Ensure Digital Signature Legality for Operations in India with airSlate SignNow

How to eSign a document: digital signature legality for Operations in India

or digital signature or digital certificate would be a category within the broad concept of an electronic signature and the digital signature has a higher degree of authenticity integrity and legal value because it is issued by a particular certification service provider [Music] legal admissibility and validity of digital signatures what are they and how do they work hello you're with Echelon and in the studio today with us is gianto Fernando now jayantha is a lawyer he is a Founder director and former chairman of Sri Lanka set he's also co-chair of the national certification authorities task force and we are talking about digital signatures and their governance framework welcome uh so let's start with something fairly basic and straightforward you know we we talk about uh digital signatures uh uh what can you give us the background what what is that yeah so uh from a legal perspective uh what might be uh useful to think about is the fact that we have a law in place sure called the electronic transactions act sure number 19 of 2006 which is uh focused in creating the enabling facilitating legal environment for digital transactions in general okay but certain categories of transactions have been excluded by the electronic transactions act ready to take note of that so things like last Bills um certain categories of trust in instruments instruments uh that needs to be notarially executed for the transfer of properties power of attorneys Etc so those sorts of documents will require signatures as we are currently used to which has to be manually authenticated and those are Exempted from the scope of the electronic traffic and that has to be noted but going into the subject of digital signatures we need to take a license of the fact that the electronic transactions Act brings the concept of digital signatures within the concept of an electronic signature so we need to also bear in mind the electronic transaction set brings into legal effect four categories of instruments a data message electronic document electronic record or a communication and those instruments are the ones for which legal Effect 2 is given in this act and all of those are defined in a very simplistic manner to take care of an SMS to a paper-based document to digitizing uh or using a message word or open Office document which is transacted between parties sure so so fundamentally you know this act is not necessarily to give not necessarily for digital signatures only but it recognizes electronic communications right so it can be an email it can be a document shared electronic document share it can be an SMS or a WhatsApp message and this gives legal kind of recognition to that sort of communication whereas just to get it clear uh previously it had to be some sort of paper physical document right so what is a digital digital signature then uh as far as this act is concerned uh which is in electronic transactions act what is a digital signature and how does that fit into this whole picture covered by this act yeah so how how I would respond is to Simply say that a digital signature or digital certificate would be a category within the broad concept of an electronic signature and the digital signature has a higher degree of authenticity integrity and legal value because it is issued by a particular certification service provider a certification service provider authorized under the ACT would have the ability to provide a service by issuing a digital certificate or a digital signature that would ensure Trust sure let's let's sort of dumb this down let's sort of demystify this right um now now from a end consumer point of view or somebody who's who needs to authenticate a document or sign a document something like that right if if the physical format is is something we are going to leave aside right uh assume um assume we want to do that how does one get about this okay exploring a digital signature what is it and how does one get about exploring that yeah so uh one has to rely on the certificate provided to you or me by the certification service provider and currently in Sri Lanka we have one of them which is a public private partnership authorized under the electronic transactions act so that is yes right which is a public private Partnerships authorized under the electronic transactions Act within a governance framework that I will described later and you have to go to that entity and there is a verification criteria that entity would follow before the grant or issue of a digital certificate to you or me or to a corporate entity and once that is issued there's a process of including that digital certificate pin 2 the electronic document or electronic record before sending it to the other party and that is embedded in such a manner so as to ensure a higher degree of Integrity so that any manipulation of that instrument will be able to be detected so are you suggesting it's it's uh much more difficult to uh for somebody to carry out an act of fraud as a digital signature is in place as opposed to a physical you know if if you again can sort of in a basic sense explain uh why you say that yeah so let's look at a contract or instrument that is used between the party so even a letter that would commit a high value or maybe look at a simple set of instructions given by a entity to a bank [Music] from a email account of that company to the bank manager authorizing a transfer sure a high value amount of somebody else now if that is sent by a process where a digital certificate is not used between the sender and the recipient if there is a intrusion and an adjustment to the figure including the destination to which the money should be transferred there could be a problem and that might impact financially to uh entity because small so in that kind of ecosystem and in the scenario of The New Normal postcode where many of us are doing transactions without physical interaction it is essential that you rely on a trust based model to ensure authenticity and integrity and this provides use of a digital certificate and a digital signature provides that okay so uh one may Wonder okay we've been using uh physically signed documents for the longest period of time they will continue to be valid uh in a court of law Etc we are used to them being used as evidence in these transactions Etc should there be some dispute about it how does a digital signature sort of fit in in such a situation it does does it have the same legal status as we are used to assigning to a physical signature good question the answer is found in section 7 of electronic transactions Act which says notwithstanding any law or written provision requiring the use of signature that requirement can be met by the use of an electronic signature so long as it is a method that is acceptable and appropriate further purpose and in that context we should keep in mind that the law as it is worded now gives the digital signature the same status as a Android installation so so in essence you are suggesting that it has the same status as a physical signature in law so electronic signatures are the broader concept and digital signatures are a subset of it right and it is the the extra security is found in digital signatures not necessarily electronic signatures would you suggest that you know Electronics signatures are even more uh easy to abuse uh than a physical signature yeah because in a example like you attach a scan image of a signature either to uh electronic document or a done on a laptop or you fix that into an email along the way somebody put into the system and change it and the profile of the person sending can be different to what was origin in NBC sure that is the amount of tempering that can be possible using a standard electronic signature and that is why the lower recognizes the concept of a certification service provider which is authorized by a high Authority called the certification Authority which is a governance layer that enables these to function and if I am to add one more point shamitra on this note uh Sri Lanka is the first country in South Asia to adopt the gold standard on the subject area through an amendment to the electronic transactions act in 2017 which enables Sri Lanka to onboard International instrument called the U.N convention on the use of electronic communications in international contracts which is in short referred to as the UN electronic communications convention and in that we have a framework that led to certain changes of this act so that the law adopted in Sri Lanka is incomparable with the international standard sure so that cross-border trade and commerce can take place digitally and in that context we can look at a future where electronic signatures or digital certificates issued in Sri Lanka through a trusted service provider like a certification service provider licensed and authorized by by this act to be recognized in another country sure is it is it will will will those sort of dealing in international transactions trading across borders right for services or Goods often use some form of electronic communication like you you uh you often email things up and down right do you think this is this this law and the in and it's bringing digital signatures to the four sort of gives greater security to to trade that Sri Lanka is very much doing currently absolutely it would enhance security in the context of electronic business and international electronic trade and commerce that can be carried out in the future and to add two that point in the context of uh what has been recently said about taking the country forward in the direction of free trade agreements with other countries in every International Trade instrument now there's a reference point given to this International gold standard I referred to the UN electronic communications convention Sri Lanka having ratified that standard to the amendment into 2017 puts us in the right place to become part of that international trading Arrangements where crossboard instruments can be mutually recognized provided we use uh regulated trusted digital signing process which is just again for some context joints are here and that is the electronics transactions Act is a is a law that has existed uh the component of electronic signatures and digital signatures uh was wasn't was bought through an amendment to the law was it uh originally right from the beginning the concept of electronic signatures were always there right what was done was to further strengthen that show aligned to the international standard through the amendment in 2017. right what's been the sort of you are a policy maker you are uh you you have internet laws right in in Sri Lanka so you are not necessarily somebody who will go and try to operationalize this or promote this but from your Vantage points uh Point uh of having sort of pushed this policy and and got this enacted in 2017 uh when you look back you know how do you think what do you what do you think about the its adoption and use in in society in business in Commerce very interesting question actually uh initially the adoption was slow and then came a new wave of opportunity when the commercial High Court gave a ruling [Music] in Colombo in 20 2007 within one year of this act coming in 2017 no 2007 with the within one year of the original act yes that the information contained in an SMS this would be a data message and would be legally buried sure and it was a bit recovery case where the defendant had sent certain Communications to the plaintiff and the photocopies of the smss subutical court and that was admissible so that opened a new wave of opportunity for SMS based transactions in that early days to take shape in in the distance Commerce Arena and Banks started providing SMS alerts and you know communicating via text messages sure so certain sectors started adopting this faster than others so the banking sector was in the Forefront of adoption a digital signature adoption and gradually we see over the years in a way due to kobit we have physical physical interaction became impossible uh Customs Department to exercise Department to many other organizations have provided methods for their uh inter they are their stakeholders to submit documents electronically and to ensure security to those transactions to recognize the digital certificate attached to those transactions to authenticate the party sure so it has been a slow adoption but I think kovid ramped up adoption with a new normal I think that momentum should not be lost by the way I'm not a polythemic I am a lawyer but I think policy makers and leadership in the Country Must insist over a period of time that this should be used as a default to save paper and to ensure is of communications for individuals doing business with government or privacy you referred to that Watershed 2017 case when 2017 2007 case when the high court recognized an smss as admissible as a digital communication in as evidence has has the has a digital signature that was an electronic communication has a digital signature also at any point been the subject or evidence uh in a court case I'm just wondering from uh you potential users perspective has this been tested or has the test done in you know the evidence that came through in 2007 really adequate to give anybody uh Comfort I believe the precedent set in 2007 and the consequential rulings by the commercial high court in Colombo over the years in a number of cases right the enabling framework specifically on uh electronic signatures and digital certificates uh well they are maybe pending cases but they are aware of at least two court of appeal judgments they are broadly the provisions of electronics transactions act has been given meaningful interpretation to have cross-cutting legal effects sure so in that situation I think what we have at the moment the judicial dicta from the court of appeal and the commercial high court has a lot of persuasive and binding legal effect so it is your opinion as as a lawyer who's been watching this space that uh somebody who wonders about uh the Practical user use of this of a digital signature you should find comfort in that the courts have been very consistent in their interpretation of uh of digital signatures or electronic communications and they are standing the the Judiciary has been proactive in Sri Lanka in interpreting the electronic transactions act in a progressive manner sure if if we sort of talk about the overall governance framework around electronic signatures and and digital signatures as a lawyer and somebody who's interested deeply interested in this subject uh how do you reckon how do you rate Sri Lanka's standing currently in its with its you know the laws the systems that we have placed for this yeah so uh Sri Lanka was an early adopter of another International standard connected with this instrument called the uncitra model on electronic signatures which has a governance framework sure for the use of digital signatures in a country so that is found in the electronic transactions act in a particular chapter which is titled certification Authority so the certification Authority is a trusted government entity sure which has the technical competency and capability to set up the governance tools essential for the implementation of digital signing methods in a country sure so we have a certification Authority designated in Sri Lanka which is at the moment Sri Lanka's cert which is the national Center for cyber security and they have been at the Forefront of implementing the technical framework required to operationalize the certification Authority the certification Authority is further governs by the electronic transactions Act under that amendment I mentioned into 17 2017. and under Section 18a a task force can be established for the proper functioning of that certification Authority and at the moment we have that task force in place jointly chaired by shulak assert and Central Bank of Sri Lanka and that has ensured that the task force would set the throne and the standard 4 uh proper interoperable regime to be used for the use of electronic signature so that task force has authorized the certification authority to permit certification service provider in Sri Lanka to operate provided the certification service provider meets the minimum standard right so if you're suggesting there is several layers of this governance framework the framework itself at the top there is uh there is cert under that uh there is there is a technical framework that cert will take uh we will have to follow and top of all that you have the task force under Section 8. so this task force is in tandem with cert I suppose it sits as a supervisory body offset and the certification the certification service provider comes after that so so the quality of the certification service provider is not something that automatically comes it's it's these several layers that Overlook its operation exactly so that requires a process of audit sure that has to be carried out on the provider which issues a digital certificate sure and the current provider had to go through a rigorous International audit oh I see before they were issued the authorization sure to provide digital certificates in Sri Lanka yeah it's a very expensive job it's a very expensive investment and we realized that in the economic context and sustainability uh you know not many entities can invest that much of money because the auditing is an international audit and it it has to comply with the international norm and a standard that a technical guy will is it is it the intention of the governance framework that there is continuous monitoring of the quality of service of the certification service provider how does that happen so it happens through a not a one-off audit a regular audit specified time frame and the [Music] regulated functioning of a certification service provider is reviewed by the certification Authority and reported to the task force on a continuous basis to ensure that the trust Integrity security aspects is Ensure in digital Commerce right so so technically there can be more than one certification service provider uh and and however many there are the [Music] the certification Authority and the governance framework will make sure its services are up to the standards specified in the in the laws yeah and the standards specified as per the mandate of the certification Authority and the task force right they have the authority to ensure proper Administration and governance of the system and in any further us of that objective has set uh International standard based audit as the minimum standard just to understand then how it works from there assume um there is uh there is let's say a legal matter regarding a digital signature that comes up before a court uh who does the court reach out to the certification Authority or the certification service provider to check the authenticity of documents very good question actually in fact they are the first point may be to verify from the issuing party which is a certification service provider regarding the originality of a digital signature if further verification is required on the procedures followed by the certification service provider whether it conforms to minimum standard then the quotes would have the ability to call upon evidence from the certification service provider sure so somebody who says sorry a certification Authority certification Authority right so so a company or an individual you know people use digital signatures as individuals not as companies right well individuals can use companies can designate number of individuals right to use the digital certificate and a company can request uh the CSP to issue digital certificates to a number of entity persons within that and and anybody who sort of uses that process any company that avails itself of you know several people being able to sign on its behalf on documents need not sort of be apprehensive about uh the rigor of the process should there be a dispute about the quality and the rigor of the process that will automatically be applied yeah in a sense when it comes to the quality and rigor the higher quality and the I think would ensure enhance Integrity uh as a as a lawyer and as somebody who's sort of engaged in this area uh when you look at the framework currently how confident are you that the framework we have the law and the framework that we have uh meets the best Global standards bill have no law is perfect right a law has to go through a process of evolution Amendment and appropriate adjustments based on uh how effective it has been in terms of adoption but we are talking of area which takes years too uh in the process of transformation so I think maturity will take time it has economic investment aspect as well in terms of meeting Global standards uh Sri Lanka being one of the early adopters of this U.N convention I mentioned which is the core standard we will ensure that we are in line with Global standards and that we are interoperable with other trading partners with whom Sri Lanka May potentially have free trade agreements in the future so this has been a fairly comprehensive discussion I think janta about the governance framework underlying electronic signatures and its subset the move current one which is a digital signature uh in conclusion uh anything you would like to add well what I would like to say is that the electronic transactions act has been there for a while before they mended and that has also been there for a few years adoption has been slow but I see a change uh the change would happen if there is opportunity for people to trust it sure so the trust Factor comes from the Integrity security aspects to a transaction that can be ensured by the use of a digital signing method but having said that we have to be mindful of the potential confusion lack of awareness that can take place and the generation gap between those who are used to the standard physical approach to those of us in the Middle Ages kind of looking at this as a round two you know around with and then of course the New Kids on the Block and the new version generation is fast and adopting this than any of us and we can see that in the Capital Market ecosystem in relation to what the stock exchange did with SCC launching a digital solution for onboarding customers uh in the stock exchange now in that digital signing is happening as we speak through the mobile tool but uh if we look at that framework it's the younger age group the under 35s who have been portfolio doctors so I see a change over time but I think the confusion and the lack of awareness is a barrier to fast adoption and programs such as these and other capacity building initiatives have to be enhanced and fast tracked to ensure production of this law effectively Jonathan Fernando uh grateful for this opportunity to discuss the electronic transactions act and it's later morphing and adding aspects to do with digital signatures thank you very much for your time thank you [Music]