Source: https://www.federalregister.gov/documents/2000/05/02/00-10801/procedures-and-guidance-implementation-of-the-government-paperwork-elimination-act
Timestamp: 2017-09-20 22:34:44
Document Index: 79296654

Matched Legal Cases: ['art 3', 'art 232', 'art 11', 'arts 2', 'art 552', 'art 101', 'art 18', 'art 1', 'art 1']

Federal Register :: Procedures and Guidance; Implementation of the Government Paperwork Elimination Act
A Notice by the Management and Budget Office on 05/02/2000
25508-25521 (14 pages)
00-10801
Section 2. What is an “electronic signature?”
Section 9. Summary of the procedures and checklist
https://www.federalregister.gov/d/00-10801 https://www.federalregister.gov/d/00-10801
The Office of Management and Budget (OMB) provides procedures and guidance to implement the Government Paperwork Elimination Act (GPEA). GPEA requires Federal agencies, by October 21, 2003, to allow individuals or entities that deal with the agencies the option to submit information or transact with the agency electronically, when practicable, and to maintain records electronically, when practicable. The Act specifically states that electronic records and their related electronic signatures are not to be denied legal effect, validity, or enforceability merely because they are in electronic form, and encourages Federal government use of a range of electronic signature alternatives.
Electronic Availability: This document is available on the Internet in the OMB library of the “Welcome to the White House” home page, http://www.whitehouse.gov/​OMB/​, the Federal CIO Council's home page, http:/Start Printed Page 25509/cio.gov/, and the Federal Public Key Infrastructure Steering Committee home page, http://gits-sec.treas.gov/​.
Jonathan Womer, Information Policy and Technology Branch, Office of Information and Regulatory Affairs, (202) 395-3785. Press inquiries should be addressed to the OMB Communications Office, (202) 395-7254. Inquiries may also be addressed to: Information Policy and Technology Branch, Office of Information and Regulatory Affairs, Office of Management and Budget, Room 10236 New Executive Office Building, Washington, D.C. 20503.
This document provides Executive agencies the guidance required under Sections 1703 and 1705 of the Government Paperwork Elimination Act (GPEA), Public Law 105-277, Title XVII, which was signed into law on October 21, 1998. GPEA is an important tool to improve customer service and governmental efficiency through the use of information technology. This improvement involves transacting business electronically with Federal agencies and widespread use of the Internet and its World Wide Web.
To provide for a broad framework for ensuring the implementation of electronic systems in a secure manner, the Administration has taken a number of actions. In February 1996, OMB revised Appendix III of Circular A-130, which provided guidance to agencies on securing information as they increasingly rely on open and interconnected electronic networks to conduct business. In May 1998, the President issued Presidential Decision Directive 63, which set a goal of a reliable, interconnected, and secure information system infrastructure by the year 2003, and significantly increased security for government systems by the year 2000 based on reviews by each department and agency. In September, 1998, OMB and the Federal Public Key Infrastructure Steering Committee published “Access With Trust” (available at http://gits-sec.treas.gov/​). This report describes the Federal government's goals and efforts to develop a Public Key Infrastructure (PKI) to enable the widespread use of cryptographically-based digital signatures. On December 17, 1999, the President issued a Memorandum, “Electronic Government,” which called on Federal agencies to use information technology to ensure that governmental services and information are easily accessible to the American people (Weekly Compilation of Presidential Documents, vol. 35, pp. 2641-43, (December 27, 1999); also available at http://cio.gov/​). Among other things, the President charged the Administrator of General Services, in coordination with agencies, to assist agencies in the development of private, secure and effective electronic communication across agencies and with the public through the use of public key technology. This technology can offer significant benefits in facilitating electronic commerce through a shared, interoperable, government-wide infrastructure.
GPEA seeks to “preclude agencies or courts from systematically treating electronic documents and signatures less favorably than their paper counterparts”, so that citizens can interact with the Federal government electronically (S. Rep. 105-335). It requires Federal agencies, by October 21, 2003, to provide individuals or entities that deal with agencies the option to submit information or transact with the agency electronically, and to maintain records electronically, when practicable. It also addresses the matter of private employers being able to use electronic means to store, and file with Federal agencies, information pertaining to their employees.
GPEA states that electronic records and their related electronic signatures are not to be denied legal effect, validity, or enforceability merely because they are in electronic form. It also encourages Federal government use of a range of electronic signature alternatives.
This guidance implements GPEA, fosters a successful transition to electronic government as contemplated by the President's memorandum, and employs where appropriate the work described in “Access with Trust.”
On March 5, 1999, OMB published the “Proposed Implementation of the Government Paperwork Elimination Act” for public comment. (64 FR 10896). It was also sent directly to Federal agencies for comment and made available via the Internet. In addition, OMB met with relevant committees and staff of many interested organizations including: American Bar Association (both the Business Law and the Science and Technology Sections); American Bankers Association; National Automated Clearing House Association; National Governors Association; National Association of State Information Resource Executives; National Association of State Auditors, Controllers and Treasurers; National Association of State Purchasing Officers; the Government of Canada; the Government of Australia; and relevant industry forums. All were uniformly positive about the content and tone of the guidance. OMB received specific comments from 24 organizations. Most comments proposed changes in clarity and detail. Where the comments added clarity and did not contradict the goals of the guidance, they were incorporated. The principal substantive issues raised in the comments and our responses to them are described below.
A number of comments, including those from the Justice Department and the General Accounting Office, requested that the guidance contain further information on how to conduct the assessments of practicability needed to determine the proper combination of technology and management controls to manage the risk of converting transactions and record keeping to Start Printed Page 25510electronic form, and then conducting transactions electronically. Each assessment should contain elements of risk analysis and measurements of other costs and benefits. Most comments on assessment referred to the risk analysis portion.
Risk analyses provide decisionmakers with information needed to understand the factors that can degrade or endanger operations and outcomes and to make informed judgments about what actions need to be taken to reduce risk. Consistent with the Computer Security Act (40 U.S.C. 759 note), Appendix III of OMB Circular No. A-130, “Security of Federal Automated Information Resources,” (34 FR 6428, February 20, 1996), Federal managers should design and implement their information technology systems in a manner that is commensurate with the risk and magnitude of harm from unauthorized use, disclosure, or modification of the information in those systems. To determine what constitutes adequate security, a risk-based assessment must consider all major risk factors, such as the value of the system or application, threats, vulnerabilities, and the effectiveness of current and proposed safeguards. Low-risk information processes may need only minimal consideration, while high-risk processes may need extensive analysis. OMB reiterated these principles on June 23, 1999, in OMB Memorandum No. 99-20, “Security of Federal Automated Information Resources,” and reminded agencies to continually assess the risk to their computer systems and maintain adequate security commensurate with that risk, particularly as they take increasing advantage of the internet and the world wide web in providing information and services to citizens. (Available at: http://cio.gov/​ and http://whitehouse.gov/​omb/​memoranda/​m-99-20.html).
The Commerce Department's National Institute of Standards and Technology (NIST) also recognizes the importance of conducting risk analyses for securing computer-based resources. NIST provides guidance on risk analysis (available at http://csrc.nist.gov/​nistpubs):
“Good Security Practices for Electronic Commerce, Including Electronic Data Interchange,” Special Publication 800-9 (December 1993);
“An Introduction to Computer Security: The NIST Handbook,” Special Publication 800-12 (December 1995);
“Generally Accepted Principles and Practices for Securing Information Technology Systems,” Special Publication 800-14 (September 1996); and
“Guide for Developing Security Plans for Information Technology Systems,” Special Publication 800-18 (December 1998).
More recently, the General Accounting Office published “Information Security Risk Assessment: Practices of Leading Organizations,” GAO/AIMD-00-33 (November 1999) (Available at http://www.gao.gov/​). This document is intended to help Federal managers implement an ongoing information security risk analysis process by suggesting practical procedures that have been successfully adopted by organizations known for their good risk analysis practices. This document describes various models and methods for analyzing risk, and identifies factors that are important in a risk analysis.
Other commenters wanted more guidance on how to weigh the risk analysis with other costs and benefits. In combination with the risk analysis, the results of a cost-benefit analysis should be used to judge the practicability of such a process transformation. All major information technology investments are evaluated under the Appendices of OMB Circular No. A-130, “Management of Federal Information Resources” and Part 3 of OMB Circular No. A-11 “Planning, Budgeting, and Acquisition of Capital Assets.” Specific guidance on information technology cost-benefit analysis is available from the Capital Planning and IT Investment Committee of the Federal CIO Council in the recently published “ROI and the Value Puzzle.” (Available at: http://cio.gov/​). When developing collections of information under the Paperwork Reduction Act, agencies currently address the practicality of electronic submission, maintenance, and disclosure. The GPEA guidance builds on the requirements and scope of the PRA; all transactions that involve Federal information collections covered under the PRA are also covered under GPEA. In addition, agencies should follow OMB Memorandum 00-07 “Incorporating and Funding Security in Information Systems Investments”, issued February 28, 2000, which provides information on building security into information technology investments (also available at: http://cio.gov/​).
The Department of Justice commented on the need for each agency to consider the broad range of legal risks involved in electronic transactions. Justice's comments are especially appropriate for particularly sensitive transactions, including those likely to give rise to civil or criminal enforcement proceedings and we expect them to be further developed in Juctice's forthcoming practical guidance. The risk analysis process required by the Computer Security Act and by good practice must be tailored to the risks and related mitigation costs that pertain to each system, as understood by the Federal managers most knowledgeable with the systems. When evaluating legal risks, Federal managers should consult with their legal counsel about any specific legal implications due to the use of electronic transactions or documents in the application in question. Agencies should also keep in mind that GPEA specifically states that electronic records and their related electronic signatures are not to be denied legal effect, validity, or enforceability merely because they are in electronic form. We are not, therefore, prescribing specific “one size fits all” requirements applicable to transactions regardless of sensitivity.
In light of all the above comments, we have added greater detail to the practicability aspects of the guidance, and an expanded discussion of cost-benefit analysis and its relation to risk analysis. We have also placed additional emphasis on the need for risk analyses to identify and address the full range of risks, including reasonably expected legal and enforcement risks, and technological risks. Further, we included a reporting mechanism in Part I Section 3 to facilitate the assessment of practicability. Although many of the comments concern the costs and risks of changing to electronic transactions, it is also important to consider the full range of benefits that electronic transactions can provide. Possible benefits include: increased partner participation and customer satisfaction; reduced Start Printed Page 25511transaction costs and increased transaction speed; improved record keeping and new opportunities for analysis of information; and greater employee productivity and enhanced quality of their output. An agency's consideration of risks needs to be balanced with a full consideration of benefits.
Some commenters were concerned with the privacy implications of the guidance. They want to ensure that any move to electronic transactions does not encourage the gathering of unnecessary information, and that Federal agencies adequately protect the personal information that does need to be collected. We agree that agencies must incorporate privacy protections when developing electronic processes. Several helpful suggestions were made that have been incorporated into the final guidance. With respect to a commenters' concern that agencies not collect unnecessary information, the Privacy Act requires an agency to “maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency.” 5 U.S.C. 552a(e)(1); see e.g. Reuber v. United States, 829 F. 2d 133, 138-40 (D.C.C. 1987). Furthermore, the collection by agencies of unnecessary information would be contrary to the Paperwork Reduction Act's mandate that agencies collect only information that is “necessary for the proper performance of the functions of the agency” and “has practical utility.” 44 U.S.C. 3508.
This document provides Executive agencies with the guidance required under Sections 1703 and 1705 the Government Paperwork Elimination Act (GPEA), Public Law 105-277, Title XVII.
GPEA requires agencies, by October 21, 2003, to provide for the (1) option of electronic maintenance, submission, or disclosure of information, when practicable as a substitute for paper; and (2) use and acceptance of electronic signatures, when practicable. GPEA specifically states that electronic records and their related electronic signatures are not to be denied legal effect, validity, or enforceability merely because they are in electronic form.
GPEA is an important tool in fulfilling the vision of improved customer service and governmental efficiency through the use of information technology. This vision contemplates widespread use of the Internet and its World Wide Web, with Federal agencies transacting business electronically as commercial enterprises are doing. Members of the public who wish to do business this way may avoid traveling to government offices, waiting in line, or mailing paper forms. The Federal government can also save time and money transacting business electronically. Start Printed Page 25512
This guidance also implements part of the President's memorandum of December 17, 1999, “Electronic Government,” which calls on Federal agencies to use information technology in ensuring that governmental services and information are easily accessible to the American people. Among other things, the President charged the Administrator of General Services, in coordination with appropriate agencies and organizations, to assist agencies in developing private, secure, and effective communication across agencies and with the public through the use of digital signature technology.
Creating more accessible and efficient government requires public confidence in the security of the government's electronic information communication and information technology systems.
Electronic commerce, electronic mail, and electronic benefits transfer can involve the exchange of sensitive information within government, between government and private industry or individuals, and among governments. Electronic systems must be able to protect the confidentially of citizens' information, authenticate the identity of the transacting parties to the degree required by the transaction, guarantee that the information is not altered in an unauthorized way, and provide access when needed.
To reach these goals, agencies must meet objectives outlined by GPEA guidance. First, each agency must build on their existing efforts to implement electronic government by developing a plan and schedule that implement, by the end of Fiscal Year 2003, optional electronic maintenance, submission, or transactions of information, when practicable as a substitute for paper, including through the use of electronic signatures when practicable.
Agencies must submit a copy of the plan to OMB by October 2000 and coordinate the plan and schedule with their strategic IT planning activities that support program responsibilities consistent with the budget process (as required by OMB Circular A-11).
b. Performing the assessment to evaluate electronic signature alternatives should not be viewed as an isolated activity or an end in itself. Agencies should draw from and feed Start Printed Page 25513into the interrelated requirements of the Paperwork Reduction Act, the Privacy Act, the Computer Security Act, the Government Performance and Results Act, the Clinger-Cohen Act, the Federal Managers' Financial Integrity Act, the Federal Records Act, and the Chief Financial Officers Act, as well as OMB Circular A-130 and Presidential Decision Directive 63.
(5) Ensure that measures taken under the plan reflect appropriate information system confidentiality and security in accordance with the Privacy Act, the Computer Security Act, as amended, and the guidance contained in OMB Circular A-130, Appendices I and III; and ensure that these measures use, to the maximum extent practicable, technologies that are either prescribed in Federal Information Processing Standards promulgated by the Secretary of Commerce or are supported by voluntary consensus standards as defined in OMB Circular A-119, “Federal Participation in the Development and Use of Voluntary Consensus Standards and Conformity Assessment Activities,” (63 FR 8546; February 19, 1998).
The National Archives and Records Administration must develop, in consultation with the agencies and OMB, policies and guidance on the management, preservation, and disposal of Federal records associated with electronic government transactions, and Start Printed Page 25514must give particular consideration to records issues associated with the use of electronic signature technologies.
The guidance builds on the requirements and scope of the Paperwork Reduction Act of 1995 (PRA). According to the PRA agencies must, “consistent with the Computer Security Act of 1987 (CSA) (40 U.S.C. 759 note), identify and afford security protections commensurate with the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of information collected or maintained by or on behalf of an agency.” 44 U.S.C. 3506(g)(3). In addition, we note that all transactions that involve Federal information collections covered under the PRA are also covered under GPEA.
(1) so-called “shared secrets” methods (e.g., personal identification numbers or passwords),
a. GPEA defines “electronic signature” as follows:
“* * * a method of signing an electronic message that—
(B) indicates such person's approval of the information contained in the electronic message.” (GPEA, section 1709(1)).
This definition is consistent with other accepted legal definitions of signature. The term “signature” has long been understood as including “any symbol executed or adopted by a party with present intention to authenticate a writing.” (Uniform Commercial Code, 1-201(39)(1970)). The “Uniform Electronic Transactions Act,” recently adopted by the National Conference of Commissioners of Uniform State Laws, and which is being enacted by the States, contains a similar definition (see http://www.nccusl.org). These flexible definitions permit the use of different electronic signature technologies, such as digital signatures, personal identifying numbers, and biometrics (section 7 provides more detail on electronic signature technologies). While it is the case that, for historical reasons, the Federal Rules of Evidence are tailored to support the admissibility of paper-based evidence, the Federal Rules of Evidence have no actual bias against electronic evidence.
“Electronic records submitted or maintained in accordance with procedures developed under this title, or electronic signatures or other forms of electronic authentication used in accordance with such procedures, must not be denied legal effect, validity, or enforceability because such records are in electronic form” (GPEA, section 1707).
To evaluate the suitability of electronic signature alternatives for a particular application, the agency needs to perform an assessment. The assessment should include a risk analysis, in cases where the sensitivity of the transaction is sufficiently great, and a cost-benefit analysis. The assessment identifies the particular technologies and management controls best suited to minimizing the risk and cost to acceptable levels, while maximizing the benefits to the parties involved. Often parts of the assessment can be quantified, but some factors—particularly the risk analysis usually can only be estimated qualitatively.
Reliable data on likelihood and costs may not be available. In this case a qualitative approach can be taken by defining risk in more subjective and general terms such as high, medium, and low. In this regard, qualitative analyses depend more on the expertise, experience, and good judgment of the Start Printed Page 25515Federal managers conducting them than on quantified factors.
c. Document the decision. The Computer Security Act gives agency managers the responsibility to select an appropriate combination of technologies, practices, and management controls to minimize risk cost-effectively while maximizing benefits to all parties to the transaction. Agency managers should document these decisions, however qualitative, in the system security plan (see the NIST “Guide for Developing Security Plans for Information Technology Systems,” Special Publication 800-18 (December 1998)) for later review and adjustment.
(2) Increased partner participation and customer satisfaction. Often a decrease in partner transaction costs leads to more partners completing the transaction. In addition, partners tend to Start Printed Page 25516have a more positive view of the process given its speed and ease of use.
Properly implemented electronic signature technologies can offer degrees of confidence in authenticating identity that are greater than a handwritten signature can offer. These digital tools should be used to control risks in a cost-effective manner. In determining whether an electronic signature is sufficiently reliable for a particular purpose, agency risk analyses need at a minimum to consider the relationships between the parties, the value of the transaction, the risk of intrusion, and the likely need for accessible, persuasive information regarding the transaction at some later date. In addition, agencies should consider any other risks relevant to the particular process. Once these factors are considered separately, an agency should consider them together to evaluate the sensitivity to risk of a particular process, relative to the benefit that the process can bring. Start Printed Page 25517
Risks tend to be relatively low in cases where there is an ongoing relationship between the parties. Generally speaking, there will be little risk of a partner later repudiating inter-or intra-governmental transactions of a relatively routine nature, and almost no risk of the governmental trading partner committing fraud. Similarly, transactions between a regulatory agency and a publicly traded corporation or other known entity regulated by that agency can often bear a relatively low risk of repudiation or fraud, particularly where the regulatory agency has an ongoing relationship with, and enforcement authority over, the entity. For the same reasons, risks tend to be relatively low within rulemaking contexts, as all parties can view the submissions of others so the risk of imposture is minimized. Other types of transactions, involving an ongoing relationship between an agency and non-governmental entities and persons, can have varying degrees of risk depending on the nature of the relationship between the parties; the same would apply in the case of those Federal programs in which the ongoing relationship is between entities that are acting (and collecting information under the PRA) on behalf of an agency and such non-governmental entities and persons—e.g., transactions between a lender, guaranty agency, or other institution participating in a Federal loan or financial aid program and another program participant or a member of the general public, such as a borrower or grant recipient. On the other hand, the highest risk of fraud or repudiation is for a one-time transaction between a person and an agency that has legal or financial implications. Agencies should also pay attention to transactions with non-Federal entities, where the agency has a law enforcement responsibility but does not have an ongoing relationship. Transactions between a Federal agency and a foreign entity may entail unique legal risks due to varying national laws and regulations. In all cases, the relative value of the transaction needs to be considered as well.
Section 1708 of GPEA limits the use of information collected in electronic signature services to communications with a Federal agency. It directs Start Printed Page 25518agencies and their staff and contractors not to use such information for any purpose other than for facilitating the communication. Exceptions exist if the person (or entity) that is the subject of the information provides affirmative consent to the additional use of the information, or if such additional use is otherwise provided by law. Accordingly, agencies should follow several privacy principles:
b. When electronic signatures are required for a transaction, agencies should not collect more information from the user than is required for the application of the electronic signature. When appropriate, agencies are encouraged to use methods of electronic signing that do not require individuals to disclose their identity. This includes the ability of individuals in a group to be identified by a group identifier rather than an individual identifier if the only information needed to authenticate is the fact that the individual is a member of the group.
Questions regarding the following should be directed to the Department of Commerce. This section addresses two categories of security: (1) Non-cryptographic methods of authenticating identity; and (2) cryptographic control methods. The non-cryptographic approach relies solely on an identification and authentication mechanism that must be linked to a specific software platform for each application. Cryptographic controls may be used for multiple applications, if properly managed, and may encompass both authentication and encryption services. A highly secure implementation may combine both categories of technologies. The spectrum of electronic signature technologies currently available is described below.
a. Non-Cryptographic Methods of Authenticating Identity. (1) Personal Identification Number (PIN) or password: A user accessing an agency's electronic application is requested to enter a “shared secret” (called “shared” because it is known both to the user and to the system), such as a password or PIN. When the user of a system enters her name, she also enters a password or PIN. The system checks that password or PIN against data in a database to ensure its correctness and thereby “authenticates” the user. If the authentication process is performed over an open network such as the Internet, it is usually essential that at least the shared secret be encrypted. This task can be accomplished by using a technology called Secure Sockets Layer (SSL), which uses a combination of public key technology and symmetric cryptography to automatically encrypt information as it is sent over the Internet by the user and decrypt it before it is read by the intended recipient. SSL currently is built into almost all popular Web browsers, in such a fashion that its use is transparent to the end user. Assuming the password is protected during transmission, as described above, impersonating the user requires obtaining the user's password. This may be relatively easy if users do not follow appropriate guidelines for password creation and use. Agencies should establish adequate guidelines for password creation and protection.
(2) Smart Card: A smart card is a plastic card the size of a credit card containing an embedded integrated circuit or “chip” that can generate, store, and/or process data. It can be used to facilitate various authentication technologies also embedded on the same card. By having different authentication choices the user can pick the authentication technique that meets but does not exceed the information requirement for the transaction. A user inserts the smart card into a card reader device attached to a computer or network input device. Information from the card's chip is provided to the computer only when the user also enters a PIN, password, or biometric identifier recognized by the card. Thus, the user authenticates to the card, making available electronic credentials which can then be used by the computer or network to strongly authenticate the user for transactions. This method offers far greater security than the typical use of a PIN or password, because the shared secret is between the user and the card, not with a remote server or network device. Moreover, to impersonate the user requires possession of the card as well as knowledge of the shared secret that activates the electronic credentials on the card. Thus, proper security requires that the card and the PIN or password used to activate it be kept separate. This is not a concern if a biometric is used for the latter purpose.
(3) Digitized Signature: A digitized signature is a graphical image of a handwritten signature. Some applications require an individual to create his or her hand-written signature using a special computer input device, such as a digital pen and pad. The digitized representation of the entered signature may then be compared to a previously-stored copy of a digitized image of the handwritten signature. If special software judges both images comparable, the signature is considered valid. This application of technology shares the same security issues as those using the PIN or password approach, because the digitized signature is another form of shared secret known both to the user and to the system. The digitized signature can be more reliable for authentication than a password or PIN because there is a biometric component to the creation of the image of the handwritten signature. Forging a digitized signature can be more difficult than forging a paper signature since the technology digitally compares the submitted signature image with the known signature image, and is better than the human eye at making such comparisons. The biometric elements of a digitized signature, which help make it unique, are in measuring how each stroke is made—duration, pen pressure, etc. As with all shared secret techniques, compromise of a digitized signature image or characteristics file Start Printed Page 25519could pose a security (impersonation) risk to users.
b. Cryptographic Control. Creating electronic signatures may involve the use of cryptography in two ways: symmetric (or shared private key) cryptography, or asymmetric (public key/private key) cryptography. The latter is used in producing digital signatures, discussed further below.
(2) Public/Private Key (Asymmetric) Cryptography—Digital Signatures
(a) To produce a digital signature, a user has his or her computer generate two mathematically linked keys—a private signing key that is kept private, and a public validation key that is available to the public. The private key cannot be deduced from the public key. In practice, the public key is made part of a “digital certificate,” which is a specialized electronic file digitally signed by the issuer of the certificate, binding the identity of the individual to his or her private key in an unalterable fashion. The whole system that implements digital signatures and allows them to be used with specific programs to offer secure communications is called a Public Key Infrastructure, or PKI.
(b) A “digital signature” is created when the owner of a private signing key uses that key to create a unique mark (the signature) on an electronic document or file. The recipient employs the owner's public key to validate that the signature was generated with the associated private key. This process also verifies that the document was not altered. Since the public and private keys are mathematically linked, the pair is unique: only the public key can validate signatures made using the corresponding private key. If the private key has been properly protected from compromise or loss, the signature is unique to the individual who owns it, that is, the owner cannot repudiate the signature. In relatively high-risk transactions, there is always a concern that the user will claim someone else made the transaction. With public key technology, this concern can be mitigated. To claim he did not make the transaction, the user would have to feign loss of the private key. By creating and holding the private key on a smart card or an equivalent device, and by using a biometric mechanism (rather than a PIN or password) as the shared secret between the user and the smart card for unlocking the private key to create a signature this concern can be mitigated. In other words, combining two or three distinct electronic signature technology approaches in a single implementation can enhance the security of the interaction and lower the potential for fraud to almost zero. Furthermore, by establishing clear procedures for a particular implementation of digital signature technology, so that all parties know what the obligations, risks, and consequences are, agencies can also strengthen the effectiveness of a digital signature solution.
The reliability of the digital signature is directly proportional to the degree of confidence one has in the link between the owner's identity and the digital certificate, how well the owner has protected the private key from compromise or loss, and the cryptographic strength of the methodology used to generate the public-private key pair. The cryptographic strength is affected by key length and by the characteristics of the algorithm used to encrypt the information. Further information on digital signatures can be found in “Access with Trust” (September 1998) (http://gits-sec.treas.gov/​).
c. Technical Considerations of the Various Electronic Signature Alternatives. (1) To be effective, each of these methods requires agencies to develop a series of policy documents that provide the important underlying framework of trust for electronic transactions and which facilitate the evaluation of risk. The framework identifies how well the user's identity is bound to his authenticator (e.g., his password, fingerprint, or private key). By considering the strength of this binding, the strength of the mechanism itself, and the sensitivity of the transaction, an agency can determine if the level of risk is acceptable. If an agency has experience with the technology, existing policies and documents may be available for use as guidance. Where the technology is new to an agency, this may require additional effort.
(2) While digital signatures (i.e. public key/private key) are generally the most certain method for assuring identity electronically, the policy documents must be established carefully to achieve the desired strength of binding. The framework must identify how well the signer's identity is bound to his or her public key in a digital certificate (identity proofing). The strength of this binding depends on the assumption that only the owner has sole possession of the unique private key used to make signatures that are validated with the public key. The strength of this binding Start Printed Page 25520also reflects whether the private key is placed on a highly secure hardware token, such as a smart card, or is encapsulated in software only; and how difficult it is for a malefactor to deduce the private key using cryptographic methods (which depends upon the key length and the cryptographic strength of the key-generating algorithm).
(1) Securities and Exchange Commission (17 C.F.R. Part 232), electronic regulatory filings;
(2) Environmental Protection Agency (55 FR 31,030 (1990)), policy on electronic reporting;
(3) Food and Drug Administration (21 C.F.R. Part 11), electronic signatures and records;
(4) Internal Revenue Service (Treasury Reg. 301.6061-1), signature alternatives for tax filings;
(5) Federal Acquisition Regulation (48 C.F.R. Parts 2 and 4), electronic contracts;
(6) General Services Acquisition Regulation (48 C.F.R. Part 552.216-73), electronic orders;
(7) Federal Property Management Regulations (41 C.F.R. Part 101-41), electronic bills of lading.
(8) Administrative Committee of the Federal Register (1 C.F.R. Part 18.7), electronic signatures on documents submitted for publication in the Federal Register.
(9) Commodity Futures Trading Commission (17 C.F.R. Part 1.4 and Part 1.3(tt)), electronic signatures for filings.
When specifying the requirements for electronic record keeping by regulated entities or government business partners (e.g. contractors or grantees), particularly the maintenance of electronic forms pertaining to employees by employers, agencies should consult the “Performance Guideline for the Legal Acceptance of Records Produced by Information Technology Systems,” developed by the Association for Information and Image Management (ANSI/AIIM TR31). This set of documents offers suggestions for maximizing the likelihood that electronically filed and stored records will be accorded full legal recognition. If an agency chooses to use digital signature technology, a regulation might specify that each individual will be issued a unique digital signature certificate to use, agree to keep the private key confidential, agree to accept responsibility for anything that is submitted using that key, or accept other conditions under which the agency will accept electronic submissions.
b. Where necessary, use a mutually understood, signed agreement between the person or entity submitting the electronically-signed information and the receiving Federal agency. As a matter of efficiency, arrangements with large numbers of customers may be best accomplished by setting forth an agency's terms and conditions in a policy or regulation. Arrangements with smaller numbers of customers may lend themselves to one or more agreements, using a document referred to as a “terms and conditions” agreement. These agreements can ensure that all conditions of submission and receipt of data electronically are known and understood by the submitting parties. This is particularly the case where terms and conditions are not spelled out in agency programmatic regulations.
c. Minimize the likelihood of repudiation. Agencies should develop well-documented mechanisms and procedures to tie transactions to an individual in a legally binding way. For example, the integrity of even the most secure digital signature rests on the continuing confidentiality of the private key, so instituting procedures for ensuring the confidentiality of the private key would be in an agency's interest. Similarly, in the case of electronic signatures based on the use of shared secrets like PINs or passwords, the integrity of the transaction depends on the user not disclosing the shared secret, so an agency should have Start Printed Page 25521procedures for encouraging the maintenance of the PIN's integrity. If a defendant is later charged with a crime based on an electronically signed document, he or she would have every incentive to show a lack of control over (or loss of) the private key or PIN, or in the case of a PIN, that the government failed to protect the PIN on its computer system. Indeed, if that defendant plans to commit fraud, he or she may intentionally compromise the secrecy of the key or PIN, so that the government would later have a more difficult time uniquely linking him or her to the electronic transaction. Promulgating policies and procedures that ensure the integrity of security tools helps counter such fraudulent attempts.
e. Ensure the “Chain of Custody.” Electronic audit trails must provide a chain of custody for the secure electronic transaction that identifies sending location, sending entity, date and time stamp of receipt, and other measures used to ensure the integrity of the document. These trails must be sufficiently complete and reliable to validate the integrity of the transaction and to prove, (a) that the connection between the submitter and the receiving agency has not been tampered with, and (b) how the document was controlled upon receipt.
i. Determine if regulations or policies are adequate to support electronic transactions and record keeping, or if “terms and conditions” agreements are needed for the particular application. If new regulations or policies are necessary, disseminate them as appropriate.
[FR Doc. 00-10801 Filed 5-1-00; 8:45 am]