USE OF DIGITAL SIGNATURES IN COMMUNICATIONS WITH PUBLIC ENTITIES IN CALIFORNIA

Transcription

1 MORRISON & FOERSTER LLP USE OF DIGITAL SIGNATURES IN COMMUNICATIONS WITH PUBLIC ENTITIES IN CALIFORNIA This legal analysis evaluates relevant California Government Code provisions and California Secretary of State requirements regarding the legality of accepting, requiring and using digital signatures for the submittal of solar rooftop permit applications to local municipalities. This analysis explains the differences between electronic vs. digital signatures, the extent of a public entity s obligation to accept or require digital signatures under California law, the process by which a municipality accepts digital signatures, and the specific form that a digital signature must take in order to ensure compliance with the California Government Code and California Secretary of State requirements. I. SUMMARY Every city and county requires some form of signature verification for private applicant solar rooftop permit submittals. In general, municipalities and other public entities in California are permitted, but not required, to accept digital signatures in place of manual, or wet, signatures. Essentially, whether a public entity can be compelled to accept digital signatures depends on the laws and regulations governing the specific agencies and documents at issue. If a public entity does accept digital signatures and the private applicant chooses to submit electronically, the applicant s signature(s) must be of a form proscribed by the California Secretary of State. Currently, there are two permitted methods public key cryptography ( PKC ) and signature dynamics. PKC can be immediately verified, is the most amenable to simple PDF formats, is easily implemented, and can be transmitted over . Signature dynamics is logistically easier for the average user to understand, but is less secure, more difficult to implement, and only allows for future verification of the signature. The most appropriate digital signature form depends upon the particular public entity s needs and resources. II. ELECTRONIC SIGNATURE vs. DIGITAL SIGNATURE As an initial matter, it is important to differentiate between electronic and digital signatures. An electronic signature is a broad term encapsulating any digital rendering of a minimal signature or symbol needed to satisfy the subscription requirement for the statute of frauds. 2 Cal. Transactions Forms--Bus. Transactions 8:4. For instance, the term electronic signature includes initials at the end of an or any other mark intended to identify a party to a communication or signal acceptance of an offer. A digital signature, on the other hand, is required in situations where a signature is required to authenticate a party. California law defines a digital signature as an electronic identifier, created by computer, intended by the party using it to have the same force and effect as the use of a manual signature. Cal. Gov t Code 16.5(d). Digital signatures allow the recipient to verify the origin of the document and confirm that its contents have not been 1

2 changed since it was signed. 1 Digital signatures are often used for a variety of transactions, such as applications for local business permits, filing of state income tax forms, and online college applications. Given that public agencies require a form of signature verification for permit submittals and applicable legal regulations refer only to digital signatures, the remainder of this analysis focuses specifically on legal considerations pertaining to digital signatures under California law. III. A PUBLIC ENTITY S OBLIGATION TO ACCEPT DIGITAL SIGNATURES The California Government Code, provisions of the Uniform Electronic Transactions Act, and relevant case law indicate that the inquiry into whether digital signatures are legally sufficient depends on the laws and regulations governing the specific permits the applicant wishes to sign digitally. A. The California Government Code Permits, but Does Not Require, the Acceptance or Use of Digital Signatures. As a result of the rapidly expanding areas of electronic commerce and digital signature technology, the California legislature adopted Government Code section 16.5 and required the Secretary of State to adopt regulations regarding the use of digital signatures. The Code and regulations permit the use of digital signatures in place of manual signatures in written communications with any public entity. Cal. Gov t Code 16.5(a); 2 C.C.R The term public entity includes a county, city, district, public authority, public agency, and any other political subdivision or public corporation in the State. Cal. Gov t Code However, the Government Code does not require public entities to accept electronic signatures in lieu of wet signatures. Section 16.5(b) provides: The use or acceptance of a digital signature shall be at the option of the parties. Nothing in this section shall require a public entity to use or permit the use of a digital signature. Similarly, since the Code specifies that the use of a digital signature is at the option of the parties, it appears that a municipality may not require a permit applicant to submit materials electronically (i.e., applicants should be given the opportunity to submit applications with either a digital or wet signature). 1 The California Code of Regulations defines a digitally-signed communication as a message that has been processed by a computer in such a manner that ties the message to the individual that signed the message. 2 C.C.R (a)(1) (2012). 2

3 B. The UETA May Require Public Entities to Accept Digital Signatures in Certain Situations, but There Is No General Rule. The Uniform Electronic Transactions Act ( UETA ) applies generally to contracts and written records (as opposed to communications specifically with public entities) and it has been adopted by 47 states, including California. See Cal. Civil Code It provides that if a law requires a signature, an electronic signature satisfies the law. 2 Id. at The UETA may potentially override the option of the parties language of 16.5(b), but no court has explicitly addressed that question. Only one California court has analyzed section in the context of communications with public entities, but the case was focused specifically on the interaction between the UTEA and the California Elections Code and is therefore not overly instructive for our purposes. See Ni v. Slocum, 196 Cal. App. 4th 1636 (2011) (voter challenged county s chief elections officer s refusal to accept his digital signature on a ballot initiative petition). Reviewing the legislative history of the Elections Code, the court held that does not compel an elections commissioner to accept a digital signature. However, the court did not address the implication of 16.5(b) s provision that the use or acceptance of a digital signature shall be at the option of the parties. Given the lack of case law and legal guidance on this issue, it is possible (though far from certain) that the UETA may compel a public entity to accept an electronic signature in situations where it requires a signature, but only if doing so does not conflict with other legal requirements for the submission. 3 IV. PROCESS FOR ACCEPTING DIGITAL SIGNATURES According to California Code of Regulations section 22005, a public entity must adhere to the following requirements before accepting a digital signature (all of which are described in more detail in Section V): 2 The UETA generally requires the acceptance of an electronic signature in place of legal requirements for a signature. However, the use of the UTEA s term electronic signature does not preempt other laws requiring that records be posted or displayed in a certain manner, be sent, communicated or transmitted by a specified method, or contain information that is formatted in a certain manner. Cal. Civ. Code (this would include local or state laws requiring wet signatures). 3 As an aside, the Federal E-SIGN Act, which provides for the use of electronic signatures in transactions affecting interstate commerce, does not preempt state law in this case. Similar to the UETA, E-SIGN provides that [n]othing in this title limits or supersedes any requirement by a Federal regulatory agency, self-regulatory agency, or State regulatory agency that records be filed with such agency or organization in accordance with specified standards or formats. ESIGN 104(a), 15 U.S.C. 7004(a). E-SIGN does not define the term state regulatory agency, but it appears to include agencies at the county or municipal level. See Reynolds v. Sims, 377 U.S. 533, (1964) ( Political subdivisions of States counties, cities or whatever never were and never have been considered sovereign entities. Rather, they have been traditionally regarded as subordinate governmental instrumentalities created by the State to assist in the carrying out of state governmental functions ). 3

4 1. Prior to accepting a digital signature, public entities shall ensure that the level of security used to identify the signer of a document is sufficient for the transaction being conducted. 2. Prior to accepting a digital signature, public entities shall ensure that the level of security used to transmit the signature is sufficient for the transaction being conducted. 3. If a certificate is a required component of a digital signature transaction, public entities shall ensure that the certificate format used by the signer is sufficient for the security and interoperability needs of the public entity. A public entity need not undertake a formal process in order to accept digital signatures. Rather, listing the pertinent submittal information on the municipality s internet site, in permit application requirements, or in guidance documents should be sufficient. A number of jurisdictions, both within and outside of California, allow for the use of digital signatures for building permit applications, as well as the electronic payment of fees. These jurisdictions websites provide user guides, bulletins regarding the use and form of digital signatures, payment specifics, and other information. Some of the most instructive information may be found from the following municipalities: San Diego County, CA ( Beverly Hills, CA ( fault.asp); Boca Raton, FL ( Medford, OR ( and Miami Beach, FL ( V. DIGITAL SIGNATURE LOGISTICS Should a public entity decide to accept digital signatures, the signature shall have the same force and effect as the use of a manual signature if and only if the form of the signature has the following attributes: 1. It is unique to the person using it; 2. It is capable of verification; 3. It is under the sole control of the person using it; 4. It is linked to data in such a manner that if the data are changed, the digital signature is invalidated; and 5. It conforms to regulations adopted by the Secretary of State. See Cal. Gov t Code 16.5; 2 C.C.R Third-party companies, known as certificate authorities, issue digital signatures, and municipalities typically require no additional hardware to utilize this information. The California Secretary of State has approved two types of digital signatures public key cryptography ( PKC ) and signature dynamics and the regulations adopted by the 4

5 Secretary provide guidance on each type. See 2 C.C.R The regulations are intended to protect public entities from accepting digital signatures that do not conform to regulations and legislation governing the technology. A. Public Key Cryptography PKC is the most commonly utilized format for digital signatures and has the greatest degree of verifiability. An individual wishing to sign a document using PKC must generate two numerical keys; one is public and one is private. The two keys are related, but are designed so that, knowing one, it is computationally infeasible to discover the other. The private key is used to encrypt (and thereby sign ) the document. Since only the author of the document has access to the private key, the signature is therefore unique to him/her. The public key is used to decrypt it, verifying that the encrypted document was indeed encrypted by the private key (and thus by the author). Third-party certificate authorities that have verified authors identities host certificates containing the signer s public key, allowing the recipient to tie the public key to the name of the author. Most web browsers and document readers include functionality for PKC. Section 22003(a) of the Secretary s regulations describes specific technical requirements for PKC and the California Secretary of State maintains a list of approved certificate authorities (public entities may only accept certificates from these authorities). 4 B. Signature Dynamics The second digital signature technology, signature dynamics, uses a biometric electronic signature based on measurements of the shapes, speeds and/or other distinguishing features of the author s handwriting. 2 C.C.R (b). It requires the author to digitize his/her written signature, either by signing on a sensor or scanning a written copy. A numerical description of the written signature is used to encode the document, similarly to the use of a private key in PKC. California Code of Regulations section 22003(b) describes specific technical requirements for signature dynamics. Signature dynamics is easier for the average user to understand but is less secure and more difficult to implement than PKC, since it requires additional steps (including handwriting analysis) to verify the signer of the document. Essentially, while PKC signatures can be immediately verified with a third-party issued certificate, the use of signature dynamics only allows for future verification of the signature. C. Preferred Digital Signature Form The public entity s specific needs and resources will inform its decision regarding what form to require for private applicants digital signature submittals. However, it is important to 4 See Currently, there are seven (7) approved certification authorities listed. The authorities must provide current proof of accreditation to the Secretary at least once per year or they are immediately removed from the list. 5

6 keep in mind that if immediate absolute verification of a signature is required, PKC should be the preferred option. D. Cost to Applicant The cost outlay to private applicants to ensure that their digital signature conforms to the requirements above (particularly for PKC certificates) is relatively minimal and likely starts at around $20/user/year. 5 The technical details of both signature formats should be confirmed with information technology staff and experts. ATTACHMENTS: A. California Government Code section 16.5 B. Example of digitally-signed PDF - NOTE: When opened in Adobe Acrobat, a blue bar appears at the top of the window indicating that the document has been signed and lists the certificate authority that vouches for the identity of the author. C. California Secretary of State, Digital Signatures: Frequently Asked Questions - See D. Approved List of Digital Signature Certification Authorities - See E. California Code of Regulations (2 C.C.R ) - Technical requirements for PKC and Signature Dynamics F. Smart Permit: A Blueprint For Success (2001) - Guidebook published by eight Silicon Valley cities that joined forces to create a Smart Permit prototype. 5 See for an example of how to obtain an individual digital ID. 6