Digital Signature Legality for Engineering in European Union

How to eSign a document: digital signature legality for Engineering in European Union

tribe lead po sign of trusted service um [Applause] courtes Eng uh so now I will not to lose you in translation y we we you and I talk very nice but it's nice to have you in in English please so uh please give yon a very warm welcome on stage thank you thank you uh I'm on yeah good so yeah um future of electronic signing to start up front I won't say much at all just briefly touch upon what signat is doing in signing but uh please approach me get I'm I'm happy to talk in a break or whenever um yep uh starting as starting from the basics what's electronic signing how is it regulated how do we use it it's um something we do for a purpose right we sign something for a purpose and it's regulated and uh es already mentioned the Adas regulation of the EU and for signing this means there's a Comm framework a common legal basis for electronic signing across all of Europe so adus does electronic identification including the wallet it does trust Services which is mainly about signing and sealing and it also has an important Point stating that uh electronic documents are useful um terminology signing is always by a natural person physical person if it's by a legal person we call it a seal in this terminology also this is not necessarily done throughout but the way the terminology is supposed to be used is that an electronic signature is a legal term it's technology neutral in a way that uh for the act of signing digital signature is more a technology term for certain use of public key crypto photography and certificates but to reach the upper level of this staircase in practice you need to use digital signature technology so that's the link between them so alos defines three levels of signatures electronic signature is like almost anything goes anything that links you to something that in a way proves your consenting to this act uh and typically you can see also those scribbled signatures right or um um onetime codes by SMS to prove your identity weak identity schemes you can use them to sign you can use them to reach an electronic signature Advanced electronic signature is regulated by ad Us by four properties must prove the identity it must be linked to the to the content it must um it must also protect the content in a way that if the content is later changed then it's discovered uh it's a good level and it must also the last one is it must also be reasonably uniquely linked to the signer so no one can forge the signature in or I mean if you scribble your name anyone can scribble your name but to invoke an advanced electronic signature that's something that can only be done by the signer qualified is the top level again we're on legal terms so what's a qualified it's an advanced signature with two extra properties first one is your identity is proven by qualified certificate so there's really great certainty on the identity of the person and um your signing means uh your key is protected in a specific um certified hardware and that means this so control that this user is the only one that can activate the signing is extra enforced um compared to just advanced level and gives certain legal properties to the qualified signature um the legal presumptions of signatures in Europe um well an electronic document should not be denied legal effect U maybe it's obvious to most of us in the aics that of course you can use an electronic document it wasn't like that in all European countries before Adas on signing it's quite important to state that an electronic signature shall not be denied legal effect just because it's in electronic form and it's not qualified so what it means all signatures are useful in a given context in are useful but it depends on the context I would I should say um what you can use or not qualified electronic signator the top level uh has given the legal status that it shall always be able to replace a handwritten signature so you you can always use a qualified signature but if nothing specific is stated you can use on one of the other levels as well and uh the crossborder aspect qualified signature U made in one you member state is recognized as qualified all over so that's part of the internal Market given us that um there are some Sometimes some misconceptions I know we're not we should tidy up our own documentation I think also when stating we create legally binding signatures ah ah okay yeah but as a starting point any electronic signature is binding right because no signature can be discarded or should be discarded just because it's uh electronic signature it's not qualified uh except when there are some specific requirements I'll get back to that U legal binding of any signature could be disputed um if I'm tricked fooled threatened into producing a qualified signature um and I managed to convince the court that that was the case of course the qualified signator is not legally binding but it's guaranteed compliant but it's not guaranteed legally binding and this leads actually to um yeah I think I I'll do this one first actually how do you select the level of signature to use um there can be legal requirements there can be something stated that uh in in the law that you can only do this using a qualified signature in that case of course you need to ad her to it but in most cases in many cases is up to your risk assessment what do I need imagine I need to take this agreement this document to court uh in the dispute between the person that presumably signed the document so it's a risk assessment what's good enough for the purpose what fulfills my risk and then also it's a good user fit for the process uh it works it's a good flow uh so you don't get to the situation where people don't sign because ah this is too complicated it doesn't work right so what I would say levels could be relevant we state that advanced is a really good secure practical level but uh you need qualified if it's required by uh by law or you need to make you can use qualified if it's easily available as well if I try to go back to the previous yep this points at a very important fact on use of signatures and that is Adas only regulates these levels electronic Advanced qualified but it doesn't say anything about your particular use case if you want to sign uh par sign in a particular context it doesn't set the rules that ah yeah for this context you need this level of signature this is governed by uh sectorial rules and there are actually surprisingly few EU directives or regulations that state something that's valid for all of EU in practice this is down to National Law U as an example uh if I want to sign up an employee contract uh signed up for a new job and many European countries there are hardly any requirements at all you you don't practice you don't need to sign it maybe the scribbled one or what not few requirements but if I want to sign up for a job in Estonia and sign that document electronically I need a qualified signature I need to produce a qualified signature and this as it says at the bottom it creates cross border challenges because if I from Norway want to sign up for a job in Estonia qualified signature is not easily available to me in Norway it's not like something I can up until quite recently I couldn't even do knew it uh now there are some opportunities and we make working to make it better but there are different rules in the Meers different member states for the same purpose um nordics this is a region where we're not that focused on the qualified signatures I don't think there are any at least hardly any requirements in any Nordic countries maybe except Iceland that requires the qualified signature to do something this is also why we we use the advanced electronic signature level to a large degree for everything that goes on in the noric countries but there is some movement Desiring to move towards qualified because at least it gives a it gives a legally more certainly you could say it's better from a risk perspective but it's also like it enables the cross border cases so you don't have to bother about I this is good enough in Denmark but I want to take it to Lithuania it's not good enough most cases are national cross border will increase in in importance so uh there will be there will be a bit more higher demand for qualified so um what do we do well we have a vision uh or guideline for what we do in signing saying sign documents by any verified identity smooth flows covering multiple signers and document and providing also preservation and validation of signatures this is what we do and the circle there says that we are stepping up to whenever there is a requirement to sign by a qualified signature that qualified signature shall be available so our customer shall will in the quite near future uh be in a situation where I require a qualified signature for Lithuania and previously you couldn't get it now yeah you can maybe it's a little bit more awkward but it works at least uh what happens outside of the EU if you go uh further ahead right EU is only a small part of the world um there's a um strong difference between the approach in the EU and the US EU we see this focus on yeah it's the strength of the mechanism it's electronic Advanced qualified qualified is really strong right this is this is you can trust it us has another Focus which is actually not present in Adas and that is uh you need to prove the intent of what happened uh you need to really show that this person intended to sign and if you get that in place any mechanism can do so us you have one level it's nothing like Advanced or anything it's just electronic signature globally we see U others over there uh many countries around the world uh adopt the EU scheme so there are many countries that have similar laws to Aid us but it's not illegal it's not a legal crossb guarantee there it's not like a Turkish qualified signature is automatically accepted as a European qualified but they have the same legislation there is a model law yal is a EU agency uh on legal matters and they prepared a model law so a country that wants to implement an electronic signature law they could use that as a basis to get some sort of international uh leverage and this is more equal to the U to the EU style so International I would say the EU style is the predominant way of doing it but it's not the only one yeah we mentioned um we like to say we combine both uh um we combine the strengths of the um European legislation the advanced level and increasingly the qualified level but at the same time what we do in our signing process is We Gather an audit Trail We Gather evidences of what happened in the process We Gather that we seal it and we provide it to the customer and say Here's the evidence of the process so you get a stronger evidence with what we're doing than just the sign document and and the sign document you didn't know how it was created uh but in this case yeah you can prove this person opened the document presumably read it and the person consented to signing and proved the consent by authenticating by the M ID for example we believe that's a that's a good purpose well uh I couldn't talk about future of signing without uh getting back to Esther's theme and the wallet of course and so it's clear from the legislation stated clearly that any EU wallet shall enable the user to sign using qualified signature and that this shall be also as it's stated by default and free of charge means the user doesn't pay that's the case usually today as well the service provider the relying party the one receiving the signature is the one that pays not the user but anyway it's St there so whenever or if it's an if the EU wallet is generally deployed then everyone will have qualified signature so that's a much easier situation of course and you could say it to someone you need a qualifi say well go get yourself a wallet you can be able to sign and we um we are leading the um signing activities in both these Pilots we're in in both noit and ewc see we are in lead and in charge of the activities on signing so we're on top of it and um Esther mentioned there are wallets available in ewc already we plan to demonstrate use of them for signing late Q3 early Q4 this year I think we can do it it won't be qualified signature in the first run for compliance reasons but it will be the same setup so we can show it I think it's if you look at future of signing I think it's important um this mix we also have on how to prove your identity because some will sign by the wallet and some will use other means for signing in the same process there are multiple signers which is a common case right so it needs to go together and fit together it's not like it's going to be only wallet or maybe that's the we have the outcome scenarios we ran a webinar on that it's available from signat Pages uh as a recording where we looked at and this discuss the interplay of the wallet with existing Eid Solutions and also risk scenarios and possible outcome scenarios on the wallet well of course what the commission wants what countries want is this is a success right uh by 2030 80% of the European population has a wallet that's uh one hairy goal you could say U it there is a possibility it could fail it will be there for sure it will be there will be an offer in each and every member state it could be that no one wants it and we use other means it could be a paral success it could be success in Romania but not in Germany or it could reach a fairly good level we don't know yet there are certain outcomes there but we must be prepared for all of them and we must be prepared to handle the wallet for signing both um both as the sign means and in combination with others so we're stepping up again we say we can sign documents by any verified identity and that identity can be verified by an authentication means Eid uh our own mobile identity solution or identity proofing using remote using an identity document remotely for example or it could be a third party signing service or it could be what you w it so any way what what we're trying to do is to map any verified identity we can get by any means to Signature uh how do you get to a qualified signature um Etsy is standardizing it and from the revised regulation there will be an implementing act referencing standard saying that if you do if you follow this standard for the identity proofing uh you can get the qualified certificate and then you can get the qualified signature so um to sign this standard is sufficiently important that we raise their hand and say that we provide the editor Yours Truly for uh for this standard and we set requirements how can you get a certificate by physical presence authentication using Eid uh use of an existing signature or remote identity proofing using identity document and a selfie video and important also um revised data says that you can only get a qualified signature certificate by using an EOD at level high and this yeah we didn't like it because uh most the Nordic countries except Norway and Iceland you use substantial level level below and suddenly and the Italians got Furious because they have their speed ID on level substantial they issuing qualified certificates and qualified signing uh all the time they can't do it anymore because they raise the bar to high so an important part here is how to specify in the standard how you can do a step up from an authentication by a substantial Eid to get to the level required to get the qualified certificate and qualified signature we're working also with digs in Denmark on this because this is highly relevant for Denmark yeah so so this is sign using any verified identity um how do we do it signing with a wallet well first step is just we add the wallet or the wallets because as Esther said there are multiple it's not one there's not one wallet for Europe there's at least one per country uh but if we add them to the um menu of e providers we already have together with the 35 others and then well we can use that identity to sign and you have also um the identity proofing methods on the other side where we can prove your identity remotely and use that identity to sign yeah it gets a little bit more on the Flow side but uh first setup is like that we are the top the signing service provider our customers at the bottom you want something signed as a signicant customer you leave it to us you call us transfer the document signers contact us we control the process we provide the audit Trail as I mentioned and we use the wallet as an authentication means calling a remote signing service in the background to to um to use to to add the in overtime qualified signature and this is um in this case we just use the authentication capabilities of the wallet we don't need anything specific built in into the wallet which is an easy start for it um there are also architectures um and I I think this will be implemented by quite some member states and it will it's part of the road map for the wallet development is that the wallet will control the signer the wallet the user is the one that wants to select the signing service to use the certificate to use and the way of invoking it and in that case it's the same interaction we see and but we'll go via the wallet to invoke um an attached uh signing service it's not too complicated but this is a different protocol and different way of doing it there are also IDs saying uh yeah this should be completely user control the document should be sent to the wallet and the user should control it and do everything in the wallet to sign and we say um it's a it's it's a good idea but uh firstly you need to read complex documents on your mobile phone um as a service provider the line provider if I give you the document how do I know you don't change it before you signed it uh and uh in some cases with multiple signers if I hand the if you download the document you block all other signers until you're done and I don't know when when that is so um download loading and signing in the wallet is also a scenario but we don't believe it's going to be that useful at least not for Co for um for complex processes so that's where we're heading we're stepping up to qualified because we believe there's going to be a demand but we see that like in the nordics advanced signature is um a good reasonable level we have the electronic signatures the scribbled ones if anyone wants and in short for anything related to signing we got you covered that's what you want to say there's plenty of time for questions yeah we have some time and room for questions anyone from the audience wants to uh ask your a question about the Outlook and the future for digital signing please raise your hands I'm keeping you away from your lunch so the is coming up say something I think we have one it's actually yeah it's an internal one but does a signature dig signature last forever or does it need some kind of Maintenance or resealing or yeah that's it's a very good question um what we do is we immediately after signing we add a time stamp um and that time stamp guarantees in our case that you can validate a signature up to three years after it was done with a successful result no matter what happens to certific ific if the certificate of the signer expires or is revoked or anything happens after signing that doesn't matter you can still validated up to three years uh after that time we can run a preserve service meaning essentially we get the document we add another timestamp and you can store it back and then it's the same it's valid for another three years without any problems but also uh we shouldn't exaggerate the problems that exist if it's just a timeout of the signature after three years uh it's not like it's invalid it's just that you have a weaker proof of the validity of the signature the legislation is very clear it says that a signature is valid if it was valid at the time of signing so it's not like a signature becomes invalid it's just that you the pro the the ability you have to prove that it was valid at the time of signing gets weaker yeah thank you for that any other questions I just had one question you also uh because in my introduction I talked about that uh our signing solution is kind of the core of what signat does right um how many signatures actually run through our engine each year uh um each year uh it increases throughout the years I won't make a prediction but the last uh measures we have we are somewhere between four and 4 5 million signatures per month yeah okay that's in total and uh 90% is via API integration and 10% is via portal a portal solution with the manual more manual procedures it's quite uh and this is I mean we want to conquer Europe right the potential is big and we're rebuilding our service platform now to um the modern version we're re-engineering the sign solution to get rid of some limitations we have for example and get a get a better experience and a component oriented architecture that makes it easier to extend it and all that and also including a a new Eid I guess right for signing purposes like uh yeah spit you mentioned that that's the Italian one right and we are looking upon the Polish one in a minute yes speed for signing we don't yet have but it's approaching and uh uh imagine also we're developing our own app so you can enroll by use of an identity proofing or identity document a selfie video it can enroll to the app and then you get this qualified signature mechanism that you can use later in syat platform that's under development and under compliance so there's lot of lots of new stuff coming up all right guys I think uh let's give Yun a big Applause hey thank [Applause] you for