An electronic signature, or e-signature, is any electronic means that indicates either that a person adopts the contents of an electronic message, or more broadly that the person who claims to have written a message is the one who wrote it (and that the message received is the one that was sent). By comparison, a signature is a stylized script associated with a person. In commerce and the law, a signature on a document is an indication that the person adopts the intentions recorded in the document. Both are comparable to a seal.
Increasingly, encrypted digital signatures are used in e-commerce and in regulatory filings as digital signatures are more secure than a simple generic electronic signature.[1][2][3] The concept itself is not new, with common law jurisdictions having recognized telegraph signatures as far back as the mid-19th century and faxed signatures since the 1980s.
In many countries, including the United States, the European Union and Australia, electronic signatures (when recognised under the law of each jurisdiction) have the same legal consequences as the more traditional forms of executing of documents.[4]
Since well before the American Civil War began in 1861, morse code was used to send messages electronically by telegraphy. Some of these messages were agreements to terms that were intended as enforceable contracts. An early acceptance of the enforceability of telegraphic messages as electronic signatures came from the New Hampshire Supreme Court in 1869.[5]
In the 1980s, many companies and even some individuals began using fax machines for high-priority or time-sensitive delivery of documents. Although the original signature on the original document was on paper, the image of the signature and its transmission was electronic.[6]
Courts in various jurisdictions have decided that enforceable electronic signatures can include agreements made by email, entering a personal identification number (PIN) into a bank ATM, signing a credit or debit slip with a digital pen pad device (an application of graphics tablet technology) at a point of sale, installing software with a clickwrap software license agreement on the package, and signing electronic documents online.[7] The first agreement signed electronically by two sovereign nations was a Joint Communiqué recognizing the growing importance of the promotion of electronic commerce, signed by the United States and Ireland in 1998.[8]
In 1996 the United Nations published the UNCITRAL Model Law on Electronic Commerce.[9] The model law was highly influential in the development of electronic signature laws around the world, including in the US.[10]
The U.S. Code defines an electronic signature for the purpose of US law as "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."[11] It may be an electronic transmission of the document which contains the signature, as in the case of facsimile transmissions, or it may be encoded message, such as telegraphy using Morse code.
In the United States, the definition of what qualifies as an electronic signature is wide and is set out in the Uniform Electronic Transactions Act ("UETA") released by the National Conference of Commissioners on Uniform State Laws (NCCUSL) in 1999.[12] It was influenced by ABA committee white papers and the uniform law promulgated by NCCUSL. Under UETA, the term means "an electronic sound, symbol, or process, attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record." This definition and many other core concepts of UETA are echoed in the U.S. ESign Act of 2000.[11] 47 US states, the District of Columbia, and the US Virgin Islands have enacted UETA.[13] Only New York, Washington State, and Illinois have not enacted UETA,[13] but each of those states has adopted its own electronic signatures statute.[14][15][16]
Canadian law (PIPEDA) attempts to clarify the situation by first defining a generic electronic signature as "a signature that consists of one or more letters, characters, numbers or other symbols in digital form incorporated in, attached to or associated with an electronic document", then defining a secure electronic signature as an electronic signature with specific properties. PIPEDA's secure electronic signature regulations refine the definition as being a digital signature applied and verified in a specific manner.
In the European Union, the EU Directive on Electronic Signatures or the EU Electronic Signatures Directive was published in the EC Official Journal, as Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures (OJ No L 13 p. 12 19/1/2000).[17]
Various laws have been passed internationally to facilitate commerce by the use of electronic records and signatures in interstate and foreign commerce. The intent is to ensure the validity and legal effect of contracts entered into electronically. For instance,
The purpose of the UETA and the federal ESIGN Act is to authorize the use of electronic records and signatures. In other words, these laws answer the question "is it a signature", but not the question "is it YOUR signature." Most contract disputes are not related to the authenticity of signature or the identity of the contracting parties, and so these laws have great utility for a broad range of electronic contracting transactions, and allow flexibility by permitting the type of electronic signature used to fit the nature of the transaction. But in law, if a signature on a contract or other document is contested, the signature must meet certain tests before a court will uphold it. These requirements vary by jurisdiction, but various sorts of signatures, some entirely electronic Telex addresses (for example, ABC Company sends a Telex to XYZ Company making an offer at a particular price. The offer was held to be binding when the "signature" was challenged.), telegrams (for example, "I ACCEPT, SMITH" even though Smith never actually touched the telegraph key), and faxes of documents, even in some cases where the original was not signed by the sender.
In the case of Mehta v J Pereira Fernandes[20] the English High Court held that
Accordingly, it would appear that in English law any insertion of a name by the purported signer or a natural person authorised by him constitutes a signature but an automatically inserted email address does not.[21]
A central question in such cases is forgery and spoofing of assent, and in these decisions, courts have held that forgery and spoofing can be in practice ruled out. Nevertheless, it is easily possible, for many electronic methods of signature, or imputed signature, to forge or spoof assent. The rapidly rising problem of identity theft illustrates the ease of such forgeries.
Often, businesses rely on other means to attempt to ensure an electronic signature is correct, including talking with the signing person directly or over the phone before an electronic signing, having an ongoing business relationship, and receiving payment or other indications of intent to do business that do not rely solely on a signed document. This is good business practice even in the paper world, as forgeries have been common there since time immemorial. Fraud is a common issue in all signature situations, and neither type of signature (paper or electronic) provides fully effective anti-fraud protections.
None of the electronic signatures in these examples are "digital signatures", as that term is commonly used, in that there is no cryptographic assertion of the signer's identity, and no integrity check on the text received. However, all are electronic signatures, and all have been found legally binding in many different types of consumer, commercial and business transactions. However, proving the authenticity of a digital signature in a court of law may, in some circumstances, be easier than proving the validity of other types of electronic signatures. The relative ease of proving authenticity of a digital signature is dependent on the integrity of the process for delivering the cryptographic key to the signer, and the extent to which the signer has agreed, or is otherwise bound, to protect the key and accept responsibility for its use.
Some web sites and software EULAs contain terms that assert that various electronic and other actions give rise to legally effective signatures. For example, a web page might announce that, by accessing the site at all, you have agreed to a certain set of terms and conditions. A software product might assert, in its packaging or on an early installation screen, that by using it you have agreed to licensing terms. These may or may not have been discernible prior to sale, and may or may not be completely displayed even at installation.
In regard to a prominent limitation typically imposed in EULAs: Such licenses often include such restrictions as a prohibition of reviewing the product for publication (electronic or otherwise) without prior permission of the publisher/distributor, or prohibition on studying the product (i.e., reverse engineering) for an otherwise lawful purpose such as producing data files in a compatible format. Some such claims would appear to be contrary to patent law (which requires public disclosure as a condition of granting a patent) or to copyright law which does the same for works available to the public, or to contract law which requires informed knowing assent to reasonable contract terms as a condition of enforceability in court. Only if all such covered matters are trade secrets would many such clauses appear sustainable, but even so a condition of trade secrecy is maintenance of the secret by the holder. This may not be met in the case of a widely distributed product offered for sale to anyone.
The legal status of such claims is uncertain. In the US, only two states have adopted a new revision of the Uniform Commercial Code which authorize such licensing restrictions, with disclosure after purchase. The validity of such terms remains uncertain, despite the views of many EULA authors. Analogies to the physical world in which contracts and signatures are written, signed, and stored in tangible form suggest that analogous terms would not be acceptable.
Returning to the subject of the validity of a contract's existence (as determined by its means of creation): Courts in the UK have taken the view that online contracts are no different to (a) offline ones or (b) ones made electronically at a distance by telex, fax, or morse-code telegraphy, and accordingly can be valid subject to all the usual contract principles: there must be offer, acceptance, contractual intention and certainty as to terms. Contract terms must be available before acceptance, as established in the 1971 case of Thornton v Shoe Lane Parking Ltd where a contract was entered into with a machine before terms were known (and therefore those terms were not binding).
In any event any contract is subject to tests of reasonableness (and in the case of contracts with consumers, "fairness") under the Unfair Contract Terms Act and the Unfair Terms in Consumer Contracts Regulations. In addition under the Electronic Commerce Regulations 2002 (SI 2002/2013) and Distance Selling Regulations there are requirements to make the steps required to conclude the contract clear, and rights to revoke contracts within certain periods and subject to certain limits. Many of these laws and regulations arise from EU Directives and Regulations so are broadly replicated throughout the European Economic Area. Generally the courts have treated this more as a matter of acceptance by conduct than signature.
"Electronic signature" may sometimes mistakenly be used to refer to cryptographic signatures: a piece of data included with a message that uses cryptographic methods to assure, at the least, both message integrity and authenticity. Cryptographic signatures are themselves a common feature of many larger systems or standards for electronically "signing" a message or contract.
Another common term for cryptographic signature is digital signature; the similarity of the term to "electronic signature" can invite confusion, which is why for this article cryptographic is used.
For an example of a cryptographic signature, a proposed purchase order accepted by a vendor and returned via email to the purchaser after being digitally signed. In fact, in modern practice, a digital signature of some text is always electronically processed in some sense, for the cryptographic mechanisms are impracticable without computers. In theory however, this is not required. Because of the use of message integrity mechanisms, any changes to a digitally signed document will be readily detectable if tested for, and the attached signature cannot then be taken as valid.
It is important to understand the cryptographic signatures are much more than an error checking technique akin to checksum algorithms, or even high reliability error detection and correction algorithms such as Reed-Solomon. These can offer no assurance that the text has not been tampered with, as all can be regenerated as needed by a tamperer. In addition, no message integrity protocols include error correction, for to do so would destroy the tampering detection feature.
Popular electronic signature standards include the OpenPGP standard supported by PGP and GnuPG, and some of the S/MIME IETF standards. All current cryptographic digital signature schemes require that the recipient have a way to obtain the sender's public key with assurances of some kind that the public key and sender identity properly belong together, and that message integrity measures (also digital signatures) which assure that neither the attestation nor the value of the public key can be surreptitiously changed. A secure channel is not typically required.
A digitally signed text may also be encrypted for protection during transmission, but this is not required when most digital signature protocols have been properly carried out. Confidentiality requirements will be the guiding consideration.
As already discussed, the term "electronic signature" may be used to refer to "cryptographic signatures" (cryptographic data affixed to a document) and more broader forms of establishing authenticity and origin of message which often include cryptographic data. However, electronic signature may also refer to electronic forms of processing or verifying identity through use of biometric "signatures" or biologically identifying qualities of an individual.
Such signatures use the approach of attaching some biometric measurement, or hash of said measurement, to a document as evidence of signature. For instance, fingerprints, hand geometry (finger lengths and palm size), iris patterns, or even retinal patterns. All of these are collected using electronic sensors of some kind. Since each of these physical characteristics has claims to uniqueness among humans, each is to some extent useful as a signature method. Unfortunately, each is easily spoofable by a replay of the electronic signal produced and submitted to the computer system responsible for 'affixing' a signature to a document. Wiretapping techniques often suffice. In the particular case of fingerprints, a Japanese professor and some graduate students managed to spoof all of the commercially available fingerprint readers available to them with some ordinary kitchen chemistry (gummy bear candy gel) and a little ingenuity. No actual fingers were needed to successfully spoof every reading device.[22]
In addition, some German journalists at a CeBit conference were able to fool several iris pattern scanners with improvised masks.
Biometric measurements of this type are useless as passwords, as they can't be changed if compromised. However, they might be serviceable as electronic signatures of a kind - except that, to date they have been so easily spoofable that they can carry little assurance that the person who purportedly signed a document was actually the person who did.
An emerging form of electronic signatures for the purposes of contracts is defined as “Dynamic Signature,” or confusingly sometimes themselves labeled "Biometric Signatures" (despite their existence as only one item in the category of biometric signatures). The term stands for handwritten signatures that are digitized throughout the writing process – including static characteristics and biometric (dynamic) signals. Instead of replacing the handwritten signature these kind of e-signing solutions seek to transfer the signing ceremony into the digital world. Like any biometric signature system, these "Dynamic signatures" require a hardware device for signature capturing and a software which is able to combine the signature data, encrypt it and allows to detect later manipulation by creating a hash value.
At the time when the first versions of electronic signature laws were created in the mid 90s this sort of technology was almost unknown. In 1999 the European Directive about a framework for electronic signatures opened a broader technological approach to electronic signatures. Law makers are gradually reflecting “biometric signatures” now as well.
A lot of digitized handwritten signatures today are taken at a low resolution. One example is the capture devices that courier services are using. They capture a rather pixellated image of a signature that is usually not applicable for a later verification. Signatures taken on these devices may easily be claimed to be a forgery. Non-repudiation can only be achieved when the biometric characteristics of a signature are captured too, and when this information is securely bound to the signed document. The additional verification of dynamic signals offers a higher level in security. A signature with a similar image like the reference signature may be detected as falsification because differences in their creation characteristics are discovered.
In order to understand what is necessary to trust a signature it is important to keep in mind that forensic experts rely on the holistic analysis of signatures, i.e. they look at and take into account the paper features, type of stylus, the ink flow and “visible” pressure. Most forensic experts exposed to the analysis of dynamic signatures tend to forget to apply the same principles. The equivalent holistic approach for dynamic signatures must take into account which device was used for signature capture, the device features and maybe even the signing environment and the co-relations to the signing process.
Handwritten signatures may be digitized during the signing process instead of scanning them from paper using a wide range of instruments: pen pads (with and without LC display), special pens and Tablet PCs. They allow a gradual move from paper-based documentation to electronic forms and straight-through-processing as well as upgrading the quality of signature verification in general. A proper comparison of static signature characteristics and dynamic signature signals requires a digitizing instrument that is taking a sufficient amount of time signals.
In practice, many different electronic signature systems find wide use today, for many different purposes. In the broad sense of establishing identity and successful transmission of data, cryptographic signatures (also known as "digital signatures"). Examined here, however, are systems used specifically for verifying the authenticity of a single transmitted message.
One of the best examples of widespread use of electronic signature for common contractual purposes is in the Baltics. Estonia, and most recently Latvia, have seen widespread adoption of E-Sign systems by which all citizens are provided with the means to electronically sign agreements [23]