Key e-signature questions remain unanswered

From...

by Jennifer Jones and Brian Fonseca

(IDG) -- Lawmakers' decision not to prescribe specific technologies in the sweeping digital signature bill, which kicks in this week, may haunt the security industry -- and consumers -- for years to come. Industry experts predict plenty of interest but an equal amount of confusion as enterprises assess the risks and benefits of moving from paper-based documents to legally validated electronic ones.

E-Sign (Electronic Signatures in Global and National Commerce Act) went into effect Oct. 1 and was designed to boost e-business by giving legal weight to electronic documents.

"The definition of a signature under the new act is very broad; even an e-mail address can be used. [E-Sign] leaves it up to the individual people entering in contracts to prove that the person that they're trying to hold responsible really did issue the electronic signature. It leaves you on your own," said Aegis Frumento, an attorney at New York-based law firm Singer Frumento.

	MESSAGE BOARD
Security on the Net

Under pressure from the security industry, lawmakers designed E-Sign to be technology-neutral so as to institute development uniformity and eliminate the advantages that some individual state digital signature statutes previously gave to specific technologies, Frumento said.

"I think E-Sign will open the door to let systems evolve. [It] really levels the playing field across the country," Frumento said. "Now industries can develop systems with confidence that whatever systems they put in place will not be rendered state-by-state, and that's a big thing."

MORE COMPUTING INTELLIGENCE

IDG.net home page

InfoWorld home page

Sidebar: Cashing in on E-Sign

Digital signatures take effect in U.S.

Brokerages nervous about digital-signatures law

Reviews & in-depth info at IDG.net

E-BusinessWorld

TechInformer

Questions about computers? Let IDG.net's editors help you

Subscribe to IDG.net's free daily newsletter for IT leaders

Search IDG.net in 12 languages

News Radio

Fusion audio primers

Computerworld Minute

However, Frumento said there are disadvantages to not approving specific e-signature technologies, including the fact that it could give legal validity to subpar methods of proving an issuer's authenticity and could lead to a lack of safeguards for legally protecting the recipient.

To stand up in court, documents signed electronically will need a rigorous set of mechanisms to validate the identity of a person doing the signing -- which could give a boost to PKI (public key infrastructure) certificate and infrastructure companies such as Entrust Technologies, Baltimore Technologies, VeriSign, and RSA. But lagging PKI user technology still must be addressed, said analyst David Thompson, of Stamford, Conn.-based Meta Group.

"You need strong user authentication such as a smart card or [a] biometric [reader] or both -- something more than just certification built in to the browser, which is weak," Thompson said, adding that as a result, digital signature application companies such as Silanis Technology, Shym Technology, and Ubizen also could benefit.

Even aside from these issues, some security experts are skeptical that many electronic markets, such as the business-to-business e-commerce and online exchanges, will implement PKI anytime soon.

"I don't see b-to-b being greatly impacted, because right now there are not ad hoc relationships forming around extranets and exchanges," Meta's Thompson said. "And this legislation may not be enough to make up for the technology that is missing to do that and the trust it would involve."

Emphasizing the confusion in the market, one-third of companies seeking to implement digital signatures have decided to seek outsourcing help, estimated Jason Wright, industry analyst at researcher Frost and Sullivan, in San Antonio. And that number will increase to two-thirds by the year 2006, he said.

Reflecting that trend are offers from vendors such as Baltimore Technologies. Baltimore's Unicert plan allows corporate customers to do digital signature work themselves but carries an option to pass that work over to Baltimore if the enterprise decides in favor of outsourcing, Wright said.

Systems integrators PricewaterhouseCoopers and IBM are also poised to begin helping enterprises move to digital signature use.

Although it is unclear how E-Sign's impact will trickle down to other online forums of e-business over time, the bill's time and cost benefits are already attracting interest from some industries, according to Laura Rine, vice president of marketing at global financial institution and digital signature securer Identrus, based in New York.

"I think our financial institutions can envision the benefits of not having to look at a stack of papers six inches high from Japan to see if the goods were delivered on time or not and if they have to pay," Rine said. "I can tell you [that] they're excited."

The use of digital signatures could have a big impact on applications such as CRM (customer relationship management) that involve the time-consuming shipment of paper documents to customers for necessary signatures.

CRM vendor TechExcel, because of E-Sign, recently kicked into high gear its plans to combine digital signature capabilities from Silanis Technology with TechExcel's ServiceWise Web-based form initiative. Lafayette, Calif.-based TechExcel hopes to enable end-users to better manage Web-based purchase orders, product returns, and other processes that have traditionally required signatures.

"Electronic signatures could become a real trigger for workflow. Once a document is approved within a CRM product, it can trigger another aspect of workflow, and that is just not possible with papers and files," said Jeff Johnstone, senior director of marketing at TechExcel.

House passes digital signature bill
January 31, 2000
Compromise likely on digital signature bill
November 8, 1999
California inaugurates digital signatures
October 19, 1999
Bill would give legal recognition to online contracts
October 14, 1999

Digital signatures take effect in U.S.
(NW Fusion)
Brokerages nervous about digital-signatures law
(Computerworld)
New digital-signature law prompts vendor scramble
(Computerworld)
Digital-signature bill enables e-commerce
(InfoWorld)
U.S. commerce department selects Belgian algorithm
(InfoWorld)
What does it take to secure your systems?
(InfoWorld)
Compromise in the works on digital-signatures bill
(Computerworld)
Giving a digital handshake to online signatures
(NW Fusion)

The Electronic Signatures in Global and National Commerce Act (E-Sign)
President's remarks at signing of Electronic Signatures in Global and National Commerce Act

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.