440 likes | 574 Views
Tony Sutherland Ess Consulting. The Digital World and its impact on the Legal World. Relying on Paper is a Fool’s Paradise. Ess Consulting. How business will be conducted. Ess Consulting. MIS Australia - March 1998.
E N D
Tony Sutherland EssConsulting The Digital World and its impact on the Legal World
Relying on Paper is a Fool’s Paradise EssConsulting The Digital World and its impact on the Legal World
How business will be conducted EssConsulting The Digital World and its impact on the Legal World
MIS Australia - March 1998 • MIS - “One of the biggest stumbling blocks for organisations wishing to carry out business online is that the legal framework isn’t in place yet. ...” EssConsulting • Alston - “… There are separate legal issues about validation of contracts, about verification of digital signatures, about encryption technology in terms of security, and they’re all being addressed and we will be in a position to make some announcements in the not too distant future”. The Digital World and its impact on the Legal World
MIS Australia - March 1998 • Alston - “… There will probably also be a need for legislation to allow for the courts to accept digital signatures and digitally signed contracts so that there is a proper enforcement mechanism but I don’t think that’s going to be a very difficult issue.” EssConsulting The Digital World and its impact on the Legal World
How business is conducted today EssConsulting The Digital World and its impact on the Legal World
How business is conducted today • Receive fax with letter of engagement, requesting signature. EssConsulting The Digital World and its impact on the Legal World
How business is conducted today • Pull up image of fax in software - save in correct directory. EssConsulting The Digital World and its impact on the Legal World
How business is conducted today • Apply scanned signature to sign line, annotate date - re-save. EssConsulting The Digital World and its impact on the Legal World
How business is conducted today • Send back the image document via fax. EssConsulting The Digital World and its impact on the Legal World
How business is conducted today • Nothing ever printed. EssConsulting The Digital World and its impact on the Legal World
Was it signed? • Applying a scanned hand-written signature constitute signing? • Applying a “drawn” X (or cross)? • What about typing name in with “S/” using an annotation tool? EssConsulting The Digital World and its impact on the Legal World
Digitally Assisted “Paper” Fraud • Hypothetically … • I am having a little “contretemps” with the contracting authority. EssConsulting The Digital World and its impact on the Legal World
Digitally Assisted “Paper” Fraud • Before I sign and save the document, I perform a little “creative” accounting. EssConsulting 42,000 12,000 The Digital World and its impact on the Legal World
Digitally Assisted “Paper” Fraud • I fax the document back as before - Nothing ever printed. EssConsulting The Digital World and its impact on the Legal World
Digitally Assisted “Paper” Fraud • At the contracting authority office, they print and file the received fax - on the paper file. This is now the “latest” copy - and signed copy - of the contract. EssConsulting The Digital World and its impact on the Legal World
Digitally Assisted “Paper” Fraud • Which is the correct version? How can one tell from simply perusing the paper? EssConsulting The Digital World and its impact on the Legal World
Absolutely Fabulous • I also get a hankering for some … EssConsulting Bolle. The Digital World and its impact on the Legal World
Absolutely Fabulous • I copy and paste the Contract Manager’s signature. EssConsulting The Digital World and its impact on the Legal World
Absolutely Fabulous • I put together a Purchase Order - with their logo - ordering TEN crates of the best Bolle, delivering to Room 666, Sheraton Southgate. EssConsulting The Digital World and its impact on the Legal World
Absolutely Fabulous • I fax the PO to LiquorLand, who promptly deliver EssConsulting The Digital World and its impact on the Legal World
Absolutely Fabulous • I make a few phone calls and we party on. EssConsulting The Digital World and its impact on the Legal World
Absolutely Fabulous • When LiquorLand sends an invoice for payment, the Contract Manager denies sending the PO, and doesn’t pay the bill. LiquorLand contemplate suing for the money but decide it will be too difficult. EssConsulting ... • Meanwhile, I have had the best party of my life. The Digital World and its impact on the Legal World
Business conducted via email EssConsulting The Digital World and its impact on the Legal World
What about email? • Is signing with “S/ Tony Sutherland” a valid signature? • Does the addition of a “sig” constitute signing? • Does sending an email without a “signature”, but known to come from your address, constitute the equivalent of signing? EssConsulting The Digital World and its impact on the Legal World
Issues Raised • The issues are well known in legal terms • Confidentiality • Integrity • Authenticity • Non-Repudiation EssConsulting The Digital World and its impact on the Legal World
Digital Solutions • There are many other scenarios whereby the current operations - especially those predicated on a paper model - can no longer be relied on. • The solution is available in the digital world (and has been for many years). EssConsulting Encryption Digital Signatures The Digital World and its impact on the Legal World
Encryption • Cryptography: the science of converting messages or data into a different form, so that they can only be read by using a “key” • Cryptology: the science of “breaking” or “cracking” encryption schemes, by discovering the “key” EssConsulting The Digital World and its impact on the Legal World
Digital Signatures • Digital Signatures are a reliable electronic means of signing electronic documents that provides send authentication, message integrity and non-repudiation, in a convenient and efficient manner. • Note the difference between electronic signatures and digital signatures EssConsulting The Digital World and its impact on the Legal World
How Digital Signatures Work SENDER Res IPSA LOQUITUR S2. Produce Message Digest (hash) 101000110 S1. Plain Text Document EssConsulting S!G09US*ET S3. Encrypt Message Digest with Sender’s Private Key Res IPSA LOQUITUR S!G09US*ET S4. Attach to Message S5. Obtain Receiver’s Public Key POI5RE83R FSD9&^dsa97SFef(WR4 S6. Encrypt Message and Signature with Receiver’s Public Key S7. Send Secure Message and Signature FSD9&^dsa97SFef(WR4 The Digital World and its impact on the Legal World
How Digital Signatures Work RECEIVER FSD9&^dsa97SFef(WR4 R1. Receive Secure Message and Signature EssConsulting R2. Decrypt Message and Signature with Receiver’s Private Key Res IPSA LOQUITUR S!G09US*ET R3. Separate Signature from Message (now in plain text) S!G09US*ET Res IPSA LOQUITUR 9*y$H56#fc R4. Obtain Sender’s Public Key R5. Decrypt Signature with Sender’s Public Key 101000110 R6. Produce Message Digest (hash) 101000110 Confidentiality Integrity Authentication Non-Repudiation R7. Compare Sent Message Digest with Calculated Digest The Digital World and its impact on the Legal World
Digital Solutions:Satisfying Confidentiality Confidentiality is satisfied because messages are encrypted and not easily read without substantial effort. EssConsulting The Digital World and its impact on the Legal World
Digital Solutions:Satisfying Authentication Only the sender can (digitally) sign a message using her private key, therefore if the (digital) signature is properly decrypted using the sender’s public key, it must have come from the sender. EssConsulting The Digital World and its impact on the Legal World
Digital Solutions:Satisfying Non-repudiation In a similar vein to Authenticity, only the sender can (digitally) sign a message using her private key. A successful decryption of the (digital) signature means the signature can only have come from the sender, who therefore can not deny signing (and sending) the message. EssConsulting The Digital World and its impact on the Legal World
Digital Solutions:Satisfying Integrity The message digest can only be calculated with respect to the text which it is “hashing”. Thus, if the sent message digest equates to the message digest calculated on the message at the receiving end, it means that the message must be intact (it has not been tampered with). EssConsulting The Digital World and its impact on the Legal World
Certificate Authorities • The digital signature process relies on finding, retrieving and using the public keys of both senders and receivers. • Certificate Authorities (CAs) are trusted sources of public keys. • CAs issue certificates, verifying that the public key to be used is valid and up-to-date. • International standard: CCITT X.509 EssConsulting The Digital World and its impact on the Legal World
Key Escrow • Escrow is an arrangement whereby something is deposited with a trusted party, to be accessed by a third party under special conditions only. • Key escrow (of private keys) is needed so that encrypted messages can be read under certain conditions, such as: • An employee leaves the organisation • Law enforcement requirements. EssConsulting The Digital World and its impact on the Legal World
Legal Progress of these Digital Solutions • Australia - PKAF Report (“Strategies for the implementation of a Public Key Authentication Framework for Australia”) • United States - • National Institute of Standards and Technology Federal Digital Signature Standard • American Bar Association Guidelines • Malaysia - Public Key Infrastructure Pilot EssConsulting The Digital World and its impact on the Legal World
Arizona - accept digital signatures for documents filed with the office of the secretary of state. California - digital signatures affixed to communications with public entities. Connecticut - use of electronic signatures for certain medical records. Delaware - electronic signatures with respect to accounting and payroll documents. Florida - Electronic Signature Act of 1996. Iowa - electronic signatures for voter registration forms. Illinois - Electronic Commerce Security Act. Louisiana - "alphanumeric or similar codes, fingerprints, or other identifying methods" for medical records. Legal Progress of these Digital Solutions EssConsulting The Digital World and its impact on the Legal World
Legal Progress of these Digital Solutions • New Mexico - Electronic Authentication of Documents Act - its purpose is to "provide a centralized, public, electronic registry for authenticating electronic documents by means of a public and private key system; promote commerce; and facilitate electronic information and document transactions.” • Utah - Utah Digital Signature Act - The first to authorize commercial use of digital signatures. It governs the use of public-private key pair encryption and certification authorities. • Virginia - use of digitized signatures, thereby enabling what is referred to as electronic commerce. • Washington - Digital Signature Act, enabling reliable electronic messages, to minimize the incidence of forged digital signatures and fraud in electronic commerce. The Governor signed the bill digitally. EssConsulting The Digital World and its impact on the Legal World
Digital Solutions and the Courts EssConsulting The Digital World and its impact on the Legal World
Problems with the Digital Solutions • Ability to “crack” keys • Privacy • Certification requires identification • De-facto “Australia Card” • Government Control • Law Enforcement EssConsulting The Digital World and its impact on the Legal World
Where to from here? • The Bleedin’ Obvious: The Digital World is here to stay! • Business will be transacted digitally, and the law (and the Courts) must embrace digital concepts • Legislation • Experience and Understanding • Use • Lateral Re-think on Privacy and associated issues EssConsulting The Digital World and its impact on the Legal World
FIN EssConsulting The Digital World and its impact on the Legal World