News focus: digital signatures dilemma

It is now 17 years since parliament passed the Electronic Communications Act to make electronic signatures on contracts admissible as evidence. The law helped usher in a new world of e-commerce. Yet for personal transactions that really matter, whether signing a marriage register, making out a will or conveying a property, we almost invariably turn to the ink-on-paper signature to authenticate a document.

It is no coincidence that transactions requiring a wet signature are those in which a solicitor is likely to be involved. But a flurry of announcements by government bodies suggests that the tide could be turning.

In its annual report last week, HM Land Registry announced that, as part of its plan to make its role ‘almost totally frictionless’, it was ramping up its digital mortgage service. The system allows a mortgage to be added to a registered title electronically (at present, only when there is no change in ownership). It has been in ‘private beta testing’ since summer last year; the annual report says the tests will be opened to a wider group of users by the end of this year.

John Abbott, director of digital, data and technology, writes: ‘The first truly digital mortgage can be created, signed and registered without the need for any paperwork or emailing and without the need for our colleagues to be involved in the process.’

To illustrate the concept, the annual report shows a mock-up of a mobile phone screen inviting the holder to ‘Sign your mortgage deed’ by pressing a green ‘start now’ button.

To prove the signer is who they say they are, Land Registry plans to rely on a system called GOV.UK Verify, developed by the Cabinet Office to authenticate transactions with public bodies. It is a federated identity management service; citizens sign up with a choice of seven third-party providers which verify identities from public and private sources, and authenticate transactions as required. It is the centrepiece of the government’s ambition to cut costs by making public services ‘digital by default’.

Other potential uses in the legal sphere include online probate. HM Courts & Tribunals Service revealed earlier this month that it plans to replace the ritual of swearing in a solicitor’s office (accompanied by the welcome cash fiver) with a ‘digital statement of truth’ signed online. The planned online civil court and online guilty-plea process for non-custodial offences may also make use of Verify. If these systems are to achieve critical mass, trust in their integrity is essential.

However, it is by no means clear that the Verify system is yet up to this task. The government’s target is for Verify to have 25 million users by 2020; it now has just over a million.

Earlier this year, an investigation by the National Audit Office suggested that the target will be difficult to achieve. Verify has proved difficult for some people to sign up to, especially individuals without a sufficient ‘digital footprint’ and up-to-date mobile phone. Verify is unsuited for signing on behalf of other parties and, as we shall see, for witnessing signatures. As a result, public bodies have had to hang on to their existing log-in routines in parallel with Verify even if they are no longer being updated. This can pose security risks, the NAO warned.

‘It is not yet clear whether Verify will be able to overcome the limitations that have prevented its widespread adoption across government, or whether attempts to expand in other ways will be successful in encouraging departments to adopt it,’ the NAO comments. ‘Take-up and cost projections remain optimistic and there will always be many services that do not use the current Verify service.’ These include ‘medical services with higher assurance requirements’.

Perhaps more worrying from a legal point of view is an assessment of Verify by the Law Commission in wide-ranging proposals published this month on reforming the law of wills. As widely reported, the commission enthused about the possibility of new technology as a way of encouraging more people to make wills. It even floats the prospect of linking electronic wills to a computerised probate service to execute testators’ instructions automatically.

Less widely reported was that the digital proposals came with a large caveat. Electronic wills would have to be authenticated by a signature process at least as robust as that available today, where a whole infrastructure of expertise is available to scrutinise signatures in the event of a challenge. The commission concluded that, at the moment, digital technology is not up to the job. One problem is the need for two witnesses to sign in the presence of the testator.

‘The first truly digital mortgage can be created, signed and registered without the need for any paperwork or emailing and without the need for our colleagues to be involved’

John Abbott

The commission also has particular concerns about Verify, saying that the system ‘does not currently ensure that the person entering the information is in fact the person he or she is purporting to be; rather it focuses on verifying that the person exists’. The special problem is that the sort of person who might have access to an individual’s Verify credentials – an intimate family member – is likely to be at the top of the list of those with a motive for altering a will.

One solution might be to demand biometric proof of identity (fingerprints or iris scans for example) when signing electronically. Even here the commission is sceptical, citing reports that fingerprint and iris scan data have been stolen and forged. Moreover, it notes that once biometric data has been compromised, it cannot easily be made secure again: ‘A fingerprint cannot be reset in the same way a password can.’

Another way out might be to record wills on video. This is attractive as the testator is directly linked to the content and witnesses can be present. The snags are that wills are technical documents in which precise language is vital; fluffed lines might be challenged. There is the possibility that forgeries might be contrived with computer-generated imagery, the commission says, though observing that this is a risk ‘which is beyond our expertise to assess’.

If digital signatures are to find a place in the legal world – especially in areas as potentially life-changing as guilty pleas to criminal offences – consensus on their robustness is vital. This month’s announcements suggest that this consensus does not yet exist.

The Law Society’s practice note on execution of a document using an electronic signature is available.