Electronic Signature Assurance & the Digital Chain-of-Evidence

ProofSpace White Paper
Electronic Signature Assurance
& the Digital Chain-of-Evidence
Executing Legally Admissible Digitally Signed Records
by Jacques R. Francoeur, B.A.Sc., M.A.Sc., MBA
ProofSpace900 Clancy Ave NEGrand Rapids, MI 49503(312) 933.8823www.proofspace.comProofSpace White Paper
Table of Contents
1. Executive Summary 32. Electronic Signatures shall be Equivalent to Handwritten Signatures - Easier Said than Done 43. What needs to be Equivalent - an Electronic Signature? 54. The Challenges and Risks of the Electronic Medium 95. The Formation of a Digitally Signed Record 116. Electronic Signature Assurance 136.1 Signing Module 146.2 Act-of-Signing 176.3 Signed Record 206.4 The Digital Chain of Evidence 247. The Digital Chain of Admissibility: Meeting Legal Standards & Regulatory Requirements 268. Conclusion 29About the Author 31
ProofSpace900 Clancy Ave NEGrand Rapids, MI 49503(312) 933.8823www.proofspace.com Electronic Signature Assurance & the Digital Chain-of-Evidence - Revised July 2007 ProofSpace White Paper
1. Executive SummaryThe vast majority of information today is generated and processed in electronic form. Consequently the majority of business conducted today is in part or entirely electronic. However, the need to obtain signatures causes business processes to be driven to the physical world, resulting, not only, in delays and costs, but also, in the loss of competitiveness and the ability to adapt. The objective is simple - maintain an end-to-end electronic state throughout the business process. But are electronic signatures legal? Are they regulatory compliant? Can I hold my management accountable for approvals and decisions? Are my contracts enforceable? Can I have the same degree of control and security over my business? The answer is yes, if done correctly. The U.S. e-Sign Act provides for the non-discrimination of electronic signatures and records when compared to their physical counterparts. In legal terms, the legislation provides the same "legal effect and validity" to an electronic signature as that granted to a handwritten signature on a paper. Note, the legal recognition granted a handwritten signature, which is that of admissibility in a court-of-law, is far greater than the legal recognition granted an electronic signature, which is not to be deemed invalid solely because it is electronic. The key challenge is how to have an electronic signature have the same legal recognition as a handwritten signature - that of admissibility. In converting from ink-based signatures to electronic signatures, governing laws and regulations describe the overall goal that electronic signatures be generally "equivalent" to handwritten signatures. In order to achieve this requirement, one must understand first what makes an ink signature reliable. Secondly, one must understand what new challenges and risks are created by adopting the electronic medium. There are many abstract and intangible factors involved in the formation of a multi-party electronically signed record. If not performed and maintained reliably, internal approvals may not be accountable; electronic evidence in legal disputes may not be admissible; and regulated processes may not be compliant. This white paper defines the life cycle of an electronically signed record and describes the equivalence requirements throughout its retention period. A risk management framework called Electronic Signature Assurance will be presented that defines a generic Digital Chain of Evidence that guides the architectural choices available in deploying an electronic signature solution. However, the requirement for equivalence establishes a minimum legal admissibility standard that restricts the architectural choices to high reliability options. The result is a high assurance Digital Chain of Admissibility that holds individuals accountable for approvals and decisions and is deemed admissible and regulatory compliant.This white paper will lay out an innovative risk management model (Electronic Signature Assurance) and reference architecture (Digital Chain of Evidence) that can be used to deliver confidence that an electronic signature solution can execute signed records that will meet the requirements for legal admissibility.
ProofSpace900 Clancy Ave NEGrand Rapids, MI 49503(312) 933.8823www.proofspace.com Electronic Signature Assurance & the Digital Ch... [download for more]