National Law Reinforces Legality Of Electronic Signatures

On June 30 2000, President Clinton signed into law the Electronic Signatures in Global and National Commerce Act (E-SIGN). Basically, the law states that electronic signatures are now officially endorsed by the U.S. government as a legal signature format. This would seem to open the door for completely electronic transactions and eliminate the need for pen and paper signatures.

But, wait a minute. Weren’t electronic transactions already taking place? Isn’t that the whole concept of e­commerce? Weren’t companies like PenOp and Verisign already selling electronic signature systems? The answers are yes, yes, and yes.

“The legal definition of a signature has always been broad enough to include electronic signatures,” explained Benjamin Wright, a Dallas-based attorney, author, and recognized expert on electronic signatures. “So E-SIGN’s substance does not change much. Its symbolism, however, is important. The law is the right of passage for electronic signature technology.”

So, what exactly has E-SIGN accomplished? “The President’s signing of E-SIGN has generated a public seminar on electronic signatures,” said Wright. “I’ve been on TV, on the radio, in newspapers, etc. This law has focused an overwhelming amount of attention on electronic signatures.”

Howard Schechter, CEO of PenOp—a vendor of electronic signature technology, agreed. “Since the beginning of the year, when people began talking about E­SIGN, interest in electronic signatures has escalated,” Schechter told DIR. “E-SIGN has set a national standard; and as a result, potential customers’ indecision is disappearing. Businesses sitting on the fence now have the impetus to take the next step toward installing electronic signature systems.”

Added Wright, “The law takes away the knee-jerk objection businesses might have to electronic signatures. A big corporation no longer has to run the concept by its legal department. Also, top executives have seen the E-SIGN publicity. They will start wondering why their companies aren’t using electronic signatures. After all, handling paper is expensive, isn’t it? This is not to say that suddenly all electronic signature companies are going to go public in six weeks and become filthy rich. However, the law has definitely created some good publicity for the industry.”

One issue preventing the immediate explosion of the electronic signature market is the number of different types of electronic signatures. “E-SIGN itself is supposed to be technology-neutral,” said Arvind Krishna, manager of advanced IT programs at AverStar, a software and professional services firm headquartered in Burlington, MA. “But from the user’s view, there are a lot of questions regarding which electronic signature technology to choose.”

Electronic signature systems come in three basic categories:

• Digital signatures – Digital signature systems leverage the public key infrastructure (PKI) for encoding and decoding documents. A digital signature does not involve handwritten signatures. Rather, a computer code is used to “sign” the document.

· Electronic signatures – Electronic signatures involve writing a name on an electronic pad and securing that name to an electronic document.

• Biometrics – Biometrics can be included in electronic signature systems in a number of ways. They can be integrated into electronic pads and used to measure such things as pen pressure to check the validity of signatures. Fingerprints or iris IDs can also be used to sign documents.

Several software developers and ASPs (application service providers) have offerings designed to take the guesswork out of implementing electronic signature systems. PenOp, which cut its teeth selling software based on written electronic signatures, is currently developing a software package—called Ceremony—to act as a “wrapper” for digital and electronic signatures.

Digital signatures, electronic signatures, and biometrics can alsobe combined in various ways. “In the paper world, everybody realizes that if you write your name on a piece of paper with some sort of stylus, you have entered into an association with the words and numbers on that paper. A written signature has cultural significance,” said Wright. “When you choose one of the 100 or so types of electronic signatures, it doesn’t carry with it that same history and cultural significance. So, users must be very deliberate when designing electronic signature systems—to ensure that their systems meet the cultural requirements of a signature.”

Specifically, Wright said that any signature must meet three requirements. “At the end of the day,” he said, “you must be able to prove three things:

· who signed the document

• that the document was not changed after it was signed

• that the person signing the document realized the intent of what he or she was signing.”

Krishna agreed with Wright that businesses must be careful when setting up their electronic signature systems. “Before picking a technology, a user should first define its business requirements, its constraints, and its processes,” he told DIR. “Choosing a technology before doing this is putting the cart before the horse.”

AverStar had installed electronic signature systems in a variety of markets, including healthcare and government. “In the healthcare market, for example, electronic signature systems have to meet the requirements of HIPAA (the Health Insurance Portability and Accountability Act of 1996). With government agencies, you have to take into account the other governments and businesses that they deal with,” said Krishna.

“Ceremony is designed to ensure that the person using an electronic signature understands his or her intent. It is also designed to prove the identity of the signer and to guarantee the security of the document,” explained PenOp CEO Schechter. “We are currently forming partnerships with vendors of different types of electronic signature technology. We want to integrate as many forms of technology as possible with Ceremony.”

Schechter said that Ceremony is currently in the alpha/beta stage and should be available by the end of the year. Two other vendors that we spoke with already have digital signature services up and running. These are DocuTouch, a Seattle-based provider of contract services, and AlphaTrust. AlphaTrust, based in Dallas, has an offering based on a credit card transaction processing model. Its CEO said the company offers “risk management for electronic transactions.”

DocuTouch was founded by former Microsoft executive Mir Hajmiragha. It opened in September 1999, and currently has 700 registered users in the legal, financial services, and building industries. Its biggest customer is LoanStreet, an online financing company. “To manage binding digital signatures, businesses have to store the signatures and their documentation in a legally binding fashion,” said Hajmiragha. “There has to be an audit trail.”

DocuTouch charges its customers approximately $1 per megabyte to store a document for its lifetime. It also charges transaction fees. “We want a percentage of the cost of processing a document. For example, if the cost of processing a loan is $2,000, we want a percentage of that,” said Hajmiragha. “So far this year, we have processed just over 1 million transactions. Our goal is to reach 12 million by the end of the year.”

To achieve this goal, Hajmiragha is negotiating partnerships with document management vendors and also with more institutions like LoanStreet—that specialize in conducting online transactions. “We will not wake up one day and find electronic signature services selling like hotcakes,” said Hajmiragha. “Rather, they will gain their foothold gradually, through vertical markets. Once consumers and businesses become confident that the technology works for a certain process, users will proliferate in that process. Potential processes include securing loans, signing insurance policies, and securing medical information. We are partnering with vendors that focus in various vertical areas.”

Hajmiragha added that it might take a court ruling to really get the electronic signature ball rolling. “Our services were legally binding prior to the E-SIGN law being passed,” he told DIR. “We rely on contract law, and E-SIGN just reinforces what we have been doing. We’ve had our site reviewed by law firms to make sure it complies with contract law, and we are in the process of having it reviewed again. One reason we perform this due diligence is that when a court decision is made regarding electronic signatures, it’s important that it comes back in our favor. We’d love to be part of the first court decision regarding E­SIGN because of the publicity it would generate.”

PenOp’s Schechter added that there is a difference between legislation, like E-SIGN, and adjudication. “As people sue and challenge electronic signatures, court rulings will be made, which begin to clarify the law—especially on the state and local levels,” Schechter told DIR.

Bill Brice, CEO of AlphaTrust, said that E-SIGN leaves a lot to be clarified. “E-SIGN has been good because it’s put a spotlight on electronic signatures. However, it leaves a lot of gaps and loopholes that companies still need to fill in themselves. It does not provide the complete coverage you would want,” Brice told DIR.

Attorney Wright, however, said it is not the government’s job to design a blueprint for how an electronic signature system should work. “All E-SIGN does is confirm the principle that an electronic signature can’t be denied simply because it is electronic. I would not trust the government to design an electronic signature system anymore than I would trust it to design my laptop,” said Wright.

AlphaTrust’s system for managing electronic signatures is based on credit card transaction processing systems. “In a credit card transaction, the user enters into a private agreement with a credit card company, like Visa. Visa then sets up different agreements with vendors that accept its cards,” said Brice. “In our system, AlphaTrust acts like the credit card vendor. Our customers sign an agreement with us saying that their electronic signatures are valid. Like credit card companies, through a warranty, we insure our customers against fraudulent use of their electronic signatures. We will also set up agreements with businesses that will accept electronic signatures from AlphaTrust customers.”

AlphaTrust began operating in late 1999. One of its customers is an online trading service that brokers a variety of transactions. Brice’s goal is to set up similar agreements with other online brokers. “It’s our view that, like the credit card market, the electronic signature market will shake down to three or four service providers,” he told DIR.

Brice said that EDI (electronic data interchange) and credit card transaction processing systems are currently the two most successful types of electronic transaction systems. “So, we’ve used those as our models. The systems are bound together through contractual relationships, not willy-nilly legislation,” said Brice. “Our customers were able to enter into legally binding agreements even before E-SIGN was passed.”

AlphaTrust has constructed its system using digital signature technology from vendors like Verisign, Entrust, Baltimore, and RSA. “We’ve chosen to base our system on PKI technology because most of the software needed to implement it is already in place in various Internet browsers and operating systems,” said Brice.

AlphaTrust charges customers $39 per year to use its service. “We believe electronic signature users will prefer a flat fee over a transaction fee,” said Brice. “After all, when you buy a pen to write your signature, depending on your taste, you pay a one­time fee of between 19 cents and $30.”

Brice believes AlphaTrust will be profitable charging such a low, flat fee because of the eventual pervasiveness of electronic signatures. “Five years ago, Internet e-mail was pretty exotic for most people. However, today, it’s an essential business tool for almost everyone,” he told DIR. “Today, electronic signatures also seem exotic. Within three years, however, I think they will also be an essential business tool.”

Comment: A year and a half ago, PenOp’s Schechter predicted that electronic signatures would send document imaging technology into its death throes. This was why Schechter left FileNET. After all, who needs paper for business transactions if you don’t need to sign the paper anymore? [See DIR 2/19/99.]

Now that E-SIGN has been signed by President Clinton, is the bell tolling for document imaging? Well, maybe the hunchback has entered the church, but he hasn’t yet approached the bell tower.

There is no question that e-commerce is the wave of the future. Too much money is being invested in it for it not to impact business transactions. However, the first wave of e-commerce is already subsiding, and document imaging companies are still standing. As evidenced by Kofax’s continuing commitment to the imaging market, at least one company doesn’t see paper going away anytime soon [see following story].

Looking a little deeper, however, you will see that the traditionally paper-centric giants that we cover, including Xerox and IKON, have been experiencing some financial woes. The market for paper documents and services may still be large (large enough to support multibillion-dollar companies), but it is not growing. And laws like E-SIGN will not help.

The good news is that the document imaging industry was formed with the goal of creating “the paperless office.” So, forward-thinking imaging companies have already been migrating to management of electronic documents and transactions. Also, the paperless office has been slower to arrive than many had anticipated, so there is still plenty of paper to keep us busy.

However, E-SIGN is just another sign that e­commerce is coming. So, although there will always be paper-based transactions, electronic transactions will definitely make their mark. Document imaging companies that want to be more than niche players will have to find a way to deal with both electronic and paper transactions.

For more information: PenOp, New York, PH (212) 997-8800, FX (212) 997-8810; Benjamin Wright, Dallas, TX, PH (214) 403-6642, e-mail: ben_wright@compuserve.com, http://wright.safeshopper.com; AverStar, Advanced IT Programs, Vienna, VA, PH (703) 827-2606, e-mail: akrishna@averstar.com; DocuTouch Corporation, Seattle, WA, PH (206) 224-3789, FX (206) 224-4982; AlphaTrust, Dallas, TX, PH (214) 290-1900, FX (214) 290-1918.