At the end of every semester we go through a little dance at the university called external examination. We send the exams to an external examiner and they have to indicate the paper is well set and fair, then we send them some of the marked papers and they indicate that they have been fairly marked and that the marks are reasonable. This process is monitored and our accreditation body (ECSA) requires that we keep the paper trail on file to check that everything was done right. They require a signature on a hard copy of the documentation at every stage of the process.
At the moment I am also going about the business of registering as a professional engineer, which also requires much signing of documents. After the signing by the people involved, it has to be signed by a commissioner of oaths and sent on to ECSA as a hard copy.
These situations have me wondering yet again why people don’t use electronic means for these processes. Perhaps I should append “in South Africa” or “in the Engineering community in South Africa”. An argument I hear quite often is that you need a handwritten signature for legal purposes. This is balony, as one can read in Act No. 25 of 2002: Electronic Communications and Transactions Act. A good summary of what the act means for digital signatures in SA can be found here, but I will give an even more summarised version: digital communication has exactly the same legal standing as hard-copy communication in South Africa. So there is no legal reason for people not to just e-mail one another and write their names at the bottom of the mail for non-contract communication just like any other time. When a legally binding contract is entered into, we need an “advanced digital signature”, which boils down to signatures using public key systems like S/MIME or PGP.
So, why is no-one using these systems? I think the first is that most people still print out everything they want to keep, and digital signatures tend to be invisible. Printing out the document invalidates the security of a cryptographic signature and there is no formal way of ascertaining whether the document printed out was signed or not. Big problem for people who don’t use computerised filing systems. Unfortunately, this means they do something very bad: they trust faxed or printed out signatures. Many people are ok with a document as long as it looks as if it has been signed. This is ludicrously simple to cheat, as all the things that make a physical signature difficult to fake are not present on the fax. I am absolutely certain that I could trace a signature and have it look legit after faxing. I am even more certain (because I have done it) that a couple of minutes with a photo manipulation software gives me a signature I can put on any document I wish.
Which brings me to the second reason no-one uses digital signatures: people think of computers primarily as an extension of the “real world”. The mental model encouraged by Office software vendors is that the electronic document is just like the real thing, only on the computer. This is great when the metaphor is solid, but many things that are used in computers just don’t have any physical equivalent, and these things become difficult to understand. This doesn’t mean they can’t be used (what’s the real-world equivalent of Facebook?), it just means you need to package it right. I reckon Adobe’s idea with a little ribbon that appears on a PDF when it’s been validated is almost there, but it’s not ubiquitous enough for people to recognise what it means, and I don’t think there is a good way of validating the document after it has been printed.
I think there is a real gap in the market for a cryptographic signature that would work with mobile phones — a datamatrix in the corner that would match an image hash of the whole document. Lots of interesting implementation details there, but a good way to make hard copies trustable.
So, what am I going to do to stop the madness of printing out documents, signing them and scanning them or faxing them? Pretty much what I’m doing already – affix a picture of my signature to the PDF and get on with my life. Legally, I could just as well have written my name, but it keeps people happy. I will also refer them to this blog entry and the law when they claim a legal necessity for hard-copy signatures.
What do you think – when will the hard copies go away?
Leave a Reply