Search /
Advanced search  |  Help  |  Site map
Click for Layer 8! No, really, click NOW!
Networking for Small Business
Where's my gigabit Internet, anyway?
How a cyber cop patrols the underworld of e-commerce
For Red Hat, it's RHEL and then…?
Will the Internet of Things Become the Internet of Broken Things?
Kill switches coming to iPhone, Android, Windows devices in 2015
Israeli start-up, working with GE, out to detect Stuxnet-like attacks
Galaxy S5 deep-dive review: Long on hype, short on delivery
Google revenue jumps 19 percent but still disappoints
Windows XP's retirement turns into major security project for Chinese firm
Teen arrested in Heartbleed attack against Canadian tax site
Still deploying 11n Wi-Fi?  You might want to think again
Collaboration 2.0: Old meets new
9 Things You Need to Know Before You Store Data in the Cloud
Can Heartbleed be used in DDoS attacks?
Secure browsers offer alternatives to Chrome, IE and Firefox
Linksys WRT1900AC Wi-Fi router: Faster than anything we've tested
Heartbleed bug is irritating McAfee, Symantec, Kaspersky Lab
10 Hot Hadoop Startups to Watch
Server makers rushing out Heartbleed patches
Fortinet, McAfee, Trend Micro, Symantec, Bitdefender battle in socially-engineered malware prevention test
Net neutrality ruling complicates US transition to IP networks
6 Social Media Mistakes That Will Kill Your Career
Canonical's new Ubuntu focuses on the long haul
4 Qualities to Look for in a Data Scientist
Big bucks going to universities to solve pressing cybersecurity issues

The pen is mightier than the electronic signature

It's not often that you can get Internet legislation passed nearly unanimously in both Congress and the Senate, then signed with a flourish by the president. To some people, such a law must seem a truly wonderful thing, sure to bring peace and harmony and increased profits through e-commerce. To the rest of us, it's a sure sign the law doesn't do anything useful. Such is the fate of the new Electronic Signatures in Global and National Commerce, dubbed the E-Sign law.

The first tip-off to security experts that this law might be less than it seems is in the title. Notice that it uses the word "electronic" instead of "digital." A quick review of the law shows that, in fact, the new signatures do not have any security associated with them. This means that when you sign a document, you have no assurance that what you are signing is in fact what you think you are signing. Furthermore, the person receiving the signed document has no assurance that it was in fact you who signed the document.

In other words, a contract that is "signed" with an electronic signature is worth less than one on paper. It is approximately as valuable as an oral contract, where either party can later claim to have heard or said something different than what the other party says. If you sign a document by clicking on a button in a Web form, or even by sending e-mail, the receiving party can easily claim that what you clicked on or sent is different than the copy you kept on your hard drive.

Unfortunately, the E-Sign law is probably just another FEFL (full employment for lawyers) action by Congress. They could have easily done the right thing by saying that only digitally signed agreements, using the kind of security Network World readers have been using for many years, were legally binding. Crafting such a law isn't easy, but it's not impossible, either. It is certainly too soon to say "all digital signatures must use Secure Multi-purpose Internet Mail Extensions" or "all digital signatures must use Pretty Good Privacy," but a reasonable law could simply state "all digital signatures must use industry-standard formats and best practice security policies."

The general state of glee among those passing the bill was probably due to the promises of the lobbyists supporting the bill that this will be "good for e-commerce." That's not likely, given that the result will surely be less-than-scrupulous e-commerce sites starting to claim that users "signed" contracts that the users don't remember signing. Of course, these sites will have copies of the Web pages that the user clicked "OK" on, but nothing other than logs to prove the signature. This will end up in the newspapers, and maybe even the courts, and the result will probably be that most of the less-savvy users will trust e-commerce less than they do today.


Hoffman is director of the Internet Mail Consortium and the VPN Consortium. He can be reached at

Hoffman is director of the Internet Mail Consortium and the VPN Consortium. He can be reached at

In the Works archive

NWFusion offers more than 40 FREE technology-specific email newsletters in key network technology areas such as NSM, VPNs, Convergence, Security and more.
Click here to sign up!
New Event - WANs: Optimizing Your Network Now.
Hear from the experts about the innovations that are already starting to shake up the WAN world. Free Network World Technology Tour and Expo in Dallas, San Francisco, Washington DC, and New York.
Attend FREE
Your FREE Network World subscription will also include breaking news and information on wireless, storage, infrastructure, carriers and SPs, enterprise applications, videoconferencing, plus product reviews, technology insiders, management surveys and technology updates - GET IT NOW.