Good Riddance to Fax Machines
Electronic commercial law (E-SIGN) is liberal as to what can serve as a legal signature. Essentially, a signature is just a symbol adopted with the intent to approve or authenticate a transaction or a record. The symbol can be as simple as the characters of a name at the bottom of an email.
But e-commerce practitioners have long fussed over how secure a signature should be. They feared that if the signature were just a typed name in an email, then the purported signer could repudiate* the signature by alleging that someone stole the password to his email account, spoofed his email address or tampered with the email record after the email was sent. Although supporting such an allegation in the context of real commercial relationships is often hard to do, the risk of the allegation still causes many lawyers and other professionals to insist that documents be signed by fax or hand-delivered paper.
But technology has changed. Webcams have become very common. They are on all new laptops, and now even smartphones like the iPhone have cameras that face the user. These webcams make video signatures easy, like this:
A webcam signature could be attached to an email that also attaches the document being signed (in the example above, the document is a non-disclosure agreement with Acme Corp.). By itself, email provides a pretty good system of records, controls and audit trails to establish from which account the email came, when it was sent and whether the record of it was tampered with. But the webcam signature adds an additional layer of reliability. It shows the signer moving his lips and speaking the words of intent to sign.
Yes, a webcam signature can be forged. But forgery is not easy amid the details of an actual commercial relationship. The forger must coordinate a fabrication of audio and video in a way that fits with the other facts of the real situation.
A webcam signature is emotionally very compelling because it involves recorded, physical activity. It’s hard to say I did not soberly, knowingly, voluntarily intend to sign the NDA.
Note one of the controls I used in the webcam signature example above. I spoke the date and time. The date and time in the video could synch up with the time stamp on the email to make a potential forger’s work all the more difficult.
Update: As more computer tablets come equipped with user-facing cameras, we need apps that artfully attach video signatures to out-going email. See demonstration using dual-camera Android smartphone.
Another update: See demonstration of webcam signature in capture of cyber-investigation evidence.
–Benjamin Wright
Mr. Wright is the founding author of The Law of Electronic Commerce, a treatise originally published in 1991.
*Signatures are sometimes needed for proving that a particular individual approved a transaction. Experience teaches that signatures can be useful to connect an individual to a legal act. Some criminal prosecutions have failed on account of the prosecutor's inability to prove that the defendant signed a document. For example, in United States v. Larm, 824 F.2d 780 (9th Cir. 1987), an allergist was acquitted of Medicare fraud concerning claim forms he did not personally sign. In United States v. Brown, 763 F.2d 984 (8th Cir.), cert. denied, 474 U.S. 905 (1985), the conviction of a pharmacist was reversed on some counts because the government could not link him, through a signature or initials, to claims submitted to the government for brand-name drugs when generic drugs were dispensed.
Ben, a couple of thoughts.
Video is forgeable, just like anything else. If you want to make this ever so slightly more difficult to forge, you want to include some elements in the video which would be hard to replicate unless you were there at the time.
Some examples:
People who take photos of mushrooms that they find in the forest often put in the frame of the picture of the current day's newspaper. That proves that they didn't get them earlier than that date. There may be other digital timestamping techniques that you can use that are equally obvious. (Of course, you can try to post-date something with this technique, but at least it provides a reference point that's tough to fake).
If you are sending someone a link to a video on Youtube, you're putting forth the opportunity for the sender to retroactively edit that video and replace it with something else. Consider sending the video as an attachment instead.
Utterances like this that are witnessed by someone else in real time, especially someone trustworthy, provide an added level of authenticity. What if instead of recording a monologue, you recorded a dialog with someone who was in some kind of notary role? The interaction could be via two way audio or video, capturing the recipient as well as the sender, and if there were any question you could refer back to the trusted third party to authenticate.
Posted by: Edward Vielmetti | October 18, 2010 at 08:31 PM
Edward:
Thanks for the comment. I agree that video can be forged. Handwritten signatures can be forged too.
However, successful, undetectable forgery of the whole package of evidence is not easy. In this example, the package of evidence that must be forged (with no trace of mistake) includes -- video, audio, email content, email audit trails, all relevant records of the email, and all of the time stamps. Plus, all of the forged facts must match up with the actual facts of the relationship between Ben Wright and Acme Corp. For example, there should be other timestamped emails between Ben and Acme discussing the non-disclosure agreement and the context of the agreement. The forgery must be consistent with those other emails.
In practice, making all of this match up places a big burden on the forger. If the forger makes even one mistake, he loses and he can go to jail for fraud.
--Ben
Posted by: Benjamin Wright | October 19, 2010 at 08:47 AM
Ben,
Interesting idea. I'm a little unclear on something. If I'm negotiating an NDA, there might be several versions that are exchanged. If I understand correctly, you're proposing that in order to agree to it, I attach the NDA and a video of me stating my intention of being bound by the NDA to an email, right?
So what's to prevent the recipient from removing the NDA that I agreed to and attaching a different version? Lotus Notes allows this fairly easily.
I'll need a higher level of assurance before I can see using this for anything but the most trivial contracts. I agree with Edward that some type of notary might be useful in your protocol.
Matt
Thanks,
Matt
Posted by: Matt Carlson | October 30, 2010 at 01:38 PM
Matt: Thank you for your comment.
The trickery that you suggest is subject to forensic analysis.
Email systems like Lotus Notes will keep an audit trail (meta data) showing whether the attachment was changed and when. If a party tries deceitfully to alter a contract by replacing the original attachment with a different one, and then to claim in court that the replacement is the original, he is buying himself a trip to jail (for fraud/perjury). See Munshani v. Signal Lake www.signallake.com/resources/email-forensics-library
--Ben
Posted by: Benjamin Wright | October 31, 2010 at 07:34 PM
Pleeeeease don't use email for that kind of stuff. You REALLY nead a secure container - the communication needs to be encrypted.
Or would you send all this info on a Post card, or let it be hand delivered by 5-10 strangers?
And for the signature - laughable as well. Put a Certificate in there - digital signature.
Just think security first, and don't brainstorm like i wanna use this technology and that... blah, and at the end i'm gonna add some 'fake' security.
Also think that each product you use like zoho, is a corporation, with corporate interests... They CAN change whatever they want - you CANNOT trust any Corp(this of course includes the Email providers, cell service providers, internet providers, hosters...). But all these trust problems you can get around with a secure container.
Posted by: Toby | November 24, 2010 at 12:26 AM
Toby:
I appreciate your comments, and I'd like to know more about them. I am grateful that you have really thought about my ideas and you have taken the time to state thoughtful arguments. What do you think about these rebuttals:
Businesses, governments and professionals have been using email for years to transact all kinds of important business and to exchange all kinds of semi-sensitive information. Should they stop doing that?
Email can be encrypted, in many different ways and to varying degrees of security and varying degrees of convenience/inconvenience. The ideas I state in the article above do not rule out encryption.
Email -- without digital signatures -- is used as evidence in court on a routine basis. Email is authenticated for legal purposes without digital signatures all the time. There are more judicial cases in which email is accepted as evidence than you or I will ever be able to read.
If you want to add a digital signature to email, you can do that (just as you can add a notary stamp to an ink-signed sheet of paper if you want to do that).
I'd enjoy hearing more about what you think a "secure container" is. If the secure container boils down to the investigator having a private key that he must protect with strong security, then a lot rides on that private key and the security around it. What happens if the investigator dies (or quits his job) after he performs his work and he locks the evidence with his key? How will someone else be able to find, unlock and authenticate the evidence? If all of this these problems are solved by key escrow, then the escrow becomes a big institutional (and possibly expensive) issue. Further, I'd like to know how practical key escrow is for investigators and how well it is implemented in practice.
Regarding reliance on corporations: 1. Happens all the time for purposes of important and sensitive transactions. 2. Backup copies of records can be make to places like hard drives and storage facilities controlled by alternative corporations. 3. The "certificate" to which you refer depends on a corporation (i.e., certification authority) that can do a bad job or go out of business.
As we evaluate these issues, please remember that the world of investigations is large and diverse. Not ever investigation is as sensitive as a criminal investigation of a mafia boss. Some investigations are just (for example) internal reviews of human resources issues inside a corporation.
--Ben
Posted by: Benjamin Wright | November 24, 2010 at 10:59 AM
Footnote. The Zoho example to which Toby refers is introduced here: http://computer-forensics.sans.org/blog/2010/10/22/digital-forensics-investigators-write-report-store-digital-evidence
Posted by: Benjamin Wright | November 24, 2010 at 11:04 AM
Thanks for sharing! However, the signature also has to be verified. After verifying by email or password, the signature is then associated with its user. One way for users to verify their own electronic signature is to privately activate it.
Posted by: Electronic contracts | January 03, 2011 at 01:04 AM
To "Electronic contracts": You say, "the signature also has to be verified." You and I have different visions for legal signatures. You seem to believe that a signature must be verified the way that a PIN or password is verified. That approach to verification inevitably involves some form of pre-registration with an authority. In your name, you linked to http://www.docusign.com, so I assume you are advocating the Docusign approach. I take it that under the approach you advocate, the signer must, before signing go through some kind of set-up process that involves registration of email or a password with an authority.
However, your approach to signatures (as you describe it here) seems clumsy and bureaucratic, a deterrent to many potential signers. Your approach is not like handwritten signatures on paper or fax. Your approach does not allow for spontaneous signatures because it requires pre-registration. Furthermore, your approach relies upon some kind of a registration authority, which is costly and problematic.
The webcam signature I offer here is like a handwritten signature on paper. It involves no pre-registration and no registration authority. No one has to pay the costs of the registration authority. The signer can sign spontaneously. Like a handwritten signature, the webcam signature normally is not "verified," except (1) the relying party can informally look at the webcam signature and confirm generally that it looks and sounds like the signer, and (2) in the event of a serious dispute about authenticity (which is very rare!), an extensive forensic analysis can be undertaken, looking into topics like (a) the meta-data associated with the email to which the webcam video was attached, (b) whether the video was altered or fabricated, and (c) evidence from the contextual relationship between the parties.
Back to you, "Electronic contracts." What do you think?
--Ben
Posted by: Benjamin Wright | January 03, 2011 at 09:24 AM