Sign here: looking for the most direct route to the paperless office? Start with e-signatures. (Special section: financial aid).

Until just a few years ago, the University of Minnesota Office of Student Finance (OSF) was all about paper. Fourteen employees staffed the records maintenance department, and students waited in long lines to sign promissory notes. The department estimates that more than 500,000 pieces of paper were wasted each and every year. That works out to a stack almost 17 feet tall.

Now, the mailroom has disappeared; a training room is in its place. One employee handles records maintenance. There are no lines to sign promissory notes. And the hundreds of thousands of sheets of paper that used to define the office are gone, as students fill out applications and sign their promissory notes online. Minnesota, in fact, was one of the first universities to develop a paperless financial aid system. But it was no easy task: The changeover took an immense amount of technology and planning. There were systems to design, processes to work out, staff to train, and equipment to purchase. Yet, the real key to getting rid of the paper, says former OSF interim director Nancy Sinsabaugh, revolved around a single step: the use of e-signatures.

THE DOE DOES IT

An e-signature is defined as "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record," The definition comes from the "Electronic Signatures in Global and National Commerce Act," which was signed by former President Bill Clinton in 2000. The act, which gives e-signatures equal legal footing with "wet" signatures, is one of two key documents for higher ed users of e-signatures.

According to David Temoshok, director for Identity Management and Policy at the General Services Administration's Office of Governmentwide Policy, the E-Sign Act laid the groundwork for schools. "It says, basically, that you cannot deny the legality of an electronic signature just because it is an electronic signature," he explains. "And any law that would restrict this is preempted." The act, however, specifically exempted student loans for a year, or until the Department of Education issued its own regulations, whichever came first. DOE's Standards for Electronic Signatures in Electronic Student Loan Transactions, issued in April 2001, provided standards for electronic transactions conducted by lenders, guaranty agencies, schools, and borrowers under programs authorized by Title IV of the Higher Education Act of 1965.

More important, the Department of Education itself started using e-signatures in July 2001. Its rollout of an e-signature for the Free Application for Federal Student Aid (FAFSA) provided a good example of how it could be done, and how it might be done elsewhere. The Department encouraged students to file the FAFSA online, and offered a personal identification number (PIN) that could be used to sign the document electronically. The program has since grown rapidly. As of this past August, nearly half of the FAFSAs filed for the year were filed electronically. The government is now expanding the use of the DOE PIN. In addition to electronically signing the FAFSA, students will use the DOE PIN to sign federal loan promissory notes and forms that help students consolidate loans after graduation.

"And when the loans start servicing, they can use the PIN to establish electronic debit of their bank account, and we'll give them a quarter-point off the interest rate," says Charlie Coleman, deputy chief information officer for E-Commerce and Innovation in the Department of Education's Federal Student Aid program office.

CREATING THE E-SIGNATURE

There are many ways to construct an e-signature. The Department of Education's standards document mentions, among others:

* "shared secrets," e.g., a PIN or password

* credentials provided by a trusted third party, such as a public-private key pair (described on the following page), a cryptographic smart card, or a one-time password device

* electronic files based on biometric data such as fingerprints or retinal patterns

* scanned written signatures

The trick, say the experts, is to ensure that the signature is correctly linked to both the signer and the document.

PIN or password. There are several ways to confirm the identity of the signer. Perhaps the most practical for an all-online transaction is to check personal data against independent databases. This is what the DOE does in issuing a FAFSA PIN. Personal data provided by the applicant is cross -checked against databases maintained by the Internal Revenue Service, Social Security, and (in some cases) the Immigration and Naturalization Service. Only then is a PIN sent out to the address provided.

"We make sure we're issuing the PIN to the right person, to protect ourselves and to protect that individual against fraud," explains Nina Colon, team Leader of FAFSA on the Web and the DOE's PIN site.

Still, the PIN is ordinarily considered a low-security option form of e-signature. "People get a lot of PINs and passwords, and it's more than likely that they've written them down somewhere where others could find them," says Temoshok. "Then too, a PIN or password requires a database. The Department of Education, for instance, keeps a database of those PINs. And any database--no matter how secure on the front end--can be hacked."

More 'shared secrets.' A more secure e-signature approach is one used by Sallie Mae to enable borrowers to sign promissory notes online. The company's secure Web site walks the student through a series of screens that instruct him to enter his personal data, and inform him about the loan. As the student dicks through, Sallie Mae's computer records time and date stamps. Finally, the computer uses an algorithm to create a jumbled set of numbers and letters based on the information that's been collected; then it appends this code to the promissory note. Sallie Mae currently allows electronic signatures on the Stafford, Plus, and alternative Loans. (Using the e-signature is an option, not a requirement.)

The University of Minnesota has students e-sign federal loans through a federal government Web site, but uses a method similar to Sallie Mae's to handle direct loans and campus loans such as the Perkins.

"They get an e-mail, and have to go through steps with pretty tight security," says Jim Kennedy, senior associate director for Loan Programs in the Minnesota's OSF. "They have to be in their Onestop account, and have to verify their university password, social security number, and birth-date. We keep that as part of the electronic signature."

Public/private key pair. While many consider these forms of e-signatures to be secure, Temoshok advocates a more complex e-signature: an advanced type of signature that employs PKI, or Public Key Infrastructure. With PKI, the person who sends a document holds a digital file on his hard drive--also called a private key. This file is "applied" to the document being sent. On the receiving end, any user can find a public key associated with the sender, which when applied, will either verify that it was sent by the sender (if it was), or determine that it was not sent by that individual. In the world of financial aid, a student could apply his private key to his FAFSA, and the government could then Find his public key and verify that the student sent the application. This would fulfill the requirements of electronic signatures, and could be paired with fingerprint scans and other biometric technologies to provide even more security.

The problem with PKI is that it's rather expensive at the moment. The private keys and public keys are sold by various companies (Verisign, Entrust, and Microsoft, to name a few) and those companies also do the verification. "With 11 to 12 million students applying for aid each year," says Charlie Coleman, "it can amount to real money."

THREE KEYS TO E-SIGNATURES

Experts agree that you should keep three things in mind when you Look to adopt e-signatures:

One: Make sure the system you implement establishes identity--or that students are who they say they are--at some point in the process. In other words, build in a system that either forces a student to present a photo ID at the beginning of the process (as the Educational Testing Service does), or build a system that crosschecks the student's status with other independent databases. These databases could include credit bureaus, commercial data services, or state agencies such as the department of motor vehicles, or Federal databases. (Perhaps the best-known private supplier of data in the realm of higher education is NCS Pearson's Student Authentication Network--STAN--which draws upon the federal government's Office of Student Finance Assistance PIN database.) Your own school database is not considered independent for purposes of e-signatures.

Two: In general, an e-signature should use the same technology as is used in providing information about what the signer is agreeing to. In other words, if a student reads about his obligations as a borrower by using Adobe Acrobat Reader, the signature process should also occur in Acrobat Reader. By using this technology, you will confirm that the user has the hardware, software, and expertise to have accessed and read the agreement, and to have signed it.

Three: Consider building a simple system at the start, and proceeding to a more complex setup, step by step. Minnesota initiated its program by rolling out e-signatures for federal loans, and then eased into designing a homegrown system to accommodate the Perkins and university loans. In the future, the university could adjust that system to use a more secure e-signature. Make sure you view each upgrade as a step to the complete system.

WHAT'S NOT TO LIKE?

In the end, one thing's certain: E-signatures are going to be popular with students. Penn State University, which also rolled out online signatures for federal loans this year, had 850 of 950--that's close to go percent--signed electronically within the first week of the program.

Minnesota saw similar results. Says Sinsabaugh: "We sent out the first notices in mid-July 2001, and I was hoping for 50 percent." Instead, she reports, 87 percent signed online. "That tells me that students are not only adept; it's how they want to transact their university business. Most did it at night or on the weekend, when it was convenient for them."

Want to get those forms back quickly, and process them in a paperless environment? E-signatures may be your doorway to the clutter-free office you've always dreamed of.

Steve Gnagni lives in New York City and writes regularly about technology, education, and urban affairs.