Electronic signature, authentication, identity management & UNCITRAL

Transcription

1 United Nations Commission on International Trade Law Electronic signature, authentication, identity management & Jae Sung LEE Secretariat Legal Officer, International Trade Law Division Office of Legal Affairs, United Nations

2 and e-commerce A pioneer in developing legal standards on e-commerce Texts adopted by have influenced a great number of jurisdictions With the increased use of e-communications in international trade, almost all Working Groups are considering related issues when deliberating their respective topics No legislative text dedicated to identity management

3

4 Texts on Electronic Commerce 1996 Model Law on Electronic Commerce (MLEC) 2001 Model Law on Electronic Signatures (MLES) 2005 United Nations Convention on the Use of Electronic Communications in International Contracts (ECC) 2007 Promoting confidence in electronic commerce: Legal issues on international use of electronic authentication and signature methods

5 Texts on Electronic Commerce Provides comprehensive legal framework for electronic transactions Based on the following underlying principles: Non-discrimination Functional equivalence Technological neutrality Party autonomy

6

7

8 (1) Where the law requires a signature of a person, that requirement is met in relation to a data message if: (a) a method is used to identify that person and to indicate that person s approval of the information contained in the data message; and (b) that method is as reliable as was appropriate for the purpose for which the data message was generated or communicated, in the light of all the circumstances, including any relevant agreement. (2) Paragraph (1) applies whether the requirement therein is in the form of an obligation or whether the law simply provides consequences for the absence of a signature. Article 7. Signatures

9

10 Article 2. Definitions (a) Electronic signature means data in electronic form in, affixed to or logically associated with, a data message, which may be used to identify the signatory in relation to the data message and to indicate the signatory s approval of the information contained in the data message; Article 3. Equal treatment of signature technologies Nothing in this Law, except article 5, shall be applied so as to exclude, restrict or deprive of legal effect any method of creating an electronic signature that satisfies the requirements referred to in article 6, paragraph 1, or otherwise meets the requirements of applicable law.

11 Article 6. Compliance with a requirement for signature 1. Where the law requires a signature of a person, that requirement is met in relation to a data message if an electronic signature is used that is as reliable as was appropriate for the purpose for which the data message was generated or communicated,. 3. An electronic signature is considered to be reliable if: (a) The signature creation data are, within the context in which they are used, linked to the signatory and to no other person; (b) The signature creation data were, at the time of signing, under the control of the signatory and of no other person; (c) Any alteration to the electronic signature, made after the time of signing, is detectable; and (d) Where a purpose of the legal requirement for a signature is to provide assurance as to the integrity of the information to which it relates, any alteration made to that information after the time of signing is detectable.

12 Electronic Communications Convention Adopted by the General Assembly on 23 November ECC builds up and, in certain cases, updates the provisions of the Model Laws on electronic commerce and electronic signatures. ECC aims at enhancing legal certainty and commercial predictability where electronic communications are used in relation to international contracts.

13 Entry into force of the ECC Entry into force on 1 March 2013 States parties: Congo, Dominican Republic, Honduras, Russia and Singapore 16 other signatories (Central African Republic, China, Colombia, Iran, Lebanon, Madagascar, Montenegro, Panama, Paraguay, Philippines, Republic of Korea, Saudi Arabia, Senegal, Sierra Leone, Sri Lanka) Australia, Thailand and the United States have expressed intention to adopt Other States have adopted substantive provisions of the ECC domestically

14 Article 9. Form requirements 3. Where the law requires that a communication or a contract should be signed by a party, or provides consequences for the absence of a signature, that requirement is met in relation to an electronic communication if: (a) A method is used to identify the party and to indicate that party s intention in respect of the information contained in the electronic communication; and (b) The method used is either: (i) As reliable as appropriate for the purpose for which the electronic communication was generated or communicated, in the light of all the circumstances, including any relevant agreement; or (ii) Proven in fact to have fulfilled the functions described in subparagraph (a) above, by itself or together with further evidence.

15 Promoting confidence in electronic commerce (2007) Analyzes main legal issues regarding Signatures and authentication methods Cross-border use of electronic signatures and authentication methods Part 2 focuses on international use of digital signatures under a PKI (not a recommendation)

16 What is meant by authentication? UN Centre for Trade Facilitation and Electronic Business (CEFACT) adopted a revision of an outdated recommendation 14 on authentication of trade documents (by methods other than manual ink signatures) Questions arose about the term authenticity, to authenticate, authentication, authentic??? It currently recommends (i) removal of signature requirement for trade documents, (ii) legal framework to give equal status to electronic methods of authentication and (iii) a regular review of such rules.

17 What is meant by authentication? A building block to establishing trust in the electronic transactions regime. More emphasis being put on the security of the system, particularly in closed network systems Leading to a preference for specific technologies, PKI being one example. Concerns about technological neutrality Electronic signature or authentication should include digital signature (PKI), biometrics, passwords, scanned signatures and other such means.

18 Legal issues relating to authentication Technology-specific approach: for higher level of security, recognizes only digital signatures within a PKI as a valid means of authentication / Possible exclusion of emerging technologies and limited cross-border use Minimalist approach: recognizes all technologies for electronic signature and maintains technology neutrality/ Security issues Two-tier approach: a low threshold for legal recognition and greater legal effect to certain authentication methods

19 Legal issues relating to authentication Balancing between security in electronic transactions and technological neutrality and mutual recognition Legal and technological incompatibilities hinder cross-border use but technology-specific legislations adds more obstacles because: (i) legal and technological requirements also for e- signatures and certification service providers (ii) technology standards and licensing requirements

20 Additional considerations Interoperability (cross-recognition, cross certification between PKIs) Recognition of foreign authentication services Non-discrimination for foreign signatures and services Technology neutrality and development Conduct and liability regimes

21 Identity management Currently, not involved in IDM In 2010, the Commission discussed future work in e- commerce which included a general outline of IDM (A/CN.9/692) IDM systems: to identify and authenticate users seeking access to services/ tool to improve trust in e- commerce/ benefits to the user, identity provider and the relying party Technical side: ITU Focus Group on IDM / Policy, OECD Working Party on Information Security and Privacy, WCO, Un NExT

22 Identity management Conclusions at the colloquium (Feb 2011) the relevance of identity management to facilitate cross-border electronic transactions very few initiatives, if any, dealt with transnational legal aspects of identity management such work would also clarify the scope of provisions on legal signatures contained in existing texts, and facilitate the treatment of identity management in the context of other topics potentially of interest for

23 the Working Group. Identity management The Commission, in 2011, when mandating the Working Group IV to undertake work in the field of electronic transferable records, specifically noted that such work might include certain aspects of other topics, such as identity management, the use of mobile devices in electronic commerce and electronic single window facilities As to IDM as a separate topic, particular caution was recommended when discussing matters touching upon issues, such as privacy and data protection, that had important regulatory aspects. In that regard, it was added, it might be beneficial to wait for further developments so as to better define the terms of a possible future mandate for

24 Current work - monitoring Coordination with the EU - Regulation on electronic identification and trust services for electronic transactions in the internal market (e-idas regulation, 23 July 2014) UN/CEFACT on Recommendation 14 (Authentication of trade documents by means other than signature) and Recommendation 36 (Recommendation and guidelines on requirements for Single Window Interoperability) American Bar Association IDM Legal Task Force OECD 2011 Report on Digital Identity Management

25 Current agenda of Working Group IV Preparation of draft provisions on electronic transferable records Next session: Vienna, November 2014 Electronic equivalent of transferable document or instrument (promissory note, cheques, bills of lading, warehouse receipts )

26 Future work by While completing the work on electronic transferable records, compile information on cloud computing (A/CN.9/823: Canada) identity management & authentication (A/CN.9/WG.IV/120 : an overview of identity management submitted by the ABA) use of mobile devices (m-commerce) single windows By organizing, co-organizing or participating in colloquia, workshops and other meetings within available resources

27 Thank You! For more information on the work of, please visit our web site