Unlocking Electronic Signature Licitness for Corporations in Australia

How to eSign a document: electronic signature licitness for corporations in Australia

[Music] good afternoon everyone and welcome to today's webinar the urgent need for trusted digital signatures in australia i'm megan chapel from sydney flow and i'll be your host today as you know the pandemic accelerated the use of eSignatures amongst australian businesses with the federal government enacting temporary changes that allowed companies to conduct business digitally this included the use of electronic signatures instead of physically hand-written ones and it significantly eased the transition from face-to-face to remote business while the speed of which a signature technology was adopted allowed for immediate business use and electronic transactions users didn't necessarily have time to weigh the risks associated with the electronic execution of documents in addition many were not fully informed around the different types of electronic signatures available to them and what the benefits of each were you would have heard about electronic signatures and digital signatures two terms that get used interchangeably but which are fundamentally different indeed not all online signatures are created equal today we have two experts in the field rocky chan from global sign and david saunders from sydney flow with us to shed some light on this rocky and david will help you better understand the difference between electronic signatures and digital signatures against a backdrop of the urgent need of trusted digital signatures in australia at the end of the webinar we will have a q a session please feel free to bring up any questions that you have during this session or alternatively you can type your questions in the q a window and we'll answer them after the presentations now let's welcome rocky who will share more information specific to how digital signatures can prove authorship and authenticity of three documents as well as the sinus identity he will highlight all the imminent roles of trusted digital signatures in our company's digital transformation journey over to you rocky thank you very much megan hi everyone my name is rocky and i'm a senior account manager from globalsign and myself have been working with a lot of clients from australia and new zealand for almost five years so uh allow me to give a little bit of introduction about our company uh globalsign have been a public trust certificate authority since 1997 and we as a leading provider of digital identity and security management solution for uh provider we are actually one of the longest standing web shops accredited certificate offered in the world and that lead us in the industry by providing um internet of everything in uh many countries and uh i believe many of you might have might be wondering like what is uh digi certificate authority um so basically a certificate authority is a public trusted entities that manage and issue a digital certificate and in order to issue the digital certificate we have a set of rules and the policies that we need to follow and to make sure that you know when we issue a digital uh certificate uh we are not issue out to a identity or an unauthorized person so today's agenda we will be talking about what are electronic and digital signature in general and how does pdf reader verify a valid digital signature and what is the role for global sign in digital identity and then also we talk about how global site issue a digital certificate and how does uh how to digitally sign a document by using uh significant right so um electronic signature or eSignature refer broadly to any electronic process that indicated acceptance of an agreement or a record and the term digital signature is frequent frequently used to refer a specific type of an electronic signature electronic nature is just an image and a symbol or sound that used to sign an online document which it is you know digitized equivalent of uh hamilton's signature and if you look at a digital signature it's use a specific type of electronic signature that um uses certificate based digital uh digital id to authenticate a signer's identity and demonstrate the proof of signing by binding each signature to the document where with an encryption and validation is done through a trusted certificate authorities or a trusted service provider so um let's just take a look of one of a simple comparison here about electronic signature and digital signature so you can see to compare both you have you have to look at the legal weight the area of this application security uh identity and trust and the source of the sign that so uh let's just focusing on a couple of key points here if you look at let's say uh you know in terms of the security here you can see that a digital signature actually will allow you to verify a sinus identity and also in terms of use it you will have to use it together with um assigning application like for example you can have a pin code or passcode user logging all this kind of you know features to do a digital signature and compared to electronics nature these are unable to do next part here i will be showing you uh a demo which uh i have actually seen from uh some of my customers in the past and the way they uh sign a document by using an electronic signature it's not really considered as safe or secure but it also can be easily to be d by someone else so let me show you the demo here assuming this is one of the document that uh i'm giving it to one of my customer mr jackson and john is my line manager so what i'm going to do here is that before i send out this quotation i didn't get john's approval and now i'm trying to john's signature in the document and send it to mr jackson and i can show you how to do it right now so as you can see this is um adobe pdf reader which is everybody using every day in your business practice you know when you send a document with your style contract or whatever so the pdf reader itself it comes with a function called field and sign so which is right under here so if you go to view inside i guess some of you guys have used this before so what i'm going to do is that i'm just gonna click here and then i will click sign yourself so what i'm going to do here is that i will add a signature when i add a signature you can see there are like couple of options here that allow you to uh input to sign the document so assuming i managed to get a picture of john's signature from one of the hard copy document right i can just easily copy and paste to this uh document right here all right so done let me close it and now you can see the document has john's electronic signature i can send to mr jackson without nobody know because this is a handwritten signature from john and i just you know take a picture of it and save it as an image to send out so this is one of the way that i have seen people done it in the past and you can see that how easily an electronic signature can be d by different person so this is one of the scenario there will be a there's a second scenario which also people told me that oh they can uh create a digital identity by themselves uh yes uh they can do that but what i'm going to show you here is that if a digital identity is not you know provided by a public trusted certificate authority meaning to say anyone can use your name to create a digital identity so here's another function that you can see from here still go to the tools then i will go to a certificate and i'm going to here click digitally sign and then i will just draw a signature block here and i go here configure new digital id so if i go here create a new digital identity continue and i will save this digital identity into a windows certificate store so a windows certificate store is where your laptop or your pc that save the digital certificate in general so now i'm going to continue and right here i'm going to create uh put john's name [Music] sales sign on email and then yeah all these i can choose any like countries or region when i want it so i leave all this as by default save it so after save it you can see that i have john's digital id i just um i can just use it to sign the document so i'm going to hit continue and yep everything i have already all preset so yeah still i have john's signature sign the document so before i sign this document i will have it say okay so now i have this document saved let's open it and then let's see what happened so you can see the document has been uh digitally signed by use uh by using a self-created uh digital identity and yes you might be wondering why the ribbon here say that cyan or signatures are valid let me explain to you remember earlier when we created this uh document this digital id uh it's also created a digital uh identity for john which is automatically saved in my microsoft windows and meaning to say if you have these saved in any of the pc when you receive uh this a self-signed document you will all get this uh blue ribbon here but let me show you some more detail here if i go to the signature let's go to the signature and i will go to check the signature properties by meaning to say see the digital signature detail you can see yes you can still see this this name is email address this information an issue by john smith so now comes to a question with all this information right here is all created by myself and if you receive it you may be wondering oh okay this is actually from john but what what if i delete this um digital id in my laptop in my computer and think about it think about it in this way your computer or your laptop may not have john's digital id so let me show you how it looks like after this so i'm gonna go here i'm gonna delete this digital id close it i will close the document and then i will open it again so this is the document that i just digitally signed and you can see here says at least one signature has problem is because i deleted john smith digital id so in a your general practice you will not receive any random person's digital id and then save it in your windows and then say okay this is my id you have to trust my digital id because this is not really make sense to to to trust an actual digital signature right so let me uh show you a sample here that what is an actual digital signature like what kind of information that it will contain so again you see the blue ribbon here which i will explain it further for you later but what i'm trying to show you here is that if i go to the signature here again i will check the digital signature uh information i will see yes my name my email address my organization name and uh issue issued by uh global site gcc r6 aatlca so remember this one here this one i also will explain further in my following slide so after you see this um uh this demo and you can see that a valid digital signature site by a digital certificate is trusted in the adobe reader and uh this is due to adobe approved trusted list member so meaning to say uh adobe approved trusted list member is a program that allows millions of users and um around the world to digitally sign a document that is trusted whenever the site document is open in adobe reader so global site as a part of adobe approved trust list member and therefore the the digital identity that provided by globalsign is a trustworthy certificate that and this is how you know adobe reader verify the digital signature based on their members digital certificate so um if you remember right a digital certificate in primary act like a identity card or like a driver's license or you know or a passport as it uh basically tell you that you know uh that you are who you are and you know your and your uh identities of validity right and uh for example here if you can see a digital certificate that will show you that the owner's company certificate issuer expiry date and more right so um next we're gonna show you guys uh how does global site uh january issue uh digital certificate so uh you know as we uh you know as global site we are a trusted a public trust certificate authority uh we are guaranteed that you know individual granted the unique certificate in fact who he or she claims to be and a certificate it provides authentication by serving as uh you know credential to validate the identity of the entity is issued to so uh here's one of you know our process how a process about how we issue a certificate um a customer will request a certificate from globalsign and a global size vetting officer will review this application so when we review this uh uh application we will review these uh customers company registration information so the uh customers organization registration information such as the business address the location registration number all this they all can be found from a public trusted source from the internet and a company's registered telephone number it can be seen from a public trusted source so global site affecting officer will uh phone this number and request to speak with that customer directly to ensure that we are speaking with the right person by not mis issuing the uh certificate so um and once we uh confirm that yeah this is an actual order from this actual customer and authorized by the company this and that then yeah we will issue out the certificate so um here are some of uh key points that you know from my presentation today and as you can see how an election is signature and a self-signed certificate it can be easily in a document but if you look at a digital signature it protects your document by providing the information of the signer and the blue ribbon to show you that you know if a digital certificate is uh trustable and you may be wondering why this is an urgent need so in fact right there are many of examples that are showing you in the past or even right now that you know what are the consequences of being online with a document or a gen uh or general document signing practice so uh some of you guys may read this news before back in 2021 uh westpac says that at least uh seven major corporate uh customers including uh cross woolworth uh viol violia and uh westrack they have been caught up in a flock involving uh invoice uh and forged signature that it could be cost the bank more than uh 290 million and other than that right um you know you can see that the risk of you know forgery or fraud document it will also damage your company's reputation uh badly so uh in my earlier career i am working as an international student uh recruiter that recruiting student from different part of the world that go to study abroad so one of my students he applied a university to studying australia before for me and one day he came to me by telling me that hey i received uh a visa approval from the australian government so i told him that this is impossible because from what i can see from my system here it says that he's a academic uh uh documents everything are still under assessment it's impossible for him to get the australian student visa so uh the student and the parents they were shocked and they they they were quite uh you know quite angry upset at me and my company because they think that how can we you know that you know uh giving them a information this and that but after i explained to them like all the you know visa application process everything they uh they slowly understood how should it be and turns out that that student applied through many many different agencies and some one of agency could be happening to be a scam you know a scammer and then try to you know scam him by using this uh particular document so you know that that gives me a thought is that um it's difficult you know to prevent something like this happening but uh what i realized is that you know uh with now these are modern uh innovation and technology uh there are actually so many ways that a company can uh you know should should consider use this kind of technologies and uh this kind of uh you know security to make sure that their business reputation will be protected by you know and by giving you know their customer their business partner everyone uh uh informational education about how to identify what is the real or a document in general right so yeah um that's all my uh sharing today uh everyone's enjoying and thanks again for your time so i'm back to you now megan uh thank you rocky for sharing your valuable knowledge we trust it's helped all of you to better understand how electronic and digital signatures differ as we made clear the risks that come with using untrusted signatures such as simple electronic signatures are significant regardless of the size of your business the damage that can be done by employing a solution with inferior security is serious now let's welcome back david who will tell us about how trusted digital identities can be used in sydney flow's secure and easy to use signing application [Music] hello everybody my name is david saunders i'm the regional director for signalflow based in melbourne um so today already i'm just going to give you a bit of an insight into more cygniflow in general and then we'll quickly have a look at the the signing application just to show you how you can actually sign with a digital signature which really ensures um that you're signing with a trusted digital identity so um so today really i'm going to focus on how our partnership with global science is helping organizations in australia to fully automate their document processes in a secure manner using trusted digital signatures so globalsign is one of the largest certificate authorities and has successfully integrated its digital certificate issuance system with cygniflow this allows for businesses and organizations to collaborate and have instant visibility into his received reviewed site and signed a document using trusted digital certificates clients can conduct business efficiently knowing that their signed documents are legally binding and fully backed by a court admissible digital signature signalflow is a digital signature workflow manager that enhances and fully digitizes any process that requires a document to be signed or approved as rocky mentioned unlike a simple electronic signatures signifier's digital signatures use digital certificates issued by global sign that binds the identity of the person to the pdf document so when a document is digitally signed with signiflow and the document's exact contents and the identity of the signatory are bound together to form a unique digital fingerprint thereby ensuring non-repudiation in the court of law signatures can be verified without the need for any special proprietary software users can verify the signer's identity by simply clicking on or double clicking on the on the digital signature within the document and that will actually pull up the order trail associated with the signing ceremony also the information specific to the sign so using signalflow you can really ensure compliance with the australian electronic transactions act you can secure your digital transactions and you can store your files electronically as well so next i'm just going to give you a bit of an overview of signalflow who we are um so we're a global company and we're headquartered in the united kingdom and we've got offices in johannesburg in melbourne australia as well as in singapore all of our clients and partners benefit from 24 7 365 days a year support we serve about 32 countries globally platformers in 11 languages and we have about 20 000 plus business clients that hosts close on a million users and they and they circulate um tens of millions of documents through the platform each year all of our operations are iso 9001 certified we have an iso 27001 certification for information security um well our deployment is in microsoft as you're in sydney so really you're complying with all local privacy requirements in australia so next up um i'm going to be sharing my screen just to show you what the platform actually looks like when signing a document so the first thing that you do is log into cygniflow and generally it's just a username and password that that you have to log in and when you when you log in the first thing that you actually see really is a dashboard so i have a certificate issued by globalsign provision to my account meaning that i have been vetted by globalsign and i'm signing with a digital certificate so the first thing you see is a couple of baskets you can see what documents are pending so we all get busy sometimes we miss emails you would receive the document via email to sign however you can go into the pending basket just to access those documents and sign them circulating circulating is where you've actually sent documents out for signature and you're waiting for other people to actually sign them so within the circulating basket and you'll be able to see the document id so if we go in here you'll see there's a document id if you click on the document id it'll actually pull up an order trail associated with that specific transaction and if we go into another document id you'll see that it has the same order trail you can see the signatures that are required the date requested the priority if you've got multiple people in the workflow and at any stage a signer has to change you don't have to go and cancel the workflow you can just click edit and then you can as long as the person hasn't signed the document you can edit the signer and then it will just quickly re-read back to that person for signature so you can remind people you can open documents you can download them or you can cancel the workflow entirely so we also have cancelled expired rejected so somebody can reject the document with a reason um completed so everybody within the workflow has fulfilled their roles and responsibilities which might be a um a signer an approver a um a viewer or a witness you then have drafts um shared with me your team doc so if you've got multiple departments and you want to make sure that audio information is segregated between different departments we set up the business profile and under the business profile we can set up teams departments users you can allocate team leads to the teams or departmental managers to the managers if you go into team docs you'll be able to see all the documents that are currently in circulation with your team and once again you can access the order trails you can reassign the document so perhaps i've gone on leave or somebody within my team has gone on leave and you can assign it to reassign it to somebody else or you can remind that person that they need to sign so each and every basket will have a document id and as well as those embedded the embedded order trail the audit trail does reside within the document as well but is it backed up in the application portfolios is used extensively across our client base and so in particular maybe perhaps maybe a law firm you have a specific matter and that matter already has various documents that somebody has to sign over the life cycle of that matter a signalflow portfolio allows you to create a essential file associated with that matter and within the matter you would have all the documents so if i click open you'll see it as an example here i've got multiple documents that are associated with that specific transaction these documents could be signed documents they could be just copies of my passport they could be invoices they could be contracts engagement letters could be anything and the actions that you can take within the portfolio is really you can download you can email a copy you can rename delete you can add a file so maybe it's just a file that complements that portfolio we can add a form you can add a flow we can also share the portfolio with everybody in the business or maybe a department or a team or with a contact we can also make provision for attachments within the portfolio so already portfolios allow you to digitize certain processes accounts payable or any form of approvals you can also build forms so you've got a form builder so maybe you've got internal paper-based forms that you quickly want to go and digitize you can just drag and drop and so it becomes quite smart i'm doing this in haste today um but the end result is that informs um or a standard user can go select a specific form that they use frequently and they can select it and they can push this form into workflow so you've gone and already digitized a paper-based process by just building this form okay so really um the platform comes with all microsoft office plugins you can actually sign in the microsoft office suite this can directly connect it to signalflow for the purpose of today i'm just going to show you how you can quickly sign a document or send a document up for signatures so we can create a new workflow we can click to import a document from our desktop we can drag and drop documents we can use template templates precedence i'm going to use my document template that i use frequently we can now check the document to make sure it is the right document we can rename it we can replace it we can split the pages we can start a new portfolio or we can add to an existing portfolio so as i showed you earlier i had a whole list of portfolios so i can go find that portfolio maybe it's an hr file and i can link it so when the document does get signed it'll go back to that portfolio but for today we will just create a demo portfolio we can set the priority we consider due date we can set the document to expire on certain dates we can set auto remind i've got some custom configurations on my platform so we'll choose to ignore that for today and we can set pre-configured messages so it's a three-step process you upload the documents you configure the document settings and then you add the signers or approved so i'm going to add myself as a signer my information will automatically pre-fill i'm going to opt for a digital signature today so you do have the option for a simple electronic signature but i want a high security digital signature should um non-repudiation we also have face sign available where we can actually embed an image of the person into the documents at the time of signing i'm going to add myself and i'm going to add an external person so this person's known to me their information will pre-full as soon as i type their name and i would go through the same process i want them to sign the document i don't want them to be able to proxy i want to send a completed email i want a digital signature and i don't want baseline so i'm going to add them we have viewers we have approvers we have face-to-face which is a witness and we have a group next i'm going to go to the document prepper now i use this document frequently so i've actually built a template that i have saved and i'm going to apply that template shortly but just to show you you can navigate and apply the respective fields anywhere on the document that you needed and we have signature initials mandatory text fields non-mandatory check boxes checkbox groups dropdowns names dates email addresses contact numbers designation face-to-face initial face-to-face signature company stem and this is where you can save your template once you've applied the fields but for today i'm going to go and find a template that i use often and i'm going to load it so now i've made provision for that you can also because i've created a portfolio i can go and share this portfolio now with anybody with within my team a department or the business i can give them certain access viewer contributor or owner if it's just a specific user i can type in their email address and share that portfolio i'm also going to add a document placeholder so this is an id document so a placeholder is our version of an attachment and you can limit the visibility of the placeholder to certain people so i'm going to add the id documents and the next step is really just to release the documents and because i'm the first person in the workflow i'm going to be prompted to sign first so there's there is an order of events so we'll see that here is the documents the date has already been inputted as well as my name there's a requirement for an id document so i'm going to quickly add that document because we created that portfolio as soon as i add this document it's going to be added to that specific portfolio so you can see the document has been uploaded we have an id document as well as the contract and within the portfolio so i just need to sign while that's signing we'll quickly jump back into the platform just to show you what's actually happening so if we go into circulating we can see now um this is the workflow that i sent i initiated the workflow i have signed on page one there's my ip address my browser my geo location i've uploaded a document and now we are waiting on somebody to sign okay so that document has now come through this would contain your company branding we would brand this ing to your corporate identity and the person receiving the document would click open document and they would go straight into something called easy sign it is a simplified user interface that the person engages with it is not complicated there is just some instructions and there is your personal message and then they would just start navigating through the fields completing the fields you can see that i've signed this document now already and they would then sign by drawing or uploading their signature or they can they have the option also for a font signature as well so if we go back into circulating see that document still over there take a few seconds to come through it will probably just go into the portfolio just to show you where that designs so you'll see now we we created that portfolio not too long ago we have a document order trail associated with the portfolio if we open the portfolio you'll see that it has the document as well as the attachment now just to show you the document that has been signed so as mentioned i have a certificate that has been issued by globalsign so if you click on the signature you'll see that we have embedded the audit trail into the document using a certificate issued by globalsign if we go into the signature properties we can see that i have signed the document there's my email address the signing time i've accepted the documents in an electronic format there's a geolocation now what's important here is that i have my own personal certificate so i have my own trusted digital identity and that has been issued to me so within the top of the screen you can see there's a green tick and each signer has the necessary embedments to actually ensure not repudiation in a court of law and what's important here is that we include an embedded timestamp we do not call we do not use the date and time on the pc clock and we we use global science time stamping service um so a simple electronic signature does not offer you that you'll find that if you click on that panel it'll say that the time is from the person's clock on their pc now if i to check if i decide with a simple electronic signature and change the date and time on my pc of course it will affect the legal standing so this is an advance in qualified means um signing with a digital certificate okay i think that's um everything from me so thank you thank you everybody for attending today's session thanks david for the presentation we trust that it was a helpful demonstration of how cygniflow's signing application works with trusted digital identities all right and then next up we are going to welcome back both rocky and david so they can answer any questions that you have um that you've submitted during the presentation or that you'd like to submit now which you can do through the q a box at the bottom of the screen oh there we are so david are rocky not sure which one that you'd like to do but um how long does it take to implement these solutions i think uh from from a significant point of view i think we can have you set up within a 24 hour period right and from a global sign here we have uh since we have this set of uh you know vetting process to follow and uh but in general our voting process will take up one to two business day all right um perfect also just wondering uh do both signatures require certificates income perhaps maybe i i will answer that question so um if you are signing with a digital signature then you do require a certificate which is issued by global sign and as part of that they will actually vet you or your organization and that really proves that you really are the person who you say you are um a simple electronic signature does have a certificate issued but it's not issued to that specific person so really from from a high security use case perspective um we would be beneficial to have a certificate issued to you directly by globalsign all right perfect are there different types of digital certificates yeah let me answer that so yes uh that's a good question so uh did you public trust certificate authority like global sign we are providing uh different types of a digital uh certificate for different purpose so one of a very typical example is that you might see some of the website have those like a small tag log in the url bar we call those uh ssl certificate to prove the website's um um identity or and also it carries a function of encryption and other than that yes they also certificate that will be using for example like a software application which is a code size certificate and you might sing some of the email they also have those uh called as my certificate to sign on the email to prove that there's an email address it comes from um come from a sender who claims he or she used to be so yes there are multiple types but the one we are talking about here today is in particular that um approved by pdf document adobe pdf document so i hope they answer your question all right um there were some questions that have come through in the chat um how does one know if the person in the copy of the passport is the same as the person who they're dealing with so i guess what we're not actually verifying the the passport information provided in the passport um however signalflow does have a integration with australia post digital identity and as part of that we can actually run um know your customer checks whereby we actually um where we qualify that the passport information and as part of signifier you do have the ability to upload a document into into signalflow but unfortunately we don't do the checks then and there and there would be separate functionality that you would have to use to actually run those checks we've got another question what happens if i modify the sign document right so uh as you can see earlier when you have a document to be uh digitally signed you will see a blue ribbon shows that um all signatures are valid but if someone tempered this document so adobe pdf reader will visually indicate that the document has been tampered by showing that at least one signature has problems this kind of information showing on that ribbon great i think that is a wrap with all our questions so we thank you for our time today [Music] you