Unlock eSignature Legitimacy for Animal Science in Canada with airSlate SignNow

How to eSign a document: eSignature legitimacy for Animal science in Canada

[Music] all right this is nice room been proud to have thank you guys for having us and thank you guys for coming to the event as Matt Foggia I'm going to tell you about digital signatures and east signatures a lot of people think those are the same thing so that's kind of the jokin tone you about it a little bit about myself I was a practicing attorney before a joined PS PDF kit and our company basically provides a mobile SDKs recently we went into web so technically not mobile anymore but a software development kit so if you need to view edit PDFs whatever in an app that's what we do so yeah whenever you give an attorney talk you have to start with these wonderful disclaimers that everybody hates but as you guys know this is not legal advice if you guys have any questions please contact an attorney and let's move on all right so the overview of what I'm going to talk about today it's not going to be nearly as technical as other talks it's probably going to be more baseline because I'm not an engineer I'm gonna start first with just a little brief history on signatures tell you what any signature is what a digital signature and specifically with PDFs what a digital signature is and then what's the current landscape and I'm going to give you a little bit of the us mostly but also the EU because a my company is based in Vienna Austria but also because I think they're a little bit ahead on the legal framework with signatures so a little bit of brief history of signatures the Romans are actually the first ones known to use signatures as a written text obviously we know seals this was done during the era of Valentine the third and for 39 ad but the first person that was actually known as a nobleman in Spain El Cid when he gave a donation to the church of Valencia or the cathedral Valencia and that's actually a signature which it's supposed to read ergo Rodrigo which it doesn't look like that to me but I guess that's what it says the big thing that happened where signatures really came into play was in 1677 with the statute of frauds you might have heard this it's an English you know law that was put in place and adopted in the u.s. via common law but it basically said that there's certain things that require signatures to be valid so the big ones were like sales of land agreements for an executor so that's like if somebody dies marriage promises contracts that couldn't be performed in a year so if it took over a year you had to have it in writing with the signature and ultimately promises to pay debt had to be in writing with the signature we'll talk about statute of frauds more but in 1776 this great document that we can see in the Rotunda was signed by probably the most famous signature that we know around here John Kane Cod when he signed the Declaration of Independence and then finally in 1954 there was a proposed draft through what's called the uniform commercial code or the UCC that ultimately had a statue of for all its provision put in there for anything of the sale over 500 dollars and there's a breakdown in the UCC as to saying if it's a business the business transaction versus a consumer to business transaction but we'll talk about that more again so as technology started to change signature started or the validity of signature started to get challenged the first one was when was used as whether a telegram so I signed something that I you know put it in the telegram and the person says yup he signed it does that constitute a valid signature and that was in 1869 Holly V ripple established that agreement actually was made and then in 1980s we all know the fax machines I'm a child of the 80s so I remember fax machines they became a rise and a lot of people just faxed orders or fax contracts and the question ultimately came again is this actually a contract if somebody faxes it over with their signature on it and so most US courts started saying yeah this is actually a signature it constitutes agreement this works finally in 1999 another group came together in formed what was called Uyeda or the uniform electronic transaction act the big thing here is that these are proposed statutes for states ultimately enact in the u.s. because we have the federal system where you have you know the federal federal system and ultimately states have their own systems so you Ito was ultimately used as a gauge for a bunch of states to adopt and statutes that they could adopt in their individual states to deal with uniform trends electronic transactions and then finally the federal government in 2000 adopted the electronic signatures and global and national Commerce Act or the esign Act if you can imagine that by Bill Clinton both of these were basically saying trying to deal with the passed court cases so all these court cases and technologies were like okay we know this person intended to sign this a Senate via an electronic the thing is this a valid medium for them to do it and basically both Uyeda and e-sign said yeah this is fine but it ultimately broke out what mattered in a signature what what actually came to matter in a signature and the two men could signature the two main considerations with all signatures are intent obviously does the person intend to enter into agreement by signing this document and then finally the the last one is some evidentiary standard that this is this person's actual signature right so in the past this was always done with ink like I showed you the Ergo Rodrigo right so how do you actually verify that this is this person's signature typically the way you did this is you put a qualified document examiner on the stand establish that he was an expert and then he went through how he knew this was their signature based on old signatures which I don't know if anybody's ever forged signature here I did with my mother's on a sick note when I was in high school and we all know how we did it right you put here she signed this document here you put the sick note on top of any tray it's really slowly over it and it looked nothing like your mother's signature but it passed forcing a sick note so this is a common way obviously of tracing signatures in the past you transmitted light carbon intermediate are using pressured ultimate and did the signature and so a documents ammeter when they would get on state when they would examine the signature with a magnification loop they would alternate looked for the speed and pressure of the signature if there is any pen lifts hesitation marks tremor lines six starts and stops or whether the two were actually a perfect match because nobody's two signatures are ever a perfect match and that's how they would determine whether this was actually this person's signature so kind of moving off what is an eSignature we've all heard this we all used it we all know what it is in some sense but I don't think people realize how broad of the definition of e signature or what an eSignature is so a etus which is the the EU version of this described in each signature electronic signature as data and electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign so yeah this is a super broad definition and it can be anything from checking a box if you agree to this check this box check the box click consent or submit it can be anything as put your initials here type your name here it's literally the broadest definition it can mean a lot of things so obviously this you know constitutes a problem we talked about before if we're altima talking about intent and ultimately trying to verify whether this is a person that actually did it so anybody could have checked the box how do we know that was that person that checked the box so most jurisdictions have come up with either an advanced or what they're called qualified East signatures that kind of attacks on more requirements for it to be valid so the common common elements of the advanced each signature is that the signature has to be uniquely identified and linked to the signature they must have sole control of the private key the key that was used to create the electronic signature the signature must be capable of it identifying if it's the company data has been tampered with and ultimately if the the signature the data has been tampered with then it needs to be and validated so you know what is a digital signature I just told you what any signature was most people think digital electronic those words go hand-in-hand and in fact a digital signature is is quite different but it is an electronic signature so there's a confusing thing so a digital signature in general is a mathematic scheme a mathematical scheme that's used essentially authenticate a digital message or a signature right so the three key elements and again you know these will these will sound like I'm echoing myself but about a digital signature gives a recipient reason to believe that the message was created by a known Cygnet knows known sender known as authentication that the sender can't deny having sent the message so non-repudiation and then ultimately that the message wasn't altered in transit so there's some integrity associated with it right and the best way to describe this or think about this is think of a digital signature as your digital fingerprint right and ultimately digital signatures use what's called a public key infrastructure PKI is a technical term to ultimately provide the highest level of security and universal acceptance when it's created and and here's the real kicker it's really just a technical implementation of electronic signature so in a PDF a perfect example is I'm sure you guys have had a tablet or maybe you've used square or something like that where you've signed with your finger on a tablet that is not a digital signature most likely whereas if you have a PDF that's in a form and ultimately you sign it and it stamps it it is generally the term that's more likely to be a digital signature so trying to give you guys kind of a what we call a wet ink signature would be the one where you sign with your finger or a stylus versus a digital signature that's actually created by the yoke through which I'll tell you the method here but created by the the actual device and stamped on there so yeah let's run through the current legal landscape before I ultimately get to how digital signatures work in PDF so let's say we're at a PDF conference right so yeah the current legal landscape let's talk about us Uyeda and each sign acts and kind of dive into a little bit more both of them again we're trying to establish that you can use transit you can use an electronic means to in turn to an agreement and basically that the objection in court couldn't be well they used a computer to enter this agreement they can't do that it's not a valid medium so the two laws basically said no contract signature record shall be denied legal effect solely because it's an electronic form and a contract relating to a transaction cannot be denied a legal effect again same thing sorry so again this was in 2000 turn of this century so this may be a little bit outdated now but this was a huge deal especially during this time so both acts may put four major requirements or four major things that they went to I had to show the intent to sign consent to do business electronically association of the the signature with a record and that that record could be retained and we'll dive into each one of those because they're important so like a wedding signature with the intent to sign both parties must actually intend to do business this is a key of any agreement if a person is coerced or if a person has undue direst ultimately signed something and they didn't intend to signed it it's it's the it's the basis of every agreement there wouldn't be an agreement so the the person or the the parties have to actually intend to enter into agreement intend to use an electronic method to do this so I kinda already went over this but the US law was really focused on the validity of the medium not necessarily both lis the intent to sign and the validity of the media medium not the evidentiary side of it so consent was the clearest one both parties must consent to do business electronically the big difference here is again that business the business transaction versus that consumer to business transaction so with the business business transaction the both parties are considered more sophisticated kind of knowing what they're doing so the bar is actually really low to actually be able to look and they can look into the circumstances surrounding how the the transaction happened to determine whether that actually you know constitute concern whereas with the consumer they actually put out what they called Uyeda consumer consent disclosures and basically you have to give these to them the person s tougher mature affirmative ly agree to use this electronic rathered record and they can't withdraw their consent before signing so this is with consumers so these are keys if you're doing anything with non business parties this is good to know finally it's the association of signature basically that the you know they have to whatever system capture the signature has to put it in a record and ultimately the record must be reflect how the process was done to create the actual signature and ultimately keep track of the person be able to have it for each party so each party has a record of how the signature was created when it was created and ultimately this thing that shows that this was done electronically obviously retention is huge with electronic documents and this is another another thing put into the law that it had to be done in a retain Abul format and what do you know PDF is probably the best way to do this is by far the best file type to be able to do electronic signatures so yes some further consider further considerations with the u.s. so these laws are minimum requirements you know any the federal law especially there's a lot of agencies that you have to go above and beyond when you do documents with them but so the reason this is this is set out as a minimum is to know that just because you do these you may have to also look and see if there's other things you have to do to have a signature be valid and then again appropriate they primarily focused on the medium and not so much on the actual evidentiary of do I know this is the person that's signing this so again the additional considerations like the FDA is one off the top of hand they have a whole entire directive as far as if you want to submit documents to them and sign them that you need to have but most of them try to deal most of these extras on top try to deal with the evidentiary issues so they're ultimately dealing with accuracy reliability protection can you limit who who actually has authorization to the the digital signature of the documents and then is there some sort of audit log like how detailed is the audit log of when these documents were created inside so quickly in the EU how many people are from outside of the US or in the EU here sorry being an American that deals and the EU all the time it's a-you know it's most of the EU especially Germany and Austria are very statutory systems or is the u.s. it's a very common law case driven thing so one of the things that happens with the statutory system is sometimes they can wait and be ahead of the game and the EU ultimately had an e signed directive that they put out in 2000 I believe maybe it was 2001 about the same time that Uyeda and E time we're done and then they updated it in 2016 and replaced it with what they call a itis which is ultimately set out what they called a simple advanced and qualified signature and it almost is specifically dealing with the evidentiary side of things so what they basically said is you can't with these things if it's done in electronic media that you can't not allow them to bring this as evidence into a case to determine whether a signature was done and we'll get into this a little bit further at the end I promise I'm almost done so the itis focused more on the the technology technological process of verifying the identity of the sign or the security around the process and ensuring that the signature had not been tampered with so again it kind of sounds like I just told you about digital signatures again because that's really what they cared about was the same thing that a digital signature cared about and so again it was to allow the evidence of any of these three types of East signatures to be admissible which I told you what if advanced signature was I didn't tell you what a qualified one was or a simple one a simple signature is basically the same definition of an eSignature it's any type of signature in advance we went through the elements of it and I qualified actually is more it might as well just say it's a digital signature because it's basically it can be done in any type of mechanism they don't require you to do it via PDF but it basically has to have all the requirements of what a digital signature has in PDF so yeah many of the member states in the EU as well it's a federal system if you can think of it that way as the EU gives it directive and then ultimen bar states can decide how they want to enact these laws or whether they want to or not there's certain things where they say hey no no electronic signatures are done at all the common one that I've run into is if you've ever done business in the US and your ultimate Lea are getting some sort of shares of a company or you're writing a company you have to have a notary it's not like a notary in the US where you go to a bank it's actually a person it's a very significant like kind of a person that basically sits there watches over the proceedings takes the document and literally reads the document out and make sure everybody understands what they're signing so there are certain things where they say electronic signature sorry we won't allow them but for most things it's actually just like the US and again the idea is that even a simple signature can get into evidence and have an evidentiary wait but obviously as you go to an advanced signature and a qualified signature the weight of that being a valid signature is heavier so yeah how does this relate to a PDF sorry it took me so long to get there but yes it relates to a PDF is because of digital signatures and digital signatures are part of the the PDF spec they've actually been updated in the most recent ISO 32000 - that was recently done last year I recently adopted last year but basically a digital signature when signing a PDF uses again the pay the PKI or public key infrastructure and so I'm really trying to break this down for people because it's confusing if you don't deal with it or have never dealt with something like this a PKI protocol basically says it uses a mathematical algorithm to generate too long numbers right long numbers think of like a password generation right thing right these are called keys one key it's public one key it's private you hold it nobody knows it right then basically when the person signs a PDF the signature is created using the person's private key and the algorithm acts as a cipher so it basically takes that private key it ciphers it and creates a hash right then encrypts it and signs the document the resulting encrypted data is the actual digital digital signature this is what the thing is actually stamping into the document so then when it's actually sent to the person on the other side and they need to verify whether this is a signature they have the public key and they basically use it as a cipher of the hashed and see whether it matches the private key and if they match obviously this is about signature right so there's a lot of things you can put in this digital signature most of the time it's I don't know it's everything you can put your initials you can put your actual written signature and image of a written signature in there but you can put things like the time it was done IP address of the person when they signed it there's a million things you can put in here but some other things that recently been done is you can put if a person is using a stylus what type of style is say they're using the pressure sensitivity of them using that stylish the touch radius of them the time it took them to start the signature and in the signature I mean it literally goes on and on and on that you can store in this thing to make sure it's a you know add to the validity of the the evidence if it were ever to be challenged so here's a nice little diagram kind of trying to show you guys this you have a none side unsigned document there's a hash algorithm that was that math mathematical algorithm I told you it creates a hash it's encrypted it's then digitally sign it's invalidated so you go back the digital you sign a document you have you you decrypt it with the public key it gives you the same hash algorithm as the DH it was created with the private key then we have a valid signature now give me the giving to the next talk a little credit here this is essentially blockchain it's essentially some version of creating blockchain which will be talked about so this could be done via blockchain if you wanted to so you could come up with PDF coin and be signing digital signatures everywhere if you wanted to but so yeah obviously when a person does a digital signature they want some you know validity that this is a secure signature and that hasn't been tampered with you know so what they what the way the PDF did this was they created what they called certificate authorities which is a whole entire list of certificate authorities that adobe has put out that says these people are the certificate authorities that you can trust and what these people do is they give you what's called a digital signal certificate that ultimately says this is your public key this public key associates associates with John Doe and it's valid so if you use this public key and it matches up in the signature that you know that John Doe sign this this document and they're kind of uses a guarantor if you want to think of it that way is okay my guarantee that this person is this person is this third party over here side note about this I'm not getting into it so I'm not getting into this too much I'm sure most of you guys know of I've heard of in the US are the largest certificate authority more more signatures are done via electronically than any other any other version and they're not on this list of a certificate authority so you can kind of see it's maybe it's breaking down or maybe it's not as good as it should be but again the digital certificate contains the public key for the digital signature it identifies the the person with the associated key that is a guarantor it's valid for a limited time and it must be issued by a trusted Authority right the big thing is that both parties have to agree to use this certificate authority that can be huge so if you guys both don't agree to use this person and then it doesn't work so yeah what was updated in the PDF spec and this is called I'm probably gonna announce this wrong pronounce this wrong as pepitas this is essentially the PDF spec trying to trying to update with these digital certificate authorities and essentially the validity of these digital certificates so the big question is a big problem you ran into with the oldest back right was I have a digital signature I sign it and now I go look 10 years later and the certificates expired well do I know whether that certificate was valid when it was signed do I there's no way to track what you know or digital digital certificate is compromised in July document was signed in January they realized in July it was compromised in April right or they realized in July they was compromised last December how do you know that that document when it was signed was valid and it was trying to solve this problem and basically what they did is said okay when the digital signature is actually created we're gonna timestamp it and we're gonna include the timestamp in but then if it's online we're gonna check whether that digital certificate it is actually valid if it's valid we're gonna timestamp it again that this certificate is done in its valid and we're going to incorporate all this into the actual digital signature if it's offline we're gonna wait until whatever is online that it can actually do it so maybe the dates are later and then later ten years ago I can look back and said the digital signature was traded here and it was verified with the certificate authority that it was accurate here therefore I know that a hundred years from now this was a valid lease Article II event and it's actually one of the big gaping holes I think in digital signatures and something that I think it's it's very good that it got into to the spec yeah and I just told you all that sorry so yep yep yep okay yep and I'm done thank you guys if you guys have any questions or [Applause] yes go ahead sure the question was can I go back and explain it Vance versus qualified so yeah this sorry real quick so yeah advanced signature it says that it's think of these as baseline is in specificity simple advanced qualified they kind of build on top of each other so an advanced signature Vance the signature the signature a signatory has to be uniquely identified and leading to the signature they must have sole control the private key and they must be capable identifying it the company data hasn't been tampered with and in the event the the data has been tampered with it's invalid so then a qualified signature basically says that this has to be done with a medium so a digital medium and that it actually has to it basically has to and and I'm probably not going to say this correctly so it basically says that if you use PDF let's say and that's the system you use is this PDF system to create a signature and it has a record retention in with that signature then that's considered qualified and and in fact the way it's done in the EU spec they actually have said each individual signature so PDF digital signature is done with this back is is a qualified signature or is they may say another one's not and in actuality and use a qualified digital signature is super rare as in like it's not advanced signatures in the EU are much more common and because it's seen as enough right and to go above and beyond is what's the point but there are systems available and they have a section of the law written in case that these would be used so I'm sorry I probably cause more confusing with that and answering the question yes sir also part of this is just a part of this I think is really understanding how US law works in the federalist system so you know if the federal says this is the baseline thing you can always put more things on it you can't put less so I think the way it works in the agency system is the FDA has said especially it deals mostly with like like drug studies and things like this but they said no we need to you know this is a long out process of them submitting these documents we need them to be signed but we need to know what happens throughout this long out process because maybe it needs 10 people to sign it right and we need to know that only these 10 people have access to this document because these are the only 10 people that can verified it that this group is actually accurate so I think really what it's doing is saying no in this use case we have extra things that matter here and the baseline standard isn't good enough and so I think it's more seen and this happens I'm sure aviation is another standard where I'm sure they have different protocols that are just because it's seen as a higher standard or as the law is meant to be everything dealing with any type of transaction on a you know foreign government or domestic basis on the federal level yeah sure go ahead so the question was how does pdf/a implement into this wouldn't if you wanted to archive a signed document I'll be the first one to say I don't know I'm sorry thank you guys I believe we're out of time Thank You illegal talks really hard to deal with so I appreciate you guys staying awake thank you [Applause] [Music]