Identification and Data Security: New Obligations and New Roles for the Notary in the Electronic World

1. Identification and Data Security:New Obligations and New Roles for the Notary in the Electronic World Thomas J. Smedinghoff Wildman Harrold Chicago

2. “Can You Notarize This?” What Do Notaries Do Today? • [In the U.S.] the essential function of the notary is • to attest the genuineness of writings and acts of execution and, thereby, • to authenticate documents for purposes of admissibility and proof in court proceedings as well as for public recording purposes • – Tim Reiniger, Executive Director, NNA • Civil-law notaries (or latin notaries) are . . . able to provide legal advice and prepare instruments with legal effect

3. A Transition in Obligations? • Historically the focus has been on “documents” • Today, electronic notarization requires an enhanced emphasis on – • Identification • Security • Contents • Signatures

4. The Notary’s Role In Identification

5. Identification Is Required For All Notarial Acts • A notary shall not perform a notarial act if the principal: • is not in the notary’s presence at the time of notarization; • is not personally known to the notary or identified by the notary through satisfactory evidence; • shows a demeanor which causes the notary to have a compelling doubt about whether the principal knows the consequences of the transaction requiring a notarial act; or • in the notary’s judgment, is not acting of his or her own free will • Model Notary Act, Section 5-1(b)

6. Identification as a New Priority • “Only in the 20th Century has identificationofdocumentsigners become the Notary’s overriding preoccupation and problem. • For most of the nearly 2000 years the office of the Notary Public has existed, identification required little effort: • most people were anchored in small communities, and Notaries personally knew everyone that appeared before them. • But today, . . . Notaries have the sobering responsibility ofvouching beyond a reasonable doubt for the identities of total strangers.” The ID Puzzle, The National Notary Magazine, September 1996, p. 9. quoted in Closen, Notary Law & Practice, at pp. 180-181.

7. Identification as a New Priority (2) • The electronic environment has added to the concern • Since other indicia are missing (e.g., handwritten signatures) • "Prosecutors see Notaries as a new kind of cop in the electronic world, who makes sure the person signing is who he says he is, so we can trust electronic documents." • Jim Provenza, Los Angeles County special assistant district attorney • “FBI: Notaries Needed to Combat Identity Theft and Mortgage fraud” • Recent NNA article (2009)

8. The Process Is Called “Identity Management” • Three “roles” involved – • Subject – the person being identified • Identity Provider – the person verifying the subject’s identity • Relying Party – anyone who relies • One person may fill multiple roles • E.g., employer as both Identity Provider and Relying Party

9. The Elements of the Identity Management Process • Identity Proofing • Of the Subject by the Identity Provider • Issuing an Identity Credential • That Subject can use to assert his/her identity • Making an Identity Assertion • That makes a claim about a Subject’s identity • Authentication(by Relying Party) • Of the Subject named in Identity Credential or • Of the Person making Identity Assertion about a Subject

10. Identity Proofing • Who are you? • Involves associating one or more attributeswith a person • Name alone often not sufficient – e.g., Bill Gates? John Smith? • Two dimensions • What personal information is collected and verified? • What is the degree of certainty with which the identifying attributes are ascertained – “Assurance Level” • Result of process is – • An “identitycredential” and/or • An “identity assertion”

11. Identity Provider Dept. of Motor Vehicles U.S. State Department Public library Employer Employer Bank Certification authority Notary Credential / Assertion Driver’s license Passport Library card Employee ID card User ID ATM card Digital certificate Notarial Certificate Examples of Identity Credentials and Identity Assertions

12. Notarial Certificate – Identity Assertion re Principal • Notarial Certificate: states the facts attested by the notary in a particular notarization • Model Notary Act, Section 2-9 • Example: “On this _______ day of __________, 2009, before me, the undersigned notary, personally appeared [Bill Gates] , proved to me through identification documents allowed by law, which were ____________, to be the person who signed the preceding or attached document in my presence.” • Model Notary Act, Section 9-3 Signature Witnessing

13. Authentication • How can you prove it? • How do you verify that someone – • presenting a credential or • making an identity assertion -- is the previously identified person they claim to be? • For example – • How do we know who signed the notarial certificate? • How do we know that such person is a notary? • Performed by cross-checking a claimed identity against one or more authenticators that are associated with or linked to that identity • A photo? A seal? A signature? A password? A PKI certificate?

14. Credential / Assertion Driver’s license Passport Library card Employee ID card User ID ATM card Digital certificate Notarial Certificate Authenticator Subject / IdP Photo / name & hologram Photo / name & hologram Possession / name on card Photo / name on card Password / ____ PIN / data in card Private key / CA signature ____ / Seal?, Signature?, Sec. of State? Other? Authenticators

15. The Key Question for Electronic Notarization • What are the standards applicable to the notarial identity management process? • How are they enforced?

16. The Notary’s Role In Security

17. Security as a New Priority • The Notary will be the front line of protection in preventing fraud and forgery of digital documents • Tim Reiniger, NNA Vice President and Executive Director

18. The Legal Role of Security in E-Transactions • Create trust • So parties will be willing to do business • Mitigate enhanced risk of electronic • Comply with applicable legal requirements • E.g., protecting privacy of personal data • Ensure legal / enforceable transactions i.e., level of security may determine – • Validity of a signature • Admissibility of a document • Validity of a transaction

19. Security as a Condition for Enforceability • Vinhnee case • Must be able to establish integrity of electronic record • Dillards Store case • Must be able to authenticate signer’s electronic identity • NASS notary rules • Must be able to detect alterations in electronic record and signatures

20. What Is the Notary’s Role? • What should the notary be responsible for? • Is notary responsible for authenticity and integrity of – • Signatures? • Notarial certificate? • Notarial seal? • Document contents? – (e.g., 10 page contract) • Is notary responsible for such security – • Before signature and notarization? • During signature and notarization? • After signature and notarization?

21. A New Role for the Notary?

22. Identification Per Se Is Rapidly Becoming a Legal Requirement • FTC Act enforcement actions • U.S. v. Rental Research Services, Inc. (March 5, 2009) • State security laws • FTC Red Flag Rules • ACH rules • FFIEC rules • KYC rules for banks • HSPD 12

23. Identity Management Is the New Priority • Obama Administration "Near Term Action Plan" includes: "Build a cybersecurity-based identity management vision and strategy . . . for the Nation.“ • "Cyberspace Policy Review" released by Obama Administration on May 20, 2009 • "The United States should make strong identification of identity . . . a mandatory requirement for critical cyber infrastructures.“ • Center for Strategic and International Studies report titled: “Securing Cyberspace for the 44th Presidency” (December 8, 2008)

24. New Roles for the Notary? • Is Identification the new Notarial Act of the future? • Is Security the new Notarial Service of the future? • The notary advantage • Notary is an officer of the law • Legal presumptions for notarial acts • But will the banks be the competition?

25. One Example –Notary Role in EV SSL • Extended Validation SSL Certificates • Used to identity businesses for display when browser accesses website • Notary role – • Face-to-face validation of identity of Principal Individual associated with the Business Entity • No “notarial act” involved

28. The Future? • Electronic identity management standards? • Obligations re electronic record security? • Notary as a key player in Identity Management?

29. Further Information Thomas J. Smedinghoff Wildman Harrold 225 West Wacker Drive Chicago, Illinois 60606 312-201-2021 smedinghoff@wildman.com Wildman Harrold Privacy & Security Law Resource Center privacylaw.wildman.com