Are you who you say you are?

The issue of identity cards is one topic that is guaranteed to polarise debate in the UK. The main political parties have different views and it is safe to assume that we are unlikely to see European-style ID cards being introduced in the UK for some time.

Personally, I believe that that is unfortunate and that we would be individually and collectively better off if all citizens had ID cards. In New Zealand, for example, the Government gave all its citizens ID cards a number of years ago. Most of us already hold one form of photographic ID, either for our driver’s licence or passport, and it is now standard practice that airlines, other major organisations and even solicitors will require to see photographic ID as a matter of course at the outset of a transaction. I would argue that in our modern society, most people when away from their home have some form of photographic ID on their person at all times. Nevertheless, there is a strong and vocal body of opinion that believes that the introduction of compulsory ID cards would be an intrusion on our individual civil liberties and that storing everyone’s biometric data could only be done at huge cost. If this cost is not to be borne by Government then it has to be passed on to the individual.

We already carry various forms of ID, and we are accustomed to paying by credit card when we transact online. Of course there are examples of fraudulent transactions and ID theft, and no doubt that will occur no matter what form of ID verification we use. Is it really such a leap of faith to move to a single form of ID? I am of the opinion that it is not and that we are closer to it than we might imagine.

The subject of ID cards for lawyers was considered recently in an article in the Law Gazette on 19 February by Jonathan Goldsmith (www.lawgazette.co.uk/print/54239). Mr Goldsmith is the Secretary General of the Council of Bars and Law Societies of Europe (“CCBE”), which represents around 1,000,000 European lawyers through its member bars and law societies. He is a proponent of ID cards for lawyers and, in particular, their use to facilitate cross-border transactions in an age when the European Commission is taking large scale initiatives to resolve the question of cross-border e-identity. See Mr Goldsmith’s article for details of the STORK project. Details can also be found at www.eid-stork.eu/.

Where are we now?

A commonly held view in the UK is that e-identity is sufficiently well protected by login and password procedures. However, a recent study has shown that a considerable number of user names and passwords can be guessed quite quickly by tapping into information gleaned from social networking sites, for example – and once you have one, the chances are that the same details apply to other credit cards belonging to that person. How secure is that, I ask you?

A contrary view however is that ID cards per se will not solve the problem of establishing identity relationships. That view has recently been put forward in an article entitled “Identity and its verification” by Nicolas Bohm and Stephen Mason, Computer Law and Security Review, 26(1), January 2010, 43-51. In that article, which focused primarily on digital signatures which can be part of an ID card, the authors expressed their concern that the drawbacks outweigh the advantages in switching to digital signatures. In their view, digital signatures and Public Key Infrastructure (“PKI”) technology has not produced the predicted advantages apart from for some closed-loop products.

As mentioned above, however, we do already use ID cards in various forms, and we are all much more aware of the risks associated with using credit cards generally and on transacting on the internet. It is therefore suggested that now is an opportune time to consider taking a further, and I would argue, small step towards Scottish solicitors having an ID card incorporating a personal digital signature in Scotland. We already use card readers to enter chip and pin details when doing telegraphic bank details. We are also accustomed to electronic registration of title using a digital signature. (See www.ros.gov.uk/artl .) Why therefore can we not consider introducing ID cards for solicitors, perhaps initially in the form of an e-practising certificate in a smartcard format?

Do we really need to have our paper practising certificates sent to us each year? Would it not be simpler for both us and the Law Society of Scotland if we had a plastic card containing the relevant information, which could be updated annually electronically by inserting it into a reader on your desk? Solicitors would then be able to operate more efficiently within their businesses, engage with Government and its various agencies, and bring about greater identity security and reassurance when conducting business online. Now is an opportune time to be doing this as member states in Europe are moving towards this goal.

On the political front, Government is highly focused on efficiency savings and delivering an increasing number of services online. They see this as a benefit to the taxpayer and those using services both in a personal and business capacity. For example, the Digital Economy Bill states that “digital information and communications are vital to the future of the UK economy”. In addition, the Prime Minister in a speech on 7 December 2009 stated that “our aim is – within the next five years – to shift the great majority of transactional services to be online only... saving as a first step £400 million”. While the focus is currently on the public sector, private businesses will certainly follow. There are other economic and social benefits to support the introduction of e-practising certificates.

Importantly, sophisticated technical solutions already exist to support such a proposal. These are cost-effective and straightforward to use. In a social sense, there is considerable concern to be safe online, protect one’s identity and know who one is communicating with (or dealing with) online. Technical solutions can and are being developed to temper these fears.

Scottish perspective

In a Scottish context, there are a number of factors that support the contention that there is good reason why the Society should consider introducing paperless practising certificates. These include (1) the desire to develop Scotland as a leading destination to conduct legal matters: having a leading edge technical environment to conduct and conclude business online must be at the core of this; (2) various new electronic-based initiatives are currently being pursued, such as an online Scottish property portal for solicitors; and (3) another important opportunity is that it would enable missives for the sale and purchase of property to be concluded online.

The conclusion of missives electronically is not currently possible. Article 9 of the E-Commerce Directive 2000/31/EC ought, by now, to have been transposed into Scots law. Article 9 provides that “member states shall ensure that their legal system allows contracts to be concluded by electronic means”. The deadline for transposition of the directive was, in fact, 17 January 2002.

The recently published draft Land Registration (Scotland) Bill, which forms part of the Report on Land Registration by the Scottish Law Commission (Scot Law Com no 222), contains a provision which will inter alia enable e-missives. The enactment of that bill may be a number of years in the future. However, an opportunity currently exists to transpose the directive into Scots law and thus allow missives to be adjusted electronically. This can be done by the Scottish Government giving consideration to promulgating a s 8 order in terms of the Electronic Communications Act 2000 with a view to e-enabling the terms of the Requirements of Writing (Scotland) Act 1995.

Once article 9 of the E-Commerce Directive has been transposed into domestic law, it would be possible for a conveyancing transaction to be done entirely online, with significant savings arising for both the conveyancer and, more importantly, the citizen. For this to become a reality however, it would be essential that there be a suitably secure digital certificate so that solicitors can conclude safe in the knowledge that the person they are transacting with is who he/she says they are. This is where an e-practising certificate smartcard containing a secure digital signature would be invaluable.

What are the benefits?

Technically, conducting business online is a straightforward matter. The electronic tools exist, software can be developed, websites built and programs written. However, while it is possible to conduct business online, it is not necessarily possible to conclude that business online, as at that point there is frequently a reversion to paper plus wet signature. With the introduction of a smartcard practising certificate which contains the digital identity of the holder, people on both sides of the transaction will be confident as to each other’s identity.

Consequently, the way in which this digital identity is issued and controlled will need careful management. This is achieved using suitably draconian PKI technology under the control of a trusted party or organisation. That trusted party vets an individual, verifies their identity and provides them with the digital credentials to operate online, and only after that process has been completed satisfactorily will the person be entitled to use his/her digital signature.

The Law Society of Scotland is an ideal organisation to operate as such a trusted party. Indeed, since 2005, the Society has had representation on a technical subcommittee of the CCBE whose purpose was to agree standards for electronic signatures for the legal profession in Europe. The result is a recognised standard for the profession based on the EU Directive for Electronic Signatures, which is in accordance with the Electronic Communications Act 2000. With PKI, each person is issued with a unique electronic identity (or digital signature). This can be used for a variety of purposes, from digitally signing a document on the one hand to securing access to a website in a much more rigorous way than user ID and password.

Part of the CCBE project is based on a very successful scheme developed by the Spanish bar, called PENALNET. (See www.penalnet.eu/portalPenalnet/home.do?idioma=en_EN .) This is a secure online document exchange used by criminal practitioners in Spain to lodge and retrieve court documents. Digital signatures are central to this process. The system has been a great success and it has established a benchmark that is being used as a prototype for secure communication between lawyers in Europe.

The way forward

There will obviously be those who have concerns about any form of electronic system, so I believe that it is important that there is an informed debate on the issue at the earliest possible opportunity. If the Society were to follow the Spanish precedent, it is likely that the PENALNET system could be licensed for use in Scotland in a variety of ways. For example, we are already using standard regional missives, and technology exists to enable property transactions to be processed online. Once article 9 of the EU directive has been transposed into Scots law, it will be possible, using a secure digital signature, to conclude missives electronically via an online medium akin to PENALNET.

There is no reason why that digital signature cannot be contained within an e-practising certificate smartcard. The ARTL digital certificate is another solution, but that would require Scottish Ministers to authorise its use outwith the e-registration process. The benefit however would be to have a single digital certificate for use in the whole conveyancing transaction. There are other alternatives with varying levels of security that can be considered if that were not possible.

I believe that we should be looking to present a modern, forward-thinking impression to our clients and the public at large, and moving to an electronic regime will deliver real, tangible benefits to solicitors and to the public. One of the most significant benefits would be for a solicitor to be able to transact electronically on behalf of his/her client and, most importantly, sign documents digitally on their behalf. That happens already in ARTL, and an extension to the rest of the conveyancing transaction and beyond would be a major step forward. A solicitor’s digital certificate would be a significant marketing tool for the legal profession which would further cement the traditional role of the solicitor as a trusted adviser, especially for so long as society as a whole does not fully embrace the benefits of all citizens having ID smart cards. The technology already exists. Are we ready to use it?

• Professor Stewart Brymer, Stewart Brymer WS