Before the arrival of the Internet as an open channel for business-to-business electronic commerce, parties to a commercial transaction normally created a vast paper trail to document the proceedings. While the paper trail itself created its own set of problems (such as the classic "battle of the forms"), the courts and commercial lawyers usually did not have to devote significant time and effort establishing the identity of the parties to the transaction. The paper trail provided the necessary verification and identification needed to confirm basic contractual details (e.g., that Able Company entered into a contract with Baker Manufacturing to purchase 100 widgets at $10 each, to be delivered to Able Company by January 10, 1995). One could easily determine the identity of the parties by simply reviewing the paper itself, including letterheads, logos, watermarks, handwritten signatures, initials, stamps, facsimile cover sheets, and facsimile header information, for example.

Parties seeking legal enforcement of paper-based commercial contracts could authenticate the content of a paper document or the validity of a signature on a given document through the testimony of witnesses, notaries public, records custodians, parties, or signature experts. They could use other documents containing writing samples at trial to prove the authenticity of a given signature. Original paper documents could be compared to copies to confirm that the copy was an accurate reproduction. The paper trail spoke for itself and was self-authenticating.

Why the Paper Trail?

Much of the commercial paper trail existed purely to satisfy the requirements of ancient, ritualistic contract law, which is the foundation of modern commercial law. For example, a doctrine known as the Statute of Frauds (now embodied in the Uniform Commercial Code) required that contracts for the sale of goods over $500 be in writing. To be enforceable, that writing had to be signed "by the party to be bound." Historically, commercial law envisioned a signing ritual where the contracting parties met face-to-face to review and sign the written agreement, the codification of the "bargain" the parties had struck. Most states have continued to honor the historical, ritualistic notions of contract in their commercial laws despite the adoption of the Uniform Commercial Code and rapid advances in technology, including facsimile machines, computers, electronic data interchange (EDI),

and, now, Internet-based electronic commerce. Courts in most jurisdictions have preferred tangible paper-based evidence of the contract. State and federal evidentiary law and rules have been slow to allow the admission of electronic mail and electronic information, in part because it was difficult to authenticate and did not fit the standard, age-old definitions applied to tangible objects of evidence. In addition, many consumer protection laws mandate the existence of certain tangible documents.

Enter Electronic Commerce

Business-to-business electronic commerce is conducted nearly anonymously through email, Web sites, and exchange of electronic information in various formats in real time. The paper trail is gone, replaced by streams of bits and bytes. There are no more face-to- face bargains, and there is no single paper contract that can be signed or brought into court to be enforced. The absence of a tangible written contract creates major legal problems regarding the "signed writing" requirements of existing commercial law.

Central to the legal problems of electronic commerce and electronic contracts are issues concerning authentication, integrity, and repudiation. Authentication refers to conclusively determining the identity of the sender of a given communication. In the legal context, authentication entails proving the identity of the parties to the contract or proving that one of those parties sent a given communication. Integrity refers to determining the accuracy and validity of the content of the communication. In the legal context, integrity can refer to proving the terms of the contract. Repudiation refers to a challenge to the authenticity of the communication. In the legal context, this is a denial by one of the contracting parties that it actually entered into the agreement or a challenge to the terms of the agreement itself. For example, the documents comprising an agreement with IBM might be written on IBM letterhead, which itself may have unique qualities (paper stock, watermarks, ink, logos, document control numbers, handwritten signatures of authorized agents, attorneys, etc.). The recipient of a document on authentic IBM letterhead with an authentic signature from an authorized IBM employee may reasonably rely on the authenticity and validity of the communication. Unlike paper documents, however, unencrypted electronic communications that are not digitally secured are easy to forge and alter absent some security mechanism. Given the ease with which many electronic mail systems and Internet sites can be invaded by hackers and unauthorized users, unsecured electronic communications lack the inherent authentication, integrity, and nonrepudiation qualities of paper-based communications.

Digital signature technology was created to provide the security mechanisms needed to address authentication, integrity, and repudiation issues. If a communication is sent with a digital signature, one can programmatically determine the identity of the sender by verifying the signature and digital certificate with the independent third-party Certifying Authority that issued the certificate. Digital signature technology also addresses the integrity issue, because the digital signature itself is unique to the content of each message sent by the sender: If the content of the digitally signed message has changed since the signing of the message, the recipient is notified by the software application performing the verification of the digital signature and certificate. In these respects, the digitally-signed communication is perhaps more reliable than older, paper-based evidence (such as facsimile transmissions), provided the sender or the Certifying Authority has not compromised the process. However, without legal changes giving digitally signed communications the same legal force and effect as their analog counterparts, the parties to an electronic transaction may not have a legally enforceable contract. In particular, while the digital signature technology vendors presume that the sender of a validated, digitally signed transaction cannot repudiate it, the law has not yet arrived at that conclusion.

State Action to Legitimize Digitally Signed Transactions

Lawmakers worldwide are beginning to address the issues of which electronic records will suffice as a "signed writing" in their jurisdictions and which digital signature technologies will serve as a legally recognizable substitute for a signature on the contract. Many entities have published guidelines for implementing electronic contracts and digital signature technologies, including the America Bar Association, the Internet Law and Policy Forum, and the United Nations Commission on International Trade Law (UNCITRAL). Many states are looking to the Uniform Electronic Transactions Act (UETA), drafted by the association that authored the Uniform Commercial Code (UCC), the National Conference of Commissioners on Uniform State Laws. The model UETA legislation contains the following basic provisions:

• A record or signature may not be denied legal effect or enforceability because it is in electronic form.

• A contract may not be denied legal effect or enforceability solely because an electronic record was used in its formation.

• If a law requires a record to be in writing, an electronic record satisfies the law.

• If a law requires a signature, an electronic signature satisfies the law.

The UETA model contains a number of other provisions designed to integrate digitally signed transmissions into the fabric of state law. The model legislation is technology-independent and does not specify criteria for any particular digital signature technology or any Certifying Authority. The UETA defines an electronic signature as "an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record."

Some states, such as Utah, have adopted detailed digital signature legislation, affecting a broad range of commercial transactions. The Utah legislation is based on the American Bar Association's Digital Signature Guidelines and provides for state-licensed Certifying Authorities (CAs), regulation of certificates issued by CAs, and delineation of duties for the various parties (CAs, subscribers, third parties, and key repositories). It also defines the legal validity of digital signatures.

Other states, such as Pennsylvania, have adopted the UETA model legislation nearly verbatim. California has adopted the UETA-style legislation with substantive modifications, including numerous exclusions, and specifies criteria for digital signatures to address security and trustworthiness concerns. Illinois has modeled its laws after provisions in the UNCITRAL Model Law on Electronic Commerce. Many states will have to harmonize the model legislation with existing consumer protection laws, which may require signed writings and tangible evidence of commercial contracts.

Finally, many states have enacted limited digital signature legislation pertaining to limited government transactions (such as corporation filings, tax filings, death certificate filings, UCC filings, and financial institution filings.)

Federal Legislation

Congress has also been bitten by the Internet regulation bug, and these interstate variances in the adoption of digital signature law have prompted Congress to act. In 1999, the House of Representatives passed H.R. 1714, the Electronic Signatures in Global and National Commerce Act. Figure 1 contains an excerpt from this bill, which is presently referred to the Senate. Figure 2 shows language regarding interstate commerce contained in the pending Senate bill 761, the Millennium Digital Commerce Act.

In prior sessions, Congress has passed other bills enabling various federal agencies to use digital signatures and electronic records in lieu of signed, written contracts.

Examples include the Government Paperwork Elimination Act (GPEA). Congress has also been adding digital signature provisions to various bills on a piecemeal basis. Past congressional efforts include the Electronic Financial Services Efficiency Act of 1997, Electronic Commerce Enhancement Act of 1997, and Digital Signature and Electronic Authentication Law (SEAL) of 1998.

As of this writing, a question that remains open is whether or to what extent these federal laws will pre-empt state laws. While the issue of pre-emption is complex, the basic question for the courts is whether Congress, in passing legislation, has manifested an intent to "occupy the field" for a particular area of law, precluding the various states from enacting law in that field. U.S. courts will have to address the preemption issue, especially given the broad scope of the proposed federal legislation and in light of Congress' right to use and extend its powers to regulate interstate commerce under the Commerce Clause of the U.S. Constitution.

International Efforts

The European Union, Argentina, Australia, Canada, Columbia, Denmark, Finland, France, Germany, India, Ireland, Italy, Japan, Malaysia, Netherlands, New Zealand, Russia, Singapore, Sweden, South Korea, and the United Kingdom have all recently undertaken studies and/or legislation regarding digital signature technologies in electronic commerce.

Privacy Rights Issues with Certifying Authorities?

Another growing concern is the lack of uniform laws regarding Certifying Authorities. Many groups have expressed concern that Certifying Authorities will not protect the privacy rights of their subscribers. Given that a Certifying Authority would, in essence, be privy to all digitally signed transactions undertaken by its subscribers, the concern is that Certifying Authorities could become unregulated data warehouses of private consumer information, including data trails from transactions. To that end, privacy rights groups favor limited data collection and disclosure by the Certifying Authorities, as well as a technologically neutral approach so that consumers can use multiple digital signature technologies to conduct their transactions.

A Binding Contract

Lawmakers worldwide are struggling to determine which digital signature technologies will receive legal recognition in their jurisdictions and which areas of law will require revision to permit the use of digital signatures in lieu of a paper-based signature in commercial transactions. Various states are adopting different approaches, as are various national governments. As of this writing, the various states and nations have not enacted uniform digital signature laws, and congressional action may slowly preempt state laws in this area. Given the rate of growth in electronic commerce, the infancy of digital signature technology and infrastructure, and the weaknesses of existing state and federal evidentiary and commercial laws, digital signature legislation will be a growing part of state, federal, and international legislative activity for the foreseeable future.

Figure 3 shows links that you can search for more information on digital contracts.

a) Prohibits a rule of law from denying the legal effect of certain instruments of electronic commerce on the ground that: (1) they are not in writing; or (2) they are not signed or affirmed by a signature if they have been signed or affirmed by electronic signature.

b) Upholds the legal effect of such instruments regardless of the type or method of electronic record or signature selected by the signatories. Emphasizes that this Act does not require a party to use or accept electronic records or signatures.

c) Cites circumstances in which an electronic record satisfies State rules of law mandating: (1) availability to the customer of a record in writing; (2) retention of a contract, agreement, or record in writing or in its original form; and (3) retention of a check. Upholds the contestability of signatures and charges.

d) Cites circumstances in which a State statute or rule of law may alter or supersede the general rule of validity governing instruments of electronic commerce under this Act, including: (1) that such statute or rule of law constitutes an enactment or adoption of the Uniform Electronic Transactions Act as reported by the National Conference of Commissioners on Uniform State Laws; and (2) a State requirement that certain notices be in writing for the protection of the public health and safety of consumers.

Figure 1: The Electronic Signatures in Global and National Commerce Act is currently in the Senate for approval. This is an excerpt from the Act.

(a) IN GENERAL—In any commercial transaction affecting interstate commerce, a contract may not be denied legal effect or enforceability solely because an electronic signature or electronic record was used in its formation.

(b) METHODS—Parties to a transaction are permitted to determine the appropriate electronic signature technologies for their transaction, and the means of implementing such technologies.

(c) PRESENTATION OF CONTRACTS—Notwithstanding subsection (a), if a law requires that a contract be in writing, the legal effect or enforceability of an electronic record of such contract shall be denied under such law, unless it is delivered to all parties to such contract in a form that—

(1) can be retained by the parties for later reference; and
(2) can be used to prove the terms of the agreement.

Figure 2: Bill number 761, the Millennium Digital commerce Act, is currently pending in the Senate. This is an excerpt from the bill.

Public Key Infrastructure Solutions Vendors

RSA Security Inc.: www.rsasecurity.com VeriSign, Inc.: www.verisign.com CyberTrust--A GTE Company: www.cybertrust.com Entrust Technologies: www.entrust.com Entegrity Solutions Corporation: www.entegrity.com Xcert International, Inc.: www.xcert.com IBM security Site: www.ibm.com/security/

Legal Links

United States Congress—Current Session Bills: thomas.loc.gov/home/c106query.html American Bar Association, Science and Technology Section: www.abanet.org/scitech/ec/home. htmlnternet
Law and Policy Forum: www.ilpf.org/ United Nations Commission on International Trade Law: www.un.or.at/uncitral National Conference of Commissioners on Uniform State Laws: www.nccusl.org/

Figure 3: Search these legal links and leading digital signature solutions vendors for more information on digital technology.

Also Read

Authentication and Authorization: Why? Part 3: A Word About Privileged Account Management

Authentication and Authorization: Why? Part 2: Query-Response Language & Policies

Authentication and Authorization: Why? Part 1: Access