Electronic Signatures Security, Enforceability, & Admissibility

Electronic SignaturesSecurity, Enforceability, & Admissibility Thomas J. Smedinghoff smedinghoff@wildmanharrold.com

Key E-Signature Laws • United States • Uniform Electronic Transactions Act (UETA) • Electronic Signatures in Global and National Commerce Act (E-SIGN) • European Union • Electronic Signatures Directive • International Treaty • 2005 United Nations Convention on the Use of Electronic Communications in International Contracts (UN E-Contracting Convention)

The UN E-Contracting Convention • Negotiated 2002-2005 at UNCITRAL • Approved by United Nations in November 2005 • Currently open for signature and ratification • Central African Republic, Lebanon, and Senegal signed to date • Signing ceremony July 2006 at UN • Applies to B2B international transactions • Non-regulatory approach to – • remove barriers to international e-commerce • provide legal certainty

E-Contracting Convention Summary • Legal recognition of e-commerce • Can’t deny enforceability due to electronic form • Definition of e-signature • E-records and e-signatures satisfy – • Writing & signature requirements • Originality requirement • Recognition of automated contracts • Rules for time and place of sending and receipt of messages • Rules for human input errors • Freedom of contract

How Should We “Sign” an Electronic Document? – Options (1) • Digitized handwritten signature • e.g., • Typed name of a person • e.g., “/s/ James Bond” • Secret code for a person • e.g., a PIN number – “007” • Any symbol • e.g., “X”, “” • A mouse click • e.g.,

How Should We “Sign” an Electronic Document? – Options (2) • Biometric data • A fingerprint • A retinal scan • A voice print • A “digital signature” • E.g. “iQCVAwUBMARo7vgyLN8bw6ZVAQF6ygP/fDnuvdAhGlDWsSMXUIRMuNHYzdZ00cqkDb/Tc2+DuhuEa6GU03AgZY8K9t5r9iua34E68pCxogUz009b1OcjNt6+o+704Z3j1YY9ijYM8BWNaSp9L2W4nUuWBdIyIWyol/2PjjRVNZEtqtSRQnPEpJ2IHtz9iGovHf0SqhSZKZs”

E-Signatures Are We Asking the Wrong Question?

But How You Sign is Not the Key Issue;The Real Issues are . . . • Identifying “who” signed (or “who” clicked) • Even an “X” on paper can comply with legal signing requirements • Ensuring document not altered • In other words, is the signed document trustworthy? • Security -- the missing element in e-signature discussions

Key Requirements for Trust • Authenticity • Who really signed the document? • Integrity • Has the document/signature been altered? • Since it was signed? • Since it was sent-- e.g., in transmission? • Since it was received --e.g., while in storage? • Nonrepudiation • Evidentiary issues – ensuring the signer cannot – • Falsely deny signing the document • Falsely deny the contents of the document

U.S. Symbol or process Attached Intent ________ ________ EU Data Attached _________ Method of authentication _________ Comparison of Requirements for a Valid E-Signature UN • Method • _______ • Intent • Identify signer • Reliability

The UN Approach • Long history of signature issue development at UNCITRAL • 1992-1996 – Initial focus on identity and “approval” • 1997-2001 – Shift to PKI focus • 2002-2005 – Shift to reliability appropriate to the transaction • Ultimate focus on a “reliable” “method” to establish “identity” and “intent” • Security is required for enforceability! • Doesn’t even use term “signature” • Option to prove up non-reliable signature

E-Signatures “Deemed” Reliable? • The standard formulation • Unique to the signer • Capable of independent verification • Under the signer’s sole control • Linked to the document signed such that any alteration of document or signature is detectable • But is this necessary or appropriate? • UNCITRAL moved away from this approach

Establishing Trust in a Signature • Trust can be derived from the type of signature • E.g., using a PKI digital signature for signing and/or digitally “locking the document” • Trust can be derived from the process used • E.g., careful authentication of the signer before he signs or clicks • E.g., carefully controlling access to the signed document

E-Signature Security: Why Should You Care? • The level of security may determine • Validity of a signature or assent • Enforceability of a document • Authenticating the source • Verifying the integrity • Validity of a transaction • Admissibility of electronic evidence

Security as a Precondition to Admissibility • An interesting recent case • American Express v. Vinhee (9th Cir.) • Electronic records not admissible without evidence of adequate security

The Key to Electronic Signatures and E-Transactions PROCESS and SECURITY!

Further Information Thomas J. Smedinghoff Wildman Harrold LLP 225 West Wacker Drive Chicago, Illinois 60606 (312) 201-2021 smedinghoff@wildmanharrold.com

Electronic Signatures Security, Enforceability, & Admissibility