In addition to UETA, there is the Electronic Signatures in Global and National Commerce Act (ESIGN Act). The ESIGN Act is federal regulation that addresses discrepancies between individual state laws for electronic signature and in cases where no state law exists. Its primary purpose is to establish that electronic signatures are legally valid.

University departments and employees requesting and using electronic signatures should primarily refer to the Illinois act. However, when the University itself interacts with other agencies/entities, especially at an international level, ESIGN Act may apply instead. Inquire with the Office of General Counsel if you need confirmation for your situation.

According to UETA and the ESIGN Act, an electronic signature is defined as an "electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record."

The most common form used is an electronic symbol. Examples include but are not limited to a form field to type, draw, or otherwise mark a signature or interactive buttons labeled with "I agree" or "I accept."

Digital signatures are a type of electronic signature the utilizes digital certificates provided by certificate authorities. This type of electronic signature often requires additional software and an identity verification process by the certificate provider. An example would be the State of Illinois Digital ID service.

This type of electronic signature provides the greatest level of technical assurance, but is also more complex to implement/leverage at an individual or departmental level. At this time, the University has not formally established technology or processes to leverage this type of electronic signature. If you have a need to utilize digital signatures, contact the Information Security Office to request a consultation.

When developing an electronic signature process, you must consider risk to ensure your approach is appropriate. The primary risk would be that the process does not result in a legally valid electronic signature. In such a scenario, an invalid signature could result in the record itself, and whatever it covers, being invalid as well. The impact of such requires careful consideration before proceeding.

The parties to the transaction must either display or imply their consent before transmitting information electronically.

During the activation process of a user account at Illinois State University, individuals are presented with such terms and the option to specifically consent or not consent. However, unless your process specifically checks, confirms, and adjusts to their selection, you must implement your own consent step of your process.

Examples

Like paper-based equivalents, electronic signatures are only valid when a signer displays a willful intent to sign. A standard approach is to ensure that signature lines have a statement that specifically indicates agreement to the terms as well as the choice to sign electronically.

An electronic record or electronic signature is attributable to a person if it was the act of the person. The act of the person may be shown in any manner, including a showing of the efficacy of any security procedure applied to determine the person to which the electronic record or electronic signature was attributable.

Design a process that is appropriate to the risk level of the transaction or record. You should include greater technical assurance capabilities when there would be a greater likelihood and impact.

In the context of electronic signature, this includes the completed final record as well as the records of evidence for the prior requirements (e.g. documentation of consent being provided). Refer to record retention regulation and policy to determine the required length of retention.

Before using electronic signatures, it is important to understand the provisions of the UETA and University policy, including what constitutes an electronic signature and how it can be used to sign contracts and other legal documents.

Illinois Uniform Electronics Transaction Act (815 ILCS 333/)

9.8.8 Electronic Signature Procedures

Implement a secure process for creating and verifying electronic signatures. This may include using secure authentication methods, such as multi-factor authentication, to verify the identity of the signer. The process must fulfill the legal requirements for electronic signature as well as be appropriate for the risk level associated with the record being electronically signed.

If feasible, use a reliable electronic signature service provider that has been certified by a reputable third-party organization, and that implements appropriate security measures to protect the authenticity and integrity of electronic signatures.

Before a document can be signed electronically, the signer must provide consent to use an electronic signature. The consent to use an electronic signature can be and is often obtained electronically itself.

In order for the consent to be legally valid, it must meet the following requirements:

1. The consent must be presented in a clear manner so that the individual can easily understand what they are consenting to.
2. A record must be captured and retained that demonstrates the consent was presented and how the individual responded.
3. The consent given must be unambiguous and reflect that they clearly understood what they are consenting to (in this case, collection and use of their signature in an electronic form).
4. The individual must be able to revoke their consent at any time.

A common practice is to present a consent prior to the form or document to be signed that meets these requirements. Should an individual decline to consent to electronic signature use, it is recommended that you provide an alternative method that enables a traditional "wet" signature to be received.

Keep records of all electronic signatures, including the date and time of the signature, the identity of the signer, and any supporting documentation. This information should be securely stored and easily accessible for later reference.

Moderate Risk

• Terms include responsibilities for safety, prohibitions, and liabilities.
• You could require the use of authentication prior to signing of the agreement. Authentication with a username and password would provide greater assurance than just emailing a document with a signature mark.
• The process documentation, technical configuration, and the records of authentication would be associated with the record to reasonably demonstrate it was the act of the individual.
• A risk is that basic authentication of username and password is known to be weak to compromise through phishing attacks. If the agreement warranted a greater assurance, multi-factor authentication could be additionally required.

Moderate Risk

• The document reflects performance and whether improvement is necessary.
• You could require the use of individual organization email to send the document with a marked signature. The assumption is that authentication is required to access and send email.
• The process documentation and email messages exchanged would be associated with the record to reasonably demonstrate it was the act of the individual.
• A risk is that the performance evaluation documents are downloaded from email and filed in separate storage which no longer has the evidence associated with the record. Since performance evaluations can be central to formal improvement or disciplinary processes, the process should either leverage an alternative method or include steps to capture and retain the email messages with the record.

Low Risk

• The time sheet reflects the reported time worked by an employee to be approved/signed by their supervisor.
• You could require the use of authentication prior to signing of the agreement. Authentication with a username and password would provide greater assurance than just emailing a document with a signature mark.
• The process documentation, technical configuration, and the records of authentication would be associated with the record to reasonably demonstrate it was the act of the individual.
• A risk is that basic authentication of username and password is known to be weak to compromise through phishing attacks. However, there is a low likelihood that such an attack would target time sheet approval and even if it did, the impact would be low and likely to be easily corrected.