DPI ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION DIGITAL TRANSFORMATION POLICY NOTE SERIES SEPTEMBER 2024 © 2024 The World Bank 1818 H Street NW, Washington DC 20433 Telephone: +1-202-473-1000; Internet: www.worldbank.org Some rights reserved. This work is a product of The World Bank. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of the Executive Directors of The World Bank or the governments they represent. The World Bank does not guarantee the accuracy, completeness, or currency of the data included in this work and does not assume responsibility for any errors, omissions, or discrepancies in the information, or liability with respect to the use of or failure to use the information, methods, processes, or conclusions set forth. The boundaries, colors, denominations, links/footnotes and other information shown in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. The citation of works authored by others does not mean the World Bank endorses the views expressed by those authors or the content of their works. Nothing herein shall constitute or be construed or considered to be a limitation upon or waiver of the privileges and immunities of The World Bank, all of which are specifically reserved. Rights and Permissions The material in this work is subject to copyright. Because The World Bank encourages dissemination of its knowledge, this work may be reproduced, in whole or in part, for noncommercial purposes as long as full attribution to this work is given. Cover photo: © Shutterstock, Inc. Used with the permission of Shutterstock, Inc. Further permission required for reuse. Cover Design: [add name here] Attribution – Please cite the work as follows: “Tullis, Christopher; Constantine, Nay; Cooper, Adam. 2024. Electronic Signatures: Enabling Trusted Digital Transformation. © Washington, DC: World Bank.” Any queries on rights and licenses, including subsidiary rights, should be addressed to World Bank Publications, The World Bank, 1818 H Street NW, Washington, DC 20433, USA; fax: +1-202-522-2625; e-mail: pubrights@ worldbank.org. 2 TABLE OF CONTENTS Disclaimer 6 About ID4D 7 About KWPF 7 Acknowledgements 7 Executive summary 8 1. Introduction 10 2. Electronic signature basics 13 2.1 Enabling trust in the digital economy 13 2.2 Digital versus electronic signatures 13 2.3 Authenticating electronic transactions 15 2.4 Electronic signature use cases 16 2.5 Common myths 18 3. Trusted (electronic) transactions 21 3.1 What is a signature anyway? 21 3.2 Sources of trust 23 4. Trust framework 24 4.1 The role of a trust framework 24 4.2 Tiered trust: Levels of assurance 25 5. Legal framework 27 5.1 The role of the legal framework 27 5.2 Mutual recognition 30 ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 3 6. Technical implementation 32 6.1 A variety of possible technologies 32 6.2 The role of public key cryptography 33 6.3 The role of digital identity 35 7. Conclusions 37 7.1 Strategic 37 7.2 Legal and regulatory 37 7.3 Technical 38 8. Appendices 39 Appendix 1: Glossary of key terms 39 Appendix 2: Electronic signature use cases 41 Appendix 3: Good practice legal frameworks 43 Appendix 4: From analog to digital trust 46 4 Figures Figure 1: Layered model of digital trust 12 Figure 2: How electronic and digital signatures support authentication of electronic transactions 15 Figure 3: Use cases of electronic signatures 18 Figure 4: How signatures increase trust in transactions 22 Figure 5: Functional equivalence of electronic signatures 29 Figure 6: Digital and electronic signatures 35 Tables Table 1. Electronic signature versus digital signature 14 Table 2: Risk-based approach to analyzing electronic signature use cases 17 Table 3: eIDAS levels of assurance: Summary of key features 26 Table 4: Examples of advanced electronic signature implementation 33 Table 5: Examples of qualified electronic signature implementation 33 Table 6: Relevance of cryptography to electronic signature functionalities 34 Table 7: Illustrative example of the roles of providers of digital identity and trust services 36 Table 8. Common electronic transactions across sectors grouped by risk level 41 Table 9. UNCITRAL texts and key milestones 44 ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 5 DISCLAIMER This Policy Note is a reference document to be consulted by governments, development partners, academics and others when considering, designing, implementing, or managing national electronic signature ecosystems. It is not intended to be a comprehensive guide for planning World Bank operations. This Note is based on evolving international good practice, as understood by the World Bank’s Digital Development practice. It reflects experiences in a range of countries from different regions, with different legal systems, and at different stages of economic development. It also takes into account existing literature, laws, model laws, and norms and principles. There is no guarantee that addressing all the issues raised in this Note will result in successful design, installation, or management of a national electronic signature ecosystem—as doing so will depend on the consideration of many factors, which may be different from country to country. While every attempt has been made to be complete, there may be issues affecting the design, establishment, and operation of a national electronic signature ecosystems that are not addressed in this Note, or that are addressed in the context of certain assumptions, facts, and circumstances that do not apply equally to every situation. This Note is a reference tool only. 6 ABOUT ID4D The World Bank Group’s Identification for Development (ID4D) initiative uses global knowledge and expertise across sectors to help countries realize the transformational potential of digital identification systems to achieve the Sustainable Development Goals. It operates across the World Bank Group with global practices and units working on digital development, social protection, health, financial inclusion, governance, gender, and legal, among others. The mission of ID4D is to enable all people to access services and exercise their rights, by increasing the number of people who have an official form of identification. ID4D makes this happen through its three pillars of work: thought leadership and analytics to generate evidence and fill knowledge gaps; global platforms and convening to amplify good practices, collaborate, and raise awareness; and country and regional engagement to provide financial and technical assistance for the implementation of robust, inclusive, and responsible digital identification systems that are integrated with civil registration. The work of ID4D is made possible with support from the World Bank Group, Bill & Melinda Gates Foundation, the UK Government, the French Government, the Australian Government, the Norwegian Agency for Development Cooperation, and the Omidyar Network. To find out more about ID4D, visit id4d.worldbank.org. ABOUT KWPF This work is supported through the Korea-World Bank Partnership Facility (KWPF), a single-donor trust fund sponsored by the government of South Korea and administered by the KWPF Program Management Team within the World Bank Group. KWPF supports projects that identify, implement, and scale sustainable development solutions in developing countries around the globe, drawing on the significant experience and expertise gained by South Korea across its own development journey. ACKNOWLEDGMENTS This policy note was authored by Christopher Tullis, Nay Constantine, and Adam Cooper. Excellent feedback and input were provided throughout the development of this guide. The authors thank the following individuals for their various contributions: Audrey Ariss, David Black, Victoria Esquivel-Korsiak, Issam Khayat, Daria Lavrentieva, Viky Manaila, Jonathan Marskell, Slavina Pancheva, David Porteous, Lara Wanna, Gillan Ward, and Matthew Zoller. The authors are also indebted to invaluable comments from our expert peer reviewers Harish Natarajan, David Satola, and Vijay Vujjini. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 7 EXECUTIVE SUMMARY Trust lies at the foundation of all commercial and may represent a form of electronic signature. Attempting administrative transactions, which for centuries have relied to regulate such techniques out of existence in an attempt upon the handwritten signature for authentication. As to replace them with more sophisticated mechanisms can transactions are digitalized, the signatures that provide trust be counterproductive. However, as transactions become in them must also become electronic. The lack of trusted riskier—for example, due to a high monetary value or a risk and legally-recognized means of authenticating electronic of legal liability—more sophisticated electronic signature transactions has forced a continued reliance on in-person solutions may be necessary to enable digitalization. handwritten signatures, undermining digitalization efforts by Cryptographic techniques, in particular, can be used to necessitating recourse to in-person interaction to complete protect the integrity of signed documents and prevent a transaction. subsequent tampering. Such sophistical electronic signature techniques can provide a very high level of trust, enabling In-person handwritten signatures in the analogue world are even the highest-value and riskiest transactions to be safely not a particularly secure means of authentication. When digitalized. Full digital transformation cannot occur unless transactions are digitalized, new security issues arise, as the all transactions, regardless of risk, can be brought online. ease with which digital data can be duplicated or altered introduces additional vulnerabilities that never existed with The element of “trust” in electronic signatures is composed of paper. To address these concerns, electronic signature a set of complementary and mutually reinforcing layers. Each frameworks provide a means of authenticating the various layer builds on the lower layers to extend trust beyond what electronic transactions in a way that facilitates the emergence can be achieved without it. The foundational layer is rooted in of a trusted digital economy. existing “analog” sources of trust. The role of a trust framework should not be to crowd out these existing sources of trust but This policy note presents electronic signatures in terms instead to build on them. Trust frameworks accomplish this of their four main functions: (1) identifying the signer, (2) by formalizing a set of minimum requirements for electronic attributing the signature to the signer, (3) recording the signatures, providing transparency in their reliability. Trust signer’s intent to sign, and (4) assuring the integrity of frameworks should not only focus on the technology the signed data and protecting against tampering. Not components, but also the people and process elements, all transactions require a high degree of assurance of all which are as—if not more—important for providing trust. four of these functions. Indeed, for lower-risk transactions, Finally, the legal framework gives legal weight to the rules in attempting to assure a high level of trust in all four functions the trust framework and clarifies when and how signatures can may be counterproductive, for example, if doing so leads to be legally recognized, both domestically and across borders. excessive cost or frictions for users that dissuade them from A key function of the legal framework is to give electronic transacting in the first place. Therefore, policy makers should signatures the same legal weight as handwritten signatures. balance priorities between security and usability to ensure Many legal frameworks accomplish this by enshrining the widespread adoption of electronic signature solutions. legal equivalence of electronic and paper signatures into law, ensuring that signatures provided online are not disqualified Because different types of transactions have very different from having a legally binding nature. requirements, electronic signature frameworks should be designed around a risk-based approach that allows different The policy note concludes with suggestions at the strategy, approaches according to the needs of the use case. Low risk legal, and technical levels. Governments should design use cases may have very basic requirements. Whenever we electronic signature frameworks according to demand, click an “I agree” button to consent to terms and conditions, aligning with the needs of users and verifiers. They should enter a PIN code to authorize a payment, or type our name seek to promote adoption across the digital economy by at the end of an email or text message—all of these gestures addressing barriers and balancing security and usability, while 8 promoting interoperability. Taking a risk-based approach that requiring sophisticated cryptographic technologies, such defines outcome-based levels of assurance can provide for as public key infrastructure, should be limited to high-risk an electronic signature scheme that supports both low- and use cases where the additional cost and complexity of high-risk transactions. Trust frameworks should ensure strong such approaches is justified. Aligning trust frameworks linkages with legal identity systems for digital verification and with international standards can facilitate cross-border authentication, enhancing trust in electronic signatures. recognition, ensuring trust and facilitating cross-border trade. Governments should support sustainable business Maintaining technology neutrality can promote innovation models for the actors implementing electronic signatures and product differentiation, allowing systems to evolve and facilitate private sector participation to maintain long- and scale with changing requirements. Implementations term financial viability. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 9 1 INTRODUCTION As the world becomes increasingly digital, the need for to move past the limitations of current, often-rudimentary secure, efficient, usable, and legally-recognized methods of electronic signature frameworks to avoid bottlenecking the transacting online becomes ever more important. Electronic continuous development of the digital economy. Why, for signatures are a key enabler of digital transactions, allowing example, can the PIN code on the farmer’s mobile phone parties to interact online while being able to trust that not be used to authorize other types of transactions apart they are protected from the various types of fraud that can from those on his mobile money account? Why are such otherwise plague digital interactions.1 Electronic signatures electronic signatures seemingly confined to specific sectors can provide assurance of the identity of the parties to a of the economy, and often not available for interactions with transaction as well as protect the integrity of a transaction government? Why is it typically only low-value aspects of by preventing ex post modification of important details, service delivery that are digitalized today, with higher-value such as contract2 terms or transaction amounts. Alongside transactions still requiring an in-person visit to sign a paper other techniques for authenticating electronic transactions,3 form? This note will explore the ways that regulations can electronic signatures are a vital component in the move improve trust in electronic signatures, allowing them to be towards paperless environments, as they reduce costs and used to authenticate higher-risk transactions. streamline processes in both private and public sectors, enhance customer experience in electronic commerce, and In low-income contexts, electronic signatures can support facilitate the expansion of the digital economy. financial inclusion by enabling digital banking as well as e-commerce, extending the reach of these sectors to remote Although the legal frameworks explicitly regulating populations that are often difficult to access. Similarly, in electronic signatures tend to be more developed in higher- public services, electronic signatures can make government income countries, widespread use of electronic signatures services more accessible and efficient by reducing is a common occurrence in countries of all income levels. bureaucratic hurdles and improving transparency. However, For example, when a poor, smallholder farmer uses a mobile implementing electronic signatures in such contexts does money account to cash out a social assistance benefit or come with unique challenges, such as mitigating adoption pay his children’s school fees, the PIN code he types into barriers like poor connectivity, limited digital skills, and trust his phone to authenticate his identity and authorize the transaction is a simple form of electronic signature. issues among users. Despite these challenges, the potential benefits of using electronic signatures to facilitate digital So, if electronic signatures are already having a transformation makes them an essential tool in the digital age transformational effect worldwide without necessarily across all regions of the world. requiring any specific attention or regulation, what is the purpose of this policy note? The answer lies in the need 1   OECD Recommendation on Electronic Authentication and OECD Guidance for Electronic Authentication, 2007, accessible at: https://www.oecd.org/ digital/ieconomy/38921342.pdf 2   For the sake of simplicity and ease of understanding, this note uses the term “contract” to refer to various types of legal acts, not necessarily limited to contracts in the strict legal sense. For example, a signature may also be considered in the context of a will, which legally is not considered a contract between parties but rather a unilateral act. This note elides such distinctions for the sake of simplicity. 3   The nomenclature of the techniques used for authentication of electronic transactions can vary according to jurisdiction. Some legal frameworks reserve the term “signature” for cases where signatories are natural persons, distinguishing them from cases where transactions carried out by legal persons, such as firms or government entities, with a related term such as “stamp” or “seal.” Other techniques, such as securing a communication channel, may also provide additional trust and contribute to the transaction being considered authentic. For additional discussion, see also, UNCITRAL Model Law on Electronic Signatures with Guide to Enactment 2001, accessible at: https://uncitral.un.org/sites/uncitral.un.org/files/media-documents/uncitral/en/ml-elecsig-e.pdf 10 To this end, the purpose of this note is to guide policy makers Layer 2: Trust framework through the implementation of effective trust and legal frameworks to enable the use of robust and fit-for-purpose • Requirements for evidence and assurance. The sources electronic signatures throughout the digital economy. The of trust are then formalized and extended through a note is relevant for policy makers working on such electronic trust framework, which lays out minimum requirements signatures frameworks at national, regional, or sectoral for the people, process, and technology elements of levels. Following a brief presentation of electronic signatures a signature that provide evidence of its reliability. The and their role in enabling the digital economy, the bulk of trust framework extends trust through standardization the note focuses on how to create the policy environment and transparency. needed to provide for trust in, and adoption of, electronic • Levels of assurance. The trust framework may also signatures by users and relying parties.4 include multiple levels of assurance or levels of trust. Such tiered requirements can better support the A premise of this note is that “trust” in digital interactions needs of transactions of varying risk levels, allowing a is not solely, or even primarily, a function of technology signature of appropriate strength to be matched with a choices, but is rather a product of various people, process, transaction of corresponding risk. and contextual factors. These multi-dimensional sources of trust complement, and in many cases pre-exist, the Layer 3: Legal framework application of digital technologies. The note examines how the enabling environment can be calibrated to further • National legal framework. The legal framework is two parallel objectives: (1) capitalizing on existing sources the set of laws and regulations governing electronic of trust in the analog world and bringing them into the transactions and signatures. It establishes the legal digital economy, and (2) leveraging digital technologies to validity and enforceability of the trust framework extend this trust to new types of transactions as well as to and clarifies the legal implications, in particular the interactions with actors who would not otherwise be trusted. conditions under which electronic signatures are Achieving both goals simultaneously has the potential to considered equivalent handwritten signatures. multiply the number of electronic transactions while also increasing confidence in them, thereby enabling the growth • Mutual recognition framework. To ensure a common of the digital economy. Conversely, failure to achieve either basis for trust and cross-border recognition and of these objectives would pose a significant bottleneck to interoperability of electronic signatures, legal and the growth of online transactions. trust frameworks can be harmonized internationally, extending trust across borders. The note analyzes “trust” in electronic signatures as a set of complementary and mutually-reinforcing layers. Each layer Exact details of how electronic signatures can be builds on the lower to extend trust beyond what can be implemented using any specific technology is outside the achieved without it. scope of this note. References to specific technologies— whether paper-based or digital—are made only for Layer 1: Sources of trust illustrative purposes, and thus should not be interpreted as comprehensive or as endorsements of the technologies • Pre-existing trust. Trust can stem from existing sources, cited. In particular, the details of how high-trust electronic such as parties who already know each other, in signatures (sometimes referred to as “qualified electronic addition to contextual sources of trust, such as a secure signatures”) can be implemented using cryptographic communication channel. techniques and accompanying public key infrastructure (PKI) is outside the scope of this note; readers interested • Evidence of reliability. Existing sources of trust can in learning more about PKI implementation models should be extended using various techniques—with people, refer to the companion note in this series entitled, Public process, and technology elements—to provide Key Infrastructure: Implementing High-Trust Electronic evidence of a signature’s reliability beyond what would Signatures. Additionally, the scope of this note does not be possible relying only on pre-existing trust. cover in detail all the various related techniques that exist 4   A relying party is an entity (person or organization) that relies on an electronic signature by verifying it. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 11 Figure 1: Layered model of digital trust Mutual Recognition Legal Framework National Legal Framework Levels of Assurance Trust Framework Requirements for evidence and assurance Evidence of Reliability Sources of Trust Pre-existing Trust for authenticating electronic transactions (e.g., stamps and e nable trusted electronic transactions and scale the digital seals), but instead focuses on the particular case of electronic economy. It builds on previous analytical and normative signature. Although all electronic authentication techniques work, in particular work done by the World Bank,5 the are covered comprehensively, it should be noted that the United Nations Commission on International Trade Law technical, legal, and operational underpinnings of methods (UNCITRAL),6 the International Telecommunications Union,7 such an electronic seals are very similar to those used for the United Nations Conference on Trade and Development electronic signature, and due to this, much of the discussion (UNCTAD),8 the Organization for Economic Cooperation in the present policy note may apply to those authentication and Development (OECD),9 and others. methods as well. This note is intended to give practical guidance to practitioners on implementation of electronic signatures to 5   Examples of relevant work in include: World Bank. 2016. World Development Report 2016: Digital Dividends. Washington, DC: World Bank. World Bank. 2021. World Development Report 2021: Data for Better Lives. Washington, DC: World Bank. 6   UNCITRAL. 1996. Model Law on Electronic Commerce. Vienna: UNCITRAL. UNCITRAL. 2001. Model Law on Electronic Signatures. Vienna: UNCITRAL. 7   International Telecommunication Union (ITU). 2019. ITU-T X.509: Information technology - Open Systems Interconnection - The Directory: Public-key and attribute certificate frameworks. Geneva, Switzerland: ITU. 8   UNCTAD has engaged extensively in work related to e-commerce, including facilitating electronic transactions and fostering trust in the digital economy. Their work includes research, policy analysis, and technical assistance to developing countries, aiming to create an enabling environment for e-commerce and digital trade. 9   Examples of relevant work include: OECD. 2015. Recommendation on Digital Security Risk Management for Economic and Social Prosperity. Paris: OECD Publishing. https://oe.cd/dsrm OECD. 2019. Recommendation of the Council on Digital Security of Critical Activities. OECD/LEGAL/0479. https://legalinstruments.oecd.org/en/instruments/ OECD-LEGAL-0456 12 2 ELECTRONIC SIGNATURE BASICS 2.1 ENABLING TRUST IN for use cases related to digitalization of basic services for the population. Ensuring relevance to use cases with high THE DIGITAL ECONOMY development impact and avoiding deepening of digital divides will require attention to accessibility and adoption. For the digital economy to develop, many face-to-face Thus, another question arises: interactions will need to move online, and paper-based transactions will need to be conducted using digital 3. How can we reduce the friction of carrying out electronic means. The inherent security vulnerabilities of electronic transactions? communications systems raise the following question: Reducing friction will increase transaction efficiency and 1. How can we ensure that electronic transactions are at reduce barriers for end users, however, successfully least as trusted as paper ones? implementing electronic signature usage across the digital economy ultimately depends on lowering cost. Without The current state of digital transformation in many countries cost-efficiency, the development impact of trusted electronic is uneven and incomplete, with certain transactions transactions will be mitigated by low adoption. Thus, the being digitalized while others remain paper based. Some final question is: transactions can be initiated online, but at some point, an in-person interaction is required to sign a registration 4. How can we reduce the cost of carrying out trusted form, transaction order, or consent form. The reverse may electronic transactions? also be true, with initial onboarding for a service requiring an in-person signature before the door opens to future This question and the ones leading up to it will be addressed online interactions. End-to-end digital transactions and in the following sections. administrative processes remain the exception, especially in lower-income countries. More often than not, incomplete digitalization is due to transaction risk. Lower-risk aspects 2.2 DIGITAL VERSUS of a transaction can be carried out digitally or online, while ELECTRONIC SIGNATURES higher-risk aspects require paper processing due to a lack of digital solutions to prevent fraud. Digitalization of business Electronic signatures are a legal concept. The term is processes cannot lead to full digital transformation if high- relevant in cases where there is a need for a transaction risk transactions cannot also be brought online. This raises carried out electronically to be considered legally equivalent an additional question: to its analogue equivalent. Such transactions could be commercial (e.g., signing a contract), administrative (e.g., 2. How can we make electronic transactions even more issuing an official document), or involve individual signers trusted than paper ones? (e.g., consenting to a medical procedure). Although a primary concern with electronic signatures is At the simplest level, an electronic signature is any data security and fraud prevention, the development impact in electronic form, associated with other data, used by a of the digital economy will be limited if these signatures signatory to sign. Electronic signatures are technology are not usable, accessible, and adopted by users. The neutral and concerned with enabling trust in electronic premium on usability and accessibility is particularly high transactions along with legal recognition. Technical ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 13 sophistication and trust can vary widely, from a simple name used to generate it. It should be noted that digital signatures typed at the bottom of an email to a trusted implementation also have myriad uses outside of implementing high-trust of a PKI-based digital signature. Electronic (and indeed all) electronic signatures—such as securing everyday internet signatures presume that the signer is an individual person.10 browsing—which are outside the scope of this paper.11 Not to be confused with the legal concept of electronic While digital signatures refer to the technical process of signatures, digital signatures are a technological concept. assuring trust through cryptographic verifiability, the term The term digital signature refers to a specific way of assuring electronic signature introduces a socio-legal dimension the authenticity of a document or communication using of trust.12 Digital signatures are often used to implement techniques based on public key cryptography. In contrast electronic signatures, which include any electronic data to the technology-neutral concept of electronic signature, that carries the intent of a signature, but not all electronic digital signatures are a technology-specific technique, signatures use digital signatures. The two related but distinct allowing for robust cryptographic verification of the notions are compared in the below table: association between the signature and the digital certificate 13 Table 1. Electronic signature versus digital signature Term Definition Implementation Scope Legal concept denoting a signature generated using A technique for authenticating Electronic electronic means for the purposes Technology-neutral legally binding electronic Signature of authenticating an electronic transactions. transaction.13 Technology concept denoting a Applications both within and Digital signature generated using the Technology-specific (PKI) outside the sphere of legally Signature private key embedded in a PKI- binding electronic transactions. based digital certificate. 10   Legal entities and juridical persons cannot “sign” per se but may use equivalent techniques referred to as electronic seals or stamps. For further discussion, see for example, UNCITRAL. 2009. “Promoting confidence in electronic commerce: legal issues on international use of electronic authentication and signature methods.” Vienna: UNCITRAL. 11   Readers interested in a detailed discussion of digital signature use cases are referred to the companion paper, Christopher Tullis and David Black (2024), Public Key Infrastructure: Implementing High-Trust Electronic Signatures, Washington D.C: World Bank. 12   This note follows the convention of associating the term “electronic signature” to contexts where the focus is on signatures to enable legally recognized electronic transactions and reserving the term “digital signature” to refer to specific technology implementations using cryptographic techniques for assuring integrity and authenticity based on public key infrastructure. Although this terminological distinction is fundamentally arbitrary, making it allows for a convenient way to distinguish between two very different phenomenon, which is why the distinction is maintained here. Readers should note that several jurisdictions use these terms differently; in the United States and India, for example, the term “digital signature” is used to refer to the highest-trust electronic signatures provided for in national regulations. 13   Examples of more technical definitions can be found in relevant electronic signature legislations. For example, according to the EU eIDAS Regulation (2014), electronic signature means “Data in electronic form which is attached to or logically associated with other data in electronic form, and which is used by the signatory to sign.” Alternatively, in UNCITRAL Model Law on Electronic Signatures (2001), “data in electronic form in, affixed to or logically associated with, a data message, which may be used to identify the signatory in relation to the data message and to indicate the signatory’s approval of the information contained in the data message.” 14 2.3 AUTHENTICATING transaction. For many electronic transactions involving individuals, an electronic signature is sufficient. ELECTRONIC TRANSACTIONS There are, however, cases where additional evidence may Legally, a transaction or document is generally regarded be required. For example, since electronic signatures are as “authentic” if there is sufficient evidence that it is what generated by individual signers, transactions that require it—or its proponent—claims it to be.14 In the context of an a person to sign on behalf of a legal entity may also electronic transaction carried out online, this means that the require an additional authentication technique, such as an results of the transaction accurately reflect the intentions and electronic stamp or seal. In such cases, the combination of understanding of the parties that carried it out. The parties the electronic signature (of the representative of the legal could be natural persons, legal entities (juridical persons), entity), the electronic seal (of the legal entity itself), as well or a combination of the two. as other potential authentication techniques, such as the use of a secure communication channel, would be considered Electronic signatures are a central technique for together when evaluating the authenticity of the transaction. authenticating electronic transactions because they allow to identify and capture the intent of the people involved in the The relationship between electronic transactions, electronic transaction, as well as offer some assurance of the integrity signatures, digital signatures, and other authentication of any documents or other data exchanged as part of the mechanisms such as stamps and seals is illustrated in Figure 2. Figure 2: How electronic and digital signatures support authentication of electronic transactions ECONOMY s ns ion tio ct ac Authenticated sa ns electronic an Secure tra Tr transactions communication channels ic on ctr Ele Electronic electronic signatures Electronic seals timestamps Digital signatures COMPUTER SECURITY 14   UNCITRAL. 2009. “Promoting confidence in electronic commerce: legal issues on international use of electronic authentication and signature methods.” Vienna: UNCITRAL. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 15 2.4 ELECTRONIC • Judiciary. Submitting affidavits or declarations, signing court orders or judgements. SIGNATURE USE CASES For many services and administrative procedures, only part of Electronic signatures are relevant to a variety of use cases a process can be digitalized without an electronic signature, across the economy. In general, any transaction – whether but the overall transaction cannot be completed without an high or low value, commercial or administrative—that can in-person paper signature. The absence of suitable electronic be digitalized, can be an electronic signature use case. signatures solutions for riskier transactions impedes the Drivers for making signatures electronic include allowing resilience and competitiveness of the digital economy, transactions to be carried out online, as well as reducing the effectively leading to a “glass ceiling” effect, potentially number of digitalized processes that need to be interrupted limiting legal recognition and therefore putting limits on and continued offline due to a digital trust deficit. what can be safely digitalized. While the Covid-19 pandemic prompted a swift move towards remote online services for More specifically, there are transactions across sectors for which in-person interaction was previously needed (such which the absence of a trusted electronic signature is a key as notary services),15 the requirement for a handwritten barrier to digitalization. Some examples are given below; a signature is still prominent in many countries for sensitive more comprehensive list can be found in Annex 2: Electronic transactions. The lack of trusted means for conducting digital Signature Use Cases. transactions poses a significant barrier to achieving end-to- end digitalization of services and administrative processes, a General pre-requisite for bringing them fully online. • Authenticating electronic transactions. Signing a contract, In the financial sector, for example, governments worldwide issuing an official document, verifying their integrity. are trying to improve access to and portability of financial services through financial inclusion and open banking • Providing consent. Recording user consent, e.g., to strategies. These efforts can be hampered if electronic share personal data or for a medical procedure. signature mechanisms are not in place to facilitate secure • Trusted data sharing. Sharing data and documents online transactions. Financial institutions may allow customers between entities in a way that preserves data integrity to start the process of opening a new account or applying and machine readability. for a loan online, but the customer may still be required to visit a branch in person to sign the necessary documents to Specific complete the process. Electronic signatures would provide a secure and legally binding way for customers to sign the • Banking. Opening accounts, online banking, authorizing account form or loan agreement digitally without needing to payments. visit a branch. • Credit and insurance. Submitting applications, signing An important dimension that needs to be analyzed for agreements, submitting claims. each use case is the risk level of the transactions as well as • Health. Consenting to procedures, issuing prescriptions, the usability requirements. Some transactions are highly managing medical records. risky, for example, if they have a high monetary value or process highly sensitive data, while other transactions may • Education. Course registration, online exams, issuing be relatively low risk. For lower-risk transactions—where diplomas and certificates. the premium is on promoting transaction volumes and accessibility while lowering costs—the most sophisticated • Electronic commerce. Ordering from suppliers, signing electronic-signature trust measures may not be appropriate contracts, real estate transactions. as they might be too expensive or too cumbersome to use. • Public services. Initiating administrative procedures, tax These high-security measures should be reserved for higher- declarations, e-procurement, online voting. risk transactions where the trust benefits outweigh the cost. 15   See for instance: “e-Signatures and remote notarization in the time of COVID-19,” Jones Day, March 2020 accessible at: https://www.jonesday.com/en/ insights/2020/03/esignatures-and-remote-notarization 16 Consider the following three illustrative examples: security features—over the mobile money case – may be justified to ensure trust. • Low risk: P2P Payments. A person-to-person (P2P) • High risk: Government Procurement. Digitalizing remittance payment made using mobile money, government procurement systems is crucial to enhance generally done in small monetary amounts, is a relatively efficiency, increase transparency, reduce corruption, low risk transaction. This is reflected by the very simple and facilitate access to government contracts for a mechanisms used to process payment orders, which wider range of suppliers.16 However, procurement can be signed using a four-digit personal identification digitalization can also heighten the risk of fraud and number (PIN) code. This technology choice may be manipulation of procurement processes if robust appropriate given the typically low transaction amounts security measures to safeguard the integrity of the as well as the low digital skills of the target population, procurement process are not in place. The high value which include low-income and illiterate populations, of many government procurement contracts gives and accompanying need to actively promote service fraudulent actors a high incentive to try to break the adoption through service design. system. Relatively low transaction volumes combined • Medium risk: MSME Payroll. A micro, small- or medium- with the relatively high digital skills of the target sized enterprise (MSME) may wish to process payroll population (bidders on government contracts) puts less digitally into employee accounts using electronic bank of a premium on usability. transfers without having to go to a bank branch to sign a payment order. Since such transfers may be of higher These three indicative use cases, and the risk-based value and subject to more disputes than P2P payments, methodology used to analyze them, are illustrated in Table which are often sent within trusted networks, additional 2, in addition to a real estate use case.17 Table 2: Risk-based approach to analyzing electronic signature use cases Transaction Signature Transaction Usability Signing method Use case value Assurance risk level requirement (indicative) (indicative) Level User enters PIN code using P2P payment17 $10 Low High Low standard mobile money interface. Mobile banking app used. User may authenticate with a biometric; MSME payroll $10,000 Medium Medium Medium other security features may be employed. Medium to High-trust electronic signature Real estate $1,000,000 High High Low generated using a digital certificate issued by a trusted Government party in conformity with $100,000,000 Very High Low High procurement applicable standards. 16   Electronic government procurement can also help open government contracts to international competition by eliminating the need to submit physical bidding documents, which can be costly, time-consuming, and may disincentivize bidding. 17   The amount of individual person-to-person (P2P) transactions can vary widely. The amount represented here should be taken as indicative, for comparison purposes only, as it is based on general trends observed in Global Findex surveys for typical P2P transfers made using mobile money or other digital financial services in emerging markets. Demirgüç-Kunt, Asli, Leora Klapper, Dorothe Singer, Saniya Ansar. 2022. The Global Findex Database 2021: ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 17 Figure 3: Use cases of electronic signatures Government procurement $100 million Real estate $1 million Increasing transaction risk Payroll $10,000 P2P payment $10 Increasing size of user base A list of additional potential use cases of electronic important to recognize that the PKI itself gives no assurance signatures, broken down by risk level, can be found in Annex of one of the most crucial components of the signature: the 2: Electronic Signature Use Cases. signer’s identity. 2.5 COMMON MYTHS For many common use cases, the identity functions of a signature—knowing who signed or confirming that someone intended to sign—may be more important than A number of common myths about electronic signatures the sophisticated assurance of integrity and non-repudiation can lead to the design of sub-optimal electronic signature offered by a PKI-based signature. For this reason, the many frameworks. This section examines and dispels six common electronic signatures for low- to medium-risk transactions are myths regarding electronic signature application and designed around the identity component rather than a PKI. implementation, motivating a more detailed discussion later in the paper, which will further substantiate this analysis. For example, many financial-sector transactions allow a wire or P2P transfer to be initiated based on the authentication Myth #1: Electronic signatures require a PKI for of the identity of a user using a feature phone interface or a implementation. bank or payment provider’s mobile application—using a PIN code or biometric, for instance.18 In such cases, the electronic signature authorizing these transactions is implemented based on digital ID authentication technology without any In certain cases, it’s assumed that electronic signature PKI-based digital certificate or other cryptographic methods. implementation must be centered around PKI technology. Introducing sophisticated functionality to such simple Although the cryptographic technologies underlying PKI transactions would be counterproductive, as doing so could do offer some of the most secure techniques for verifying pose a barrier to the increasing adoption of digital money the integrity of signed documents and preventing the transfers without adding meaningful additional security to subsequent repudiation of electronic signatures, it is Financial Inclusion, Digital Payments, and Resilience in the Age of COVID-19. https://doi.org/10.1596/978-1-4648-1897-4 18   In this particular use case, both the authentication of the user’s identity and the electronic signature of the transfer order are implemented using the same technological means. This is possible when assurance of the identity function of an electronic signature is determined to be sufficient to the risk level of the use case. 18 these generally low-value transactions. all else—especially if additional levels of security would Cryptographic technologies such as PKI can be reserved for degrade usability, accessibility, cost-efficiency, or adoption. higher-risk use cases where it is necessary to be able to verify The most ideal way to provide an adequate balance of the integrity of the precise text of the wire transfer order, or its security is through a multi-tiered trust framework based on a risk-based approach that creates space for different types of electronic signature solutions for different needs, according Myth #2: A digital signature is just a specific, highly to specific use cases. Standardizing levels of assurance in an secure type of electronic signature. outcome-based way can facilitate transparency and trust in precise timestamp, in order to ensure trust in the transaction. Myth #4: Low- and medium-assurance electronic The term “digital signature” usually refers exclusively to signatures are not legally valid. signatures based on digital certificates issued and managed by a PKI. Such PKI-based digital signatures can be—and are— used to create legally valid signatures to support electronic such a variegated electronic signature framework. transactions. Digital signatures have the potential to provide While low-trust electronic signature may not benefit from a very high levels of trust when they are used as a technology presumption of reliability in court, it still can be legally valid to implement electronic signatures. as functionally equivalent to a handwritten signature. The nuance is that courts have the final authority to determine the However, digital signatures are also used in a variety of validity and legal effect of lower-trust electronic signatures. other applications outside the digital economy where legal While laws and regulations provide general guidance, equivalence to handwritten signatures is not the goal. The courts interpret and apply these laws based on the specific most common of these transactions is securing everyday circumstances of each case. Factors such as the intent of electronic communications, such as internet browsing and the parties and the reliability of the signature process are email. Indeed, modern web browsers require PKI-based considered. Observed jurisprudential trends in both civil signatures to be verified for every website a user visits.19 and common law systems highlight a liberal approach in The type of PKI required to support such secure electronic which courts have recognized even the simplest forms of communications is significantly less complex to implement electronic signatures (such as a name typed at the bottom than the type of PKI that would support high-trust electronic signatures implemented at country scale. These technical use cases for digital signatures are not electronic signatures, Myth #5: Electronic signatures are not relevant to since the legal dimension is lacking. While such purely lower-income countries. technology-focused implementations of digital signatures may provide a high level of assurance of data integrity, of an e-mail) as legally valid for many common transactions. without being coupled with additional non-technology measures, they would not offer assurance of the identity of When a mobile money account user in a low-income a signer, which is a key requirement of electronic signatures country makes a transfer and enters his or her PIN code to authorize the transaction, this simple gesture is an electronic signature. Despite any shortcomings from a functional Myth #3: The highest-security electronic signature or security perspective, such simple electronic signature available is always preferred. technologies have been largely successful because they are fit-for-purpose for the types of transactions for which they are used in terms of risk-appropriateness, usability, and most electronic transactions. and adoption. Such pragmatic and innovative solutions Designers of national-level electronic signature frameworks to securing transactions are continuously emerging as the should avoid the temptation to prioritize security above digital economy develops. Further digital transformation 19   It is incorrect to assume that it would be straightforward to implement PKI-based digital signatures in the digital economy simply because they are mainstream for internet transactions. The way that digital signatures are implemented on the internet does not require individual users to generate electronic signatures (this burden falls on the website publishers). For individuals and businesses, this method removes many adoption barriers to PKI-based digital signatures, particularly constraints related to registration/identification and usability/adoption. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 19 will require additional innovations to extend the reach and implementing lower-assurance electronic signatures first to relevance of electronic signatures to enable additional begin harnessing their benefits while PKI implementation electronic transactions. Demand for additional use cases issues are sorted out. will increase as the volume of digital transactions continues to grow. Consenting to having personal data shared with third parties, signing loan and microcredit agreements, Myth #6: To implement national PKI, government and using digital health services all require a way to reliably must build and operate the infrastructure. record a user’s intent to make a transaction. Services that would use this functionality cannot be digitalized without a reliable method to record intent, as they could not be To implement high-trust electronic signatures, there needs deployed securely and with trust. Therefore, innovations to be a legally recognized way for signatories to obtain in this area should be embraced and competition that digital certificates and relying parties to verify the signatures includes the private sector should be encouraged to yield a created using them—in other words, a PKI. Operationalizing new generation of ever more usable and secure electronic a PKI on a national scale system is a complex undertaking, signature technologies in less-developed countries. Building usually requiring the intervention of multiple actors in a trust framework that creates space for new innovative complementary roles—for certification, registration, etc. solutions, while simultaneously extending trust in existing solutions, is a goal relevant to countries of all income levels. There is no one best practice institutional or architectural model for PKI implementation. While vertically integrated One key reason for this myth’s persistence may lie in the models are possible, where one public sector entity confusion between electronic and digital signatures. performs all the PKI’s functions, it is more common for a PKI Specifically, the misled assumption that electronic signature to be implemented in a partnership of multiple actors in the implementation requires the operationalization of a public or private sector, or a combination of the two. There national level PKI (see Myth #1), or that public provision are strengths and weaknesses to each model, and the most or monopoly on PKI is required (see Myth #6), may make appropriate model for a country to choose depends on a electronic signature implementation seem unnecessarily variety of contextual factors, including institutional capacity, daunting. At the national level, good reasons not to private sector market maturity, and financial and budgetary prioritize implementation of PKI-based electronic signatures considerations, among other concerns. include: (a) high cost and complexity of implementation; (b) low relevance of high trust level, especially if priority use For a more complete discussion on this topic and cases are lower risk; and (c) prioritization of adoption and more concrete guidance on how to choose the best transaction volumes and accompanying concerns about implementation model for a national PKI, the reader is usability and accessibility. In such cases, governments can referred to the companion note to this document.20 consider phased approaches, 20   Christopher Tullis and David Black. 2024. Public Key Infrastructure: Implementing High-Trust Electronic Signatures. Washington D.C: World Bank. 20 3 TRUSTED (ELECTRONIC) TRANSACTIONS 3.1 WHAT IS A signatures – whether electronic or handwritten – in terms of a set of distinct but overlapping functionalities that help SIGNATURE ANYWAY? ensure trust in transactions of various types.26 Specifically, when attached to some data or a document,27 signatures “If you say to the most illiterate person ‘Sign this paper,’ provide evidence of one or more of the following: if he cannot write, he will put a cross to it, and if he do not know how to do this the most experienced man of 1. Identification. The real-world identity of the signer business cannot tell him to do more.”21 should be known. Although signatures have been used for centuries to provide 2. Attribution. It should be possible to reliably link the trust in commercial and administrative transactions, the signature to the signer, demonstrating their personal term “signature” has no strict formal definition. Definitions involvement in signing. can vary between contexts and jurisdictions,22 stemming 3. Endorsement. A signer signals an intent to be bound by from the fact that a signature may be many things and can the contents of the signed data or document. take many forms.23 A signature is, ultimately, whatever mark or sign that allows transacting individuals to trust a written 4. Integrity. It should not be possible to alter the contents transaction.24 This reasoning has prompted scholars (and of the signed data or document after it has been signed. courts) to shy away from defining signatures in terms of the form they take and focus rather on the functions they fulfill. Not all types of signatures perform each of the above functions equally well. For example, traditional handwritten This “functional” approach to the definition of a signature signatures can be said to fulfill the first three functions, as a is important to understand how the concept can be best handwritten name both identifies the signer and attributes adapted for use in the digital world.25 This note considers the signature to him/her (with some degree of confidence), 21   Opinion from the 1855 South African case Van Vuuren v. Van Vuuren, cited by S. Mason in Electronic Signatures in Law, Chapter 1, p.3, published by University of London Press; Institute of Advanced Legal Studies, available at: http://www.jstor.com/stable/j.ctv5137w8.7 22   Different sources and jurisdictions use terms such as “signature,” “verification,” “authentication,” as well as related and/or complementary terms such as “seals,” “legalization,” “apostille,” among others, in similar and sometimes overlapping ways. Readers interested in a discussion of these terminological nuances are referred to UNCITRAL. 2009. “Promoting confidence in electronic commerce: legal issues on international use of electronic authentication and signature methods.” Vienna: UNCITRAL 23   Common dictionary definitions include “a special mark of a person written with his or her own hand as an authentication of some document or writing” or “a sign or mark impressed upon anything; a stamp; a mark; the name of a person written by himself either in full or by initials.” Oxford English Dictionary, accessed in 2023, available at: https://www.oed.com/view/Entry/179546?rskey=ixiPb1&result=1&isAdvanced=false#eid. Jowitt’s Dictionary of English Law (4th edn., London: Sweet & Maxwell, 2015). 24   A signature can be affixed to any type of writing, document, data, or message of which the authenticity might be called into question. 25   This “functional equivalent approach,” established in 1996 by the UNCITRAL “Model Law on Electronic Commerce,” is based on an analysis of the functions of the various requirements for authenticating paper-based documents in order to determine how those same functions could be fulfilled in the digital world. 26   In the UK, courts have, for example, held that the many non-electronic forms amount to valid signatures. And including “a description of the signatory if sufficiently unambiguous, such as ‘Your loving mother’ or ‘Servant to Mr Sperling’ – Law Commission. 2022. Electronic Execution of Documents. Industry Working Group Interim Report. 27   The notion of a “document” used in this note is broad and covers not only documents in the traditional sense, but also other types of writings, information, instructions, data, messages, and records destined for transmission, or of which the source or authenticity might be called into question. In principle, any piece of data can be signed. This note generally refers to all of the above as “documents” for convenience. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 21 Figure 4: How signatures increase trust in transactions 1 2 3 4 Who? Why? What? Trust requires... Name of Did that person Intent to ... evidence of... Signed content the signer really sign? be bound ... to assure... Attribution Endorsement Integrity Source: Authors’ elaboration as well as signals the signer’s intent to endorse the signed functions of electronic signatures (identity, attribution, and document. Traditionally, handwritten signatures are defined endorsement) directly relate to the signer, establishing their 28 primarily in terms of these three main functions: identity, identity and intentions. Unsurprisingly, the means used in attribution, and endorsement (or intent to be bound).29 electronic signature solutions to assure these functions may Fulfilling the integrity function and providing strong be the same as the means applied by digital identity systems assurance of attribution, however, requires additional for identification and authentication assurance.32 Likewise, measures beyond simply writing a name. since the last function (integrity) relates to the document to be signed and not the signer, assurance of this function In cases where signatures provide a high level of assurance does not overlap with digital identity. of attribution, this function is sometimes referred to as “non- repudiation” to indicate that the assurance of attribution Many simple electronic signature implementations limit is strong enough to make it very difficult for the signer to themselves to assuring the identity-related dimensions of subsequently repudiate their signature. The need for non- a signature; such solutions may be technically identical to repudiation is why signers of paper documents are typically digital identity or authentication implementations. A basic required to do additional things such as use an ink pen, include requirement for any signature involves some basic ability the date, and sign two copies of the document, among other to authenticate the identity of the signer, thus, the simplest authentication measures.30 Ensuring integrity requires even electronic signature implementations usually focus on this more measures still, such as notarization, for example.31 aspect. One example is the case of mobile money, discussed above, where a PIN code (authentication factor) is relied on The similarities between electronic signatures and digital to initiate and authorize a payment and make it difficult for identity are worth highlighting. Indeed, the first three the user to subsequently repudiate the transaction. 28   UNCITRAL. 1996. Model Law on Electronic Commerce. Vienna: UNCITRAL. UNCITRAL. 2001. Model Law on Electronic Signatures. Vienna: UNCITRAL. 29   Additional measures beyond the signature itself may be required in some contexts to authenticate a transaction by providing additional assurance of the intent to be bound. For example, in some francophone jurisdictions it is common to require the signer to handwrite the phrase “lu et approuvé,” meaning “read and approved,” prior to signing. 30   The ink pen prevents erasure of the signature; the date prevents time-based repudiation; while the additional copy allows the other party to produce evidence of the signature if the signer attempts to disavow it. 31   In addition to notarization, in some jurisdictions it is common practice to initial each page of a multi-page document to assure integrity by preventing later tampering. Imprinting each page with a raised seal can serve a similar purpose. 32   Identification and authentication assurance are discussed and defined in various standards for digital identity, such as the US National Institute for Standards and Technology (NIST) special publication 800-63 providing Digital Identity Guidelines. https://doi.org/10.6028/NIST.SP.800-63-3 22 However, as electronic signatures are extended to higher- One reason why handwritten signatures are able to keep risk use cases and potentially exposed to more sophisticated the analog economy functioning so smoothly, particularly attackers, stronger identity or authentication assurance may be for everyday transactions, is because of existing sources required. This may lead to the use of multifactor authentication, of trust between the transacting parties that can serve to or to a decision to rely on trusted digital ID credentials outside of supplement and reinforce the technical trust offered by the the electronic signature software solution. High-risk use cases signature itself. Depending on the transaction, technical also make assurance of the function of integrity increasingly trust may be supplemented by existing sources of trust in important. In such implementations, electronic signature cases where parties: solutions diverge from digital identity and integrate other complementary assurance measures, such as implementation • Know each other or otherwise have a pre-existing trust using a cryptographically-based digital signature. relationship; • Have transacted with each other successfully over a For use cases where strong assurance of integrity is not period of time; required, a digital ID system alone could be leveraged to provide the authentication functionality required to • Have a pre-existing contractual relationship, such as a implement an electronic signature. The legal value of such service provider and its client; an implementation would then depend on the legal and trust frameworks in that jurisdiction. • Belong to the same group, such as a professional body or trade association. 3.2 SOURCES OF TRUST • Transact in person, on closed systems, through other trusted communication channels.35 Although trust lies at the foundation of commercial and administrative transactions, in most cases, the handwritten When moving from paper to electronic transactions, the signatures used to authenticate these transactions are quite aim should be to use technology to supplement and extend insecure. For a handwritten signature to function securely, existing sources of trust, not to replace existing sources of the persons relying on the signature should ideally have trust with technologically-derived sources of trust on the access to both the names of the persons authorized to grounds that they are superior. sign as well as specimen signatures for comparison—both of which are rarely available. Even when specimens are Importantly, governments should take these considerations available, expertise is required to detect forgery. Moreover, into account when regulating electronic signatures to avoid such expertise may only be available in rare cases when a requirements of excessive technological sophistication that signature’s authenticity is challenged in court. may have a chilling effect on electronic transactions. Just as it is important to supplement and extend the sources of Despite these deficiencies, the analog economy has trust underpinning paper transactions to ensure trust in the functioned effectively for centuries relying upon handwritten digital world, it is also equally important not to assume the signatures to establish trust. Indeed, the use of additional deterioration of such pre-existing trust relationships. Efforts to authentication measures that could improve transaction overly formalize electronic trust or make it excessively reliant security (such as stamps, seals, attestation, and notarization) on technology-based sources of trust could “crowd out” pre- are quite rare in practice, as are legal challenges to signatures’ existing non-technology sources of trust. Efforts to arrogate the authenticity. It is also worth noting that handwritten signatures notion of trust to a purely technology realm could lead to overly have functioned to support these transactions without any technological sophistication of electronic transactions, which particularly designed legislative trust framework.33 Prior to the adds a barrier to the continuity of currently well-functioning emergence of digital media, law on signature was focused on commercial relationships and administrative transactions. questions related to the identity of the signer. 34 33   UNCITRAL. 2009. “Promoting confidence in electronic commerce: legal issues on international use of electronic authentication and signature methods.” Vienna: UNCITRAL. 34   Historically, law on paper signatures was primarily concerned with a signature’s reliability in terms of (a) identifying the signer; (b) attributing the signature to the signer; and (c) demonstrating the signer’s intent to be bound by the terms of the document. 35   UNCITRAL. 2009. “Promoting confidence in electronic commerce: legal issues on international use of electronic authentication and signature methods.” Vienna: UNCITRAL. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 23 4 TRUST FRAMEWORK 4.1 THE ROLE OF A on the substance and adequateness of the trust framework, and not its legal form or (initial) comprehensiveness. TRUST FRAMEWORK Regulators should see their role as extending existing sources of trust—through standards and transparency – to If the vast majority of electronic transactions can be carried out scale the digital economy beyond what can be based on without issue, free of any particular regulatory attention, then existing trust relationships. This extension could include what is the role of an electronic signature trust framework? scaling to new sectors, new untrusted parties, and new risk levels, where electronic transactions would not be possible A trust framework for electronic signatures is a set of without the transparency and trust supplied by regulation. requirements and standards that governs their use, recognition, and interoperability. It establishes the roles and A well-designed trust framework for electronic signatures responsibilities of parties involved, including the issuers of should adhere to the following principles: electronic signatures, users, and relying parties. This framework often includes standards for identity proofing, authentication, 1. Ensure security of electronic transactions. Given consent, and the use of technologies, among other elements. the inherent fungibility and velocity of electronic It outlines the processes and security requirements necessary communications, additional measures are needed to for ensuring that electronic signatures are trustworthy ensure trusted online interactions. and reliable. Trust frameworks extend trust by providing 2. Capitalize on existing sources of trust. Improving trust standardization, rigor, and transparency around the elements in technology should not “crowd out” existing sources of that determine the reliability of electronic signatures. Trust trust, including sources that are not technology-derived. frameworks may be comprehensive from the outset, or they may be organic outgrowths or progressive formalizations of 3. Extend the frontiers of trust. One role of a trust framework existing implicit or de facto relationships. Trust frameworks can be to ex tend existing sources of trust to new types include requirements related to: of transactions. This could include extension to higher- risk use cases or to parties without pre-existing trust relationships who would not otherwise transact online. • People, such as a requirement to link a signature to the identity of a real person; 4. Promote usability and adoption. Risk-based approaches can help ensure that the most sophisticated • Process, such as minimum standards for the identity technologies are reserved for cases where the checks carried out by the signature provider when transaction risk justifies them. onboarding a signer; 5. Promote innovation and technology neutrality. • Technology, such as technical measures to protect the Avoiding technology-specific requirements can allow integrity of the signed document. for innovative approaches and avoid obsolescence and technology lock-in over time. The role of a trust framework is not to provide all the 6. Clarify roles and responsibilities. In addition to defining elements of trust or to assume that parties don’t trust each the roles and responsibilities of the various actors in other. Trust frameworks for electronic signatures should not operationalizing the trust ecosystem, the trust framework be overengineered in an effort to supplant contextual trust can clarify liability, establish penalties, and provide the with technologically-derived trust on the basis that the latter opportunity for redress by any party, all of which serve to is assumed to be superior. Instead, the emphasis should be build confidence in electronic transactions. 24 4.2 TIERED TRUST: The following table summarizes some key features of the eIDAS assurance levels.41 LEVELS OF ASSURANCE In summary, a trust framework performs the following Increasingly, countries around the world are adopting a functions: multi-tiered or hybrid approach to electronic signature regulation, where the regulation defines levels of assurance, • Defines requirements around the people, process, and remaining agnostic to implementation strategies or technology components used to create an electronic technology specifics.36 Levels of assurance describe the signature and provide evidence of its reliability. degree of confidence in the identity of the signer and the • Enables multiple levels of standards to coexist through integrity of the signed document. The higher the level of different levels of assurance, allowing for multiple levels assurance, the more rigorous the requirements. of trust to improve relevance to electronic signature use cases of varying risk levels. Generally, the lower trust levels are formulated with minimal • Provides transparency around the requirements, requirements, if any, and contracting parties and market standards, and compliance with these measures during players are left to determine what technologies they implementation, in turn, fostering trust in electronic consider adequate. At low assurance levels, courts may signature reliability. weigh the assurances provided by these technologies as evidence if the signature is challenged. Taken together, these requirements and their surrounding transparency provide the foundation of trust in the people, Higher levels of trust introduce more requirements process, and technology elements that are used to create a to increase trust by providing additional assurance of signature. This, in turn, provides evidence of the signature’s identity, endorsement, integrity, and/or non-repudiation. reliability, underpinning trust in the authenticity of the They do this by establishing standards for the people, signed document. process, and technology elements of a signature, such as how a user’s identity is verified during onboarding, or In addition to encouraging transparency, trust frameworks how the trust ecosystem is monitored and supervised. should also promote certainty about the allocation of liability These requirements and their surrounding transparency among parties to the framework when things go wrong. The provide evidence of electronic signature reliability. consideration of liability is an important component of risk and return attached to the business model of parties to A concrete example of a multi-tiered approach can be found in the framework and to the operator of the trust framework. the European Union Electronic Identification, Authentication Effective trust frameworks allocate liability to those best able and Trust Services (eIDAS) regulation,37 which gives an to bear it. As an example, credit card schemes are sector- indicative illustration of how levels of assurance for electronic specific trust frameworks which are very specific about how signatures can be structured. Although the eIDAS is regulated liability is allocated based on evidence that parties have at the EU-level, the framework has also been emulated outside followed set standards for different processes, especially the EU38 and also served as a key source of inspiration for the authentication and authorization. In certain countries, such recent UNCITRAL model law on cross-border recognition of as the US, these frameworks must comply with specific laws trust services.39 However, the specifics of the eIDAS assurance which explicitly limit customer liability for unauthorized framework—such as the number of assurance levels or the transactions; in relation, legal frameworks incentivize credit detailed requirements for each – are not set in stone and can card schemes to manage these risks carefully. vary between frameworks and jurisdictions. 40 36   While lower assurance levels may be fully technology neutral, higher assurance levels may introduce some technology-specific elements, in particular, elements related to public key infrastructure and digital certificates, although the implementation model is usually unspecified. 37   eIDAS regulation governs electronic signatures in the EU and was established in EU Regulation 910/2014 of 23 July 2014. 38   Georgia, Lebanon, Singapore, and Switzerland are examples of countries with electronic signature frameworks containing levels of assurance or other elements that mirror eIDAS. 39   UNCITRAL. 2022. Model Law on the Use and Cross-border Recognition of Identity Management and Trust Services. Vienna: UNCITRAL. https://uncitral. un.org/en/mlit 40   For example, some governance frameworks leave the low-trust (simple) assurance level implicit, while others may require accreditation of the certification authority for the medium-trust (advanced) assurance level. 41   See eIDAS Art. 24-28. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 25 Table 3: eIDAS levels of assurance: Summary of key features Level of Assurance Low Medium High eIDAS Simple Electronic Signature Advanced Electronic Signature Qualified Electronic Signature Terminology (SES) (AdES) (QES) Identity of the Electronic signature uniquely Electronic signature uniquely No requirement signer linked to a signatory identity linked to a signatory identity Must be under the sole control of the signer Data used for Must be under the sole control No requirement signing42 of the signer Must conform to rigorous standards for digital certificates Integrity of the Signed document cannot be Signed document cannot be No requirement signed document modifiable after signing modifiable after signing Requires some assurance of the Rigorous in-person (or Registration identity of the signatory equivalent) onboarding process No requirement process No requirement for in-person with high assurance of linked identity verification signatory identity43 Accreditation of Rigorous people, process, digital certificate No requirement No requirement technology, and audit issuer requirements Supervision of the Ex post supervision by the Ex ante supervision by the digital certificate None competent supervisory body competent supervisory body issuer44 High-security, certified Device used for No requirement No requirement45 signature-creation device signing required46 Appropriate transaction risk Low Medium High level No presumption of validity; No presumption of validity; Presumed valid (functionally Legal validity court makes evidence-based court makes evidence-based equivalent to handwritten determination determination signature) Source: Authors’ elaboration 4243444546 42   In the eIDAS framework, “data used for signing” refers to the electronic data that is uniquely linked to and used by the signatory to create an electronic signature. In the case of a high-trust (qualified) electronic signature, this data is the cryptographic key stored in the digital certificate used by the signer to generate digital signatures. At lower trust levels, this description refers to other data and technical systems used to generate signatures and provide assurance of integrity. 43   In practice, live video interviews have been considered in some jurisdictions as equivalent to in-person. 44   In a public key infrastructure, the issuer of digital certificates, often called a certification authority, is a trusted organization responsible for issuing PKI- based digital certificates that binds them to a public key. 45   The concepts of “accreditation” and “qualification” of a certification authority or trust service provider are sometimes used interchangeably in the eIDAS context since only qualified electronic signatures require the certification authority to be accredited. 46   In practice, this secure “device” can be implemented on a user-managed physical device as well as in cloud implementation models. 26 5 LEGAL FRAMEWORK 5.1 THE ROLE OF THE Functional equivalence LEGAL FRAMEWORK The legal framework for electronic signature should recognize functional equivalence49 between electronic and paper-based If trust frameworks can offer transparency around the people, signatures in terms of legal effects and evidentiary value.50 Legal process, and technology elements needed to provide provisions may also prevent courts from discriminating against evidence of a signature’s reliability, then what is the role of electronic signatures on the grounds that they are in electronic the legal framework? form,51 thus mandating courts to consider supporting evidence regardless of its electronic form to assess its reliability. Often The legal framework is the set of laws and regulations introduced through primary legislation, these legal provisions governing electronic signatures and trust services.47 It would recognize the admissibility of electronic signatures as provides the foundation for the trust framework, establishing evidence in court.52 A legal framework recognizing the functional its legal validity and enforceability and clarifying the legal legal equivalence between electronic and paper signatures is a implications on electronic transactions. More specifically, the critical prerequisite for scaling electronic transactions. legal framework helps clarify the circumstances under which electronic signatures may be: admissible as evidence in court; Evidence of Reliability considered legally equivalent to handwritten signatures; and sufficiently reliable to have legal effect. 48Fundamentally, Having an electronic signature deemed admissible as the legal framework establishes the legal equivalence of evidence in court is a first step towards establishing reliability, electronic and handwritten signatures and ensures that an but this step alone is not sufficient for an electronic signature online transaction is just as legally valid as a paper-based one. to be considered valid. 47   Specific examples include national laws, such as the Electronic Signatures in Global and National Commerce Act (ESIGN) in the United States, regional and supranational mutual-recognition frameworks, such as the eIDAS regulation in the European Union, as well as international conventions like the UN Model Law on Electronic Signatures. 48   Although contract law considers oral agreements as legally binding, contracts can only be signed inasmuch as they are written down. The law around signatures is historically an outgrowth of that governing writings. Signatures are a consequence of requiring a legal act to be drafted in writing, and the law on signatures was therefore always a function of the medium used for writing. It is natural then that the recent evolution of the law on signatures was prompted by the rise of new technologies and the emergence of electronic forms of communication. Indeed, it was the need to clarify the conditions under which an electronic writing would have the same legal value as paper writing that led to much of the recent effort to define what was meant by signature. For further information, see “L’écrit électronique : régime juridique,” Aurélien Bamdé, accessible at: https://aurelienbamde.com/2023/03/15/lecrit-electronique-regime-juridique/ 49   The “functional equivalent approach” is an approach first taken by the UNCITRAL Model Law on Electronic Commerce. This approach stems from the need for legislators to determine how the purposes and functions of the traditional paper-based requirements prescribed by laws in certain countries, such as to have “written,” “signed” and “original” documents, could be fulfilled through electronic-commerce techniques, such as electronic signature. For more information, see Annex 4: Good Practice Legal Frameworks. 50   Functional equivalence means that an electronic signature will have the same legal effect as a paper-based signature, including its evidentiary value in courts, as it could be both (a) admitted and (b) potentially recognized as valid evidence in legal proceedings as fulfilling part, or all, of the functions that a signature normally serves (be it proof of identity, endorsement, integrity, or non-repudiation). 51   For example, this non-discrimination principle is explicitly stated in Article 25 of the eIDAS regulation: “An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic signatures.” 52   These provisions could naturally be part of statutes, codes, or common law pertaining to civil or criminal procedures and, more particularly, rules of evidence. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 27 As discussed above, there is a broad range of types of make the additional cost and effort of using a high-assurance electronic signatures which offer very divergent levels of electronic signature worthwhile. assurance of their reliability. Some very simple electronic signatures offer little to no hard evidence of their reliability, Conversely, in cases where the legal requirements while others employ very sophisticated technology and non- necessary to benefit from a presumption of reliability are technological measures to marshal very strong evidence of not met, the burden of proof to demonstrate the signature’s the signature’s reliability. reliability is borne by the party claiming the legal effect of the electronic signature. Legal frameworks for electronic signatures may set out (often through primary legislation) the requirements for reliability Electronic signature validity in practice of electronic signature data as evidence in court.53 Electronic signatures that provide high levels of assurance (i.e., In practice, courts tend to take a flexible approach when evidence of a signature’s reliability) would be more likely to it comes to the evidentiary value of electronic signatures, be considered valid signatures in court and would thus have although the case may vary according to the jurisdiction. In higher probative value.54 general, courts aim to give effect to the initial intention of the parties rather than applying rigid rules to the reliability Presumption of Reliability of an electronic signature. Factors like the nature of the transaction, the context, previous dealings between the Evaluating the reliability of an electronic signature is not a parties,57 industry practice, etc., are all considered. This trivial task and may require specialist knowledge. Furthermore, flexibility is often found under common law jurisdictions, such if there is a risk that the evidence provided by the signature as in the US and UK where, for example, a name typed at the will not be found sufficiently reliable in court, then this also bottom of an email is considered sufficient to authenticate represents a commercial risk to the contracting parties. the person and evidence their intent to be bound.58 The approach taken by civil law jurisdictions is usually stricter, For these reasons, some legal frameworks introduce a as courts usually rely on existing national legislation. Courts legal presumption of reliability.55 Usually reserved for in France, for instance, have been reluctant to accept signatures meeting the requirements for the highest level electronic signatures as equivalent to handwritten ones until of assurance,56 this presumption of reliability requires the the adoption of legislation expressly recognizing it. While court to consider the signature as reliable, and therefore case law remains rare, the observed trend, even under civil legally valid, until proven otherwise. Using this method to law systems, highlights a liberal approach taken by courts put the burden of proof on the party challenging the validity vis-à-vis electronic signature, recognizing their validity even of the signature reduces the amount of evidence that must under their simplest forms.59 be evaluated in court and reduces the risk to the contracting parties of a contract being found null and void. For high- risk transactions, in particular, this quasi-guarantee that an electronic signature will be considered valid in court can 53   These provisions could be included, for example, in legislation pertaining to e-transactions/e-commerce or as part of any body of procedural laws and rules of evidence. For example, a requirement could be that the electronic signature must be issued through a reliable process for identification that guarantees its link with the document to which it is affixed. 54   Cornell Law School Legal Information Institute. “Probative Value.” Wex, May 2022. https://www.law.cornell.edu/wex/probative_value VanDerGinst Law. “E-Signature: Who Bears the Burden of Proof?” VanDerGinst Law, May 31, 2022. https://www.vdblaw.com/e-signature-who-bears-the- burden-of-proof/ 55   Under certain circumstances, the admissible and valid electronic signature may benefit from a “presumption of reliability” allowing whoever is claiming it to presume, by law, that the electronic signature introduced before the court constitutes valid evidence of both (i) the identity of its author and (ii) the integrity of the document. 56   The primary legal framework for electronic signatures would often address the procedural aspects of functional equivalence by specifying that there are specific cases in which an electronic signature would be presumed to have satisfied the reliability requirement, i.e.: the electronic signature (i) relies on a reliable process for (ii) identification that (iii) guarantees its link with the writing to which it is attached. 57   For example, if the parties have been regularly using emails to communicate during negotiations. 58   A fundamental issue with respect to electronic signatures is the connection between the mental state of the person who may wish to be bound by the electronic signature and the document to which it is attached. 59   In a 2016 decision, for example, the Cour de Cassation (the highest court in France for civil law matters) acknowledged that the admissibility of electronic evidence of a written and signed document does not require a high-trust electronic signature, therefore, the judge must independently determine whether the process is reliable. 28 Figure 5: Functional equivalence of electronic signatures Yes No Admissible? Yes No Presumed Reliable? Yes Proved No Reliable? Valid Invalid Source: Authors’ elaboration Summary • Minimalist (or technology-neutral) approach: This is the approach taken from the UNCITRAL Model law on While electronic signature legislation differs according to the e-commerce.61 Under this view, laws should aim to be relevant jurisdiction, the following three main approaches to technologically neutral in determining what constitutes legislating electronic signatures apply broadly: an electronic signature. Countries such as Australia, for example, focus on addressing the legal effect of • Prescriptive (or technology-specific) approach: A electronic signatures while letting the market determine prescriptive legislation that adopts a specific technology, non-legal aspects, such as security and reliability levels. such as digital signatures, as the method to replace a This approach aims to give flexibility and autonomy to handwritten signature in the digital environment. This market participants in shaping those aspects without approach solely recognizes digital signatures (i.e., high- imposing rigid legal requirements. trust signatures based on a particular technology, such • Multi-tiered (or hybrid) approach: Under this approach, as PKI, that ensures its reliability) as acceptable electronic signatures while excluding other forms.60 Although this electronic signature is categorized under two or three tiers approach prioritizes security, it risks limiting economic or levels of assurance, which usually range from simple or development by over-regulating e-commerce and low-trust electronic signatures to higher-trust electronic relying on a specific technology which may evolve over signatures, sometimes referred to as “advanced” or time. Adoption of electronic signatures may be limited if “qualified” according to jurisdiction.62 Such is the high-cost or low-usability technologies are imposed for approach taken by the eIDAS regulation, which is directly low-risk transactions, with an accompanying reduction applicable to EU member states. It is also the approach in transaction volumes. of many countries outside the EU, such as Brazil63 or 60   Some laws, like the Indian Information Technology Act 2000, initially focused only on digital signatures but have since been amended to adopt a two- tier approach, allowing for other forms of electronic signatures. The Electronic Transactions Act 2007 of Saint Vincent and the Grenadines follows a prescriptive approach but allows parties to agree on other methods of electronic signature, with digital signatures being the only form with legal force in the absence of a specific agreement. In Malaysia, the Digital Signature Act 1997 explicitly identifies digital signatures as the equivalent of a manuscript signature in Section 62. 61   Article 7 addresses the legal recognition and validity of electronic signatures, stating that an electronic signature should not be denied legal effect solely on the grounds that it is in electronic form or does not meet the requirements for a traditional handwritten signature. It establishes a technology-neutral approach, allowing for the use of various methods to identify the person and indicate their approval of the information communicated. 62   Terminology varies between jurisdictions for the highest trust level, including “qualified” (EU, Japan), “advanced” (South Africa), “certified” (Switzerland), “authenticated” (South Korea), and “secure” (Canada). For further information on levels of assurance, please refer to the above section on “tiered trust.” 63   Under Law No. 14.063/2020 ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 29 Singapore, which recognize two levels of electronic signature assurance, with the high-trust or “secure” level 5.2 MUTUAL RECOGNITION providing an additional level of security and integrity.64 As previously mentioned, one of the most important While legal frameworks that adopt the multi-tiered aspects of having a legal framework for electronic signature approach usually describe lower levels of assurance in a is providing legal certainty that an electronic signature will technology-neutral manner, provisions related to higher be enforceable and recognized in court as valid evidence— level electronic signatures tend to require more specific meaning that an electronic signature is granted full legal standards that may be technology-specific.65 equivalence to a handwritten signature on paper. As more countries move to digitization, such legal certainty is Alternatives to challenging increasingly needed across borders. Hence, establishing signatures in courts cross-border mutual recognition frameworks for high trust electronic signatures helps create clarity on the legal effects As digital commerce has boomed, so too has the volume and admissibility of these electronic signatures which, in and complexity of disputes related to electronic transactions. turn, fosters trust and confidence in electronic transactions. These include disputes related to validating and enforcing a transaction concluded by a form of electronic signature.66 The EU eIDAS regulation represents the first successful The relatively small value of many electronic commercial attempt to establish a harmonized multilateral trust transactions combined with their sheer volume means framework for electronic signatures across borders. that the formal legal system is not always well positioned eIDAS sets out mutual recognition as a general principle to address these issues, whose fair and speedy resolution for qualified signatures stating that qualified electronic is essential to building trust in the digital economy. One signatures and qualified certificates issued in one member consequence of this is that court challenges to electronic state shall be recognized as qualified in all other member signature reliability are relatively rare and, due to the states.68 By stating this principle, eIDAS ensures that the cost involved, may generally be limited to higher value legal effects and admissibility of qualified electronic transactions that justify the cost of litigation. signatures are not denied solely because they were created in a different member state. Mutual recognition Hence, Online Dispute Resolution (ODR) was created to offer can reduce administrative burdens as well as barriers to an accessible, expedient method for those seeking to dispute cross-border electronic commerce and service delivery, a transaction based on the validity of an electronic signature. enabling businesses and individuals to engage in digital ODR started in the 1990s by applying existing Alternative transactions more efficiently. Dispute Resolution (i.e., extrajudicial) approaches to an online environment. However, ODR had to be optimized While a country may expressly recognize in its law for an entirely remote setting due to the massive volume of the legal effect of electronic signatures issued across rich data, which warranted automatable decision making. borders (e.g., in specific countries), mutual recognition The e-commerce platform, eBay, is recognized as an early of electronic signatures can be facilitated if the national pioneer in this area. Now, however, the application of ODR law provides for mutual recognition of electronic within trust systems (like online platforms) is pervasive and is signatures or other trust services offered by trust service even changing the functioning of court systems.67 providers69 established in third countries. Under eIDAS, 64   See Singapore’s Electronic Transactions Act, Cap 88 (ETA) and the Electronic Transactions (Certification Authority) Regulations 2010. 65   For example, Recitals of eIDAS regulation provides that requirements for assurance levels should be technology neutral. Yet, Article 29 of eIDAS establishes requirements for qualified signatures which reflect, indirectly, PKI. The reference to PKI was also previously included in the European Parliament’s resolution of 21 September 2010 on completing the internal market for e-commerce. 66   Many of these disputes also relate to issues outside the scope of this paper, such as whether a good purchased online was delivered at all or in the condition advertised. 67   See Chapter 3 of Katsch, Ethan, and Orna Rabinovich-Einy. 2017. Digital Justice: Technology and the Internet of Disputes. Oxford: Oxford University Press. 68   See Article 25 (3) 69   For more information about trust service providers and how they support the implementation of PKI, the reader is invited to consult the companion note, “Public Key Infrastructure: Implementing High-Trust Electronic Signatures.” 30 a special status is given to certain trust service providers services. Countries may choose to align their national recognizing them as a Qualified Trust Service Providers frameworks with these international standards to enhance (QTSPs) based on compliance with specific requirements mutual recognition. Recently, in 2022, the UNCITRAL for the trust service (such as electronic signature) it intends Model Law on the Use and Cross-border Recognition of to provide. To qualify, the entity submits an application Identity Management and Trust Services70 has provided a to the designated supervisory body, which evaluates its normative international model law for cross-border mutual compliance through assessments and audits. If the entity recognition of electronic signatures. Heavily inspired by meets the requirements, it is granted the status of a QTSP. eIDAS, this new model law builds on previous UNCITRAL The supervisory body publishes the list of QTSPs, enabling model laws on electronic commerce and electronic their services to be trusted and recognized across the EU signatures to extend trust across borders. and, in some cases, beyond. Aside from mutual recognition of electronic signature and Outside the EU, each country or jurisdiction may have trust services more broadly, the principle is also relevant its own laws, regulations, and frameworks related to for identification (ID) frameworks that countries adopt. trust services and electronic transactions. In some cases, While recognition of an ID framework may not directly countries may have established bilateral or multilateral impact recognition of the electronic signature issued by agreements with other countries to facilitate mutual a third country, in some cases, a recognized digital ID recognition of trust services. These agreements outline the credential issued by one jurisdiction could be used as a terms and conditions for recognizing and accepting trust means of authentication or identification in the context services provided by entities from different jurisdictions. of electronic signature processes. When ID frameworks are mutually recognized, it becomes easier for individuals Additionally, international standards and best practices and organizations to use their trusted identities to sign developed by organizations, such as the International documents across various platforms and systems. This mutual Organization for Standardization (ISO) and the recognition, combined with cross-border interoperability, International Telecommunication Union (ITU), can provide fosters seamless electronic transactions, and promotes the guidance and promote harmonization in the field of trust wider adoption of electronic signature technology. 70  UNCITRAL. 2022. Model Law on the Use and Cross-border Recognition of Identity Management and Trust Services. Vienna: UNCITRAL. https://uncitral. un.org/en/mlit ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 31 6 TECHNICAL IMPLEMENTATION 6.1 A VARIETY OF Medium and high assurance. As noted in the above discussion on level of assurance, the medium and high POSSIBLE TECHNOLOGIES assurance levels require imposing some additional requirements in terms of identity, endorsement, integrity, As noted above, an electronic signature is, fundamentally, and non-repudiation. There are various form factors on any data in electronic form, associated with other data, used which these requirements might be implemented, such as: by a signatory to sign. The following discussion gives some examples of a few common ways that low- and medium- • Plug-ins to PDF reader applications that allow digital- trust electronic signatures can be implemented in practice. certificate-based electronic signing; The list is not exhaustive. High-trust electronic signatures are discussed in the following section in the context of public • Cloud-based signature solutions offering a secure key cryptography. remote signing service; • A mobile app using secure elements in smartphones to Low assurance. Simple, or low-assurance, electronic generate signatures; signatures could fulfill this function without necessarily needing any technology specific to electronic signing. Some • A hardware token, such as a smart card containing a concrete examples of how simple electronic signatures digital certificate on a chip. might be implemented could include: These form factors do not, however, tell the entire story. Each form factor can be implemented as a medium- or high-trust • Typing a name at the end of an email or document; signature depending on the various complementary people, • Clicking on an “I accept” button on a website; process, and technology elements supporting them. Table 4 gives one example of how an advanced electronic signature • Using a scanned image of a handwritten signature; (in the eIDAS framework) could be implemented using any of the above form factors. • Using a finger or stylus to hand write a signature on screen; In order for the same electronic signature solution to be • Digital authentication (for example, a biometric or a considered qualified under eIDAS (instead of advanced) one-time password). it would have to add additional complementary features, such as those provided in Table 5. 32 Table 4: Examples of advanced electronic signature implementation Trust factor eIDAS Requirement (AdES) Implementation example Electronic signature uniquely An ID document is verified during in-person or remote Identity of the signer linked to a signatory identity onboarding. Must be under the sole control of Digital authentication using a biometric or other Data used for signing the signer authentication factor required for each signing transaction.71 Integrity of the Signed document cannot be A digital certificate-based signing solution is used to ensure signed document modifiable after signing integrity of the document.72 Requires some assurance of the Registration process An ID document is verified during in-person onboarding. identity of the signatory Table 5: Examples of qualified electronic signature implementation Trust factor eIDAS Requirement (QES) Implementation example Accreditation of The signature solution vendor is accredited as a QTSP Rigorous people, process, technology, digital certificate by the competent Supervisory Body before issuing the and audit requirements issuer digital certificates used in its products. The digital certificate used to generate the signature Device used for High-security, certified signature- is stored securely in a specialized device meeting signing creation device required73 additional security requirements.74 6.2 THE ROLE OF PUBLIC transform a document into an unreadable format and create a digital signature, while the other key is used to verify the KEY CRYPTOGRAPHY signature and confirm that the document has not been altered from its original form. Cryptography is the branch of applied mathematics concerned with converting messages into an apparently For high-risk transactions, cryptographic technologies can unintelligible form using a set of mathematical formulas be deployed for electronic signatures to assure a high level and then restoring them to their original state. Public key of trust. In particular, cryptography can provide the highest cryptography, which is the basis for digital signatures, available assurance of integrity and non-repudiation.757172737475 involves generating two unique keys using algorithmic functions that are mathematically related. One key is used to 71   Biometric authentication refers to the automated recognition of individuals based on their biological and behavioral characteristics. For more, see Digital Identity Guidelines. National Institute of Standards and Technology. U.S. Department of Commerce. https://nvlpubs.nist.gov/nistpubs/ SpecialPublications/NIST.SP.800-63-3.pdf 72   Common products on the market integrating such technology include DocuSign and Adobe Sign, among many others. 73   In practice, this secure “device” can be implemented on a user-managed physical device as well as in cloud implementation models. 74   Both physical devices managed by the user and cloud-based implementation are possible. 75   Non-repudiation is only assured at the highest level of trust when, in addition to the digital certificate, the date of the signature is also assured by an accredited timestamp authority, a variety of trust service provider. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 33 It should be noted, however, that cryptography does not (identity verification at onboarding) as well as technology provide any assurance of the identity of the signatory, (identity authentication during signing) elements. Without or of their endorsement of a document. This is because such additional measures, a public-key-based electronic a pair of cryptographic keys—which are a simple pair signature will fail to meet even the requirements for of numbers—have no inherent association with any medium assurance. person or entity. Additional measures are needed to link cryptography-based electronic signatures with a The relevance of public key cryptographic to the main signatory. These measures include people and process functions of electronic signatures is summarized in the Table 6. Table 6: Relevance of cryptography to electronic signature functionalities Functionality Relevance of Cryptography 1 Identity None 2 Attribution None76 3 Endorsement None Cryptographic hashing ensures that the content of a 4 Integrity document has not been modified after signing. One solution to this identification problem is to entrust a technologies, when implemented appropriately, can achieve third party to associate a person with a specific public key. a very high level of trust, giving parties the confidence to Such third parties are referred to as a certification authority take even the riskiest transactions online, with compounding (CA) or, in some frameworks (such as eIDAS), as a trust effects of digital economic development. service provider (TSP). In order to create and maintain the key-person association, the CA needs to verify the identity While there is substantial overlap between digital and of the signatories to whom it issues private keys, maintain a electronic signatures at the higher assurance levels (for list of public keys that relying parties can use for verification, example, qualified electronic signatures must implement and manage revocation of any key pairs that have been digital signatures by definition), at lower assurance levels, they compromised. PKI comprises the set of complementary can be distinct. This relationship is summarized in Figure 6. people, process, and technology elements that, taken together, provide for the management of the association of The above diagram illustrates that while lower-trust key pairs with signatories. The private key is issued to the electronic signatures may not need to be implemented signatory with a PKI-based digital certificate.77 7677 as PKI-based digital signatures, such need is effectively a requirement for the higher trust levels. For example, the Current electronic signature regimes have a tendency toward eIDAS requirements for the highest (qualified) assurance excessive focus on the security benefits of certain sophisticated level must be based on a qualified certificate, which, in turn, technologies, such as public key cryptography. This can lead must be issued by a qualified TSP—a role which, in practice, to lower adoption, especially if requiring such signatures leads is fulfilled by a CA operating within a PKI. It is worth noting to high cost of low usability and creates unjustified friction that various common legal frameworks, including not only for low-risk and everyday transactions. Conversely, such eIDAS but also the UNCITRAL Model Law on Electronic 76   In some technologically sophisticated implementations, a verifiable timestamp issued by a trusted timestamping authority can provide additional evidence of attribution. This can be relevant to use cases where repudiation of the timing of the transaction is a significant risk. Such implementations are typically limited to niche high-risk use cases and are outside the scope of this note. 77   Digital certificates are governed by the X.509 ITU standard defining the format of public key certificates, assuring the binding between identities and public keys. 34 Figure 6: Digital and electronic signatures AdES Digital Signatures Electronic Trust Signatures Services QES SES Signature (MLES), implicitly endorse PKI technology for When issuing a digital identity credential, it is common the higher trust levels, arguably undermining claims of to require issuers to verify the identity attributes against a technology neutrality. Ongoing discussions around the pre-existing foundational or legal ID system to ensure that upcoming revision to the eIDAS framework have examined the digital ID is issued to a real-world person and that this this technology specificity as a potential issue, especially person will be the sole person in control of the digital ID from a perspective of potential incompatibility with the credential issued. Due to the need to assure the identity next generation of digital identity solutions.78 The future- of signers, the requirements for electronic signatures are proofness of an exclusive reliance on PKI for high-trust very similar. Identity must be assured both at onboarding electronic signatures is thus called into question. (for example, the initial issuance of a signing certificate) and during the signing transaction itself (authentication). Readers looking for details on operationalizing a PKI on a national level to support electronic signature implementation79 Table 7 shows the complementary roles of the digital ID are referred to the companion note to this document. 80 and electronic signature solutions for a stylized high-trust electronic signature implementation. 6.3 THE ROLE OF DIGITAL IDENTITY Due to the technical and operational similarity of these Reliably establishing the identity of the signer—and the processes, there are clear synergies and complementarities attribution of the signature to that identity—is fundamental to between digital ID systems and electronic signature trust in an electronic signature. In a digital world, this implies frameworks and solutions. For this reason, digital ID and a core role for digital identity. electronic signature can be implemented together, with a digital ID credential being linked to, or containing, a signing certificate. Examples of such countries include 78   Schwalm, S., Albrecht, D. & Alamillo, I., (2022). eIDAS 2.0: Challenges, perspectives and proposals to avoid contradictions between eIDAS 2.0 and SSI. In: Roßnagel, H., Schunck, C. H. & Mödersheim, S. (Hrsg.), Open Identity Summit 2022. Bonn: Gesellschaft für Informatik e.V.. (S. 63-74). DOI: 10.18420/ OID2022_05 79   In addition to electronic signatures, PKIs can also support other types of services that require trusted cryptographic verification (sometimes referred to as “trust services”). 80   Christopher Tullis and David Black (2024), “Public Key Infrastructure: Implementing High-Trust Electronic Signatures,” Washington D.C: World Bank. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 35 Table 7: Illustrative example of the roles of providers of digital identity and trust services Function Assured through… Primary actor Identity checks during issuance of digital 1 Identity Legal identity81 authority82 certificate used for signing Electronic signature solution or external digital 2 Non-repudiation Authentication during signing identity provider83 Electronic signature solution or external digital 3 Endorsement Authentication during signing identity provider 4 Integrity Digital certificate used for signing Certification authority Estonia,84 Singapore,85 Germany,86 Georgia,87 Spain,88 and 818283 use cases, and an excessive emphasis on security and high- Argentina,89 among others. The synergies also spill over trust signatures, which may appear daunting to the average into the regulatory framework, with the EU eIDAS framework citizen. Looking forward, it’s imperative that future iterations being one example of a harmonized regulatory approach of these systems, as well as new ones, take a more balanced to mutual recognition and standardization of digital identity approach. By better harmonizing digital ID frameworks with and electronic signatures. electronic signature regulations, it’s possible to enhance the offerings of low to medium trust electronic signatures. Despite numerous national ID systems successfully This can also lead to making qualified signatures more user- incorporating digital certificates and high-trust electronic friendly, thereby significantly boosting their usage among signatures into national ID credentials, these solutions citizens. This dual approach, focusing on both the low-trust have seen remarkably low adoption. The adoption rates and high-trust ends of the spectrum, will likely yield a higher of these capabilities have been less than optimal. This can degree of engagement and adoption. largely be attributed to inadequate understanding of the technology, usability challenges, ambiguity surrounding 81    Legal identification systems provide recognition before the law and proof of legal identity. Principles on Identification for Sustainable Development: Toward the Digital Age. Washington, D.C.: World Bank Group. http://documents.worldbank.org/ curated/en/213581486378184357/Principles-on-Identification-for-Sustainable-Development-Toward-the-Digital-Age 82  Because certificate issuance is a one-time process, it is common to use traditional legal ID credentials such as a national ID card or passport. In principle, this identity verification can take place either in person or online. 83    One standard definition of a digital identity provider can be found in NIST 800-63-3 Digital Identity Guidelines: “Identity provider (IdP): The party that manages the subscriber’s primary authentication credentials and issues assertions derived from those credentials.” In the context of an electronic signature implementation, the digital ID provider could be the same entity that provides signature or certification services, or an external digital ID could be used. Since online authentication is a requirement for electronic signature, it is not possible to use a traditional ID credential unless it has digital ID functionality allowing it to be used for authentication online. 84    Estonia’s national ID card includes a chip that contains two certificates: one for proving identity (authentication), and another for digital signing (digital signature). The Mobile-ID offers similar architecture, with the difference that the certificates are stored on the SIM card of the mobile phone while the Smart-ID version offers a software-based solution in which storage of the digital certificates are split between a smartphone app on the user’s device and the cloud. https://www.id.ee/en/article/ digital-signing-and-electronic-signatures/ 85   The Singaporean smartphone-based digital ID includes a service called “Sign with Singpass” allowing high-trust PKI-based electronic signatures to be generated using the mobile app. Cooper, Adam Kenneth; Marskell, Jonathan Daniel; Chan, Cheow Hoe. National Digital Identity and Government Data Sharing in Singapore: A Case Study of Singpass and APEX. Washington, D.C.: World Bank Group. http://documents.worldbank.org/curated/en/099300010212228518/ P171592079b3e50d70a1630d5663205bf94 86   The German national ID card (Personalausweis) has an embedded chip for electronic signatures. Germany also launched a smartphone app (AusweisApp2) that acts as a card reader, allowing online use of the national ID card for electronic signatures. https://www.ausweisapp.bund.de/en/how-to- use-the-eid-function 87  The Georgian national ID card contains a chip with a digital certificate allowing generation of high-trust electronic signatures. Currently, the national ID card issuer - the Public Service Development Agency - is the only accredited qualified trust service provider in the country, and the national ID card is the only option for generating electronic signatures benefitting from full legal equivalence to handwritten signatures. https://sda.gov.ge/?page_id=5090 88   The Spanish national ID card (DNI electrónico) includes a digital chip containing two digital certificates: one for authentication and another for electronic signing. The card can be used in combination with a card reader attached to a computer to sign documents online. Additionally, a smartphone app called DNIe en el móvil (DNIe on mobile) allows electronic signature generation using a smartphone. https://www.dnielectronico.es/portaldnie/ 89   Argentina’s national identity authority has a smartphone app called Mi Argentina. The app includes a digital certificate allowing generation of electronic signatures with the same legal validity as handwritten signatures. https://www.argentina.gob.ar/aplicaciones/mi-argentina 36 7 CONCLUSIONS The section includes suggestions for practitioners In particular, any decision to implement a national- implementing electronic signatures frameworks at national scale PKI should be evaluated and scoped against the and international levels. specific demand for PKI-based electronic signatures. • Design to promote adoption. Do not assume that 7.1 STRATEGIC adoption will follow straightforwardly from provision, as global experience shows that multiple barriers Take a strategic approach based on the requirements of specific to adoption including cost, usability, access, lack signing use cases and their corresponding transaction risk levels: of demand, and poor understanding of benefits— on the side of individual users as well as relying • Focus on the functions of an electronic signature to parties—can undermine uptake of electronic signature determine the right technology. Whether handwritten frameworks. To achieve widespread adoption, design or digital, signatures provide four related but distinct implementation should balance security and usability, functions: (1) identifying the signer, (2) preventing the and follow standards that allow interoperability. signer from subsequent disavowal of their signature (non-repudiation), (3) indicating the intent of the signer to endorse the contents of the signed document, and (4) 7.2 LEGAL AND REGULATORY ensuring that the document is not modified after signing Build a trust framework based on a risk-based approach to (integrity). Different use cases will put a premium on provide multiple, complementary levels of assurance: different functions, and the technology choices should follow from these requirements, not the other way around. • Adopt a risk-based approach to accommodate various • Properly manage the people, process, and technology levels of transaction risk. Implementation of electronic elements to ensure trust. Understand that trust is rooted signature should follow a risk-based approach that not only in technology used but also the people and allows for solutions that serve the needs of low- to high- process elements of an electronic signature framework. risk transactions. While the latter may focus on security, In particular, the real-world identity of the signer is the priorities of the former may prioritize usability, vulnerable to compromise if the people and process adoption, and cost-efficiency, among other factors. elements, used to associate the data required to create Clearly defined, outcome-based levels of assurance and bind electronic signatures (the user account) to a real- can form the basis of a trust framework that serves the world entity (natural or legal person), are not rigorously needs of transactions at all risk levels. controlled to maintain trust in an electronic signature • Extend trust through regulation to scale the digital framework, particularly at the higher levels of assurance. economy. Electronic signature regulation should be • Design according to demand. Situate the design of an based on a “do no harm” principle. To this end, existing electronic signature framework within an analysis of trust relationships between contracting parties should the demand for electronic signatures by relying parties continue to underpin trust in transactions. Furthermore, and individual users. Use cases will differ depending regulators should see their role as extending existing on country or sectoral context as well as the maturity sources of trust—through standards and transparency— of local digital ecosystems, and understanding these to allow electronic transactions to scale the digital constraints and opportunities is necessary to ensure that economy beyond the current confines of existing trust the electronic signature framework is fit-for-purpose. relationships. This extension can include scaling to new ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 37 sectors, new untrusted parties, and new risk levels, where specifications. Technology neutrality also allows systems electronic transactions would not be possible without to extend and scale to new use cases, new technologies, the transparency and trust supplied by regulation. and keep pace with evolving requirements. • Incorporate existing sources of trust into trust frameworks • Consider how the electronic signature framework to avoid a trust monopoly. While trust frameworks are interacts with the ID ecosystem. Having some assurance necessary to extend trust, regulation should not be so of the identity of the signer is an essential component to stringent as to crowd out existing sources of trust. Exiting all but the lowest-trust electronic signatures. Therefore, relationships, practices, and products may already provide identity must be assured both at onboarding (e.g., adequate trust for certain transactions; a trust framework issuance of a signing certificate) and during the signing should avoid disrupting such well-functioning trust transaction itself (e.g., authentication). Linkages with relationships. Regulators should seek complementarity legal identity systems that provide for digital verification with sectoral regulations. In a similar vein, legal equivalence of attributes and/or digital authentication can help of electronic signatures should not scope creep into improve trust in the binding between electronic legal preference, since even the most advanced digital signatures and the signers authorized to create them. economy may still need analogue measures as backup There are dividends to stack-based thinking, considering (for example, if the internet goes down). electronic signature as part of the national digital public infrastructure. Integration of electronic signature • Deploy electronic signatures as part of a holistic digital capability into the legal ID system itself—as done economy reform. While electronic signatures and the somewhat successfully with smartcards, and increasingly trust frameworks that enable them are a cornerstone of a in mobile form factors – is another potential avenue. trusted digital economy, they should be deployed in the context of complementary enablers. Robust foundational • Align with international standards to facilitate mutual and digital ID systems are needed to allow the electronic recognition. Cross-border recognition of electronic signature regime to be implemented in a trusted way. signatures created in one market and used in another The “functional equivalence” principle that underpins requires trust in not only the technology used but also the electronic signature trust frameworks should also apply supporting people and process elements. If electronic to other aspects of the digital economy, such as electronic signatures are perceived not to follow international norms, communications, electronic commerce, and electronic it may affect their recognition abroad. Countries can transactions in the broad sense. Additionally, many of maximize recognition by aligning their levels of assurance the same principles (and implementation approaches) with international standards as much as possible. that promote trust in electronic signatures for individual • Promote sustainable business models for trust service signers can also be applied to authenticating documents providers. While project financing can provide for initial issued by legal persons (such as governments or firms) expenditures, especially if in-house infrastructure is either through electronic signature legislation or through opted for, these systems can become costly to maintain complementary trust frameworks (e.g., for electronic over time and can atrophy without sufficient demand stamps or seals). for electronic signature services. Ongoing cost drivers are particularly high in PKI-based implementations.90 7.3 TECHNICAL Facilitating participation of the private sector as providers of electronic signatures should be expressly considered Technical and financial considerations to promote adoption, as a means of ensuring ongoing financial sustainability. innovation, and sustainability include: • Promote usability and cost-efficiency. The high costs of implementing electronic signatures lowers adoption • Maintain technology neutrality. This is necessary to allow for service providers, who may be wary of turning users for innovation and product differentiation to cater to away from their service or passing higher transaction different use cases. It also prevents the need to revise legal costs onto users. Flexible, technology-neutral, and risk- and trust frameworks to keep up with natural technological based approaches can lower cost to end users and evolution. Outcome-based standards, such as levels of remove barriers to adoption. assurance, should be preferred over technology-based 90   For additional discussion, see the companion note to this document, Christopher Tullis and David Black (2024), Public Key Infrastructure: Implementing High-Trust Electronic Signatures, Washington D.C: World Bank. 38 8 APPENDICES APPENDIX 1: GLOSSARY OF KEY TERMS Certification Authority (CA), or certificate issuer, is an Electronic transaction means a transaction, action, or authority trusted by one or more entities to create and set of actions of either a commercial or non-commercial digitally sign public-key certificates. Optionally, the nature, and includes the provision of information and/or certification authority may create the subjects’ keys.91 e-government services.95 Electronic seals provide assurance of the origin and integrity Digital identity is the unique representation of a subject of a data message that originates from a legal person.96 engaged in an online transaction. A digital identity is always unique in the context of a digital service, but it does not Electronic signature is a legal construct that means “data in necessarily need to uniquely identify the subject in all contexts.92 electronic form in, affixed to or logically associated with, a data message, which may be used to identify the signatory Digital public infrastructure refers to foundational and re- in relation to the data message and to indicate the signatory’s usable digital platforms and building blocks—such as digital approval of the information contained in the data message.”97 ID, digital payments, and data sharing—that underpin the development and delivery of trusted, digitally-enabled eIDAS Regulation, short for Electronic Identification, services across the public and private sectors. Authentication and Trust Services Regulation, governs electronic signatures in the EU. Formally, eIDAS is made up Digital signature is a technical construct and means “an asymmetric key operation where the private key is used of EU Regulation 910/2014 of 23 July 2014 as revised by EU to digitally sign data and the public key is used to verify Regulation 2024/1183 on 20 May 2024. the signature.”93 Functional equivalence means that an electronic signature Electronic authentication is the process of establishing a will have the same legal effect as the paper-based signature, level of confidence in whether a statement is genuine or including its evidentiary value in courts as it could be valid when conducting a transaction online or by phone. both (a) admitted and (b) potentially recognized as valid It helps build trust in an online transaction by giving the evidence in legal proceedings as fulfilling part, or all, of the parties involved some assurance that their dealings are functions that a signature normally serves (be it proof of legitimate. These statements might include: identity details; identity, endorsement, integrity, or non-repudiation). This is professional qualifications; or the delegated authority to based on the “functional-equivalent approach” underlying conduct transactions.94 the UNCITRAL Model Law on Electronic Commerce, which 91   Information technology–Open Systems Interconnection–The Directory: Public-key and attribute certificate frameworks. ITU X.509. https://www.itu.int/ rec/dologin_pub.asp?lang=e&id=T-REC-X.509-201910-I!!PDF-E&type=items 92   Digital Identity Guidelines. National Institute of Standards and Technology. U.S. Department of Commerce. https://nvlpubs.nist.gov/nistpubs/ SpecialPublications/NIST.SP.800-63-3.pdf 93   Ibid. 94   Australian Government e-Authentication Framework: An Overview, Department of Finance and Administration, Commonwealth of Australia http://www. agimo.gov.au/ infrastructure/authentication/agaf_b/overview/introduction#e-authentication 95   SADC Model Law on Electronic Transactions & Electronic Commerce, Establishment of Harmonized Policies for the ICT Market in the AC. Support for Harmonization of ICT Policies in Sub-Saharan Africa (HIPSSA). https://www.itu.int/ITU-D/projects/ITU_EC_ACP/hipssa/docs/SA4docs/electronic%20transaction.pdf 96   UNCITRAL. 2022. Model Law on the Use and Cross-border Recognition of Identity Management and Trust Services. Vienna: UNCITRAL. https://uncitral. un.org/en/mlit 97   UNCITRAL. 2001. Model Law on Electronic Signatures. Vienna: UNCITRAL. https://uncitral.un.org/en/texts/ecommerce/modellaw/electronic_signatures ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 39 is based on an analysis of the purposes and functions of has not been altered from its original form. the traditional paper-based requirement with a view to determining how those purposes or functions could be Public key infrastructure, or PKI, is the infrastructure able fulfilled through electronic-commerce techniques.98 to support the management of public keys that support authentication, encryption, integrity, or non-repudiation Interoperability is the ability of one entity to communicate services. 103 with another entity.99 Presumption of reliability allows whoever is claiming the Legal identity is the basic characteristics of an individual’s electronic signature to presume, by law, that the electronic identity (e.g., name, sex, place and date of birth) recognized signature introduced before the court constitutes valid under applicable law. Legal identities may be issued and evidence of key parameters, such as the identity of its author managed by civil registration systems or other authoritative and the integrity of the contents of the data or document.104 sources of identity data in a country.100 Relying party is an entity that relies upon the subscriber’s Mutual recognition frameworks extend a trust framework credentials, typically to process a transaction or grant access (see definition below) beyond national borders, enabling to information or a system.105 cross-border recognition and interoperability of electronic signatures. Trust framework is a generic term often used to describe a legally enforceable set of specifications, rules, and Level of assurance frameworks describe the requirements agreements that govern a multi-party system established for that digital identity and electronic signature systems and a common purpose, designed for conducting specific types services must meet in order to provide a certain level of of transactions among a community of participants, and assurance in their reliability.101 bound by a common set of requirements.106 Non-repudiation means protection against an individual Trust service means an electronic service that provides who falsely denies having performed a certain action and assurance of certain qualities of a data message and provides the capability to determine whether an individual includes the methods for creating and managing electronic took a certain action, such as creating information, sending a signatures, electronic seals, electronic time stamps, message, approving information, or receiving a message.102 website authentication, electronic archiving, and electronic registered delivery services.107 Public key cryptography, which is the basis for digital signatures, involves generating two unique keys using Trust service provider is a person or legal entity who enters algorithmic functions that are mathematically related. One into an arrangement with a subscriber for the provision of key is used to transform a document into an unreadable one or more trust services.108 format and create a digital signature, while the other key is used to verify the signature and confirm that the document 98   UNCITRAL. 1996. Model Law on Electronic Commerce. Vienna: UNCITRAL. https://uncitral.un.org/en/texts/ecommerce/modellaw/electronic_commerce 99   Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms. National Institute of Standards and Technology. U.S. Department of Commerce. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175Br1.pdf 100   ECOSOC resolution E/CN.3/2020/15. United Nations Economic and Social Council. https://unstats.un.org/unsd/statcom/51st-session/ documents/2020-15-CRVS-EE.pdf 101  UNCITRAL. 2022. Model Law on the Use and Cross-border Recognition of Identity Management and Trust Services. Vienna: UNCITRAL. https://uncitral. un.org/en/mlit. 102   For additional discussion, see also UNCITRAL. 2022. Model Law on the Use and Cross-border Recognition of Identity Management and Trust Services. Vienna: UNCITRAL. https://uncitral.un.org/en/mlit 103   Information technology–Open Systems Interconnection–The Directory: Public-key and attribute certificate frameworks. Recommendation ITU-T X.509. International Telecommunications Union. https://www.itu.int/ITU-T/recommendations/rec.aspx?rec=X.509 104  UNCITRAL. 2022. Model Law on the Use and Cross-border Recognition of Identity Management and Trust Services. Vienna: UNCITRAL. https://uncitral. un.org/en/mlit 105   Digital Identity Guidelines. National Institute of Standards and Technology. U.S. Department of Commerce. https://nvlpubs.nist.gov/nistpubs/ SpecialPublications/NIST.SP.800-63-3.pdf 106   Trust Frameworks for Identity Systems. Open Identity Exchange. https://openidentityexchange.org/networks/87/item.html?id=175 107  UNCITRAL. 2022. Model Law on the Use and Cross-border Recognition of Identity Management and Trust Services. Vienna: UNCITRAL. https://uncitral. un.org/en/mlit. 108  Ibid. 40 APPENDIX 2: ELECTRONIC SIGNATURE USE CASES The following table gives a list of some typical transactions the transaction. The risk categorizations should be taken in various sectors, grouped according to the risk level of as indicative. Table 8. Common electronic transactions across sectors grouped by risk level Transaction Risk Level (indicative) Sector Low Medium High Opening a basic savings account Authorizing payments below a Opening higher value accounts certain threshold (investment account) Authorizing high-value payments Accessing online banking (large international wire transfers) Banking Authorizing payments (checking balance, viewing account history) Contracts for financial products (mutual funds, derivatives) Acknowledging receipt or accepting terms and conditions (“I agree”) Signing high-value or corporate Credit Submitting a loan application Signing typical loan agreements loan agreements Signing high-value insurance contracts (life insurance, annuities) Signing insurance policy Signing insurance policy change applications and renewals Insurance Signing insurance contracts with requests or other low-risk forms significant legal implications Signing claims forms (reinsurance agreements, commercial policies) Signing prescriptions for controlled substances Health screenings (health history Signing medical records or reports Signing prescriptions questionnaires, surveys) for legal or regulatory purposes Health Consent for complex medical Consent for low-risk medical Consent for medical directives procedures (surgeries, diagnostic procedures (routine blood tests, with legal implications (end-of-life tests) immunizations) decisions, complex directives) Signing agreements related to clinical trials or medical research Course enrollment Signing student registration forms Signing official academic for academic courses or programs Education documents, such as transcripts or Attendance tracking (online diplomas classes) Online exam submissions ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 41 Transaction Risk Level (indicative) Sector Low Medium High Signing deeds, mortgages, or Online order confirmations other real property documents Acknowledging and accepting High-value corporate transactions Signing and executing typical Commerce terms and conditions (“I agree”) (such as mergers and acquisitions) contracts Signing non-disclosure Signing documents with agreements (NDAs) significant powers of attorney or other significant legal implications Accessing highly confidential Accessing government portals Accessing secure government government data (national security to fill out basic forms (voter portals for confidential information information, classified documents) registration, driver’s license (medical records, criminal history) Public renewal) Signing legal agreements with Services Applying for licenses or permits government entities (leases, Submitting simple requests for (construction permits, business procurement contracts) information or support licenses) Submitting tax declarations Acknowledging receipt of Judiciary Signing affidavits or declarations Signing court orders or judgments documents or communications 42 APPENDIX 3: GOOD PRACTICE LEGAL FRAMEWORKS When it comes to international good practice for electronic how those same functions could be fulfilled differently using signatures, two main texts are commonly referred to as digital means.111 It recognized the validity of electronic references. Although there is continuous innovation in information and expanded the definition of a “writing” to electronic signature legal regimes internationally, many encompass information accessible and usable, regardless of countries have drawn upon at least one of these references. format. While the MLEC did not establish specific standards or procedures as substitutes for a signature, it provided UNCITRAL Model Laws some basic standards for electronic signatures, considering factors like identification methods and reliability criteria. Model laws were developed by the United Nations Commission on International Trade Law (UNCITRAL) to The MLEC was later extended in 2001 by the Model Law on harmonize legislation around the world on electronic Electronic Signature (MLES), which focuses specifically on commerce and electronic signatures.109 Although these the equal treatment of electronic and paper documents. The models are not legally binding, they serve as an example MLES contains a number of technology-specific provisions framework for countries to create or revise their domestic that focus on public key cryptography, while maintaining laws in line with international standards and best practices. an overall technology-neutral approach with flexibility to . accommodate other technologies as well.112 Many countries around the world have adopted these model laws either through direct implementation or as a basis for The various UNCITRAL texts as well as the key provisions of domestic law reform.110 each are summarized in Table 9.113114115116117 Over the past three decades, there has been significant European Union work by UNCITRAL on various conventions and model laws to promote trust in electronic commerce and transactions, As mentioned in the above sections, a more recent legal building on each other to establish norms for regulation of framework for electronic signatures that is often referred to electronic transactions and electronic signatures. as good practice is the eIDAS Regulation which is binding on all EU member states. eIDAS Regulation114 has come to Two UNCITRAL model laws are of particular historical serve as a reference beyond the EU since it incorporates and importance to establishing trust in electronic signatures. expands on internationally-recognized standards, including The earlier of the two is the 1996 Model Law on Electronic some which had been introduced under previous texts Commerce (MLEC), which established the “functional such as UNCITRAL’s MLES as well as Directive 1999/93/EC equivalence approach,” which is also the overall approach of the European Parliament and of the Council.115 As such, taken by this note. Functional equivalence is based on eIDAS Regulation reiterates key principles from previous an analysis of the various requirements for paper-based good practice such as the “non-discrimination principle”116 documents in terms of their functions, in order to determine while reiterating the “functional equivalence approach” as 109   While the model law on e-commerce was developed in 1996, that on electronic signatures was developed later in 2001. 110   Legislation based on or influenced by the Model Laws on Electronic Commerce and Electronic Signatures has been adopted in 38 States (39 jurisdictions) and 83 States (163 jurisdictions), respectively. Comprehensive lists are maintained by UNCITRAL. https://uncitral.un.org/en/texts/ecommerce/modellaw/electronic_commerce/status https://uncitral.un.org/en/texts/ecommerce/modellaw/electronic_signatures/status 111   The specific functions analyzed in the MLEC, which applied to electronic documents in general and not to signatures specifically, included functions such as legibility, inalterability, reproducibility, authentication through signature, and acceptance by public authorities and courts. UNCITRAL. 1996. Model Law on Electronic Commerce with Guide to Enactment. Vienna: UNCITRAL. https://uncitral.un.org/en/texts/ecommerce/modellaw/electronic_commerce. 112   UNCITRAL. 2001. Model Law on Electronic Signatures with Guide to Enactment. Vienna: UNCITRAL. https://uncitral.un.org/en/texts/ecommerce/ modellaw/electronic_signatures. 113   The full name is the United Nations Convention on the Use of Electronic Communications in International Contracts. 114   EU Regulation 910/2014. 115   Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures 116   The non-discrimination principles holds that a signature should not be denied legal effect solely on the grounds that it is in electronic form or that it does not meet the requirements for high-trust signature (“qualified” signature). 117   See Article 29. ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 43 Table 9. UNCITRAL texts and key milestones UNCITRAL text Key milestones Model Law of Electronic Commerce (1996) Includes rules regarding writings and signatures and established the functional equivalence approach. Admissibility and evidential weight of data messages are also considered. Focuses on legal recognition of electronic signatures, specifically their Model Law on Electronic Signatures (2001) functional equivalence to paper signatures. Establishes principles and rules that enhance legal certainty and E-Commerce Convention (2005)113 commercial predictability where electronic communications are used in relation to international contracts. Explanatory note on Promoting Confidence in Offers guidance to States and businesses on fostering an enabling Electronic Commerce (2007) environment for electronic commerce. Model Law on the Use and Cross-border Addresses the legal recognition of foreign identity management Recognition of Identity Management and Trust and trust services, providing a framework for cross-border mutual Services (2022) recognition. well as the principle of technological neutrality. However, such as real estate dealings. Brazil’s legal framework for eIDAS Regulation goes beyond then-existing frameworks e-signatures demonstrates a commitment to technological to offer a much more elaborate framework for cross-border neutrality, functional equivalence, risk-based approaches, and and cross-sector recognition of electronic signatures and the facilitation of secure digital transactions across sectors. e-transactions, while delving much more than previous texts into the requirements according to which a high- South Africa trust (“qualified”) electronic signatures may be granted equivalent legal effect of a handwritten signature.117 In South Africa, the Electronic Communications and Transactions Act 25 of 2002 governs the legal landscape of Brazil electronic transactions and signatures, aiming to facilitate and regulate these modern forms of communication and Brazil has embraced electronic signatures as legally binding transaction. This legislation promotes the use of electronic since the enactment of the Provisional Measure No. 2200- transactions, especially among small, medium, and micro 2/2001, establishing a comprehensive legal framework enterprises (SMMEs), and focuses on broadening access, that includes the Brazilian Public Key Infrastructure (ICP) human resource development, preventing information for regulating e-signatures. This foundation is further system abuse, and encouraging e-government services. It strengthened by subsequent laws such as the Brazilian Civil defines electronic signatures as data intended by the user Code, the Economic Freedom Act (Law 13.874/2019), and the to serve as a signature, whether attached to, incorporated in, Digital Government Act (Law 14,129/2021), facilitating a tiered or logically associated with other data. Furthermore, the Act approach to electronic signatures that accommodates varying introduces the concept of advanced electronic signatures, levels of transaction risk. The legislation allows for a wide which are electronic signatures resulting from a process range of e-signature applications, from basic to advanced accredited by the Authority. This accreditation process is and qualified, with the latter requiring digital certificates from detailed, including application requirements and penalties ICP-Brasil. Notably, Law 14,063/2020 specifies the use of for false claims of accreditation. electronic signatures in public sector interactions and health- related matters, introducing three categories of signatures: United Arab Emirates standard, advanced, and qualified. Each category has its own set of requirements and use cases, particularly emphasizing The United Arab Emirates (UAE) modernized its electronic the necessity for qualified signatures in significant transactions framework with the Federal Decree Law No. 46 governmental acts and certain commercial transactions, of 2021, superseding the original decree from 2006. This 44 new law categorizes electronic signatures into standard, signatures, promoting their use and ensuring the safety and advanced, and qualified types. It recognizes electronic reliability of electronic documents. The Act defines electronic signatures, documents, seals, and transactions as legally signatures as electronic data attached to or logically associated equivalent to their handwritten counterparts, ensuring with an electronic document to identify the signatory and their validity and enforceability across various contexts, to confirm that the document has indeed been signed by including dealings with government entities. Moreover, the the signatory. This legislation also introduces accreditation law endorses the use of any form of electronic signature for measures for electronic signature certification, verifying the transactions and establishes a Digital ID system, sanctioned by unique link between electronic-signature-creation data and a the Telecommunications and Digital Government Regulatory subscriber, thereby enhancing trust and security. Authority (TDRA), as a standard method for accessing government services and conducting electronic dealings. The previous legal framework had mandated the use of a certified electronic signature based on a public key certificate The legislation distinguishes between different levels of for legal validity. However, the 2020 amendment relaxed this electronic signatures based on the trust and security they requirement, equating electronic signatures with traditional offer. Qualified electronic signatures, which require a digital handwritten signatures in legal standing and broadening certificate from a trusted authority, are recognized for their the acceptance of various electronic-signature-creation high trust level. Similarly, advanced electronic signatures are devices. The amendment also set operational standards for noted for their security measures and technical requirements electronic-signature certification services, aiming to increase in identifying the signatory. This multi-tiered approach the reliability of electronic signatures. These changes not reflects the UAE’s commitment to enhancing the security, only provided a framework for users and subscribers to reliability, and efficiency of electronic transactions within its make informed choices regarding certification services but legal and regulatory framework, promoting technological also aligned South Korea’s electronic signature regulations advancement and digital governance. with international standards, facilitating trust and global interoperability in electronic transactions. South Korea South Korea’s Digital Signature Act, revised in 2020, represents a significant advancement in the legal framework for electronic ELECTRONIC SIGNATURES ENABLING TRUSTED DIGITAL TRANSFORMATION 45 APPENDIX 4: FROM ANALOG TO DIGITAL TRUST Not all sources of trust used in paper-based transactions can frameworks to go beyond questions of identity and turn to translate seamlessly into the digital world. Additional factors additional concerns, including: specific to digital interactions add a layer of complexity including difficulty in differentiating between original • The need to recognize the legal validity of the electronic and duplicate messages, susceptibility of electronic data form of signatures. to be intercepted and modified, the capacity to process transactions in bulk, as well as the automation of processes. • The need for clear rules and standards for the use118 of Considerable potential for fraud exists in exploiting these electronic signatures across transactions and industries. additional vulnerabilities introduced by technology. • The need to ensure the security and reliability of electronic systems issuing signatures. Justifiably, hyper-focused attention to technology as part of the problem has sometimes led to a biased tendency • The need to recognize such validity across jurisdictions. to discuss technology-centric solutions. While there are sophisticated technologies available that can improve the As highlighted in a recent study, the main obstacle to wider level of security of electronic transactions, an excessive focus use of electronic signatures is the legal uncertainty regarding on such technology solutions overlooks the fact that the their validity and effectiveness. It is not always clear which majority of electronic transactions worldwide do not make transactions can be carried out effectively with electronic use of any particular signature technology. signatures (and with which type of electronic signature).119 The development of legal frameworks for electronic signatures For example, a customer might place an order with a supplier that address these concerns is a key step to avoid creating over email, and the supplier may deem the customer’s typed ambiguity and inconsistency in how signatures are used name in the email as a sufficient signature to accept the electronically and helps foster legal certainty and trust in the order and dispatch the goods. There are number of potential use of electronic documents and transactions, which is key reasons why these parties might trust this transaction enough to the development of digital economies. It should be noted to be unworried about a legal challenge, including: (a) a that the legal framework for electronic signatures does not low transaction value; (b) a history of successful completion address which type of electronic signature should be used for of similar transactions; (c) a secure communication channel, which type of document or transaction. These requirements, such as the order coming from a trusted email address; as which are linked to the risk level of such transactions, are well as (d) a wish to prioritize fluidity of transactions over typically determined by the needs of signature users and security for commercial reasons. verifiers, and may also be influenced by sectoral legislation (for example, in the financial sector). In establishing regulations for electronic signatures, it is crucial to balance considerations, preventing excessively complex technological requirements that may have a chilling effect on electronic transaction volume. Trust in the digital world requires supplementing and preserving existing sources of trust in paper transactions, without assuming a deterioration in existing trust relationships. Over-formalization of digital trust, or over-reliance on technology-based trust, could overshadow non-technological sources of trust. The additional vulnerabilities of electronic media, as well as the need to leverage digital technologies to reinforce . trust, have caused the attention of electronic signature legal 118   Often referred to as “technical specifications,” these standards are “a voluntary means of providing for interoperability between equipment and processes” (See S. Mason in Electronic Signatures in Law, Chapter 16, p.384, published by University of London Press; Institute of Advanced Legal Studies, available at: http://www.jstor.com/stable/j.ctv5137w8.7). 119   Neistadt, Maria. 2022. “Electronic Signatures: At a Glance.” Brussels: European Parliament. https://www.europarl.europa.eu/thinktank/en/document/EPRS_ATA(2022)739238. 46 47