Understanding Electronic Signature Legality for Addressing Harassment in the European Union

How to eSign a document: electronic signature legality for Addressing Harassement in European Union

hi good morning before this next talk Fabian has hijacked my presentation because we've received from a customer this year video that we would like to show you we received something similar last year from a partner in the u.s. called open-source integrator this year it's a customer that send it was without solicitation I would like to show it to you and by the way we think it's really interesting to have this kind of video during big talks so if you want to take inspiration to sender something next year be my guest [Music] [Music] [Applause] [Music] [Applause] [Music] [Applause] [Music] [Applause] [Music] [Applause] [Music] [Applause] [Applause] [Music] [Applause] [Music] [Applause] [Music] stop it's nothing let's go [Applause] [Music] [Applause] [Music] [Applause] [Music] [Applause] [Applause] [Music] [Applause] [Music] [Applause] [Applause] [Music] [Applause] [Music] [Applause] [Music] [Applause] [Music] [Applause] [Music] [Applause] [Music] home team continue economy choir on all right thank you back to our regular programming so today I will be speaking about electronic signatures and the eternal questions that we all get from customers and even from partners from time to time are they legal and I'm here to tell you all to relax a little bit and I'll try to show you the thought process that you can use the speech that you can use to convince your customers that yeah okay stop worrying about this this is legal and a little bit about me just to show you that I'm not some random guy found in the street I've been working at odoo for five years now I've been working in development I've been working at professional services technical support migrations and today I would like to take that expertise that the amount of cash of questions we received for the legality of sign to to react an attention to give you this information but first before we dive into the matter let's have a few definitions set up straight so that we know what we are talking about and let's begin with the basics what is a signature like the classic handwritten one it's it's a handwritten mark or note that is a depiction of your name and that will will mark your intent and your identity on a document and this last part is really what what is interesting in in that regard we want a mark of the identity and intent with the goal of the document that you are signing and so for example if you receive your news desk something with these little scribbles at the bottom you might have a really good deal with the late Steve Jobs or with Mark Wahlberg or with John Hancock which is a signatory of the Declaration not the declaration of dependence but the Constitution of the United States of course normally you won't get this anymore but who knows and already I'd like to illustrate how weird this system is now weird it is that we all take this as the golden because I've just been fooling you for 12 seconds this is absolutely not Steve Jobs but Tim Cook and it's absolutely not Mark Wahlberg but Mark Zuckerberg and we take this as granted because we have been using signatures like this for hundreds of years we usually know who is signing the document in front of us because this is something that we do a lot of the time together we have the feeling that it's difficult to forge the signature I'm not so sure it is but we have this feeling that although I will be able to recognize if if it's not the person that I wanted to sign who signed it and and this is important actually there is quite a strong legal deterrent for forgeries of cincher I think in the u.s. it can do ink it can go from two to ten years of prison and depending on the document and quite a few thousand dollars of fine so for all these reasons we have a tendency as a culture to trust ink signatures even though when you think some for two seconds about it it's really not that strong of a proof of intent and identity and now to switch to something a little bit more modern what is a electronic signature and in this case we have to differentiate two concepts that get mixed up together quite a lot of the time an electronic signature is just some electronic data that is associated with some other electronic data and that will be used as a mark of ID as a signature so as a mark of identity and intent this definition covers a lot of stuff that we don't usually see as a signature so such as a check box even a simple online form can be considered as an electronic signature the name at the end of you of the emails you sent it's a signature it is it can be recognized as one by the law if you go to court and there are a lot of examples for example if you if you sign a you know your bank they want you to sign something they send it to you by email you print it you sign it you scan it you send it back we all think it's normal but it's actually an electronic signature and it's actually electronic signatures did back to quite a lot of time because they were legally accepted even by telegraph back in the early 20th century so it's not a new concept there's another concept however that we should not mix them with is the digital signature a digital signature it's usually something that is that uses mathematics or cryptography to both show the identity of the person who sign it to show that the document itself hasn't been tampered with that the integrity of the document and the signature is still fine examples of this usually include external at either a certificate system that you can find online or a device based system such as in Belgium we have identic I didn'ti cards with with certificates on them that you can use to sign documents even online we can submit or tax reports and this is a digital signature at oh do we will only do electronic signature and not digital signature I'll explain why in a minute because actually it's not really needed to do to do more than that but for all some of these reasons we have the feeling that electronic signature should not be trusted it's quite new we don't or we have the feeling that it's quite new if it even though it's not sometimes you send documents to people you don't know and have never met so you you don't have this trust relations at usually that you usually have when you sign something with someone and we have the feeling that it's really easy to pretend that you're someone else because on the internet no one knows that you're a dog for example and for all the for all these reasons we don't trust electronic signatures a lot ok so we have our basic definitions now I'm going to ask a few advices from my my junior legal adviser he's been helping me prepare this talk since two weeks what are the legal aspects in the United States and in Europe of these electronics injured I'll begin with Europe Europe passed the directive IV was updated five years ago now which is called the e I this directive which concerns electronic signature and identification and in Europe we recognize three levels of electronic signatures the first one is the most basic one it's what we have just been talking about the electronic signature so it might be a checkbox the name at the end of your email whatever the second one is called the advanced electronic sensor and it uses even though the the the low the directive is quite technology currently quiet or mute it doesn't impose any technology the the well most implemented solution for advanced electronic sensor is the P key ISO public key infrastructure where each signer has a key crypto para sorry a cryptographic key that we will use to sign the document sometimes with a password or a pin and finally we have the third level which is a qualified electronic signature it's basically the same thing as the advanced electronic sensor but in addition to having to know a password or a pin code you also have to have some kind of device that has been approved for this use such as a smart card or some kind of USB key that is tied to your person but the most interesting part of this directive is the first paragraph of the 25th article which says that an actor an electronic signature shall not be denied legal effects in court on the ground that is an electric that it is in an electronic form which literally and there is no being with he about this this phrase means that whatever form of electronic signature you have you can use it in court to support your case whatever your case may be of course it doesn't mean that any signature will be automatically recognized you still have to port to to bring supporting evidence about this this electronic data but still no signature can be rejected on the simple ground that it's electronic and I think that's really the crux of the issue here that we this feeling that no one will want to admit that my checkbox so that my squiggle on the screen is legal well here you have it black on white it is in the US it's something a little bit similar even though it was done quite earlier I think the the legislation is from the early 2000 it's called the assign act and it gives five criteria that you need to meet for an for an electronic signature to be admissible in court the first one is that there need to be an intent to sign and by intent usually we mean that the person who's signing as also the choice not to sign otherwise you don't have a free will if you want it could be called free will there need to be a consent to do business electronically which usually means that if the customer or if the person who wants to sign this document wants to do it on in a paper form in an ink with an in signature they should have that choice perhaps you can mail it to them via snail mail or something similar but you need to give them this choice you need a clear signature attribution this is of course the most difficult part to prove very easily what we will do in know do and in most online signature systems is that we will add metadata to these signature events so that's you who can bring supporting evidence in court to have this clear attribution you need to have a clear and unique association of the sensor with the record which means that you need to to make sure that this signature cannot be moved to another record and finally you need to keep that this record and this data in your system and this is mostly the bases the two to two with which you can convince your customers that this signature is perfectly legal that you can use it for business documents and that's what we do in the design and that's what we that's what I said earlier that we only do simple electronic sensors because for most business cases it's completely and utterly sufficient you don't need more than that you don't need certificates you know didn't anything like this because you have the law with you and we you have the metadata that will show in a second - to support your case in some cases still need more than this typically something that you would do in front of a Natori like real estate sales like last will and Testaments stuff like this but for most business cases for this is entirely sufficient regarding limited data that we keep there is just one thing that can change you know do depending on what you choose to do if you know who the person who's supposed to sign is then you will send a specific signature request to someone and in that case we will have more metadata because we know who's the intended target of the signature and there is also the concept of a public seen at your request you know do where you can broadcast the document so that's anybody with the link can sign it and and get the copy of it and in that case you will have a little less traceability what do we keep as metadata in our system to give you supporting evidence well we will log the three main operations that can happen on the document creation a signature event itself and any access by someone in the system or outside the system and the metadata we keep about these operations include the IP the timestamp of course the geolocation either by we are using jira IP for creation and access and for the signature event we use the geolocation API from the browser so it can be really really precise up to three meters if you have a GPS included in the device we have also validation of the email if the request was sent to a specific person to a specific email the link itself will be unique to that email address and when when the user clicks on it we will we will be able to tell okay II received the email so we know at least that the email address address exists which can be quite interesting as supporting evidence and the last one and I think it's really important especially here in Europe we can do two-factor authentication using sms's that we will send one number and this is actually quite strong in Europe because in Europe all phone numbers are tied to a specific identity you cannot have an anonymous phone number so if you use the system you can have quite a lot of information about who signed it when where they were what divides the use address stuff like this we send this report when the document is signed to everybody who was participating in it not all the information is included all the time we don't want to leak your phone number or your zero location to the other signers but in the system we have it so if you need to get it out of the system for a court case you can is there and and with this system where we send the disease signature where we basically combine all the data with the signature then make a hash of this and we have a chain of events that cannot be broken without having the system detects it automatically I think we have quite a strong case to reassure users and signers that this document is in fact legal and that they can use it if they need to to prove that the agreement is valid so how are they legal I think that's a question that we need to ask in that the question we get a lot the short answer is yes the longer answer is yes they are and the longest answer is this talk there is a lot of resource on the internet that I will put in the slides when they get uploaded later on it depends of course on the type of document you want to sign but for most business cases it should be enough nearly all the time that's it thank you very much [Applause]