisfies State rules of law mandating: (1) availability to the customer of a record in writing; (2) retention of a contract, agreement, or record in writing or in its original form; and (3) retention of a check. Upholds the contestability of signatures and charges.

d) Cites circumstances in which a State statute or rule of law may alter or supersede the general rule of validity governing instruments of electronic commerce under this Act, including: (1) that such statute or rule of law constitutes an enactment or adoption of the Uniform Electronic Transactions Act as reported by the National Conference of Commissioners on Uniform State Laws; and (2) a State requirement that certain notices be in writing for the protection of the public health and safety of consumers.

Figure 1: The Electronic Signatures in Global and National Commerce Act is currently in the Senate for approval. This is an excerpt from the Act.

(a) IN GENERAL—In any commercial transaction affecting interstate commerce, a contract may not be denied legal effect or enforceability solely because an electronic signature or electronic record was used in its formation.

(b) METHODS—Parties to a transaction are permitted to determine the appropriate electronic signature technologies for their transaction, and the means of implementing such technologies.

(c) PRESENTATION OF CONTRACTS—Notwithstanding subsection (a), if a law requires that a contract be in writing, the legal effect or enforceability of an electronic record of such contract shall be denied under such law, unless it is delivered to all parties to such contract in a form that—

(1) can be retained by the parties for later reference; and
(2) can be used to prove the terms of the agreement.

Figure 2: Bill number 761, the Millennium Digital commerce Act, is currently pending in the Senate. This is an excerpt from the bill.

Public Key Infrastructure Solutions Vendors

RSA Security Inc.: www.rsasecurity.com VeriSign, Inc.: www.verisign.com CyberTrust--A GTE Company: www.cybertrust.com Entrust Technologies: www.entrust.com Entegrity Solutions Corporation: www.entegrity.com Xcert International, Inc.: www.xcert.com IBM security Site: www.ibm.com/security/

Legal Links

United States Congress—Current Session Bills: thomas.loc.gov/home/c106query.html American Bar Association, Science and Technology Section: www.abanet.org/scitech/ec/home. htmlnternet
Law and Policy Forum: www.ilpf.org/ United Nations Commission on International Trade Law: www.un.or.at/uncitral National Conference of Commissioners on Uniform State Laws: www.nccusl.org/

Figure 3: Search these legal links and leading digital signature solutions vendors for more information on digital technology.



Support MC Press Online

$0.00 Raised:

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: