A PRIMER ON THE USE
OF DIGITAL SIGNATURES AND ELECTRONIC SIGNATURES
In light of the unprecedented Covid-19 outbreak declared a pandemic by the World Health Organization (WHO), our Malaysia Prime Minister has enforced Movement Control Order (MCO) on 18th March 2020 and the movement control measures are being progressively relaxed but with strict Standard Operating Procedure (SOP) being imposed to curb the spread of Covid-19. Since the world has yet to find a vaccine or cure for the virus, it is uncertain as to how long more the Conditional Movement Control Order will be in place where in the meantime interstate travel is prohibited and social distancing becomes a norm.
In a world of social distancing becoming a norm and with the advancement of technology prompt us to explore the utilisation of alternative form of document signing via electronic means, i.e. the usage of electronic signatures or digital signatures.
Legal Validity of Electronic/Digital Signatures
A signature is simply a way of providing evidence that a person agreed to be bound by the terms of a document or contract. It is clear under the Malaysian Law that a physical wet-ink written signature is not always necessary for a document to be binding. The majority of day-to-day contracts can be created electronically. Digital Signatures have been legally recognized as a valid form of signing documents since the enactment of the Digital Signature Act 1997 (‘DSA’) in 1997 (ss.62 & 64 of the DSA). The Electronic Commerce Act 2006 (‘ECA’) was then enacted in 2006 to recognize the legality of electronic signatures for signing documents (s.9 of the ECA). Legal recognition of electronic contract made with the Government executed via Electronic Signatures can be found in the Electronic Government Activities Act 2007 (‘EGAA’). The effect of the introduction of DSA, ECA and EGAA is that Digital Signatures and Electronic Signatures cannot be denied legal effect and admissibility solely on the ground that they are in electronic form.
1
Are Electronic Signatures and Digital Signatures the same thing?
2
Yes and no. ‘Digital Signatures’ and ‘Electronic Signatures’ are terms that are often used by many interchangeably, nonetheless, their concepts and meanings differ significantly. A Digital Signature is a type of Electronic Signature, but not every Electronic Signature is a Digital Signature. In other words, Digital Signatures are a subset of Electronic Signatures.
What is a Digital Signature?
3
A Digital Signature is defined in s.2 of the DSA as “a transformation of a message using an asymmetric cryptosystem such that a person having the initial message and the signer's public key can accurately determine-
(a) whether the transformation was created using the private key that corresponds to the signer's public key; and
(b) whether the message has been altered since the transformation was made.”
S.62 of the DSA stipulates that:
(1)
“Where a rule of law requires a signature provides for certain consequences in the absence of a signature, that rule shall be satisfied by a digital signature where:-
(a)
that digital signature is verified by reference to the public key listed in a valid certificate issued by a licensed certification authority;
(b) that digital signature was affixed by the signer with the intention of signing the message; and
(c) the recipient has no knowledge or notice that the signer-
(i) has breached a duty as a subscriber; or
(ii) does not rightfully hold the private key used to affix the digital signature.
(2) Notwithstanding any written law to the contrary-
a document signed with a digital signature in accordance with this Act shall be as legally binding as a document signed with a handwritten signature, an affixed thumb-print or any other mark; and
(a)
(b) a digital signature created in accordance with this Act shall be deemed to be a legally binding signature
(3) Nothing in this Act shall preclude any symbol from being valid as a signature under any other applicable law.”
In other words, Digital Signatures use certificate-based digital IDs (similar in concept to our identity card, driving license or passport), which is created by way of using the Public Key Infrastructure (PKI) technology. The signer is required to have a digital certificate so that he can be linked to the document. A digital certificate is a computer-based record which identifies the certification authority issuing it, names or identifies of its subscriber, contains the subscriber’s public key and is digitally signed by the certification authority issuing it. It is used to validate the document to ascertain its authenticity, thus proving that the document has not been forged. This plays a pivotal role in verifying the identity of the original person with the signature. The other key feature of a Digital Signature is that it is used to secure digital documents. There are people who seek to temper with digital documents obtained online but with a digital signature, this is made impossible. The document is secured and can only be accessed by the authorized person for any alterations or amendments.
PKI involves two keys being generated, one private key and one public key. With a digital certificate, the certificate itself acts as the identifier, authenticating the identity of the entity that owns that private key. The private key is what actually performs the cryptographic functions that the certificate is intended for. Each private key is unique, and each key has its own signature. The private key is confidential and is kept by a subscriber, while the public key can be distributed openly to any person. The public key verifies or ‘decrypts’ the digital signature that the private key creates. This process of using a key pair ensures the identity of the signer of the message is authentic and that the content of the message is secure and valid.
Further, each signature/signer is bound to the document with encryption which demonstrates proof of signing and such validation can only be done through licensed certification authorities that are responsible for issuing digital certificates. There are currently only (4) licensed certificate authorities approved by the Malaysian Communications and Multimedia Commission (MCMC) to issue legally binding digital certificates. They are namely:-
(1) Pos Digicert Sdn Bhd (457608-K)
(2) MSC Trustgate.Com Sdn Bhd (478231-X)
(3) Telekom Applied Business Sdn Bhd (455343-U)
(4) Raffcomm Technologies Sdn Bhd (1000449-W)
The effect of the DSA [s.62(2)(a)] is that a document signed with a Digital Signature in accordance with the above conditions is legally binding as a document signed with a handwritten signature or an affixed thumb-print or any other mark. We are of the view that a digital document executed using Digital Signatures is more secured than a traditionally signed hard-copy document.
What is an Electronic Signature?
4
An Electronic Signature is broadly defined under s.5 of the ECA as “any letter, character, number, sound or any other symbol or any combination thereof created in an electronic form adopted by a person as a signature.”
ECA provides a statutory framework for the admissibility of Electronic Signatures in Malaysia. S.9(1) of the ECA clarifies that where any law requires a signature of a person on a document, the requirement of the law is fulfilled, if the document is in the form of an electronic message, by an electronic signature which:
Association
(a) is attached to or is logically associated with the electronic message.
Adequate identification
adequately identifies the person and adequately indicates the person's approval of the information to which the signature relates.
As reliable as is appropriate
is as reliable as is appropriate given the purpose for which, and the circumstances in which, the signature is required.
(b)
(c)
In the case of Yam Kong Seng & Anor v Yee Weng Kai [2014] 4 MLJ 478; [2014] 6 CLJ 285, the Federal Court held that identification of the signer is not a difficult threshold to meet. The traditional function of a signature is to give evidence of identity and to have the signer bound by the signed document. In that case, a simple short message service (SMS) communication was held to fulfil the legal requirement for a signature, as the sender was adequately identified by the telephone number representing the sender of the message.
In view of the above provisions, no special computer programme or software is necessary for this kind of signature. A simple statement of the signatory’s name at the end of an email or a JPG image of his or her hand-written signature attached to a PDF document will suffice as a form of Electronic Signature.
Generally, the precise form of Electronic Signature used is not critical, being able to prove who signed and that they had an authenticating intention is more important.
5
Comparison table between Digital Signature and Electronic Signature
Digital Signature
Electronic Signature
Purpose
Use to secure documents and files so they cannot be altered by those without authorisation.
Use to verify documents. The source of the documents and its authors are also identified.
Regulation
Digital Signature Act 1997
Electronic Commerce Act 2006
Security
Protects signed documents and files from unauthorised tampering.
Not as secured. But its security can be improved by utilising a third party document processing platform.
Types of Signature
More complex and process-based. Different signature schemes based on the document processing platforms like Adobe Reader/Acrobat and Microsoft.
Any letter, character, number, sound or any other symbol or any combination thereof. But can be utilised through a third party document processing platform.
Authenticity
Each signer has its own unique digital certificate which offers higher authenticity.
Easy to use but less authentic.
Authorisation
A Digital Signature is authorized and regulated by a certification authority.
Does not require third party authorization.
Verification
Can be easily verified by tracing its digital certificates (i.e. private key) that is known only by the persons allowed to access the document to sign it. This private key corresponds only to a public key held by the creator of the document, which allows them to determine the legitimacy of the Digital Signature and to track any changes made in the document.
More complicated to verify authenticity as the signature is not certified. Verification involves tracing the owner of email address, Internet Protocol address (IP address) etc.
Pros
-
Identity – Each signer has his own unique digital certificate which asserts his identity and prevent him from being impersonated.
-
Authenticity – Any unauthorized modifications to a signed documents will immediately be evident.
-
Strong Validation – Licensed Certificate Authorities are obligated to perform their due diligence to validate the identity of the subscriber, which means others can be sure the signer is who he says he is.
-
Time Stamping – Digital Signatures include a timestamp that indicates when the signature was created.
-
Two-Factor Authentication – An additional layer of security comes in the form of passwords, PIN numbers and other credentials that are required at the time of signing.
-
Validity & Enforceability – s.6 of the ECA specifically recognises that contracts cannot be denied enforceability merely because they are concluded electronically.
-
Easy to use – the definition of the form of Electronic Signature is broad.
-
Cheaper and more practical option with the usage of secured commercial e-signing platforms which offer additional security and authenticity checks for simple Electronic Signature. Each signer is not required to subscribe to the platform to place his Electronic Signature.
Cons
-
The availability of Digital Signatures are limited and currently can only purchase digital certificate from the four (4) licenced certification authority.
-
More expensive, as each signer must own a digital certificate. Subscription is on annual or 2 yearly basis, depending on the issuer and the software employed.
-
Impractical and costly for persons who only use Digital Signature infrequently.
- Less secure since it is not comprised of security features that can be used to secure it from being tampered with by other people without permission.
- Need additional verification process to confirm that the person who electronically signed the document is the owner of the signature.
6
Documents which can be executed using Electronic Signature
Document Type
Commentary
Any commercial transactions or contracts
Section 2(1) of the ECA stipulates that this Act shall apply to any commercial transaction conducted through electronic means including commercial transactions by the Federal and State Governments.
Section 5 of the ECA defined “commercial transactions” as “a single communication or multiple communications of a commercial nature, whether contractual or not, which include any matters relating to the supply or exchange of goods or services, agency, investments, financing, banking and insurance.”
In the absence of any statutory requirement, there is no need under Malaysian Law for contracts to be in any particular form, in fact they can be entered into orally or by an exchange of emails, provided the essential elements of a contract are present, i.e. there is offer and acceptance, consideration, certainty of terms and an intention to be legally bound. S.7(1) of the ECA states that these essential contract formation elements may be expressed by an electronic message. Therefore, a simple contract may be concluded using an electronic signature.
Statutory requirement to be in writing
s.8 of the ECA states:
“Where any law requires information to be in writing, the requirement of the law is fulfilled if the information is contained in an electronic message that is accessible and intelligible so as to be usable for subsequent reference.”
Therefore, a contract executed using an Electronic Signature (and which may exist solely in electronic form) satisfies a statutory requirement to be in writing and/or signed under hand.
Witnessing
s.11 of the ECA states:-
“Where any law requires the signature of a witness on a document, the requirement of the law is fulfilled, if the document is in the form of an electronic message, by an electronic signature of the witness that complies with the requirements of section 9.”
Therefore, other than those documents specifically excluded by the ECA (e.g. Powers of Attorneys), witnesses are generally permitted to use Electronic Signatures.
Execution of corporate documents (i.e. board minutes and shareholder(s) resolutions) and/or deeds under ss.66 & 67 of the Companies Act 2016 (“CA 2016”)
Generally, corporate documents can be electronically signed subject to the constitutional requirements of the company and statutory requirements.
s.66 of the CA 2016 provides 2 ways which a document can be validly executed by a company:-
1. by the affixing of its common seal, subject to the conditions or limitations in the constitution; or
* s.10 ECA explicitly stipulated where any law requires a seal to be affixed to a document, such requirement may only be fulfilled by using a Digital Signature. It does not state that Electronic Signatures can be used to have the same legal effect.
2. by signature of at least two authorised officers (one of whom must be a director) or in the case of a sole director, by that director in the presence of a witness who attests the signature.
* In our opinion, this can be achieved by each of two authorised signatories signing the document (using an Electronic Signature or another acceptable method) either in counterpart or by one authorised signatory signing, followed by the other adding his or her signature to identical copy (electronic or hard copy) of the document.
s.67 of the CA 2016 : Execution of deeds
“1. A document is validly executed by a company as a deed if-
(a) It is duly executed by the company; and
(b) It is delivered as a deed.
2. For the purposes of paragraph (1)(b), a document is presumed to be delivered upon it being validly executed under subsection (1), unless a contrary intention is proved.”
* In our opinion, a deed can be executed using an Electronic Signature which complying with s.66(2) of the CA 2016.
Real estate contracts
While real estate contracts (such as Sale and Purchase Agreement, Deed of Mutual Covenants, etc…) are generally executable via Electronic Signatures, instruments effecting any dealings with real property under the National Land Code that requires authentication or notarisation will still need to be executed with physical wet-ink signatures.
7
Documents which cannot be executed using Electronic Signature
Document Type
Commentary
Power of Attorney
Expressly prohibited under the Schedule of ECA.
Creation of wills and crodicils
Expressly prohibited under the Schedule of ECA.
Creation of trusts
Expressly prohibited under the Schedule of ECA.
Negotiable instruments (i.e. promissory notes, bills of exchange, etc)
Expressly prohibited under the Schedule of ECA.
Statutory Declarations
Additional formal requirements under s. 2 of the Statutory Declarations Act 1960 have to be complied with, including but not limited to notarisation and attestation before a public notary or commissioner for oaths. In such circumstances, conventional physical wet-ink signatures are required.
Moneylending Agreements
Additional formal requirements under s.27 of the Moneylenders Act 1951 to attest the Moneylending Agreements. In such circumstances, conventional physical wet-ink signatures are required.
Court Documents
To the extent that the court documents (i.e. affidavits and statutory declarations) that require formal notarisation or attestation, Electronic Signatures are unlikely be permitted. Also, as mentioned above, ECA only applies to commercial transactions.
Legal requirement of a seal to be affixed to a document
Pursuant to s.10 of the ECA, where any law requires a seal to be affixed to a document (i.e. share transfer form, land dealings), general form of electronic signature will not suffice. However, digital signature under the DSA is valid.
Instruments require registration with Land Registry
Pursuant to the clauses 5 & 10, Tenth Schedule of the National Land Code, signatures on the forms for the purpose of transfer or conveyance of alienated land must be in manuscript with permanent black or blue-black ink. The requirement of authentication or notarization will require execution by way of conventional wet-ink signature.
Stamping of Documents
Documents must be stamped with the appropriate Stamp Duty for them to be admissible as evidence in court. There is a misconception that a document must be executed by the parties involved before it can be stamped.
The following provisions of the Stamp Act 1949 show that a document should actually be stamped before its execution and the Act gives an extension of time for the document to be stamped after its execution:-
8
Stamp Act 1949
Timeline
Section 41
all instruments chargeable with duty and executed by any person in Malaysia shall be stamped before or at the time of execution.
Section 42
the instruments executed out of Malaysia shall be stamped within 30 days after it has been received in Malaysia.
Section 47
allows an extension of 30 days to stamp the executed instruments.
Electronic stamping (which reduces the need to submit physical documents to the stamp office for adjudication) is now available as an alternative. Documents can be submitted online for stamping under the electronic Stamp Duty Assessment and Payment System (STAMPS) subject to an online adjudication and assessment of stamp duty. S.77A of the Stamp Act 1949 states that:-
“The Collector may by an electronic medium allow a registered person, without the need for the instrument to be presented to the Collector :-
(a) to obtain an assessment of stamp duty and any penalty, if any, on an instrument
(c) to obtain a stamp certificate in relation to the assessment; or
(d) to obtain an indorsement of stamp duty in a case where section 37 applies.”
A practical advantage of using STAMPS in relation to digitally or electronically signed document is that there is no longer a need to physically stamp the hard copy of the document, instead a stamp certificate is issued evidencing the stamping of the document. Thus, the parties can choose to stamp the document independently from the signing of the document and that can be done either before or after the document is digitally or electronically signed.
to pay stamp duty and any penalty, if any, on an instrument by electronic funds transfer or otherwise, in accordance with the assessment;
(b)
In order to improve the security of Electronic Signatures it is advisable to employ a commercially available third party e-signing platform. In preparing this paper, we have looked into a number of major e-signing platforms such as DocuSign, SignNow and AdobeSign. Each signing platform is different, it is necessary to check the functionality and configuration options with the e-signing platform providers in advance before deciding which platform to use.
Although each e-signing platform is different and platform services are continually being updated, in general each signatory would receive an email request to sign the relevant document. They would then access that document through a link provided in the email, and apply their Electronic Signature to the document in the appropriate signature block. Most e-signing platforms work by selling a licence/subscription to use the platform. The licensee/subscriber may then make the platform available to its clients and counterparties. Therefore, the signatories (recipient of documents) themselves do not necessarily need to have an account to sign electronically with the e-signing platform employed.
Using Electronic Signature Platforms
(E-signing platforms)
9
Recommendation:
Electronic Signatures or Digital Signatures
10
Although Digital and Electronic Signatures are both legally valid, we view that the latter is preferred for consumers since it is more practical, cheaper and easier to use than the former. For a large organisation like a bank, it may be justifiable to adopt Digital Signatures since it serves the function to limit the signers to those authorised signatories of the bank. It can be controlled just like the bank’s current pool of authorised signatories. The subscription period for a subscriber/Digital Signer can be one or two year. During the subscription period, each subscriber can sign unlimited documents with his Digital Signatures.
A simple Electronic Signature being a mere symbol or any form affixed to an electronic document, though valid, may be challenged in court for its authenticity. A better alternative is to employ a more secured commercial e-signing platform (such as DocuSign, SignNow, AdobeSign and amongst others) when allowing an organisation’s customers to electronically sign documents. Even though there are a variety of issues the parties need to take into consideration before using them (data protection, functionality, compatibility, compliance with regulations, etc.), usage of such platforms will offer additional security and authenticity checks for Electronic Signatures. An online signing platform collects meta data on the signing, including information around the date and time of signing, the email address to which the request to sign was sent, and the IP address of the device. These platforms can also use two factor authentication, where the signatory needs to insert a code that has been sent to a mobile number, which reduces the risk of someone with delegate inbox access signing in someone else’s name. The other advantage of using a commercial e-signing platform is that such platform usually comes with a document control system and workflow which can be employed for the signing of similar type of documents.
Overall, we recommend that organisations consider using Digital Signatures for their part and Electronic Signatures for their customers employing a commercially available third party e-signing platform.
We recognize that financial institutions’ willingness to use Digital and/or Electronic Signatures is key for this proposal to work. We look forward to an era where the usage of digital and electronic signatures is common place facilitating an even more efficient legal ecosystem and a safer and healthier environment for all.
You can contact us at general@ongmanecksha for further consultation.
Ong and Manecksha
Lee Khai
(L/701)