Date:  Fri, 18 Dec 92 08:22 EST
From:  WHMurray@dockmaster.ncsc.mil
Newsgroups: comp.society.privacy
Subject:  Signatures
Organization: Computer Privacy Digest
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 115, Message 7 of 9


>Why is this new gadget any more dangerous than the status quo? Anyone
>can digitize a signature from paper using your average image scanner.
>
>-Chris
>
>--
>==================
>Chris Volpe 

Well, first, this is the status quo.  Technology determines
practice, not the other way around.  Second, what one should 
learn from it is the limitations of signatures before it was 
easy to digitize them.

From David Bowman:

>   It seems to me that if you are worried about your signature being
>digitized and used for other purposes then you cannot sign *anything*
>because all it takes is a scanner to get it from a paper version of
>your signature.

Signatures have served us very well, but only for a couple of
hundred years.  Three factors have contributed to this.

First, for most of us, it is very difficult for us to disown 
our legitimate signature.  It is so obvious to us that the 
signature is ours that we believe that it is equally obvious to
others.  However, if you think about it, while you are expert
at your own signature, you, and almost everyone else, are lousy
at anyone elses.

Second, although few of us ever see one, we are equally expert 
at recognizing forgeries of our own signatures.  The law provides
us with an easy way to disown these.  We simply assert that
a particular instance of the signature is a forgery.  For example,
if someone were to forge your signature to a check, you could
simply go to your bank, assert that the signature  is not yours,
sign an affidavit to that affect, and the bank will take the
check back and credit your account.  They will do this even if
they really believe that the signature is valid, since all they
are going to do is return the check, for credit,  to the party 
from whom they got it.  

Of course, this only works for routine transactions.  It will
not work for real property transactions or for wills, affidavits,
or testaments.  For these, the signatures of multiple witnesses
and a notary public are required.  These parties attest that
they watched you sign the document and this makes it more
difficult to disown.  Note that the notary public is commisioned
by the state particularly for this purpose.  

Finally, while easy to forge in ideal circumstances, signatures
are very difficult to forge in real time, under scrutiny.  Thus,
if I ask you to sign or endorse your check in front of me, and
if it is not obviously different from the one on your driving
license, and if you wrote normally and did not draw, then I can 
have a high degree of confidence in it.  If I do not see you 
sign it, if I could not testify in court that I saw you sign it,
then the signature has far less value. 

The UPS case demonstrates this.  Note that UPS has no reference
of your signature against which to compare the instance that
you provide.  It is good evidence only because the driver can
testify that he saw you put it in.  While it could be helpful,
in the same manner as any other digital or analog record of your
signature, in perpetrating a fraud, it is far from sufficient
for doing so.

Signatures are only evidence, they are not proof.  They work 
because they are rarely disowned.  While, the cases in which 
they are disowned make interesting reading, they are exceptions.  
In most litigation, the legitimacy of the documents is 
stipulated.  It is their meaning that is in dispute.  

Rational discussion of signatures is difficult because in our
culture they are emotionally associated with identity.  For
our purposes it is sufficient to understand their limits and
to understand that in the presence of high quality recording and
reproduction equipment, they are likely to be even more limited.

William Hugh Murray, Executive Consultant, Information System Security
49 Locust Avenue, Suite 104; New Canaan, Connecticut 06840                
1-0-ATT-0-700-WMURRAY; WHMurray at DOCKMASTER.NCSC.MIL