The approach taken by a government in determining how legislation is to be enacted can affect the infrastructure of the electronic environment in a particular jurisdiction. Some jurisdictions favour the use of digital signatures carried on smart cards for the signature process, while others have developed a state public key infrastructure, with a certification authority acting as a trusted third party. Other governments have enacted legislation that seeks to be neutral, thus allowing for the changes in technology that are bound to alter over time.

United Nations Commission on International Trade (UNCITRAL)

Sets of uniform rules have been prepared by UNCITRAL: the Model Law on Electronic Commerce and the Model Law on Electronic Signatures, together with the 2005 United Nations Convention on the Use of Electronic Communications in International Contracts. The Model Laws are intended to provide help, guidance and an instrument for national states to use in forming legislation. While states are encouraged to incorporate both the Model Law on Electronic Commerce and the Model Law on Electronic Signatures fully into their domestic legislation, changes can be made to the content. The Model Laws are complementary to each other, although many states enacted legislation relating to electronic signatures before the final version of the Model Law on Electronic Signatures was adopted. The following discussion is intended to bring the salient issues to the attention of the reader.

The purpose of this chapter is to put the concept of the signature into a broad legal context: to set out the purposes that can be attributed to a signature and to explain the functions a signature is capable of performing. In order to appreciate what constitutes an electronic signature, it is helpful to understand the function a signature performs and how judges have responded to changes in technology over the generations. It is for this reason that this chapter sets out a brief history of the signature and how judges have responded to changes in technology and the different methods that have been used to indicate how a signature can be made manifest. The function a signature performs remains as valid in the electronic age as when the use of an impression of a seal was considered to be the best means of authentication before the advent of widespread literacy.

It is to be acknowledged that many of the cases referred to in this chapter refer to statutes that may well have been amended or appealed. However, this does not detract from the problems that lawyers and judges faced when applying legal principles to new forms of technology. As most of these cases illustrate, judges applied the underlying legal principles to the facts of the case, leaving the technology to one side, because the technology does not affect the legal principles. That judges and lawyers have had to deal with new technologies is hardly unique, and to suggest that judges are dealing with technological change for the first time in history is erroneous. Judges have always been required to apply the law, regardless of the technology used, and the development of the networked world is no different.

Technical overview of digital signatures

Cryptography is the method of hiding the contents of a message, used from ancient times to the present. Encryption (or enciphering) is the process by which a plaintext (or cleartext) message is disguised sufficiently to hide the substance of the content. As well as ordinary text, a plaintext message can be a stream of binary digits, a text file, a bitmap, a recording of sound in digital format, audio images of a video or film and any other information formed into digital bits. When a message has been encrypted, it is known as ciphertext or a cryptogram. The opposite procedure, that of turning the ciphertext back into plaintext, is called decryption (or deciphering). In essence, contemporary cryptographic systems change one set of symbols that have meaning (binary data) into a second set of symbols that has no meaning, by means of a mathematical process. Cryptography is usually required to undertake a number of functions, the most important of which is authenticity, rather than secrecy. These functions are discussed below.

Authenticity

To ensure the authenticity of the information. When sending or receiving information or placing an order, both parties need to have assurance of the origin of the message. The aim is to corroborate the identity of the entity that sent the data, such as the computer (the identity of a person cannot be corroborated, because a person is not part of the communications process – the process only involves computers).

The number of possible parties linked to an electronic signature will differ, depending on the type of signature used. The number of links in the chain, and how secure those links are, will give rise to different levels and types of liability, although some of the parties may be considered to be too far removed from the creation of the signature to incur any liability, whether contractual or non-contractual.

Liability: links in the chain

There are a number of ways in which liability may arise, and the following discussion serves to illustrate some of the problems that could occur.

The framework within which legislation is drafted invariably depends on the decisions made by politicians. While the existence of the UNCITRAL Model Law on Electronic Commerce and Model Law on Electronic Signatures have acted as a guide for many states when enacting legislation, other factors help shape the formation of legislation, such as the approach taken regionally by the European Union in the form of the Directive on electronic signatures. In early reports published by the Internet Law and Policy Forum, it was suggested it is possible for there to be a tension between legislation that seeks to be technologically neutral and the establishment of legal rules to provide for electronic authentication. The tension is illustrated in the judicial reaction to electronic signatures. This is because electronic signatures do not appear to be well understood in some jurisdictions (by lawyers or judges), and in what might be called civil law jurisdictions (although not exclusively), the emphasis is on the acceptance of digital signatures to the exclusion of other forms of electronic signature (although the PIN is universally accepted, which illustrates the irrational approach taken to digital signature). Of interest, a number of countries have decided to specifically exclude some forms of electronic signature, that is, signatures by facsimile or by way of a scanning device.

Approaches to legislation

There are three broad approaches to legislating for electronic signatures: the prescriptive approach, the minimalist approach and the two-tier approach. Each is discussed below.

Preface

Misunderstandings about what constitutes an electronic signature continue to occur, years after their use began, and years after the passing of legislation. This lack of understanding is not limited to lay people and journalists, but includes some judges and lawyers. It is also clear that the legal culture affects the way electronic signatures are dealt with. For instance, in Germany, even a modest e-mail sent in minor administrative proceedings between employee and employer requires the sender to pay for and use a digital signature, even though the recipient knows who sent the e-mail, and there is no doubt as to the authenticity of the communication. Requiring an employee to obtain and pay for a digital signature for such purposes would be unheard of in common law jurisdictions.

In this edition, I have removed the chapters dealing with the detailed discussion of contractual liability and non-contractual disclaimers and negligence, based as they were, on the law of England and Wales. Both areas remain in a constant state of flux, which means it is arguably more appropriate to aim to provide a reasonably comprehensive outline of the principles of electronic signatures and relevant case law (where I am made aware of it), rather than consider areas of law that will alter during the life of this edition.

The Electronic Communications Act 2000

The first draft of a bill, the Electronic Communications Bill, was published in July 1999. This Bill was withdrawn when it attracted a great deal of wrath regarding key escrow (which is now expressly excluded in the Act by s14) and provisions that were later incorporated into the Regulation of Investigatory Powers Act 2000. The Electronic Communications Act received the Royal Assent on 25 May 2000, and extends to Northern Ireland. The Act is in three parts:

1. Part I: Cryptography service providers. This part of the Act provides for the establishment of a statutory register of approved providers of cryptography support services. It has not been implemented, and a voluntary scheme is in place. Further, by the terms of s16(4), Part I was repealed on 25 May 2005 because no order was made under s16(2) by the end of the period of five years beginning with the day on which the Act was passed.

2. Part II: Facilitation of electronic commerce, data storage, etc. This part is concerned with the legal recognition and admissibility of electronic signatures; permits the removal of statutory restrictions, which impose a requirement that a transaction must be in writing; and facilitates the use of electronic means to store information in an electronic format.

3. Part III: Miscellaneous and supplemental. This part makes a number of amendments to the Telecommunications Act 1984 regarding the modification of telecommunications licences, and also covers the usual matters including interpretation, the short title, commencement and the territorial extent of the Act.

Sections 7, 11 and 12 came into force on 25 July 2000 in accordance with the provisions of the Electronic Communications Act 2000 (Commencement No 1) Order 2000 (SI 2000 No 1798); section 4(2) was amended by section 82, Schedule 4(10) of the Regulation of Investigatory Powers Act 2000; section 15(1) was amended by section 406(1), Schedule 17(158) of the Communications Act 2003; and sections 11 and 12 were repealed by section 406(7), Schedule 19(1) of the Communications Act 2003.

In the event an electronic signature becomes the subject of a dispute, the normal considerations will apply regarding the submission of evidence into legal proceedings, including any rules relating to the authentication of the evidence, the weight to be given to the evidence and whether it is necessary to help the adjudicator in reaching a decision by providing expert witnesses. This chapter aims to alert the reader to some of the issues that might arise in relation to electronic signatures, although the emphasis is on digital signatures.

The evidence forming a digital signature

A certificate is issued with a digital signature, which is a signed data structure that binds a public key to an identity. This certificate will purport to bind the public key to the information contained in the certificate. The subscribing party provides some of the information contained in the certificate, which may or may not be verified by the certification authority, and the certification authority is responsible for the remaining information. The subscriber will have a pair of keys, private and public. The key pairs may be generated by the keying material available to the subscribing party in their computer, by a registration authority, by the certification authority or by a trusted third-party key generation facility.

This first substantive case study chapter begins with forms of self-organization that have not yet become self-regulation. Prior to self-regulation, there is a step that is essentially the relationships within a community, policed by that community. For instance, clubs elect executives and create constitutions (rules) for that club. With the increasing consumer-citizen use of the Internet, new services and new business models have been created for those users. There are many user-created environments in which bottom-up rules have claimed to be set, but I focus on three specific UGC case studies, which were in early 2007 the poster children of self-organization: virtual-world Second Life, copyright reforming Creative Commons and social network Bebo. The first has since declined in popularity and its co-founder has departed, the last has seen sale, decline relative to behemoth Facebook, and resale, but Creative Commons continues to support its functions and has been officially recognized by several governments as a type of copyright licensing system that can support open data sharing. I represent these early-stage organization schemes in the table below, acknowledging that their regulatory effect is voluntary and not supported or recognized by government, the closest approach being ‘acknowledgement’ that they exist, neither a vote of support nor a condemnation.

Introduction

The term ‘co-regulation’ encompasses a range of different regulatory phenomena, which have in common the fact that the regulatory regime is made up of a complex interaction of general legislation and a self-regulatory body. The varying interests of actors result in different incentives to cooperate or attempt unilateral actions at the various points of the value chain. Without regulation responsive to both the market and the need for constitutional protection of freedom of expression and protection of minors at national levels, Internet co- and self-regulatory measures cannot be sufficiently responsive to economic and cultural environments to be self-sustaining. It has enriched conceptions of ‘soft law’ or ‘governance’ in the literature in the past ten years, but like those umbrella terms, refers to forms of hybrid regulation that do not meet the administrative and statute-based legitimacy of regulation, yet clearly perform some elements of public policy that cannot be ascribed to self-regulation, in the absence of the nation-state or European law. It is often identified with the rise of the ‘new governance’ in the late 1990s in environmental and financial regulation, yet its growth can also be traced to the birth of Information Society policy in the mid 1990s.

This chapter analyzes co-regulatory bodies ICSTIS, IMCB, ATVOD, NICAM and PEGI. The rating schemes for mobile phone, video online and computer games content derive from ‘purer’ forms of self-regulation but have morphed into a much more institutional form, while ICSTIS and NICAM are statute-derived co-regulators.

While standards and critical Internet resources are (at least in their extent) unique self- or co-regulatory institutions, there are many examples in content/applications and services delivered via the Internet which one could say are ???converging??? on the Internet. They raise regulatory problems which are created by the differing characteristics of the Internet compared to earlier media for which the regulatory regime was designed. Prior media were largely domestic, closed to interference, and therefore the content was ???certified???, protected and complied with cultural standards, norms and laws of the sovereign. In addition, these purely domestic ???receivers??? (rather than users) could not generate and mix content themselves, nor send it via p2p networks, nor communicate anonymously, nor send bulk communications virtually without cost. Signii cant dif erences exist between broadcast, mass print publishing services and the Internet.

Introducing Internet filtering and website blocking

This chapter explores the private filtering and censorship of the Internet that already takes place, its murky legal stature and government attempts to substantially increase the levels of censorship that take place, by encouraging private ISPs to censor their own customers. The information is largely culled from the 2008 EC study. I am particularly grateful to the interviewees and relevant team members of the study, for their degree of candour in discussing Internet censorship and government pressures.