Identity in the digital age
As you sit and enjoy your morning coffee, you flip open this week's edition of the Business Journal to your favorite column, "Legal Side," in the hope of learning a little more about the complexities of Polish law without suffering brain damage brought on by the reckless use of high-brow phrases in Latin or some other dead language. You notice that this week's article has been prepared by Judith Gliniecki; thus, it's likely to concern technology. Based on these assumptions, you make your decision whether to read the article or skip immediately to the restaurant review.
Buried in these assumptions is a trust that yours truly really is the author of this article. Fortunately for the readers of the WBJ, they can rely on its extensive screening and acceptance procedures for articles (well, a few margaritas never hurt the article writing and editing process). But what do you rely on when you receive an e-mail or when contracting online? This problem lies at the heart of the debate on electronic signatures.
In a paper-based world, we have developed various procedures for authenticating a document. Once upon a time when damsels in distress waited for knights in shining armor, wax seals on parchment paper were used to certify the signatory of a document. As women's hemlines became shorter, a signature inked on paper became the standard for authentication.
In the information age, the question becomes more complex for several reasons. First, there is the issue of authentication (putting your electronic stamp of approval on the document). Second, identification of the sender/signatory may be at issue because you might never have met in person. How can you be sure that the persons with whom you are corresponding really are who they say they are? Finally, when computers and the Internet make it a snap to copy and alter documents, how can you be sure if the message you receive is the message sent?
Various legislatures in various countries have attempted to tackle this issue of signatures in the digital world and adopt procedures that would allow participants in e-commerce transactions to rely on the messages received. Of primary importance to Poland in its efforts to harmonize its laws with those of the European Union (EU), on Dec. 13, 1999, the EU adopted a directive on a common framework for electronic signatures (Directive 1999/93/EC).
While the directive is based on technology-neutral principles, it makes a distinction between "electronic signatures" and "advanced electronic signatures." A regular electronic signature is broadly defined as "data in electronic form which are attached to or logically associated with other electronic data and serve as a method of authentication." Under this definition, the "JG" that I usually add to the end of an e-mail message could qualify as a regular electronic signature. Thus, the directive allows for the recognition of electronic signatures already used in the information technology sector and for any requirements adopted by this sector.
Conversely, an advanced electronic signature must meet "the following requirements: (1) it is uniquely linked to the signatory, (2) it is capable of identifying the signatory, (3) it is created using means that the signatory can maintain under his sole control, and (4) it is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable." Here, my simple signature of "JG" does not even pass the first test.
One of the most common methods for producing advanced electronic signatures consists of private and public cryptographic keys. Both of these are issued by a special service whose business is to issue keys and certify the identity of the key holder. When I send a message, I would use my private key to encrypt the message. When the recipient receives my message, she may decrypt and open it using my public key. With this system, the recipient can assume that I sent the message as only my public key can open messages sent under my private key. The other positive feature of a public key/private key system is that the public key cannot decrypt any message that has been altered after I sent it. Thus, my recipient can also assume that the text of the message is as I sent it.
The directive also addresses the issue of the evidentiary value of electronic signatures. Let's say that I enter into a contract over the Internet to sell a picture painted by my incredibly talented 3-year-old daughter (she is still in her abstract art phase). The buyer reneges on the contract, and we go to court. Under the directive, both regular and advanced electronic signatures are deemed legally effective and are admissible as evidence that the buyer and I entered into a contract. However, under certain circumstances, an advanced electronic signature must be given the same evidentiary weight as a handwritten signature. A court has more discretion in determining the probative value of a regular electronic signature.
EU member countries have until July 2001 to implement local legislation on electronic signatures. The word on the street is that Poland does not plan to be any slower and also intends to enact appropriate legislation next year.
Judith Y. Gliniecki is of counsel with and the head of the technology group at Hunton & Williams' Warsaw office.
