Do electronic signatures mean an end to the dotted line? For most Web users, signing a contract online is no big deal. But lawyers must consider the security and enforceability of their e-signatures.

"Signed, sealed, delivered--on line," you might hum, doing your best Stevie Wonder impression, as you paste a scanned picture of your signature into an e-mail and hit the "send" button. But is your John Hancock safe in cyberspace? Can you really negotiate and sign a contract entirely online with someone in another part of the world, and ensure that the signatures are valid and legally binding?

Electronic signatures are used today in many consumer transactions--from signing an electronic tablet for a FedEx package to buying books and CDs on the Internet, where entering a credit card number into a secure site that stores it in encrypted form stands as the user's agreement to purchase.

Increasingly, major transactions are being conducted electronically. People are using the Internet to buy cars and real estate, and they're signing contracts for home loans and closing costs online. For business-to-business transactions--which often involve negotiations, a lot of money, and complicated contracts--electronic signatures can render the contracts legal, valid, binding, and enforceable. Generally, these signatures use encrypted personal identification numbers (PINs) or digital-signature technology.

The Internet, an open environment that anyone with a computer can access, is changing the business of law. Where once lawyers traveled extensively for face-to-face meetings, relied on a complicated system of courier and overnight-express deliveries, or hovered by the fax machine, now they send e-mails with documents attached, saving both time and money.

The purpose of a signature, it is generally understood, is to bind the signer to a document. According to the Uniform Commercial Code, a document is "signed" if it "includes any symbol executed or adopted by a party with present intention to authenticate a writing." (1)

The American Bar Association (ABA) Science and Technology Section, which has published guidelines on digital signatures, notes that a signature identifies the signer with a document and signifies his or her approval of the document or intent that it have legal effect. The act of signing focuses the signer's attention on the meaning of the signature and finalizes the transaction.

According to the ABA section's Digital Signature Guidelines, a signature should not only indicate who signed the document and be difficult to reproduce, but also should be uniquely associated with what has been signed, making it equally difficult to falsify the document. (2) Digital signatures, it maintains, fill the bill.

But digital signatures are just one type of electronic signature, which may be any form of computer-based signature: the typed notation "/s/"; a scanned, digitized image of a paper signature; even an addressing format, like the header on an e-mail indicating who sent it. Attorney Michael Worsham of Forest Hill, Maryland, said the U.S. District Court for Maryland accepts "/s/" in front of his name to denote his signature. Herb Silverberg of Albuquerque uses a "fairly obscure, cursive-looking font" on faxes as a signature, which he said state courts accept without question. Other attorneys scan their signatures and paste them into word-processed documents, particularly for mass mailings.

"I use a .gif [picture format] image of my signature and superimpose it on the signature line of documents (usually in Word), which I then print to Acrobat PDF (with security) and send on," said Craig Ball of Houston. "I haven't researched whether this meets any statutory definition of an enforceable electronic signature, but no one has ever balked."

PINs can also signify a user's agreement to terms. "Some businesses and government agencies use PINs for signatures," said Benjamin Wright, author of The Law of Electronic Commerce. "Some businesses allow their employees to sign internal approvals (such as a senior partner signing off on an associate's work) or make changes to retirement plans using PIN signatures."

The enforceability of electronic signatures is an open question. For example, a typed name or signature block at the bottom of an e-mail messages, routinely appended, could be construed as a binding signature. Since this is not the intent, some attorneys recommend automatically including with every electronic message a statement that nothing in the message is intended to be an electronic signature.

Security is another concern. Taking deliberate steps to construct an electronic signature--by scanning a handwritten signature into a graphic file (.bmp,.jpg,.gif) and cutting and pasting it into an electronic document--may show the sender's intent to sign the document, but this method is vulnerable to forgery. What is to stop someone from copying it and appending it to another document, or preserving the signature but changing the document's content?

"Those who use .gifs as their signatures are using unsecure, symbolic signatures," said Wright, who noted that they may be legally binding because a signature is, by definition, just a symbol adopted with an intent to be legally bound.

"Even passwords as signatures are vulnerable," said Wright. "One of the things to look out for with PINs is 'keystroke logging' software [which is] planted on a network by a hacker or a disgruntled employee for the purpose of stealing the PIN keystrokes."

A more secure type of electronic signature uses a computer program to measure the characteristics of a signature written with a special pen or stylus on an electronic pad. The program tracks the curves and angles of the signature, as well as the speed and timing of the strokes, then uses security technology to attach the signature to one specific document. The signature cannot be cut and pasted into another document, and it can be verified using a database containing specimen signatures from the sender.

"Using touchpad technology to sign on a screen would be verifiable and acceptable," said Rick Digiorgio, an attorney in Birmingham, Alabama. "If it is good enough for Visa, it should be good enough for most anything else." Currently, Digiorgio uses scanned signatures on office correspondence but prefers to sign court pleadings in real ink.

Signature security

Digital signatures are perhaps the most secure form of electronic signature. These digital codes attached to electronic documents uniquely identify the sender. Digital signatures use public-key infrastructure (PKI), a system that relies on encryption and trusted third parties to verify that the person who sent--and "signed"--a document is who he or she claims to be, and that the document itself has not been altered in transmission. (3) The keys used in PKI are mathematical algorithms: The document creator uses a private key to digitally sign the document and encrypt the data, and the receiver uses a public key--generally stored in online databases--to verify the signature and return the message to its original format.

Third-party organizations known as "certificate authorities" (CAs) issue certificates to signers that list a public key and confirm that the person identified in the certificate holds the corresponding private key. They may have an arrangement with a financial institution that provides information confirming the signer's identity. The CA's role is to ensure the proper pairing of public and private keys, verify the date and time of electronic transmissions, and maintain open lists of private keys that are no longer reliable.

To conduct an electronic transaction using PKI, the sender obtains from a CA a digital certificate that verifies his or her identity, encrypts the document using the private key in the certificate, and then e-mails the document to the recipient. A digital certificate (the "signature") accompanies the document, verifying that the sender is a real person in the real world. The receiver uses verification software to retrieve the sender's public key, verify the signature, and decrypt the document.

The likelihood of malfunction with PKI and digital signatures "is far less than the risk of undetected forgery or alteration on paper or of using other, less secure, electronic-signature techniques," according to the ABA Science and Technology Section's Information Security Committee. Its guidelines describe a system for ensuring the identity of a private key's holder, making digital signatures as usable as handwritten signatures in commerce and legal proceedings, and "ascribing appropriate responsibility" if one of the parties involved in an electronic transaction denies liability. (4)

Evolving laws

The basic protections of contract law still apply in the Internet age, but the method of executing them is evolving. And as transactions that once required signet rings and sealing wax for validation begin to accept electronic signatures, laws governing the use of electronic signatures are starting to hit the books.

In July 1999, the Uniform Electronic Transactions Act (UETA) was passed by the National Conference of Commissioners on Uniform State Laws, which recommended that all states adopt the act. Under the UETA, electronic contracts are valid, and electronic signatures are binding as long as they can be traced to a person who intended to be bound by the signature. Some states adopted the UETA and included their own exceptions; others added electronic commerce clauses to larger budget or health care legislation. (5)

This patchwork of state laws made interstate commerce difficult to negotiate, so a year later, Congress passed the Electronic Signatures in Global and National Commerce Act (E-SIGN) to institute uniform guidelines. (6)

E-SIGN provides that electronic signatures have the same legal effect as handwritten signatures and "may not be denied legal effect, validity, or enforceability solely because [they are] in electronic form." The act defines an electronic signature as "any electronic sound, symbol, or process attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record," but it doesn't recommend any specific type of electronic signature.

The act, which may be overriden by state law where the UETA has been adopted, also provides consumer protections. For example, a service provider must get users' consent to a transaction and must notify them of their right to receive documents in nonelectronic form and to withdraw their consent to electronic transactions. Businesses must also state the hardware and software requirements needed for electronic transactions and notify users of record-retention policies.

E-SIGN directs that certain documents still require a signature on paper--including wills and records related to adoptions, divorce, or other family law matters; default, foreclosure, or eviction notices; product recalls; and documents whose subject matter falls under the Uniform Commercial Code. When it was written, the law also required paper signatures for court orders and notices (including official court documents such as briefs and pleadings), but electronic signatures are now being used in court filings across the country as federal courts institute electronic case filing and case-management (ECF/CM) systems.

"The fact that a document is filed via an Internet hookup that's validated by our court-assigned password is enough to have it considered as having actually been signed," said Silverberg. "The [New Mexico] courts have an elaborate digital-signature methodology for ensuring that documents issued by the court are valid."

Lawyers who have used electronic case filing cite several advantages: the ability to file or view documents 94 hours a day; immediate docket entries and access to updated docket sheets and documents; fewer paper files; savings in copying and courier costs; and notification of parties by e-mail. Using ECF, an attorney signs onto the system; follows prompts to enter information about the case, party, and document to be filed; then attaches the document, usually in PDF format. The court e-mails a receipt notifying the attorney that the document has been filed.

When attorneys register with a court's ECF system, they agree that the act of signing on will represent their signature. For example, those using ECF in the U.S. District Court for the District of Columbia agree to the following:

   Pursuant to Federal Rules of Civil Procedure
   11, every pleading, motion, and other paper
   (except lists, schedules, statements, or
   amendments thereto) shall be signed by at
   least one attorney of record or, if the party is
   not represented by an attorney, all papers
   shall be signed by the party. An attorney's/participant's
   password issued by the
   court, combined with the user's identification,
   serves as and constitutes the attorney's/participant's
   signature. Therefore, an
   attorney/participant must protect and secure
   the password issued by the court. If
   there is any reason to suspect the password
   has been compromised in any way, it is the
   duty and responsibility of the attorney/participant
   to immediately notify the court.

No single type of electronic signature has been widely adopted. With the passage of E-SIGN, both unsecure signatures, such as graphics attached to a document, and more secure digital signatures can be legally binding. "Some signature types will work well in one situation but not another," said Wright. "The problem with unsecure signatures is that they can be hard to prove in a dispute."

Attorneys who e-mail a retainer agreement or other contract to a client may still request that the client print the document, sign it, and fax it back. Courts have held that faxed signatures are valid. (7)

Since E-SIGN specified that "sound" Call constitute an electronic signature, Wright thinks there may be a future in voice signatures: "The idea is that the lawyer would ask the client or adverse party simply to call a telephone number and speak a voice signature--for example, 'I, Jane Doe, hereby sign the settlement agreement with XYZ Corp. dated August 29, 2003.'"

Wright is experimenting with his own service to provide voice signatures. To sign a document, users must e-mail the document to all parties and to Wright. The signer calls a number and speaks a script that constitutes the signature. Wright witnesses the signature with a voice record and returns electronic copies of the document, the signature, his witness, and a record explaining how the signature works.

Weighing options

In the end, attorneys must weigh the pros and cons of using electronic signatures to conduct business. It could mean tremendous savings in time and paper, postage, and document storage costs. Using digital-signature technology reduces the risk of forgery or claims that a document has been tampered with.

On the downside, there is no agreed-on standard for PKI or any other type of electronic signature.

For the higher-tech options, both sender and receiver will need to invest in hardware and software to store and encrypt documents safely. Lower-tech options, although usually less expensive, may be easily copied and misused.

Now that federal law makes electronic signatures binding, attorneys will have to match the security of their signatures to the importance of the document. Attorneys may choose to use .gifs for mergemail letters and PINs for court filings, for example.

Houston attorney Ball doesn't draw such fine distinctions. He considers himself bound by the ethic one of his first supervisors expressed: "When anything leaves this office with anything that purports to be our signature on it, that is a promise to the entire world that we will never deny the genuineness or binding effect of that signature to any outsider," he said, "no matter who put it on that document or why."

Notes

(1.) U.C.C. [section] 1-201 (39) (2001).

(2.) See INFO. SEC. COMM., AM. BAR ASS'N, DIGITAL SIGNATURE GUIDELINES, available at www.abanet.org/scitech/ec/isc/dsg-tutorial.html (last visited May 23, 2003) [hereinafter GUIDELINES].

(3.) One source of free encryption software is Pretty Good Privacy; visit the International PGP Home Page at www.pgpi.org.

To locate companies that provide PKI or act as certificate authorities, search the "Computers" directories of Internet-based search engines like Google (directory.google.com/Top/Computers) or Yahoo (dir.yahoo.com/Computers_and_Internet).

If you still haven't found what you're looking for, consider checking out the product recommendations from your favorite law-related Web site.

(4.) See GUIDELINES. supra note 2.

(5.) A list of state legislation covering electronic transmissions is available on the National Conference of State Legislatures Web page at www.ncsl.org/programs/lis/cip/ueta.htm.

(6.) Pub. L. No. 106-229, 114 Stat. 464 (codified at 15 U.S.C. [section] 7001 (2001)) (2000).

(7.) See Beatty v. First Exploration Fund 1987 & Co. Ltd. P'ship, 25 B.C.L.R.2d 377 (1988); Madden v. Hegadorn, 565 A.2d 7-25 (N.J. Super. Ct. Law Div. 1989), aff'd 571 A.2d 296 (N.J. 1989).

Rebecca Porter is an associate editor of TRIAL.