Why use a hammer to pound a screw when you have a wrench? — ji

Introduction

This is a very cross-disciplinary field where:

Many confuse the differences between Authentication and Signatures.
Close links between "Business Processes " and any "IT Solution" is required - both are required.
Few lawyers understand the technical issues
Even fewer IT technical heads understand the legal issues
Greenfield solutions designed by those who actually understand both tend to look nothing like the expected approach, eg:

AADS/X9.59
EDI/trading agreement-based approaches
IRS 1040 signing.

It’s actually a three-level problem

Legal/political
Technology in theory
Technology as it really works

ITechies mostly have no political authority and try to develop technical solutions to political/social problems, while politicians don’t understand the technology, and pass vague laws in the hope that the market will sort it out. It’s a very hard problem to solve where there is no consensus on how to do it.
The typical approach is where a:

Digital signature law is passed
Published commentary on it is usually dissenting opinions

Why do we need Digital Signature Legislation?

Existing commerce uses paper-and-ink signatures and we need e-commerce. Therefore - We need Digital Signature legislation; the corollary is:

A horse is a mode of transport
A car is a mode of transport

Therefore - A car is a horse. Result: Laws still exist requiring people to walk in front of cars waving red flags and firing pistols. Signing a mortgage (paper) is very different from an online credit card purchase under MOTO rules (electronic).

What is a Signature?

A signature establishes validity of a document to allow the reader to act on it as a statement of the signer’s intent, and leaves evidence to that effect afterwards. Signatures represent a physical manifestation of consent

Can be enforced by a court if you later try to repudiate it (Lawyers can expand on the complexities here)
A digital signature must provide a similar degree of security
A signature is not just authentication
When you sign a document (e.g.cheque / check), you’re making a commitment, not just authenticating yourself
Even when you sign in to a building, you’re engaging in ritual, not authenticating yourself.

The typical signature functions are:

Associate the signer with a document
Prove involvement in the act of signing
Provide proof of the signers involvement with the content of the signed document
Provide endorsement of authorship
Provide endorsement of the contents of a document authored by someone else, eg witnessing.
Prove a person was at a given place at a given time
Meet a statutory requirement that a document be signed to make it valid

Some countries have requirements that contracts for the sale of goods above a certain value be “signed” to be enforceable. This signature can be:

A signature in the generally-accepted manner
A stamp
A typewritten signature, email footers or the originating domain name
Use of company letterhead

A signature then isn’t necessarily a handwritten signature, eg

Stamp
Chop-marks (Chinese background)- This is probably the closest real-world equivalent to a digital signature.

Real-world .vs. Electronic Signatures

Real-world paper-and-ink signatures use:

A standard pen
A standard hand/wrist
Standard handwriting

But… The user is very aware of the importance of their action, ie
– Writing a date on a document;
– Writing a signature on a document.

A vastly different weight is given to the signature depending on the context of its use:

Inter-office memo - where a simple “X” will do
Credit card receipt, where we check the amount or a card skimmer
Mortgage / Contract agreement, where we get a lawyer to check it for you.

The difference between plain handwriting and a signature is of informed consent, one of the primary uses of signatures is to make parties aware of the consequences of their actions. This is why paper signatures are still explicitly required for the:

Transfer of interests in land
Especially solemn transactions (wills, affidavits, statutory declarations)
Consumer protection

All this ensures that consumers get a paper record and/or are forced to stop, consider and think.

Digital signatures need to artificially split key functionality because the standards are mostly written by technologists who can’t define law or social policy. What type of key/security measures do you use for:

Signing a challenge-response authentication token?
Signing a letter of introduction?
Signing an inter-office memo?
Signing a purchase order?
Signing a receipt?
Signing a will?

The credit-card scenario approach:

You may use your VISA with approved VISA merchants under these conditions…
You may use the XYZ signature key with approved XYZ business partners under these conditions…Identrus adopt this approach

Difficult to enforce on a typical Windows box where all keys are equal

Other approaches are still awaiting legal test cases.
Long-term electronic signatures are a problem, e-mail comments and committments are considered 'a now event', but a 12 month old email will largely be ignored.

30% of all contracts are mortgages which are valid for 20-30 years, Most electronic certificates expire after 1 year, ie;

X.509 has a mechanism for separating lifetime of signing key and verification key, but PKIX prohibits its uses
Various complex, arcane, and mostly untested mechanisms like timestamping and secure archiving exist.
Security Assertion Markup language (SAML) standard -- a type of extensible markup language (XML) that is really just an authentication mechanism.

Real-world Approximations to Digital Signatures

The closest analogue to digital signatures is probably cheque cards where:

Banks are liable for accepting forged cheques
When merchants accept them, they have to take liability, even though they don’t have the verification facilities that banks have available.

Banks issued cheque cards to allow merchants to verify signatures (certificates)

Cheque card blacklists were used to revoke them (CRLs).

General Requirements for Digital Signatures

The signing key must be controlled entirely by the signer for non-repudiation to function
The act of signing must be a conscious decision

The “Grandma clicks the wrong button and loses her house” problem
“You are about to enter into a legally binding agreement which stipulates that ...”

Dialog boxes can become legal documents

Lawyers (not UI designers) need to design your user interface
The case will be heard by a 60-year old judge with a fine arts degree

May require a traditional written document to back up the use of electronic signatures

“With the key identified by ... I agree to ... under the terms ...”
Written German HBCI (Home Banking Computer Interface) agreement (Ini-Brief) has:
–Key owner identification information
–Date/time
–Key and hash of key
–“I certify that this key is used for my electronic signature”

Cross-jurisdictional signatures are a problem

Non-Repudiation

Most digital signature products claim they provide nonrepudiation, it sounds good, and doesn’t cost anything to claim this, however technical non-repudiation is almost impossible to achieve.

Existence of a paper-and-ink signature implies that you were involved and saw (if not read) what you were signing
Existence of a digital signature implies that at some point something, somewhere performed a mathematical operation on some data

Non-repudiation can best be achieved through laws guaranteeing repudiation

That’s “guaranteeing repudiation”, not “guaranteeing nonrepudiation”
c.f. Reg.E/Reg.Z for credit cards/ATM cards

Liability issues are the Achilles heel of digital signature laws

Reg.E/Reg.Z

Congress passed laws guaranteeing repudiation to force banks to provide appropriate consumer protection where

Report loss within 2 days: No liability
Report loss within 2-60 days (time to get a bank statement):

Liability of $50 (value of one average transaction at the time the law was passed)

Note that physical loss is evident to the card owner; electronic fraud isn’t.

Other countries have similar legislation

UK Consumer Credit Act with a liability limit of £50. However, UK law has the nebulous loophole of “gross negligence” which allows banks to dump liability on the consumer
Australian EFT Code of Conduct. Worked out by banks, consumers, and regulators after banks had dumped all liability on their customers

No current digital signature law is capable of providing Reg.E/Reg.Z consumer protection
“Impossible-to-forge” digital signatures allow all liability to be shifted onto users. This was a severe problem with UK banks in the 1980s and 1990s

Some serious miscarriages of justice occurred because banks blamed any disputed transaction on customer fraud, and courts believed them
‘Chip & PIN’ is an attempt to return to the good/bad old days.

Open vs. Closed Systems

In an open system

Signer uses some form of universal ID from a third-party Certificate Authority for signatures. Can use the same universal signature to buy a $2 piece of clip art or a Picasso.
Parties have no previously established network of contracts to rely on.
No way to handle liability, cannot internalise the costs of the inevitable fraud which will occur
Example open systems, Public PKI's / Certificate Authorities (CA's).

In a closed system

Members sign up to the rules of the club
Only members who will play by the rules, and can carry the risk are admitted to the club
Members are contractually obliged to follow the rules, including obligations for the signatures made with their private key
Electronic agreements are bilateral or multilateral, and backed by paper-based agreements

Examples of closed systems include:

EDI (Electronic Document Interchange)
SWIFT (Society for Worldwide Interbank Financial Telecommunication)
ACH (Automated Clearing House)

Liability

CA issues a certificate to Alice. Alice’s key is stolen by a virus. Alice immediately revokes her cert. At the same time, Bob dispatches $10,000 based on a signed withdrawal note from Alice. Who is liable?
•Alice exercised due diligence in immediately revoking her certificate
•The CA is a third party not involved in the transaction
•Bob exercised due diligence in verifying the CA-certified key
To resolve this:
•Bob does away with the CA
•If Bob is a bank, it manages its own records and authorisation mechanisms
•If Bob is a merchant, he uses established mechanisms such as using a bank as guarantor of the transaction. This is a return to the model used in existing EDI transactions
•This is a business problem, not a technical problem, and not necessarily a legislative problem.

Liability in Open vs. Closed Systems

In a closed system, liability is handled via paper based bilateral/multilateral trading agreements.

In an open system, parties have no previously established network of contracts covering private key use on which they can rely upon.

On what basis do you sue someone when they repudiate a signature?
Have they published a legally binding promise to the world to stand behind that signature?
Do they owe a duty of care, actionable in the case of negligence / tort ?

Possible ways to proceed include:

Claim a duty of care where negligence resulted in financial loss. Generally negligence claims for pure financial loss won’t support this
Claim that publishing the key was a negligent misstatement, Unlikely that this will work
Go after the CA, CA won’t suffer any loss if the keyholder is negligent, so they can’t go after the keyholder
Dump liability on the relying party, which completely defeats the point of a PKI.

Pseudo-closed systems (“Let 10,000 CAs bloom”)

Theory: A CA for every occasion, each following the closed model
Practice: Even a single PKI is already hard enough to do, we don’t need to multiply this difficulty by 10,000
Better to use 10,000 application-specific solutions than to take a one-size-misfits-all one and then not apply it to -all anyway.

Open models remain popular

Rigid, hierarchical models are appealing to governments
One-size-fits-all approach is appealing to legislators
Legislating a PKI is appealing to techies
Everyone’s “we gotta do something” itch gets scratched.

One-size-fits-all Model Doesn’t Work

Case 1: Banking

Requires strict security, accounting audit trail, two-person control

Example, buying a printer cable:

Two people drive to a row of computer stores
One person selects a random store
The other person selects a random cable from the store
They drive back to the bank with the cable on the seat between them.

Case 2: Healthcare

You can violate any security rule as long as you can justify it later by saving the patient (or the Doctor said it was OK).

Example, medical practice

Anything which stops the doctors doing their job is an impediment that needs to be removed
Lowest level of security granularity that can be achieved is “everyone in the practice”
First person in the morning logs on
Everyone else uses their key for the rest of the day
Nurses/administrators know the doctor’s keys, and are expected to use them
Saving the patient is more important than security.

Existing EDI Approach

Electronic Data Interchange

X.12 in US/Canada
EDIFACT in Europe
Specialised variations, e.g. HL7 for medical EDI
XML = EDI with the second-system effect, PL/I = Cobol with the second-system effect
EDI is the Cobol of e-commerce
Boring and tedious
90% of everything depends on it.

EDI is the archetypal closed system which is governed by interchange agreements that:

Describe the rules that govern the business transactions
Cover the responsibilities of each party
Specify identification/authentication requirements
Specify archiving requirements
List technical and legal responsibilities of parties, including banks
Application-specific, custom digital signature law, security traditionally provided by passwords or MACs
The EDI process is handled by using standard business mechanisms
(US) Business Records Exception allows standard business records to be treated as evidence (rather than hearsay) in court
Well-established mechanisms (and much legal precedent) for this

It’s much easier to manage a cheap trusted message store/audit mechanism than to solve a global infrastructure and policy problem. You need this information anyway for the auditors.

Trust

This term appears constantly in relation to the generation and handling of certificates
“Alice sees the certificate and trusts Bob”... What is trust anyway?

Types of trust

Blind trust:

Sometimes the only option, e.g. emergencies, panic
“Is there a doctor in the house?”

Swift trust:

Based on a series of hedges to reduce potential loss
Trading with a new business

Deference-based trust:

Disincentive to betray trust, eg E-Bay and peer feedback pressure
Contract / auditing / “our systems are infallible, don’t even think about it”
Regulated markets, e.g. banks

Knowledge-based / historical trust:

Based on established history / trading relationship:

“We’ve been doing business with them for 10 years”
PE or CPEng accreditations

Social trust:

Based on emotions rather than rational thought, pillar of the community
Little old ladies

Identification-based trust:

Parties have common goals, ID passes.
“He’s wearing the same uniform as me, we’re on the same side”

Indirect trust:

Sometimes, trust can’t be established directly.
Establish indirect trust using third parties, escrow.
Use a bank as guarantor.

One type of trust can bootstrap another, ie Swift -> knowledge-based

Trust can be grouped into one of three classes

Mechanistic trust:

Based on positive evidence
“We’ve done it before and it worked”

Religious trust:

Based on faith
No evidence, but we hope for a positive outcome
How can you possibly question that the other person is trustworthy?

Psychotic trust:

Based on negative evidence, fear and intimindation
“We’ve done it before and it didn’t work”

Much current PKI “trust” is either religious or psychotic.

Trust is affected by:

Culture
Third-party ratings
Better Business Bureau
Consumer Reports

Not always reliable: TRUSTe handles violations by changing its policy so they’re no longer violations

Second-party opinions:

“My brother bought one, he’s had nothing but trouble with it”

First party information:

“We will not sell your private data to third parties”
(We will, however, trade it to them without actually selling it).

Trust has a value:

Business goodwill, Trust generates money
Reputation capital
Use money to buy “trust”
–Money -> trust

Trust degradation:

Without reinforcement, trust decays over time
Trust may be deliberately destroyed
“My credit card has been stolen”
Prevents parties from making decisions based on invalid trust data.

You can’t create trust with cryptography, no matter how much cryptography you use.
You can’t create trust with legislation, no matter how much legislation you generate.

Digital Signature Legislation

Prescriptive approach

You must do exactly this to comply
The government can stimulate business growth by resolving uncertainty
Driven by techies
Creates business models that would never evolve naturally in the marketplace

Hands-off approach

Based on the approach that anything reasonable is fine
The government can stimulate business growth by removing barriers and letting the market decide what to do.
Driven by lawyers
Doesn’t enforce any business models since it doesn’t (and cannot) really enforce anything.

Specific examples include:

Utah Digital Signature Act
German Digital Signature Law
Italian Digital Signature Law

Later laws worked around the problems turned up by earlier ones:

ETSI Digital Signature Draft
Swedish Electronic ID card (SEIS)
California Digital Signature Law
Massachusetts Electronic Records and Signatures Bill
US E-Sign Act
Singapore Electronic Transactions Act
UNICTRAL Model Law on Electronic Commerce - Almost everyone is now basing their laws on this model.

Other Approaches utilise a mix:

EU Directive on Electronic Signatures, “It’s already handled” approach
UK Law Commission
Australian E-commerce Experts Group.

Politics (and Money)

Local or domain-specific laws can override a national signature law, despite what the national signature law may say.

Example: Australian real estate transactions:

Have very distinct requirements for signatures
Individual states (not the Commonwealth) have jurisdiction
Land tax is the No.1 revenue earner for states
States will never give this up revenue stream.

Utah Digital Signature Act

The first digital signature act, passed in 1995. The Law of X.509:

Requires public-key encryption based signatures, licensed CAs, CRLs, etc etc
Duly authorised digital signatures may be used to meet statutory requirements for written signatures. Liability of CAs is limited, signers and relying parties assume the risk.
Signature carries the evidentiary weight of a notarised document
If your key is compromised, you’re in serious trouble, the Windows virus du jour can give a third party the ability to issue notarised documents in your name
If you hand over your key to a third party, you’re in serious trouble
If a signature is verified, it’s assumed that the user has accepted the certificate and signed the message
In order to challenge this, the user must prove a negative
c.f. proving “Aliens exist” vs. “Aliens don’t exist”.
Drafters of the act assumed the spectre of liability would prevent the emergence of commercial CAs
CA would be required to take exceptional, costly steps to confirm identity, and yet still issue an erroneous cert
Every party which relied on this could claim against the CA
CA’s liability would be staggering, CAs could avoid this by entering into contracts with certificate holders
Wouldn’t work for relying parties, who are the ones likely to incur losses

Solutions:

Use a closed system (again)
Dump liability on the cert holder
Users carry (potentially) infinite liability
No rational consumer would accept this level of risk in a marketplace transaction, ie the Vice-chair of ABA Electronic Commerce subcommittee
Little-used because of this problem.

German Digital Signature Law

Like the Utah act, based on public-key technology with requirements:

Licensed CAs which meet certain requirements, where CAs must provide a phone hotline for revocation
Identification is based on the German ID card
This type of identification isn’t possible in most countries
Allows pseudonyms in certificates
Key and storage media must be controlled only by the key owner, where the key may be generated for the user by the CA if strict controls are followed to ensure that no copies are retained
Provisions for timestamping and countersigning
Signatures from other EU countries are recognised provided an equivalent level of security is employed

Multilevel law:

Signaturgesetz (SigG) provides general framework
Defines a digital signature
Defines the role of a CA
Defines certificates and outlines how they’re handled
Signaturverordnung (SigV)
Sets out operational details and responsibilities of a CA
Signatur-Interoperabilitätspezifikation (SigI)
Technical specification to implement the SigG and SigV
Specifies data formats, algorithms, timestamping and directory service mechanisms, etc etc.

Example:

SigG: A private key must be protected
SigV: A private key must be protected in the following circumstances using certain technical measures
SigI: Here are the technical measures. While compliance with the law has been described as ‘voluntary’, it is difficult to see how alternatives could operate, see Report of the Australian Electronic Commerce Experts Group.

Details are set out in the implementation guidelines:

Extremely detailed (over 300 pages)

Specifies things like:

Hash and signature algorithms
Random number generation for keys
Personnel security
Directory and timestamping services
Spawned hundreds of pages of supplementary documentation covering further digital signature issues
BSI publishes a CDROM full of these things
Criticised as being too detailed and complex to follow
Later watered down to try and make it more workable.

Case study: Telesec CA

SigG/SigV-compliant CA with a cost of $12M to set up and 25 full-time staff
250 certificates issued, with an average cost of $50,000 per certificate.

Of the original 15 providers, 13 have now gone bankrupt.

Italian Digital Signature Law

Similar to the German law, but all requirements are listed in one place
Everything has to be certified to various ITSEC (later Common Criteria) levels
Key generation devices must be certified to ITSEC E3 with a HIGH level of robustness, where in practice, this forces everyone to use smart cards for key management
The OS must be ITSEC F-C2/E2 or TCSEC C2
Access to the system must be controlled, users identified, usage logged
CAs must be ISO 9000 certified
This severely limits the technology that can be used
Signature mechanism must present the data to be signed in a clear and unambiguous manner, and ask for confirmation of signature generation
Allows for automated signature generation provided that this is “clearly connected to the will of the subscriber”
Certificates must contain users name, date of birth, and company name
Allows pseudonyms, but this must be indicated in the cert and CA must record real identity
Includes some bizarre requirements that are at odds with the way the rest of the world does things
All prescriptive laws end up with these at some point
Makes use of COTS software impossible, where half the CAs in Europe seem to rely on this as their business model.

The CA must:

Verify that the key hasn’t been certified by another CA, another prove-a-negative requirement
Verify that the user possesses the private key
Publish certificates in LDAP directories
Publish details on themselves (company name, address, contact details, terms and conditions, substitute CA)
The fixation with (expensive and complicated) certification had made deployment problematic
System failed because of problems with certification and with vendors’ ability to deliver
Preferred vendor couldn’t deliver evaluated CA hardware
Users spent millions on hardware which (eventually) wouldn’t meet the requirements
Lawsuits between users, vendors, government departments
Users faked it with software-only solutions, eg Run a PC in a locked back room.

ETSI Digital Signature Draft

ETSI TR/TS 101 0xx reports specify technical requirements for signatures:

Role of signer (e.g. Financial director) is more important than the name
Signature must be dated to allow later dispute resolution. References various standards efforts (e.g. PKIX) for further study
Privilege attribute certificates (PACs)
Defined by ECMA, special short-lived (1 day max) certificates
Vouch for a certain property of the user

Swedish Electronic ID card (SEIS)

Smart-card contains three keys:

Authentication (= X.509 “digital signature”)
Card supports a challenge-response protocol for authentication
Card signs a random challenge from the remote system
Digital signature (=X.509 “nonrepudiation”)

Encryption:

The 3-key design was based on careful technical and legal analysis of digital signature requirements. This approach was later abandoned because Windows can’t handle two types of signing keys:

“Digital signature legislation, say hello to the real world”
“Legally sound” or “Works with Windows”: Pick only one
Windows often ignores key usage
Encryption key can sign
Signature key can encrypt
Convenient: Allows users to use the same key for everything

Card doubles as standard ID card (photo, signature, etc), where cards are issued by:

Government agencies
Financial institutions
Companies to their employees

Usage governed by the SEIS Certification Policy:

Backdoor digital signature law
Covers certificate issuing process, security auditing, physical and procedural security, key management and protection.

Key may be generated by the CA for the user provided strict controls are followed:

Two-person security
No copy of the key is retained by the CA
PIN-protected device is physically handed to user by the CA
User signs a document acknowledging receipt
Activation PIN is delivered over a separate channel
User is told to immediately change the PIN
Complex physical and procedural security procedures for cards

California Digital Signature Law

Very broad, allows any agreed-upon mark to be used as a digital signature
Western culture has no real analogue for this
Asia has chop-marks, a general-purpose mark used to authenticate and authorise. One-sentence digital signature law: “You can’t refuse a signature just because it’s digital”
Many later laws followed this model, strongly influenced by the Utah Act
“Anything but that”

Massachusetts Electronic Records & Signatures Bill

A signature may not be denied legal effect, validity, or enforceability because it is in the form of an electronic signature. If a rule of law requires a signature [...] an electronic signature satisfies that rule of law. A contract between business entities shall not be unenforceable, nor inadmissible in evidence, on the sole ground that the contract is evidenced by an electronic record or that it has been signed by an electronic signature. The Massachusetts law doesn’t legislate forms of signatures or the use of CAs, or allocate liability.

“Attorneys Full Employment Act of 1997”.

US E-Sign Act

Electronic Signatures in Global and National Commerce Act. This bill literally supplies the pavement for the e-commerce lane of the information superhighway, Senator Spencer Abraham Act was signed on paper and electronically

Bill Clinton revealed his password (“Buddy”) after the signing, rendering the electronic signature contestable (lack of diligence).

Massachusetts signature law taken to extremes:

Signatures can be a “sound, symbol, or process attached to or logically associated with a contract or other record”
“Press 9 to sign a binding contract, or 1 to hear this message again”
“Click here to enter into a legally binding agreement”
Online comparison shopping may cause problems because not buying is a “withdrawal of consent”
Enforceability will probably take a court case to decide
Vendors may charge extra for physical items (disk media, manuals, but also printed invoices), where consumers are charged extra if they want a valid audit trail.

Some records cannot be delivered electronically:

Court orders
Wills
Cancellation/eviction/foreclosure notices
Health/safety warnings/notices

Pre-empts state legislation which is more strict than the ESign Act. Law is about electronic (rather than digital) signatures. Journalists who contacted the House discovered that the people involved in creating the Bill weren’t aware that there was a difference, where they were too busy mangling metaphors to notice. Bill was prepared with input from Dell, Gateway, Hewlett-Packard, Microsoft, and other vendors. No consumer advocacy groups were consulted. The finished Act appears to be a means of imposing UETA, (Uniform Electronic Transactions Act, sibling of UCITA, opposed by the attorney-generals of most states) by stealth, would help make things like (currently dubious) clickthrough and shrink-wrap licenses legally binding.

Singapore Electronic Transactions Act

Follows the one-sentence signature law model:

Where the law requires a paper signature, an electronic one will do
Offer of acceptance of contracts may be expressed electronically
Signature apparatus must be under sole control of signer.

The certificate requirements:

Cannot publish a certificate known to be false
Certificates must specify a reliance limit

Optional feature of other laws, e.g. German law:

Of dubious value (just re-use the cert many times)
Static solutions to dynamic problems don’t work, Compliant CAs are not liable for certificate problems.

UNCITRAL Model Law on Electronic Commerce

UN Commission on International Trade (UNCITRAL) model e-commerce law. Countries felt that existing legislation didn’t contemplate the use of e-commerce, and needed updating:

Existing legislation implies limits by prescribing the use of “written” or “signed” documents
Model Law defines a functional equivalent approach for electronic documents/signatures

Ensures electronic signatures can provide the functions required of paper documents, twelve years in the making! Information shall not be denied legal effect, validity, or enforceability solely on the grounds that it is in the form of a data message. Where the law requires information to be in writing, that requirement is met by a data message. Where the law requires a signature of a person, that requirement is met in relation to a data message:

The signature method indicates a person’s approval of the message contents
Signature method is as reliable as appropriate Almost everyone is passing laws based on this model law
It’s trendy
All the other kids are doing it
“We’ve passed this new law and lo! Our e-commerce functions no worse than before”
Still an “Attorney’s Full Employment Act”

UN Draft Articles on Electronic Signatures

Follows the one-sentence signature law model:

Includes a rationale for each point
Defines two levels of signature
“Electronic Signature” = data attached to a message to indicate a signers approval of the message
“Enhanced Electronic Signature” = electronic signature with extra constraints
Unique to the signature holder
Verifiable through a standard procedure
Under the sole control of the signer
Extremely broad and technology-independent
Specifies (rather vague) reliance and obligation details.

UNCITRAL Model Law on Electronic Signatures

UN Commission on International Trade (UNCITRAL) model digital signature law:

Refines UNCITRAL E-commerce Law (“You can’t refuse a signature just because it’s digital”) and Draft Articles
Five years in the making
Eventually drifted towards a focus on PKI
Uses standard terms (“signature”, “certificate”) in novel ways to make them non-specific
Worded so as to still allow mechanisms such as “click-OK” for electronic signatures, where not discourage “any method of electronic signature”. *Requires conditions for all signatures similar to the UN Draft Articles for Enhanced Electronic Signatures
Appears to make CAs optional, but they’re more or less assumed to be present
Recognises certificates from other countries issued under equivalent terms
Pushes some regulatory issues back to the Model E-Commerce Law
Includes a rationale for all points
Makes comments about liability of all parties but “does not specify either the consequences or the limits of liability”.

EU Directive on Electronic Signatures

Defines an electronic signature as linking signer and data, created by a means solely controlled by the signer (not necessarily a cryptographic signature). Precedes the directive itself with the intended aims of the directive. Makes accreditation and licensing voluntary and nondiscriminatory:

No-one can be prevented from being a CA
Intent is to encourage best practices while letting the market decide.
Electronic signature products must be made freely available within the EU
Electronic signatures can’t be denied recognition just because they’re electronic
Absolves CAs of certain types of liability
Provides for reliance limits in certificates
Recognises certificates from non-EU states issued under equivalent terms
Allows for pseudonyms in certificates
Recognises that a regulatory framework isn’t needed for signatures used in closed systems
Trust is handled via existing commercial relationships
Parties may agree among themselves on terms and conditions for electronic signatures
Keys may be identified by a key fingerprint on a business card or in a letterhead
Much cross-pollination with UN Draft Articles/Model Signature Law, but with enough differences to make them incompatible
UN later dropped the two-level Signature/Enhanced Signature distinction.
Uses Advanced Electronic Signatures tied to individuals

Question: What about large corporations, who would need to hire hundreds of people to personally sign e-invoices, etc? Answer: Use EDI, which doesn’t need e-signatures.

UK Law Commission

UK Law Commission concluded that no special legislation is necessary:

Email and web sites are already in writing within the usual statutory meaning
Typed names or “click-OK” count as signatures
Use of public-key encryption affects the weight of the evidence in court, nothing more
Follows the analogy of technology like microfiche
What’s on the fiche is writing even if you need a machine to interpret it.

Ghana

Electronic transactions legislation that deals provides for recognition and admissibility of electronic records and electronic signatures, the recognition of electronic certificates, certification services and automated transactions.
These elements have been captured in the:

Ghana Electronic Transactions Bill 2008;
Electronic Communications Bill 2008;
National Communications Authority Bill 2008; and
National Information Technology Agency Bill 2008 passed by Parliament on 11th November 2008.

References

Lecture notes, University of Sydney, 2004, lecturer unknown.
Electronic Signatures in Law, Stephen Mason.
Royal North Shore Hospital, Social Work Department notes on trust, 2004.