Digital Signatures The Law and Best Practices for Compliance. January 2014

Transcription

1 Digital Signatures The Law and Best Practices for Compliance January 2014

2 Electronic/Digital Signature Legislation Disclaimer: ARX is not is not a law firm and does not provide legal advice. We make no warranty, express or implied, concerning any interpretation of laws and regulations or its reliability as presented here or of the content on websites cited in this presentation.

3 Electronic Signatures Legally defined as an electronic sound, symbol (e.g., a graphic representation of a person in JPEG file), or process, attached to or logically associated with a record, and executed or adopted by a person with the intent to sign the record. Some of the solutions that fit this legal definition can be very problematic with regards to maintaining integrity and security, and especially a good business policy or practice.

4 Digital Signatures Digital signatures, often referred to as advanced or standard electronic signatures, provide the highest form of signature and content integrity as well as universal acceptance. Digital signatures help organizations sustain signer authenticity, accountability, data integrity, and non-repudiation (a signer cannot later deny their participation in a transaction they signed) of electronic documents and forms.

5 US/EU Federal and State Statutes Uniform Electronic Transactions Act (UETA) 1999 Electronic Signatures in Global and National Commerce Act (E-Sign) 2000 The Electronic Identification and Trust Services for Electronic Transactions in the Internal Market (eidas) Regulation

6 US: Uniform Electronic Transactions Act (UETA) UETA - SECTION 7. LEGAL RECOGNITION OF ELECTRONIC RECORDS, ELECTRONIC SIGNATURES, AND ELECTRONIC CONTRACTS. (a) record or signature may not be denied legal effect or enforceability solely because it is in electronic form; (b) A contract may not be denied legal effect or enforceability solely because an electronic record was used in its formation; (c) If a law requires a record to be in writing, an electronic record satisfies the law; (d) If a law requires a signature, an electronic signature satisfies the law.

7 US: E-Sign Act ELECTRONIC SIGNATURES IN GLOBAL AND NATIONAL COMMERCE ACT (aka E-Sign) at: Mirrors various provisions of UETA (which preceded it) section a) says electronic signatures and documents are legal; section b) this act does not override other acts that may mandate use of paper-based transactions; section c) Consents outlines what the parties must agree, and declare they agree(d), to use of electronic signatures/contracts between them; important in consumer-focused transactions.

8 US: State Compliance with UETA 46 US States (+ DC, Puerto Rico, and the Virgin Islands) have adopted UETA. Georgia; Illinois; New York; Washington have other statutes pertaining to electronic transactions (GA: Ga. Code Ann., ; IL: 5 ILCS 175/1-101; NY: NY CLS State Technology 301 et seq.; WA: ) The US Federal Act, E-Sign, governs if disputes cannot be settled at the state level. Note: US courts seem to be so routinely admitting electronic signatures due to the E-Sign Act that it is unnecessary for them to write a written opinion actually going through the analysis under the statute. In a sense, the statute is doing its job by obviating the need for any court to think twice about whether an electronic signature could be admissible (assuming it met all the other rules of evidentiary procedure).

9 EU: Regulation for Electronic/Digital Signatures The Electronic Identification and Trust Services for Electronic Transactions in the Internal Market (eidas) Regulation approved by the EU Council in July 2014: Explicitly endorses a remote (or server-side) signing model as one that is as legally binding as the smartcard model based on the following stipulations: The system must ensure the signatory s sole control over the use of the signatory s personal signature key. The system must conform with the security standards as defined by ETSI and CEN. Allows remote digital signing from any user device including smartphones, tablets and PCs. Compulsory for all EU member states (a solution certified by one state is applicable across the EU).

10 Legal Summary US and EU law accept electronic/digital signatures but do not state specific technology choices. US law allows for a broad definition of electronic signatures. EU law narrows the definition and implies that digital signatures should be used. Regulations in specific industries tend to lean toward digital signatures. The courts are concerned with: Admissible evidence Was a policy/procedure followed consistently in the execution of routine business?

11 Best Practices for Digital Signature Deployment A legally enforceable digitally signed record should address the issues that concern the courts in this regard The record can be considered admissible evidence only if it is: Attached to signed information Uniquely linked to the signer Capable of identifying the signer Verifiable by anyone at anytime Created using means that the signer maintains under his/her control Capable of easily showing anyone at any time that changes have been made to the signed information The record was created in the execution of routine business while consistently following the relevant organizational policy/procedure: Digital signing should be part of a standard automated organizational policy/process There should be a clear audit track

12 When are Digital Signatures Required? A legally enforceable digitally signed record should address the issues that concern the courts in this regard The record can be considered admissible evidence only if it is: Attached to signed information Uniquely linked to the signer Capable of identifying the signer Verifiable by anyone at anytime Created using means that the signer maintains under his/her control Capable of easily showing anyone at any time that changes have been made to the signed information The record was created in the execution of routine business while consistently following the relevant organizational policy/procedure: Digital signing should be part of a standard automated organizational policy/process There should be a clear audit track

13 When are Digital Signatures Required? When a proof of identity, intent, and integrity is needed Audit and regulatory requirements Particular to industry/geography Acceptance Inside and outside the organization Verification Now and in the archive

14 Compliance Elements Provided by CoSign A CoSign Digital Signature is: Strongly bound to the signed document; Uniquely linked to the signatory; Capable of identifying the specific individual signatory; Created using a means the signatory maintains under his/her control; Verifiable by anyone at any time; and Ensuring that changes to signed information can be plainly seen by anyone at any time. The CoSign System Provides: Centralized control of signature-credential provisioning and revocation; Centralized control of user-enrollment and authentication policies; and User control of signature credential and signature function by the specific signatory.

15 CoSign Digital Signature Compliance CoSign creates legally enforceable digital signatures in accordance with: UETA 15 U.S.C (E-Sign) EU (eidas) Regulation The CoSign digital signature solution, when implemented with a proper organizational policy, can comply with: FDA Title 21 CFR Part 11 (Life Sciences) HIPAA (Healthcare) PE board regulations in most US states Sarbanes Oxley EU VAT Directive USDA regulations NIST FIPS level 3 Common Criteria EAL4+

16 About CoSign CoSign by ARX is the most widely used digital signature solution with millions of signers at businesses, governments and cloud services around the world using it to securely sign documents on any device. CoSign was recognized by Forrester as the strongest digital signature solution in their Wave: E-Signatures, Q report. Contact us for a live demo and quote based on your organization s needs.