Not all electronic signatures are created equal

 By Rian Schoeman, Managing Executive at Altron Security

Multimillion-rand contracts, board resolutions, regulatory submissions, contracts – every organisation signs documents it cannot afford to see repudiated, and yet the signatures that seal these documents is often the least considered part.

Often, signatures are scanned images or a typed name dropped at the foot of a page, but in a dispute, the burden of proof around who applied them can be hard to overcome. The result is that the organisation discovers too late that it has no way to hold the other party accountable when the situation calls for it.

Anything signed electronically, down to a name at the foot of an email, can bind the sender and this introduces a new level of risk to the business – few employees understand or appreciate the weight of what they routinely agree to, says Rian Schoeman, Operations Executive at Altron Security: “You can send me an email saying that you’ll do work for R5 and in certain circumstances I can hold you to it on the strength of your name appearing at the bottom of that email. Your employees need to understand the ramifications of electronic signatures and the risks.”

“An ordinary electronic signature has no security built in,” explains Schoeman. “You cannot verify that the person is who they claim to be, so if the document is ever challenged, neither side can prove how the signature got there. This distinction matters because even though electronic signatures are legal forms of signature, very often who applied that signature can’t be proved.”

To close the gap, companies need to bind a verified identity to the document itself using a form of secure digital signature. A digital signature embeds a digital certificate in the signed PDF and is issued only after a signer’s identity has been confirmed through some form of identity verification.

“That certificate travels with every version of the document and is linked specifically to the identity of that person,” says Schoeman. “It also seals the file, so it mitigates the risk of tampering.” The PDF that contains the digital certificate, will show evidence of tampering if someone tries to change it post signing. The digital certificate contains details related to the signer of the document and can be linked back to a Trust Services Provider who verified the individual’s identity.

The Electronic Communications and Transactions Act (ECTA) creates a special category of digital signature called an advanced electronic signature (AES). This signature can only be issued by a Trust Services Provider, accredited by the South African Accreditation Authority, following an in-person face-to-face verification of the individual to whom the signature is issued.

An AES enjoys the highest recognition of all forms of digital signature under ECTA and in some cases is the only acceptable form of digital signature, such as suretyships and credit agreements under the National Credit Act (under certain circumstances).

For any very important, high risk or high value document an AES is recommended, due to it is legal protections, which includes a reverse onus of proof. In essence this means that instead of the signatory having to prove that they applied the AES to a document, the onus moves to the person disputing the validity of the AES. This is significant and a major factor why most businesses opt for this type of signature for important documentation.

A handwritten signature can be copied and if there is no witness, there is no reliable evidence proving that the individual in question held the pen when the signature was made. A certificate ties the act of signing to a single, verified individual and leaves a traceable trail.

Not all use cases call for AES, but it is hard to argue that in a digital world, you don’t need reliable, provable, secure digital signatures that are traceable and come with a full audit trail. In addition you need to obtain such signature from a reputable, accredited, South African company with a proven track record and with local expertise and support.

Secure digital signatures offer the business several key benefits. It is provable, it is enforceable and it minimises many of the risks associated with handwritten or weak digital signatures.

Altron Security, incorporating LAWtrust was the first accredited provider of Advanced Electronic Signatures in South Africa, and has for 15 years, been leading the charge in bringing secure digital signing to tens of thousands of South Africans. We offer secure digital signatures and AES to all industries, including financial services, mining, the medical industry, legal and retail.

What is the difference between an electronic signature and a digital signature?

An ordinary electronic signature, such as a typed name at the foot of an email or a scanned signature, has no security built in. It cannot verify who applied it, so if the document is challenged, neither party may be able to prove how the signature got there. A digital signature embeds a digital certificate in the signed PDF, issued only after the signer's identity has been confirmed, which links the signature to a specific person.

How does a digital signature protect a document from tampering?

The digital certificate seals the file. If anyone alters the PDF after it has been signed, the document shows evidence of tampering. The certificate travels with every version of the document and can be traced back to a Trust Services Provider that verified the signer's identity.

What is an advanced electronic signature (AES), and who can issue one?

An advanced electronic signature is a special category of digital signature recognised under South Africa's Electronic Communications and Transactions Act (ECTA). It can only be issued by a Trust Services Provider accredited by the South African Accreditation Authority, and only after the individual has been verified face to face.

When should a business use an advanced electronic signature?

An AES is recommended for any important, high-risk or high-value document, such as contracts, board resolutions and regulatory submissions. In some cases it is the only acceptable form of signature, for example for suretyships and certain credit agreements under the National Credit Act. Not every document needs one, but where proof and enforceability matter, an AES provides the strongest protection.

What is the reverse onus of proof, and why does it matter?

With an AES, the burden of proof shifts. Instead of the signatory having to prove they applied the signature, the person disputing its validity must prove otherwise. This is a major reason most businesses choose AES for important documentation, as it makes their signed agreements far easier to enforce.