Boost Manufacturing Efficiency with eSignature Legality in Canada

How to eSign a document: eSignature legality for Manufacturing in Canada

welcome everyone to the engineers chief scientist manitoba lunch and learn on digital signatures before we start the session today i'd like to acknowledge that the association office and the majority of its practitioners are located on treaty one territory and the original lands of the anishinaabe cree oji cree dakota inuit and denny peoples and on the homeland of the metis nation many generations have arrived to our province and contributed to its development but we must not forget that this land indigenous land has been inhabited by indigenous peoples from the beginning those first people called this area home for generations and thrived took care of the land and developed unique ways and methods of design to survive in our province's harshest of conditions the province's original engineers and geoscientists we respect the treaties that were made on these territories we acknowledge the harms and mistakes of the past and we dedicate ourselves to move forward in partnership with indigenous communities in a spirit of reconciliation and collaboration i'll now pass it over to charles trombley to deliver the main part of the presentation thank you very much mike uh for uh this introduction an important message um so yeah welcome everyone uh glad you made it on this uh that you're taking your lunch time with us uh today's session introduction to digital seals electronic document authentication for engineers geoscientist manitoba um in today's session a couple of housekeeping stuff sorry this session is being recorded uh so the recording will be made available to those who weren't able to attend live your host myself i'm the business development manager at materius i work with 54 different professional association that matters works with across canada i am also accompanied today by mr mike gregoire michael grigwa director professional standards at engineers geoscientist manitoba so he'll keep me honest throughout the course of this presentation um i'll try to do a couple of pause during the presentation to keep as interactive as possible please if you have any questions during the session and at the end we'll also have a q a session please submit your questions through the chat feature and we'll try to answer as many as we can so on the agenda today who is notarious um also speak of the current context uh work changes that have been happening over the last couple of years legal requirements in document reliability ingredients as per the applicable laws in manitoba different types of electronic signatures so we'll learn that there's varying levels of reliability there's a lot of solutions available on the market they bring a varying level of reliability in and engineers geoscientists uh uh has put together some requirements and this is why we are working in partnership with the association why uh do regulators across canada come up with requirements for electronic documents authentication we'll learn that too and we'll also have a free and easy validation for the public so it's one thing that you have a new authentication tool it's another thing that the public has access to free means to validate the data integrity and your signature and we'll have a quick demo at the end as well just a quick introduction of how the software works and for the relying parties what to look for to make sure that your document has been authenticated so first off who is materias we are celebrating our 25th year of our 25th anniversary we've been providing trusted signatures to professional to governments to organizations or companies and systems as well so we now integrate in different um eSignature platform that relies on us as well to to to provide eSignature features to their uh systems we enable the production and issuance a reliable electronic document that can be read we'll speak of that and authenticated over decades uh it is one of the engineers reality is that the work that you're doing often the infrastructure work that you're doing they have a long life cycle 25 50 100 years so we need to make sure that we'll be able to read and authenticate those electronic draw drawings and documents for decades a couple of certifications this is not a technical presentation but if you want to do a bit of the digging from a management perspective we are certified iso 9001 we were the first certificate authority in north america to be certified iso 27001 so if you want to google that that's an information security standard we'll learn a bit more what a certificate authority is this is our our core business we are also the only certificate authority in canada to be on the approved trust list the adobe approved trustless which is kind of a gold standard if you're looking to uh to work with a trusted certificate authority we also meet ie das compliance this is for the european marketplace but that's another gold stamp that you like to look for with regards to electronic signature uh there's strong legal framework in europe and requirements that you need to meet over there we're recognized by multiple government entities uh we are preferred in alberta new brunswick we work with federal government and a lot of provincial entities and local government will rely on our digital signature solutions as well we are a strong advocate of the pdf a it's an iso archive standard we were speaking of longevity we've all had the experience in the past where as we migrate from one software version to another the previous documents the font changes the content changes sometimes funny fonts or letters or numbers are replaced by letters or numbers because of the new version there is an archive standard for pdf file format which is an open source file format there's hundreds of pdf editors on the market that are available and there's an iso standard to make sure that whatever you're creating today you'll be able to open and read in 20 30 years from now with adobe reader version 20 for example um we're also a member of the digital id and authentication council of canada cloud signature consortium again these are round tables where best practices are are put together and applied and we like to be make sure that we're applying the best latest and greatest best practices as i mentioned we work with 54 different regulators across the country we work with a couple of them in alberta manitoba landscape architects manitoba architects association obviously engineers geoscientists we work with 16 different professions lawyers notaries engineers architects land surveyors so a lot of different geoscientists as well in some provinces the geoscientists are separate from the engineers so we work with them as well so um this brings us to the changing business landscape what has changed over the past couple of years obviously even before kovit came around cloud adoption was already growing rapidly uh why well it allows us to work from anywhere at any time on any device and from either a small business perspective or even larger business perspective it allows rit um staff to be much more nimble and be able to go out and and consume uh software as a service so really we're moving into a software-based economy or what i like to call an application-based economy we're engaging with customers suppliers partners through applications through our smartphones tablets pcs and a lot of time these devices are also the devices that we use for work but also for play and they end up being uh our smartphone has basically ended up out competing the toothbrush as the first thing we pick up in the morning to check on our messages and the last thing we deposit in the evening as well obviously covet 19 has drastically accelerated this transformation with the work from home and this had some tremendous impact for engineers u.s scientists no longer having access to office supplies printers plotters that meant that but but you still have the requirements to authenticate your documents so how do we do that remotely moving away from the traditional rubber stamp so definitely covet 19 and we've seen it on our part we've basically doubled the amount of subscriptions annually over since the beginning of the pandemic because people had to work remotely um so let's look at that the um the key ingredients for document reliability so when we're talking about being able to remotely authenticate documents um electronic documents and no longer the good old rubber stamp so obviously when you look at the late 1990s the internet came of age and now we're moving into more of a cloud and application based economy so over the last 30 years information technology has fostered the development of e-commerce the first significant ones to adopt it were banks so to be able to do online banking and now we all have our banking application on our iphones and androids so this has led to significant changes in business practices and process uh and have allowed document to evolve from a paper to a digital form and in order to overcome the various legal obstacles and facilitate this transformation well laws have been put together that recognize the legal validity of the electronic transactions and documents and in canada like in many countries around the world basically what we did is we endorsed the uniform electronic commerce act which was developed in 1996 by the united nations so let's take a look at these different legal frameworks and try to find the key ingredients for document reliability let's start at the international level what does that uniform electronic commerce act say about requirements for a signature so where the law requires a signature and in the case it would be the engineer's geoscientist act of manitoba you are required to authenticate your document if an electronic signature is used it has to be as reliable as appropriate for the purpose for which the data message was generated or communicated what does that mean as reliable it means that for example if you're visiting a web page a website the web the site owner will let you know that you're using cookies to gather data about you geolocation language stuff like that and when you click i accept you're making a form of electronic consent it is a form of electronic signature there's not a whole lot of implications in accepting or refusing cookies um the same goal if i accept to meet mike gregoire for lunch tomorrow and we're doing this by email i'm accepting that we will meet tomorrow for business lunch i am making a form of electronic consent but the legal implication of me not showing up for lunch other than mike will probably not be happy at me for not showing up or probably not high so the level of reliability for those use cases doesn't have to be that high but if you're putting your stamp and your name onto a multi-million dollar project that has a whole and it has public safety involved as well uh structures that needs uh to resist a certain amount of snowfall for example uh to avoid collapsing on on people under well that's a whole different story so the level of reliability in those use cases would have to be much higher and an electronic signature is considered to be reliable for the purpose of satisfying the requirements in the first paragraph number one a uh it's sling to the signer and no other person that the signature is also under the control of the signer and no other person and that any alteration to the electronic signature made it after the time of signing is detectable so we'll go back to that in a couple of slides we'll find out the key ingredients but we're starting to get our answers right away in canada again as i mentioned we um we endorse the uniform electronic commerce act of the united nation uh all the provinces uh adopted their own i mentioned bc here but we'll take a look at the manitoba one in a couple of slides they are every provincial legislation as well as the federal one they all recognize the legal value of the electronic document so there are two key principles here one is functional equivalence documentary media are interchangeable so you can go from paper to electronic uh or magnetic media for example uh so there's a functional equivalence and there's technical technological neutrality so there's there's no more there's not a support of information that has more or less legal value so paper doesn't have more or less legal value than an electronic document so we took a look at the international level let's take a look at the federal level here uh there's provisions of the canadian evidence act that is interesting read but there's also the personal uh information privacy of the electronic documents act which applies to federal institutions unless you're working at a federal institution this should not necessarily apply to you but uh let's take a look at the deficit nation they make for electronic signatures number one the process or technology used is unique to the person number two the use is under the control of the sole control of the person number three the technology or process can be used to identify the person and number and the last one is to determine whether the electronic document has been changed since the electronic signature was applied so we're starting to see a trend between what the united electronic and uniform electronic commerce act the federal one uh defines as well lots of similarities so let's take a look at the manitoba the electronic commerce and information act of manitoba number one right off the bat an electronic signature means electronic information that the person has created are adopted in order to sign a document so it's any electronic means that you have adopted but with requirements for signature again we're seeing at 13 1 a 1 or i uh it has to be reliable for the purpose of identifying the person so let's go back to one example i gave if i'm visiting a webpage and i'm accepting cookies but i'm using the family computer so we're five living in my house me my wife and three children actually young adults or so who of us went to that web page so the click i accept is not really a good way of identifying someone with regards to original where there's a requirement to provide or retain original which is return requirements for for engineers and geoscientists uh there needs to be reliable again reliable assurances that the electronic document contains the information in the original document and that the information has remained complete and all unaltered so i think we're trying to see what are the key ingredients but let's go on a requirement to retain information again providing is making sure that the the information that i provide is remain is tamper-proof with regards to retaining or for my archive again i need to make sure that the documents will remain protected and unaltered during the course of their life cycle so we can start to see the similarities between united nation federal and manitoba uh namely that we're looking at two key ingredients how reliable is it that i know who the person agreeing or signing is and how reliable it is that the information has remained complete and unaltered so the key ingredients for electronic document authentication really is know who's signing reliably know who's signing and have reliable uh insurances as for the data integrity so one plus the other we've got a high level authenticity of the electronic records we add to that recipe our own tea one of our ingredients as well as longevity especially for engineers working on on infrastructure project the question is how will i be able to open those files that i've created today in a software version in 2022 in some other software version in 2035 so how reliable is the data longevity this is why we're a strong advocate of the pdf a file format it is a file format and iso standard that will make sure that your documents will be able to be opened and read without being altered or modified in the future also official records require a high degree of reliability even if the technology used to sign it or its provider in this case materials should no longer exist so the proof has to be embedded in the record itself and not a link to a service provider that who knows what the future holds for that service provider even if the audit log cannot be found as well a lot of times what you'll have is electronic signature system they have logs in their own environment but again if the provider no longer exists chances are the logs have disappeared we no longer have the proof of authenticity so the proof has to live on its own needs to be embedded ideally in the document so that brings us to a quick introduction into e signatures um i'll just make a quick pause to see if i have any questions in the chat actually um mike if you want to do you see any questions in the chat i'm not seeing anything right now not at this time charles no perfect excellent so let's move along then um what are the different types of the electronic signature well actually what what is an electronic signature and then what types exist again from a legal standpoint a signature is a permanent mark bonded to static documents that is traceable exclusive and personal to an individual these are criterias that we took for granted with a handwritten signature handwritten signatures are unique to a person extremely difficult if not impossible to imitate someone's signature and that can be expertise so the weight that you put on your pencil the speed that you do your different curves in your signature the way that you're going to write letters and and numbers is unique to you and it's extremely hard to imitate so we're trying to kind of replicate that to an electronic world a knee electronic signature so a signature is basically something that i'm using to mark consent or disagreement but usually it's it's to mark i agree an electronic signature is any form of consent that is made electronic so again if i'm going on if i'm downloading a free game on my iphone there's always some terms and conditions licenses we all read them right and we always click i accept so those are legally enforceable um so despite i might it might have been one of my children that had access to my my iphone downloaded the game a digital signature so i like to speak of electronic signatures all breeds of dogs right a digital signature is a german shepherd it's a specific breed of signature and it's based on a public key infrastructure an electronic signature which reliability characteristics have been reinforced with what we call asymmetric key encryption i want to go into a deep dive today explaining how asymmetric key encryption works but asymmetric key encryption is extremely reliable for the purpose of protecting data integrity now the way you issue and you manage a digital signature to someone that is what we do so asymmetric encryption is the technologies very reliable for the purpose of protecting data integrity the way you manage those credential is the way to make sure that you know the signer's identity so there's two key pieces here number one there's a certificate of 40 a certificate authority is an organization that operates one or several public key infrastructures so materias does operate a couple of public infrastructures for different use case and we're basically responsible to manage the life cycles of digital signature certificates that we issue to individuals there is no way that you can get an individual digital signature certificate from the terrace without us doing a face-to-face via video conferencing where you'll need to show at least two valid pieces of id we need to make sure that we know who you are so there's a verification of the identity of the person then there's a registration authority which is engineers geoscientist manitoba so once we are satisfied that for example mike gregoire is who he claims to be because we did the online verification of this a piece of this valid piece of id then we want to make sure that that person is registered at engineer geoscientist manitoba this is the role of the registrars of the association we will pass the request on to the association they act as a registration authority and they are responsible for receiving and validating the requests and also to revoke someone's signature that person is no longer member in good standing of the association therefore no longer has a legal right to practice in manitoba well the association has for authority to ripple so think of us as the terrorists you can think of us as the visa or the mastercards of this world we are a trust network and you might think of your professional association as being your bank so i can have a visa card that's issued by cibc or i could be a customer of royal bank and i could have a visa card from royal bank in this case you are getting a digital signature certificate as engineer geoscientist manitoba so varying levels of reliability for different forms of electronic signature at the left hand side the most unreliable one we're all guilty of doing it even i we've all copied and pasted the image of our signature and or seal or initials onto a document the problem with that is is anything that shows up on screen it will have some examples later on can be copied and pasted onto something else control print screen microsoft paint copy paste i can apply your digital signa the image of your seal and signature onto anything that you've never seen it does little if nothing to protect data integrity of the document on which you applied the images as well even if you put it read only typically speaking again i can copy the whole information create a new document and tamper with it next level up email signatures that wouldn't apply to a gmail or hotmail because obviously they don't do any vetting really i could be bozoda clown gmail.com nobody knows who i am but if you happen to have a notarious.com visual email address it's probably because rit staff made sure that you're on the payroll and you should have access to a an email license so emails typically the data data integrity is weak but you know if it's a corporate email address might be reliable in some cases as to say yeah yeah you had an agreement that you've agreed to by email we've got all the traces here there's metadata date time server licenses ip addresses so we could we could sort it out that there's a good reason that it might be in some cases though we've seen cases where the judge rejected email proof uh saying it's not strong enough so again goes back to the level of reliability depending on the context self-issued digital certificate they rely on digital signatures or they rely on asymmetric encryption extremely reliable for the purpose of protecting data integrity the problem with those here nobody's there to check on who i am so i could be i have gemma kitch email address so i could self issue uh or self forge myself a digital signature certificate with all her credentials and be digitally signing documents on her behalf without her knowing because i self-issued myself a digital credential here then next snack uh eSignature platform you probably know those brand names hello sign e-sign live we've got our own consigno cloud these are considered advanced electronic signature they typically do a very good job at protecting data integrity of the documents especially as long as the documents are in the platform the moment they leave the platform in pdf file format sometimes it's it's another game people can tamper with it so the truth relies in the platform that's the limitations or hello sign nissan live or even consignor cloud no longer exists in a couple of years you'll have some some issues to try and preserve those archives um and it depends how you manage those platforms so rd using multi-factor authentication such as an email address and an sms code for example a secret service a shared secret or something else rather than relying on hey you can create a free account with us as being bozotheclown gmail.com again the id of the signer at that point not very reliable and at the far right corner is the highest standards it's a trusted digital signature certificate uh that would be issued by a trusted certificate authority that made sure to vet your id and working in conjunction with your professional association making sure that at the time of signing you were registered at the association so in the eSignature spectrum again from left to right the image doesn't tell me who you are does not protect data integrity therefore the level of reliability from a legal standpoint weak to an existing eSignatures they are typically pretty good at protecting data integrity however the way the platform is managed the level of identity of the signer might be more or less strong therefore the level of reliability might be more or less self-issued digital certificate very reliable for protecting data integrity there's no id check therefore the level of reliability can be questioned a trusted digital signature certificate they meet the highest standards from the legal standpoint of providing retaining and digitally signing original records so um i'm gonna say i'm seeing right now there's no question in the chat for now so uh let's take a look at engineers geoscientists manitoba and this is where um mike if if you want to step in at any point in time please do so to keep me honest these are the requirements for electronic documents authentication um so the engineers and geoscientists geoscientific professionals act um with regards to the digital signature again you'll see the resemblance between their definition the legal definition it's not a coincidence uh it really a digital signature means form of identification issued by the association to a member or a specified scope of practice licensing to be used to digitally authenticate documents so if you go to our website and you sign an engineer practicing in manitoba you'll be able to choose if you're a png or geoscientist or the appropriate licenses that license and practice areas that you're allowed to do the manual seal means the form of identification issued by the association to the member so you have a choice you can stick with the rubber stamp if it's good for you uh and and it fits well with with the way you're practicing or you can go additional with a digital a signature um next what is uh digital signatures and the electronic document can be authenticated through the application of a digital signature again not copying and pasting images a digital signature is a security tag that identifies the author because we've checked on your id and locks down the document protecting the data integrity when you apply your digital signature to a document it prevents you or anyone else from making any authorized undetected change to the document we'll take a look in a couple of examples later on you are allowed to do changes to a digitally signed document but the beauty especially with the pdf file format you'll be able to know exactly what has changed on the document and you'll by doing a right click on the signature you can view the signed version as it was when you authenticated it authority to use a digital signature shall not be delegated to anyone nor shall the personal security codes again this points out to think of your digital signature certificate as your bank card it is something you own on my computer it is an encrypted file with my digital identity i need a password to use it that's the second factor of authentication it's like your pin number to your bank card so something that you own something that you know and you should never never share your pin number to anyone and you should never ever share your digital signature password to anyone as well uh stealing this is i have the hyperlink of the requirements as well in reference although the security of a digitally signed and sealed document is verified through the digital signature certificate any electronic versions of the the professional's manual seal and signature can be applied in conjunction with the signature so basically we'll see it a bit later on uh we're able to apply the image of a signature and seal onto an electronic document initially sealing the whole file including the image that were applied to the record and again members in specified code of practice licensees may only use their digital signature issued by an approved supplier under the authority of the association um and we so we're uh an authority that is um uh we're a service provider that is under the authority of the association so i'll do a quick pause actually i'll run through the whys and then i'll do a quick pause because i see there are a couple of questions that are are coming in so why do regulators do go through the trouble of saying okay in the mission of our public safety we want to make sure that we control the issuance and revocation of a digital authentication tool for in that that is linked to professional practice well it's because forged documents were real and back a couple years ago that was the main motivation of the association of engineers zero scientists of manitoba um there were and you can you can click on it you can view it i'll have the hyperlink in the presentation uh i'll share the presentation deck with uh gemma and mike from uh engineer geoscientist but you can view it so back a couple of years ago there were cases where people were copying and pasting engineers a stamp and signature on to plans and drawings that engineers had never seen and a lot of times is contractors trying to get their building their their uh building permit issue uh so there's there were a lot of examples in southern ontario as well where you can see here an email sent to chief building official city of brantford it has uh in that email i was copying and pasting of the engineer's signature and sealed to say yep everything's good we're ready to build obviously the engineer never saw those designs and it even led to a traded tragedy in the shopping mall in southern ontario as well um again there's a other cases where you have illegal practice so in one case you have a professional engineers that had his license revoked the engineers surrendered their rubber stamp but they had made a copy or a jpeg image of their staff and they were still doing illegal practice and they were actually a building official who called the bluff call the association up and say hey i'm not sure that this guy's is allowed to uh to practice anymore and it turns out he wasn't so that's one main reason public safety is a core mission of the association uh and the a digital signature certificate issued and managed by the association is a key ingredient for public safety so the professional digital signature what does it do well it confirms the signers identity so it meets the first requirement of the electronic commerce and information act of manitoba it reliably very reliably confirms designers identity because we do face to face id vetting before issuing it protects the data integrity of the electronic document it didn't go into details about that asymmetric key encryption that's one of the key feature that it does it confirms that the person is registering in good standing of his her professional association in this case engineer joe scientist manitoba the issuance and revocation is under the control of the professional association in other words engineers geoscientist manitoba does not have to ask the terrorist permission to revoke someone's signature they have this access to secure the registrar's have access to a secure console they can pull the plug on an engineer's digital certificate as soon as that person is suspended or barred the use of the signature is under the control of the registry just for like for my bank card my bank card is under the control of myself however if my bank is suspect follow play or that that someone might have stole my credential and are starting to go on the shopping spree they can pull the plug on my on my card and deactivate it so the same applies for the uh engineers geoscientist digital signature it's easily and freely verifiable by the public so the relying parties city of winnipeg ministry of transportation the ones who you are submitting your documents to they don't have to purchase any third-party software to validate the signature and it supports the association's mission of public safety um before actually it's building officials here but it's for public before we move on i will i see that there's a couple of questions in the chat mike if you maybe we can give a crack at answering a couple of those for sure charles uh the first question that we have posted here in the chat is from christopher question is once a document is authenticated by a member in good standing but then ends their membership and e-authentication account how is the document then verified if no account exists and they give an example here somebody retires or ends their membership to move to another province yeah that is a very very good question and this is the reason why you want to embed the proof in the record so at the time of signing so if let's say you retire so you digitally sign your last project before retiring and so as of today you are a member full-fledged in good standing so your digital signature certificate will work all that proof is embedded in the file and after you retire and you revoke your signature the signature will still show up as valid because at the time of signature again your certificate and password worked um so there's long term validity this is pretty technical but it'll say that signatures is was valid at the time of signing um so that's the way we do it so if i understand correctly then materia's server maintains that information and so when a recipient receives the document after the person has retired that checking goes to netarius's server which says oh yes at the time this was signed they were a valid number is that correct that is kind of sort of correct but it you don't even need to access or or this is where it's important even if we were to go out of business those documents would remain valid because the proof at the time of signing is embedded in the record that was digitally signed but obviously we keep all the key history as well uh keep in mind that we are so we're owned by the board of notaries of quebec who are using this for the quebec land title registration so the chances of us going out of business is is pretty slim because it is required for the quebec land title registry and the alberta land title registry as well but if we were to go out of business we have obligations to keep those system up and running i think for a period of at least two decades or something like that but the proof of authenticity is in the file itself you wouldn't need to access our system great thanks uh next question here is from mark mark asks i've noticed that the file size becomes huge after digitally signing 16 megabytes became 44 megabytes after signing for a 20 drawing uh 20 sheet drawing package so what strategies can i take to keep the size reasonable um so the digital signature itself would probably typically add 16k of data to a file what i'm suspecting is that the image of your seal and signature for example that might be the heavy piece of your signature so it's actually nothing to do with the digital signature it probably has to do so if you're applying the image of your stamp and signature you might want to take a look at the size of of that image and you might want to try and find a way to make it a lighter png file that's what i'm suspecting that's happening because or you're signing 16 times over the same file but even so if i were to be doing that typically speaking it's a couple of kilobytes of data that we're adding it's probably linked to the image right i wonder if there's also something happening here in the transition if they're talking about say autocad files as they get converted to pdf is there something there that makes it larger typically speaking it's the other way around the pdf file is a flat file there's a lot less metadata and typically speaking the file size between the cad drawing and the pdf would be reduced i would be curious to see if that person is using our consignor desktop tool maybe converting it into a pdfa compliant that might make the file a bit lighter and we'll be demoing that in just a couple of moments great thank you uh next question is is from christopher again how is a user of an e-authentication account protected in the event the system is cracked for example credit cards used to be based on signatures and if you refute a charge the bank must prove it's you now they switched to chip and pin and the user agreements have changed to state all chip and pin charges are valid and you are responsible unless you can prove it's not you how are we protected it's very good question so again technology is not trust it's it's the way technology is managed and this is why we are constantly [Music] updating uh encryption um algorithms uh typically speaking with the most powerful computers it would take you a couple of years to crack one person's digital signature certificate on the current security algorithms that we're using this is why as part of our processes we automatically reissue you a new pair of signature keys every two years so anyone that would have a the motivation and be the financial means of renting the most powerful computer 360 days uh 24 hours to try and crack your your your own digital sanctuary well that would probably fail because by the time they would be able to crack it uh you would have a new key pair and they would have to start over so this is all making sure that we're updated with regards to encryption algorithms um and all the id vetting processes obviously we're we're investing a lot of money in physical security and logical security we're uh constantly uh doing some what we call we hire ethical hackers to try to hack in into our systems and try to crack it um so these are all the efforts that we're doing again keep in mind that that person's point if if we were ever breached and someone would have access to the root certificate that is the mother of all certificates chances are it happened once in belgium and that company went bankrupt in two weeks it's not something that we can allow and we're doing everything that we can to to avoid that um i don't foresee how someone could do it but then again the cia got him so but that's a very good question and we do uh we make sure that we check all the boxes uh to avoid that and charles is there something that the user can do to help protect themselves against being you know there's sort of conversations that i've seen in the past about making sure that where you keep your key your personal key needs to be uh protected so keep it on a machine that you have in your in your possession and that isn't going to go yeah that that is actually a very good point there is one way that you could be vulnerable is what we call a man-in-the-middle type of attack which is i have access to your computer i now see your encrypted file or your bank card that has that chip on it that has the encrypted data and i can actually see you uh input your password so basically i could then steal away uh that credential and i now have access because i was able to spy on your computer you there's different mechanism that you can add some extra security a layer you could have your digital signature certificate on a usb it could be an encrypted usb as well a password protected these are extra steps keep in mind that hackers will try to uh align effort and payback so what is the payback for me to steal someone's engineering certificate what's the financial gains or benefits here to say i'm able to sign a plan and a drawing on behalf of mike gregoire the chances are that they're probably they're probably interested in something else in your computer which is probably related to your personal banking and i i imagine there's there's probably value in us just discussing the comparisons right so what are the alternatives to the netery's digital signature well self-signing that's a lot easier for somebody to or or or make it look like you've signed it when you haven't um even as we said you know that the digital the manual signature and an image of it that's extremely easy to to spoof so uh as far as we know this is the most robust system for for issuing digital documents it is it is it is for me the uh the i need to have access to your visual signature certificate and we'll show that in a couple of seconds and i need to know the password to use it and then i need to align what are the motivations for me in doing that as well again chances are if i'm hacking your personal computer it's probably have access to personal information to forge an identity a credit card uh driver's license uh false identity i'm probably not it's like how what's the level of trouble in the paper world is is how motivated are people to come into your office and steal your rubber stamp next question we have and it's the last that has been posted so far uh is from kevin kevin asks how would a digital signature work if the client needs to sign the cover page of the plans uh you couldn't work in collaboration well that would depend on what signature software that your customer has or are they just copying and pasting the image of their signature on it if your customer has access to a digital signature there's no limits on the amount of signatures that can be applied to a single file we've seen cases where you'll you'll have electrical engineer mechanical engineer structural engineer maybe an architect they can all sign the same record there's no limitations as to the amount of signers that you can have that is true of digital signatures obviously if they're using something else uh then it might be a question of workflow they might want to have to sign in their own system sending you the file then you digitally sign it to make sure that you have the latest and greatest version or it could be the other way around depending on what they're using you'll see what what doc what the modifications were applied to the documents after you signed it yeah thanks charles and i i'll just put in a picture that uh notarious support has been very helpful for our members in the past so if you have a specific use case uh reach out to antares they can help you figure out how to how to achieve this there's a lot that's a good point uh mike there's uh if you take a look on youtube the notarius channel we've just released a set of 21 uh short videos on our consignor desktop signature tool this is what i'll be demoing in in just a moment so that people have actually a visual on how it works great perfect uh so let's move on to the demo well free and easy validation tool for the public anyone that has adobe reader or standard or pro they just need to configure it properly uh we've got the link here to be able to know where to look what's the root ca materials where is it what's the url address to validate the signature for your customers or members of the public to whom you are submitting multiple documents and they want to be able to validate in bulk they can go on our website and download consignor desktop it's free they should just make sure that their it is good with that uh and and you'll be able to uh validate involved there's another one that's really really easy i'll show it to you in a couple of minutes it's verifiable.com it's a free web page you just upload the documents and it'll tell you if it's been digitally signed and tampered and so on and so forth um so i'll just jump into a quick demo so i'll step out of my presentation at this point um i hope everyone still sees my screen i'm not an engineer i'm not a geoscientist i'm an employee at materials so i'm let's pretend that the word document here it could be a cad drawing it could be a bin file it could be an excel spreadsheet in this case it's a word document and it's a draft contract agreement could be an engineering report let's do that so um i'm generating an engineering report uh i can print that sorry for the french os here folks but this is print i'm gonna print it to pdf i'm gonna name that i'll be original and name it i'll name it demo engineering geoscientist manitoba let's do that the other software that we have with your digital signature certificate is an application that's called consignor desktop remember i said we were a strong advocate of the pdfa file format and for that person earlier on that had issue with file size maybe that could help consignor desktop has three main windows number one is the uh where i can sort through my files and folders my templates and the larger one here is what we call the viewer so the viewer is when i open the file up it's like an adobe reader right it's viewing the file so it's in the engineering report i can zoom in zoom out if it were a multi-page report i could move around in the document by changing pages or going to the end um but right off the bat it says it does not claim any pdfa standard you want to convert the pdf eight yes there's three level version one two three the higher up you are the more restrictive it is the more uh the the it's going to be the latest and greatest pdfa standard version um i'm just going to do that so instead of printing the paper or plotting to paper and then taking my roles stamping signing dating i replace the paper with a pdf file and then i can create a signature zone i can manually create one or i can use a custom format uh again you can custom all of that i can i can have a small zone big zone initial zone signature zone let's take the small one which is going to be a square one and at that point i could i could create multiple signature zones for the person that said well if if another colleague needs to sign i could name it so i could say okay this is going to mean mike um so i can we got bored after 50 cosigners on a single document so it just goes to say there's no limits on to the amount of signers that can sign a document once i've created that by the way consigno desktop can be downloaded by your office staff so they can do all that prep work for you so they can take the cad drawing convert it to pdfa prepare your signature zone for you and at which point you would be ready to review and sign that will bring me to the signature wizard and then i can use whatever image i want i can so that let's take this is a british columbia example one but i can uh use this one here uh i can display uh the date so you are required to sign it you can change in the aspect preferences the font of the date it could be year month day month day year do you can do whatever you want you can change the font size color you can display a reason um you've got some pre i've confirmed verified but i can have a custom reason here say don't build with this because it's preliminary for example and it will show up on this on the appearance as well and once i'm ready to uh sign if i can just go down here actually sign then i'm going to the bank machine this is my digital signature certificate that's the encrypted file that has all my my information in i need the right password to use it that would be my pin number i'm seeing where rapidly row i'm getting to the hour so i'm going to go try to go fast here uh so now the document is digitally signed now i've got a valid signature here before i didn't let's take a look at how that looks in adobe reader for example so let's go ahead and open that file up that is the one i just did so it is a pdf a i could enable editing if i'd remove the pdfa and do some changes to it again we would track the change i'll give you the example so now it's digitally signed so if it would have if i would have copied and pasted the image hovering over the image it points towards a valid signature and this is what you want to look for the only person that could have applied the signature into the person's uh question before it's at the moment of signing the signature was valid my certificate is valid again i i'm gonna be reissued a new brand new key pair just in case someone is trying to hack my key pair for now and trying to brute force it we will reissue some new key pairs with the latest and greatest encryption algorithm in the detail revocation these are all the information that you can have if i were a member of engineers geoscientists you would have in the organization name eng the association you would have the member number you would have a professional title designation i'm obviously not a member so i don't have that information let's compare that to a document that was not ditchly signed only an image see the signature tab here is missing if i hover over the image nothing's happening there's no digital signature certificate attached to that file um it's going to very fuel very rapidly you could use a very view website and let's do the uh where is it so i could also go there uploading it and it'll tell me everything that i need to know and if the document had been tampered with will tell me well there's been some unsigned changes that were made and in adobe reader i could track the changes to do so we're already at the top of the hour so folks if mike i don't know mikey and gemma if we have a hard stop at this point if not i can go on for a couple of minutes we don't have a hard stop so if you want to continue and those who can stay on that'd be great perfect uh little advanced features for you here uh everyone that's that are pretty cool is i've got a set of drawings here uh it's the same drawing but it's drawing number one two three four five six so basically what i can do is i can select them all i can convert them all in bulk into pdfa formats so basically i'm making those standard pdfs i'm making them pdf a 3b compliant and then i'll be able to apply a template to all of them i can say apply a template basically a template is a predefined signature zone so let's go back to that first drawing here typically speaking that's how your documents look like right you have your corporate header you've got the drawings you've got the notes and then you've got the area where you typically affix the image of your stamp signature date and so on and so forth so what i can i can you can create some templates you can apply a template to all those files that was pretty quick so now all of these documents they have a signature zones the size i wanted on all documents and i can then my session should still be open it's not going to ask me for my passwords like online banking if you're active for a couple of minutes your session remains active so i can go ahead and sign in bulk i can choose the image again apply the reason and if i click sign it's going to go ahead and apply the images where i wanted to the dates the reason and so on and so forth and now they're all digitally signed and i can say hey before sending it to my customers i want to make sure that they are signed so let's reveal the signed documents yep they all have a green check mark and i can email it directly from consignor desktop if i want so these are a bit of advanced features uh for you um let's take another example here because a lot of times let's say you're submitting to a building official and the building official says well i need to do my work and i need to do some editing and that's exactly what i'm going to do here i'm going to it could be a zone text it could be a stamp for the building permit or it could be the billing official say i reviewed and approved for building permit for example now let's save this and let's close it and see what happens so now i've got a digitally signed document by the engineer or geoscientist it's been submitted the municipality has made some changes to it and charles has promised me that the documents are temporary well they are but we still need to work right and i need to allow maybe the building official or someone to do a review on it so sign all signatures are valid there's some unsigned changes and i can actually know what has been changed so there hey there's been annotation created on page one this i reviewed and approved for building permit was added and if someone says well you're responsible for that i can say no professionally speaking i'm responsible for the sign version so when i say that the proof is in the record that's what i meant it's in the pdf file so you don't need to have access to our system and so on and so forth the proof is in the pdf itself um so these are are a bit of there's other a lot more features in the consignor desktop that are fun to have again i invite you to go to youtube on a terrace channel you'll see a lot of them one of them is really cool is the ability to to attach original file formats into edition sign pdf so what you could create is a header a pdf header and then i can in the same way that you can attach files to an email you can attach bim files cad drawings word document excel spreadsheet in that pdf and then you conditionally sign the pdf and all the attachments that are included on the receiving end i'm the customer if i want to have access to the to the original word file which was the cad drawing i can extract it from the digitally signed pdf and play with it you're not responsible because it's no longer into that digitally signed document that's the way alberta transportation works if you want to google something pretty neat you can google alberta transportation bulk and 108 they have what they call in every project the final details and in the final details what they need is all the original file format the cad drawings the excel spreadsheet that was used for the calculation so the engineers will attach that into a digitally signed pdf and submit that and alberta transportation is able to validate that the document was signed off by an engineer and then be able to extract those file format for their own needs um so we're six minutes past i'm seeing a couple of questions in the chat i might yeah maybe we can take a crack at those as well for sure i do see people dropping off i want to thank everybody for joining if you have to leave uh thank you for for participating and you can catch the recording once uh that link is set out uh question here from christopher it's more of a request can you show what happens to the signature if someone enables editing and then changes the document that's been signed that yep that we just did that uh when we when we had the uh building official example uh with this file here right so i did some changes to it i played the role of the building official i applied this after the document was changed and i can so i'll have a message the document signed the signature is valid in other words my bank card and my pin number work when i signed a document and i can track what changes has been applied to the document since i signed it and for my professional responsibility well my professional responsibility is limited to the version i sign which is right click view signed version and you can see here there's no there's not the annotation anymore right and that would be that would be similar to if somebody actually changes like let's say they added text and they said engineering report you know if that text has changed yeah yep any change if i were to add my stamp for example just an image it would be considered a change because i'm probably going to create as a text box and apply data to the document so in a nutshell the way digital signature works under the hood right is if you have a 5meg file what you're doing is you're applying a mathematical algorithm to that file and you're creating what we call a checksum which is a mathematical summary so i'm taking the binary code of the file which is a series of random zeros and ones i'm applying a mathematical function to it that generates a very very short mathematical checksum and that is what i encrypt with my digital certificate so i'm not encrypting the file and basically encrypted the fingerprint of that file so that's why everyone has access to the file the file is unencrypted but if you modify that file and you re-run that mathematical function against the document the the result the mathematical checksum will be different because the document has changed that in a nutshell that's the way it works right and any recipient can see what did the document look like at the time it was signed depending on the pdf viewer that you're using remember when we go online with microsoft edge for example microsoft hedge has its own pdf reader it is a really really really basic pdf reader it probably won't even tell you that the document has been digitally signed so popular pdf readers consigno desktop is a popular one it's used by almost 50 percent over 50 of our subscribers adobe is a very popular one that has the capability of validating bluebeam very popular as well those are the main ones based on our annual survey 94 of the folks will either use adobe bluebeam or consigno as their preferred reader they all have the features to validate a signature right great uh another question from lisa when would click the certified box when signing a document how is this different from just signing the document that is that is a painful thing to do if you are completely adverse to anyone doing whatever modification to your file you would certify the document that effectively freezes any document tampering anyone can do with including adding an additional signature so let's say that in this example here both signature boxes were signed and the document says certify i could not add another signature box so certifying a document is if you want to make absolutely 100 sure that no one can do anything with with your documents at commenting and ending and then the last one here is uh can you show us what happens when someone tries to copy the digital seal via a screenshot and uses that copy to sign a different document yeah that's a that's a good question so we can do it right away but what you'll see is that this piece of information here will not carry over to the other document because the only way that i can embed that piece of information is i'll show you the path to it right here where is it that's my encrypted visual signature certificate and if i click on it it'll challenge me to the password so that's my bank card again to someone else earlier on had the question of can i be more secure yeah i could store that onto a usb to make sure that only someone having access to the usb would actually have access to the file rather than if my computer is well they have the file they don't have the password but if they have some spyware they might catch my password but then again what you need to understand well what what benefits as a hacker am i getting it obtaining an engineering dual scientist digital signature certificate but so let's do it let's actually do that let's do i'm just going to minimize this here view let's try to zoom out here actually basically what i'm going to do right is control print screen um let's go into paint and then what i'm gonna do here is select this and then i'm gonna select all copy then i'm going to go back to word i'm going to paste it i can move it around obviously wherever i want and then i'm going to create a brand new pdf with that and i'm going to call it so let's look at what happens so remember that signature tab here that has all the information on the digital signature certificate when we go into the one yep it has an image but where's the signature where is the digital certificate so this is where as an engineer i can if i'm using the engineers geoscientist digital signature certificate i can reverse the burden of proof saying yeah that document has an image anyone could have copied and pasted that document does not have my digital signature certificate embedded into it i think this also hammers home this idea that the image is not the signature when we're talking about digital signatures right that image is essentially a representation for people to sort of be comfortable with but you could sign you can digitally sign a document and effectively be blank in the signature section visually is that correct that is absolutely 100 correct let's do that here let's erase and let's print pdf and let's say invisible signature to your point michael this is what we're going to do i'm going to go into uh consignor desktop just going to refresh here that's not going to take the time to convert it to pdfa for this example but you'll see i can sign the document it's going to ask me do you want to create a signature zone no i i don't need to have an image so it doesn't ask me what signature appearance i want here because there's no signature box to apply an image so again bank card password now your point michael if we go back into adobe we would have the same sort of visual in blue beam for example and the invisible signature there's obviously no image here but hey i've got a message here and i've got that tab that tells me yep that document bears the cert charles's certificate with all the information so who's the issuer revocation trust summary this is so to your point by michael yep yeah great and then we've got another add-on question again thanks to everyone who's sticking around we're we've dropped off about half of the participants so far uh christopher says so copy paste a seal is possible and that does not prevent someone from printing and submitting a copy to someone else as an original copy and i'll i'll handle that question you know this is a this is something that um that has been asked by uh 37 jurisdictions so example for example city of winnipeg they're planning a property department they've asked this question before if you receive a paper document it's only an original if there's wet ink on that piece of paper and that means that somebody has signed it physically with a pen after it's been printed so yes we can always create copies of things but a copy is a copy and we encourage uh recipients in particular authorities having jurisdiction to ask for originals and that way they can have that higher level of assurance that the document has been submitted and authenticated by the engineer whose name is on the document that is a very good point mike and that that was i was the the reason i was referring earlier on to a handwritten signature as being something that is extremely unique to a person almost impossible to imitate as well so if you're if you're digitally signing your original records then your records are electronic the originals are if you're printing those off it's like making a photocopy of the handwritten hand signed document you might want to apply to reapply your initials or re-sign the whole sets of drawings just to make sure that it captures your unique uh handwritten signature and that's why our authentication guideline talks about if you are printing off a digitally signed document there should be a note on there that indicates that it was signed digitally and that whoever's viewing the copy in the printed form should look to uh the original form to ensure that it matches the matches the content very good point and we're seeing that with a lot of engineering consulting firms where here in the notes that's where there would be a mention that happens say all the documents of abc engineering inc are original any printouts of those are copy or reproduction of an electronic origin so great people have embedded that into their practice yep and somebody slipped in another question here is this consignor desktop free it's part of uh your uh digital signature annual subscription fee there's no limitation on the amount of office staff that can have access to it so in some way it is free there's we don't restrict the download and installation uh of of this software so that's why when you have an engineering professional practice a lot of times you'll have three engineers and six drawing folks right technical folks that are doing the technical drawings they can have access to the consignor desktop they can convert the cad drawings into pdf they can make the pdf pdf a compliant they can prepare the signature zone for you and you can go on doing exactly what you were doing before which is reviewing the documents digitally authenticating them um and so you don't have to do all that prep work that you weren't doing in the paper world as well great this is a follow-up from my own end and so verify although is that one free it's a web page actually it is free uh so it's really you go to the the drawback with very few and adobe is that it's one document at a time right so if you say well i want to which one of these is digitally signed and i don't want to have to open them one by one so i can right click on those and i can reveal the signed documents so there's you need to be aware of the different messages so the green with the number one it means it's checked off it's all good digitally signed by one person you could have number two three four five so it's digitally signed by five people uh this one here has a little exclamation point so if i actually dig into it this is one that will tell me the documents digitally signed there's been some changes done to it and this is where you can see that there's some changes done to it in adobe rea