Unlock eSignature Legitimateness for Communications & Media in United Kingdom with airSlate SignNow

How to eSign a document: e-signature legitimateness for Communications & Media in United Kingdom

good afternoon and uh welcome to digital transformation thursdays uh our topic this week is uh electronic signatures are they legal so we will be discussing uh the different legal aspects of electronic signatures and and we will discuss the different technologies uh more popular digital oh sorry electronic signature technologies that are currently in use and we will have as our guests people from the ict cheryl viscara and jennifer candace from the department of ict who are running the philippine national pki or publicly infrastructure program with the icp that is offering free digital certificates and also from a philippine provider using philippine technology uh jeffrey reyes of tuala actually i thought it initially it was pronounced tiwala apparently it's stuala and so that's our that's our show for today i've got far too many slides i think uh to uh to share with you so i think i'll just jump right in uh hold on let me get to my presentation i'll start with okay all right so electronic signatures so uh you know we'll we'll start off where we um where we were before and uh hold on um anyway uh for the um hold on all right okay um so what we'll discuss is the e-commerce app legal recognition of electronic signatures and then i'll we'll go into some examples of electronic signature technologies uh and then if we have some time we will jump into electronic evidence or the rules on electronic evidence and electronic signatures as i mentioned last week the definition of electronic signatures in the e-commerce app is very broad and as i mentioned also the e-commerce app was designed to give legal recognition to electronic signatures such that the electronic signatures that satisfy the e-commerce app will be considered the same as handwritten signatures so if that electronic signature is uh is related right or connected to a an electronic document then that electronic document will be considered signed under the law it is the same as a hand a paper document that has that is uh manually signed or what they say contains a web signature and therefore if the law requires that something has to be signed for example uh for a promissory note to be negotiable it must be signed uh then uh if it bears that in that electronic promissory note if it bears that valid valid electronic signature then it is that electronic promissory note could become uh negotiable under the negotiable instruments law unfortunately as i mentioned also it is a very narrow subset of signatures that are considered the same as handwritten signatures because they have to comply with this is section 8 of the e-commerce app and uh it's a very it has many requirements as you can see first there is a procedure and it cannot be alterable by the parties interested in the electronic document and then there's a method to identify the party and to indicate that parties access to the document second there is uh the method is reliable and appropriate uh and a third it is necessary for the party to be sought to be bound so to be bound in order to proceed further with the transaction to have executed or provided electronic signature and finally there must be an ability on the part of the other party uh to uh to verify right he's authorized and enabled to verify the electronic signature and to make a decision to proceed with the transaction authenticated by the same so this is a very a lot of requirements you have to tick all the boxes before you can say that the document is signed and that's a little scary initially because it does appear that uh only a very narrow subset of signatures would be considered valid under the law and that's true however when you look at the i know that when you look at the law itself there are only actually a very very few instances where something has to be signed or a document has to be signed in order for it to be valid because we follow what's known as our philippine law follows what's known as the spiritual system contracts are valid in whatever form you may find and therefore a verbal contra an oral contract is as enforceable as a written contract and only in a few instances where a signature is required and only in those instances will you will you need to have an electronic signature that satisfies section e and only and these are the instances i've some of the instances that i've brought here uh on this slide that you're looking at right now so a negotiable instrument i mean even then if a negotiable instrument is unsigned it's still a promise or you know it's just that it's not negotiable so for you lawyers out there you you can appreciate the difference so in other words you just don't avail of the the benefits of the negotiable instruments though but the promissory note by itself will be considered a written document of what the the parties agree to or it could be looked at as a a written proof of the existence of the loan okay so i'll uh now discuss the different uh ways that you can uh you can uh sign so one of the ways that uh i i'm aware of is using uh the technology of uh apple right and also an apple preview you could actually sign so i have an example here this is a uh something that was sent to me a few days ago this is an application for an id card at the philippine judicial academy and as you can see this is sent to me as a pdf document it's a scan of the document and what you do here is you click on uh i don't know if you can see the mouse that part there and when you click it shows you the different options of the signature and what you can do is when you choose the signature you want that's not my signature but so you can affix it you can see that it's now the signature is already there and the other thing you can do is you can choose a color so that it looks legitimate and then in this case normally i choose the color blue and uh so now what you have there is uh it's a signature the the document now looks like it's signed and the question now is is this a validly a valid electronic signature is this document now considered signed um and the answer is no right because uh these requirements are not are not present right uh first of all i mean just just very clearly right um the other part is not authorized or unable to verify the authenticity of the signature right there's no way for them to do that and therefore it fails now is it consider does it satisfy an electronic signature under the e-commerce app yes it's just not considered a valid electronic signature okay now let's go to adobe so adobe i captured this from the from their site so i hope i don't know but we can't see your screen oh you can see my screen oh wait uh no wonder somebody paused the screen sorry there sorry maybe i i i know so you lost everything sorry let me go back thank you for that uh oh i know but now i'm done so i'll just show you so in apple now in apple you can uh if you open a pdf you can sign uh on your pdf using maybe i should open my viber on my screen so people can message me in case something's going crazy okay um right now so uh this is a pdf you're seeing a pdf uh it's sent to me i can sign it the place where i'm supposed to put my signatures down here right now so what you can do is you can click here this part and then what does what it does is it opens it up there it opens up the choice of signatures you can you can create a signature by uh if you have an ipad or even on the on the computer you can sign using your hand or even on your phone right and then it saves it as a signature another way to do it is you sign on a piece of paper put your signature on a piece of paper you put it against the camera and then it will scan it scan it reverse and then put it in the proper place so actually one of the signatures here many of these signatures are actually signed uh manually right and then you you press that press that and then it affixes the signature here right you see that and i can change the color also so normally i do that so that people think that i actually signed it even though i did not and then so that you send this off now the nice thing about this and i'm a big user of this is that you can be anywhere you could be because it also works on uh on the iphone if somebody sends you an email with a pdf uh you can open it on preview and you can have the same functionality on your on your iphone and therefore you can sign documents this way but as i mentioned earlier this does not satisfy this is not an electronic valid electronic signature that document is still considered unsigned okay there is some you can argue that uh there's a good reason to believe that it came from me if it is bound that way how come because the only person who could um affix that signature using this uh this process is somebody who was able to open my phone or open my computer and presumably i'm the only one who can do that so under those circumstances you could argue that it's reliable you know to a certain degree uh but the problem is that you don't satisfy the requirements of the particularly the ability of the other party to enable uh to uh verify the the signature okay so now we go to adobe so an adobe so i just captured this from uh from the uh let me just move this out here okay i just captured this from uh from the web earlier so the first thing you do is you add the designer's email okay and then enter that then you add a customized message if you want you select the document that you want to send and then you send it then it's received by the person who's supposed to sign he presses start he enters his initials there i entered my initial then you click tab to enter your signature i entered my name click to finish and the document now is considered signed and the document is sent and then uh and then you get access uh in some sort of like dashboard right it shows you the status of documents that are being signed by other people and then later of course if it's signed gives you information about that the signature the document has been signed by by the individual and if you click you get more information on more details this is the document that was signed this is the person who created it and it shows information about uh the signings i i captured that so it says that uh you know it was created at this time it was emailed to this individual that individual saw it right in other words that individual saw it on the web on adobe's uh website adobe captured this ip address right and then he signed using the adobe system and then the final document was emailed by the adobe system to these two people right the question of course is that is satisfy uh uh section eight now maybe i don't know enough about adobe and actually we try to invite a representative from adobe maybe somebody will uh will uh uh come in later i don't know maybe they can uh tell us on the q a uh that they're around but um so there is a method to identify the party and that method essentially is basically email right uh because they do send you to your email address and it indicates your your access to the to the to the document the method you know you can argue whether it's reliable and appropriate and that could be a function of what type of transaction you're entering into and it is necessary for the party to continue to provide the signatures which is required to provide it but the thing that that is again not clear is whether the other party that information that i showed you earlier this information is available to both parties now it does say that the signed document is emailed to both parties but whether each party has the ability individually to get verification as to the authenticity of the signature it's not clear to me based on the demo but of course the demo is just that at the mo okay which brings us to now is a very it's a very similar process flow as a adobe you you identify the document right you you indicate your signature in this case in there in this case uh there you click on sign and then well the nice thing about uh is they allow you to have your own uh select style or you can draw your signatures it's up to you and you adopt it now if you look at the definition of an electronic signature right it's a mark that you adopt in order to identify yourself and to indicate your concept so in this particular case you've adapted this mark right right and so that that is the market you would happen you click that and then the signature is affixed on the bottom part of the document okay so you see it there and then um you are able now uh to see the history right the details about that document when it was created that it was uh emailed same the same information it was sent it was delivered and it was signed right on this date that time and that's the ip address and i wonder if that's really my ip address i should i should uh maybe i should have obscured that okay so that's the ip address supposedly of me and then uh and then there's more information the certificate that's issued by by okay giving all sorts of uh information okay uh and the gap question now is this uh uh uh legal a lawful uh signature certainly there's a method to identify both parties like initially the method to identify the first part is is the user id password that is able to access the system the second method to identify the other signage is through their email address and they're the way they can access that is of course obviously you would have access to your email if you have your user name password combo to into in order to sign the document uh whether it's reliable and appropriate again that's a there's a there's some analysis that needs to be done depending on the type of documentation and type of uh transaction you're entering into okay and the necessary for the parties are to be bound to provide the signature so that's kicked off again the last part is are you authorized and unable to verify the signature independently of each other and again that depends on whether or not the information this information all of this information is available to all signers of the document it appears that it is right so it would satisfy that so there's a there's reason to believe that because the reason i was able to have access to this info was because sent me an email and then it provided me a link to this information now whether this information is available to me moving forward uh is something that uh well i'm not particularly i'm not sure okay so i'll i'll move on to the next part of my presentation uh and my my next set of slides involves uh i don't know digital signature so we'll jump to digital signature um and uh let me see okay so visual signatures moving on so i mentioned this already right that digital signatures are electronic signatures are broadly uh authorized and recognized broadly defined but limited in recognition so a lot are considered and a lot but only a few are deemed valid now the reason i discuss digital signatures is because as early as 2000 it was my conclusion that only digital signatures within the context of what's known as the public key infrastructure are considered valid signatures so now i'm going to try to to explain to you uh and i hope i will uh be successful and explain to you what is a digital signature okay i have to uh move through a couple of slides i'd like to give credit by the way these uh these slides were stolen uh from uh but you can see it again did i did it pause and post on them what does it pause it's zoom share thank you thank you for pointing that out how does that happen um so this uh these slides were quote unquote stolen from abet de la cruz so you'll see his name here and and uh so anyway 20 years worth of uh theft you're watching right now so let's hope it doesn't sue us okay so the first the first concept of course that we need to understand is encryption very simple right you take uh plain text you apply an electronic key and then you end up with cipher text so that's encryption yeah encrypt that's easy to understand the next now is the concept of decryption and in decryption you take cipher text and then you use the electronic key the same electronic key and then you decrypt it so now you are able to encrypt and decrypt but you use the same key okay and so uh so this is known as symmetric key cryptography so let's say i wanted to send a message to you and i want it encrypted because any message that goes through the internet is um what's the word uh it's open anybody can see anybody in the path of the message can can access the the message that's why they say that internet email in terms of security is actually equivalent to uh the security of a postcard okay so i will encrypt it i'll encrypt it using this key i send it on the internet you receive it and then using the same key you can decrypt it now okay this is called single key cryptography the problem with single critique cryptography is that if you want to communicate with many people you have to send a unique key to each of them so if abbett is communicating with me and reyna and roger and janet and billy and gloria abbott has to send a key to each of us okay so it's it's messy you have to have so many keys uh if you have uh well the average filipinos are i think a thousand facebook friends that's a thousand keys you have to send to a thousand people how do you how do you transmit this key safely right unless you meet face to face you put it on a usb drive hope it doesn't i know so you can't send it by email uh so it's very very difficult so symmetric key cryptography works but it's uh it's difficult plus you're also considering that the other part is able to secure that key on their own okay what if what if or not so that's the problem and so the solution is what they call asymmetric key cryptography or public key cryptography in public key cryptography and uh sorry you are assigned what's known as a key pair okay a private key and a public key the power the private key you keep privately you hold that the publicly is known to everyone okay if you're aware of bitcoin right and the bitcoin address the bitcoin address is a public key right and if you want to um if you want to transact using bitcoin you want to move bitcoin the instruction to the blockchain must be signed with the private key and in a private key those are the keys that are in your wallet that's why if if your wallet is compromised right you can sign instructions and the blockchain will know that it's signed properly because it relates it to the public key okay so i'll go back to that later if you have any questions okay so the public key is posted and it's accessible from a public directory the private key is held in secret so that means that there could be right a minimum of only one key for for me one key and then everybody and i can use it uh and communicate with many people okay what is encrypted with one key can be decrypted with the other key so what i encrypt with my private key can be decrypted using the public key okay uh and one is useless without the other so there are key pair right and this is actually this definition has been adopted in the rules on electronic evidence so how do you use it no so let's say uh abbott uses my public key so then he with my public key is publicly available he then sends me a message he encrypts it using my public key so the message is now cipher text right you see that sent to the internet i receive it using my private key i decrypt it now what does this mean it means that this ensures privacy right because the only key that can decrypt that message is my private key so abbott can be sure when he encrypts using my public key that i'm the only one who can read that message okay so how about if abet uses his private key okay so he has a message uses his private key which only he has he encrypts it sends it on the internet i receive cipher text and then of course it will say oh this message came from abed okay then i check abet's public key which is publicly available i decrypt the message if it decrypts if it decrypts properly i know that the message could only have come from abe because i was able to decrypt it using his public key because the only key that could have been used to encrypt it was abet's private key okay i hope that's clear as clear as the passive river okay so we all we only we know that abbett is the only one who possesses the private key and therefore he's the only one who could have encrypted the message okay uh and then his authorship is also established by the fact that the key was decrypted a decrypted new using his public key okay all right so so the digital okay so now we will move outside now you understand public key the key pair right now we talk about something different okay so you start from scratch so we're going to discuss what is a hash okay a hash is a digital fingerprint of an electronic document aqua i like to think of it as a number okay so in other words you have an entire message or an entire document you run it through a hash function then you you come up with this hash it's a it's a summary of what this document of what this document is hash functions are standard okay so there are hash functions out there i don't know i'm sure one of our guests or later will be able to tell us what are the different hash functions that are available they're all standard uh the message this this this uh no here this this thing here you cannot take this and and uh get the original message so even if i have the hash of this message i'll never be able mathematically impossible or i guess improbable for me to decl to find out what the message is okay but the value of a hash is that if i send you a message and i run it through a hash so i send you the message and the hash function right when you receive it okay so you get my message you run it through the same hash function which everybody has access to these standard hash functions and then you can compare the hash that i sent to you to the hash that you created and if it's the same then you know that that the message was not changed it had not changed because uh the hash function changes if there is any meaning the hash result it's different if there is anything that's been changed here so for example this message is hello world let's say i add a space after hello right now for human beings there's no difference for computers there's a difference and therefore the hash function that will come out without the space is different from the one that will come out with the space and so that's what i mean when you're able to compare hashes then you know that the file is exactly the same okay so this is this is actually used i don't know if you've heard of the technology called the duplication to find out that both files are exactly the same you run a hash function even if the file names are different but if the hash result is the same the files are identical and so what do you do you delete the other file save on hard drive space and just make a pointer to that file to the other file that way you can save in hard drives okay now what is a digital signature a digital signature so you take the original message you run it through a hash you come up with a hash you encrypt the hash with your private key the encrypted hash is your digital signature one more one more time you have the original message the message that you want to send the document for example right then say non-disclosure agreement you run it through a hash function so you come up with a hash you you encrypt this hash using your private key which only you have right then so that hashna will be encrypted this encrypted hash is your digital signature now how do you how do you do that you send the message original message or the original document together with the assigned the the encrypted hash which is your digital signature so now this is the document and these two documents are related to each other you send it on the internet it's received so the recipient will do this he will take the original message run it through the hash function then it'll have the hash right now he takes the digital signature now he knows it came from you or at least that's what the email says he will then look up your public key and then he will decrypt the hash or the digital signature using that key he will come up with a hash which is this which is uh that decrypted right from this because you can decrypt it using the public key now you compare both hashes the hash that you run through the hash function and the hash that you decrypted if it's the same then you verified it you you've established two things let me see i don't like it i might use these slides in a long time first you've established identity how did you establish identity by the fact that you decrypted the hash using the public key of the sender in other words the only one with the private key which encrypted this message is the sender so you've you've established this identity okay that this message came from the holder of the private key now uh uh in the case of in the case of uh now what did the hash function establish the hash function established that um that that the message was not had did not change the message did not change uh from the time it was sent to the time it was verified meaning this message was the one that was that created that husk this hospital right it's the same so now you know that the message has not changed the integrity of the document has been established and the identity of designer has been established as well okay uh right so i'm going back and forth on that all right uh sorry now so people who sell digital signature uh systems will call it non repudiation right okay now the only problem is you know in uh in bitcoin i said about earlier maybe we'll i don't know if we can do that for right now so if if this is if this is a bitcoin so let's say as i said a bitcoin address is a you know it's a it's a it's a public key right meaning you're the when you send an instruction right your wallet contains the private key okay so you you you uh use that uh by entering your password right so what happens is you send a message to the blockchain and then you you take a hassle and then the message is formatted it says transfer three bitcoins to this person and that's what let's i have eight bitcoins in my wallet i transfer three bitcoins to them and then transfer the five bitcoins the remainder to me okay so that message you you will run it through a hash and then you will sign it using the key that's in your wallet right the blockchain will receive it the blockchain will receive your message it will decrypt it using the uh because you signed it because it knows that it's sent to the public keynote so uh gaga when i did decrypt the blockchain will decrypt the signature using the the bitcoin address which is the public key come up with a hash the hash is also uh the original message the bitcoin uh uh instruction is run through a hash function and then they'll come up with a hash and if they match then the instruction is valid okay so this is exactly this is the way a blockchain works at least my understanding okay so technical people out there if you're if you're squirming in your seats i'm sorry okay so um but you and i know everybody knows in bitcoin you don't know who owns a bitcoin address there's anonymity and that's the same thing in digital signature in the system that i've described up to this point nobody knows who is who really owns that private key or right like who really owns or really whose bitcoin address is that okay same thing so the problem is identity so what's the solution okay one solution uh is for a third party to certify that that public key belongs to this individual okay that per that party uh is referred to as a certification authority okay certification certification authority and that certification authority but it's a it's exactly like kyc they will verify your identity challenge you to establish your identity on that basis they will then say okay this public key is owned by this individual and the certificate authority will itself issue a certificate right they will certify that that person owns that uh that public public key okay and they issue digital certificates and digital certificates will contain the name and address of the certificate authority and it will certify that uh the certificate is valid for a certain time period this is exactly what is being done by the pn pki or the philippine national public key infrastructure by the ict they will i verify your identity and then they will issue a certificate saying that that that key right belongs to j.j dc me because jj dc went to us and and gave us his identifier identification okay so it's a bit like a credit card right uh sorry in terms of the information uh validity period uh the public key would be your address the issuer is like in this case it's visa but actually in uh in a certificate would be say that the icd okay right so uh so just that's analog uh to give you a sense of the way we structure the rules on electronic evidence we made it very simple to uh to prove a digital signature so if it's a digital signature right uh as we discus as we discussed the way to prove it or authenticate it so that the document is considered signed uh is you need to uh show to the court demonstrate to the court that there is a method used to show the existence of a digital signature and second there is a method to verify it okay so uh july 18 2001 right abet de la cruz sent me an email right and this was the outlook i don't think it still does it now but you see that if that is present that means that the the email is digitally signed you click on that and then so sorry going back long this is the method to identify that the uh email is digitally signed when you click on it this is the method to uh to validate it so it says that the digital signature is valid but when you look more closely into the the details of the digital signature what you will see is that persona is not validated okay which means that although this although the the the they were able to verify that this person uh uh says right that that that this id is issued to this person the one issuing the digital certificate in this case it's uh uh it's very sign they said we did not verify the identity of this person so in a sense this is not a that cannot be considered valid okay it's very signed that issue of the certificate but they don't know really who he is okay let me just skip this slide and i'll just i'll just uh move on to something that a few weeks ago or two weeks ago you saw uh emmer bagnes professor emerbanez used to sign the list of people who passed uh the law aptitude exam um and so if you open that document on uh on what you call this on um acrobat okay what you will see is here you see that it's assigned and all signatures are valid so you click on signature panel and it open this opens up i don't know if you can read that i think i made it bigger there okay it says the signatures are valid validated signed by signatures by so now you're saying wait so this this this uh this document which was signed by professor barnes it's digitally signed but when you look more closely right what you will find is that this document is not digitally signed by professor barnes professor banyas used to say but the digital signature actually belongs to it says here right this document so in other words the the document that was that was signed using by that document itself then signed it digitally okay so there's that there's the what they call it an envelope the envelope created when when professor barnes affixes signature that itself was digitally signed by okay so this is a document which is so now interesting that under philippine law you will say well this document is considered signed by the document arguably might not have been signed by emmer banez because we know we know for a fact it was not digitally signed by armed and when you look at the when you go deeper into the certificate when you click here for the signature details uh to look at the digital certificate what you will see again as it says it's that is uh that is uh is to whom entrance right had issued the certificate okay and i hope that was clear um so what i'm going to do now so that that ends my my part on digital signature