Accepting e-documents with e-signatures: A small step for the Govt., a giant leap for the country

By Verité Research and The Import Section of the Ceylon Chamber of Commerce

I. Summary

Improving export performance is a priority for Sri Lanka. Global export competitiveness is increasingly determined by the speed of the export process, and not just the price and quality of goods and services. Hence, exporters focus on improving supply chain logistics to optimise their response time and their speed of moving of goods. However, the room for exporters to improve their competitiveness by reducing time to export is significantly constrained by the procedures and processing time imposed by Sri Lankan border agencies.

Sri Lanka can improve the competitiveness of its exporters by reducing processing times at the border. A proven method in this regard is the use of Electronic Document (e-document) processing platforms for trade. Currently in Sri Lanka, the benefit of this particular opportunity is being hobbled by the non-acceptance of electronic signatures (e-signatures). The block is in Sri Lanka’s bureaucracy; although the legislation required for accepting e-signatures has been in place for over 10 years, there has been no action by Government agencies to implement it.

This policy note sets out the main findings of a study conducted by Verité Research on the non-acceptance of e-signatures in Sri Lanka. This note also provides some recommendations to overcome bureaucratic inaction on accepting e-signatures.

Main findings

• The necessary legislation enabling the acceptance of e-signatures (together with e-documents) has been in place in Sri Lanka for over a decade, since the passing of the Electronic Transactions Act No. 19 of 2006.
•  The continued inaction on implementing the legislation is costly to the country and undermines Sri Lanka’s potential to achieve broader economic objectives.
•  The reasons frequently highlighted by various Government agencies for the non-acceptance of e-signatures and e-documents are largely unsubstantiated.
•  In order to have Sri Lanka’s e-documents accepted in all international transactions it is important to have a functioning National Certification Authority (NCA)2. NCAs can audit and accredit local organisations to provide internationally secure digital signatures. However, such accreditation is not necessary for the acceptance of documents bearing digital signatures that are processed within the country only.
•  The main factors hindering the successful adoption of e-documents and e-signatures are bureaucratic resistance to change and administrative lethargy. 

Recommendations

Recommendation 1: Issue central guidelines to accelerate the acceptance of e-signatures in Sri Lanka. 

Issuing central guidelines, which apply to all Government agencies, on the proper and acceptable use of e-signatures in electronic communications and electronic records would be an efficient solution to inaction at the institutional level. Such guidelines can be issued by the Ministry of Telecommunications and Digital Infrastructure. Many countries, including India, have successfully followed this course of action.

Recommendation 2: Activate an NCA to facilitate international acceptance of Sri Lankan-issued digital signatures

In some instances and jurisdictions, the international acceptance of digital signatures requires the use of an accredited digital Certificate Service Provider (CSP)3. Accreditation of local CSPs is facilitated by the creation and activation of a National Certification Authority (NCA), which is a responsibility that either the Information and Communication Technology Agency (ICTA) or the Central Bank of Sri Lanka can be re-tasked with in 2017. 

II. Research overview

1. e-signature and e-document processing are key to realising broader economic policy objectives

1.1 The growth of Sri Lanka’s export sector has been sluggish since 2000. Exports as a percentage of GDP has fallen from 33.3% in 2000 to 12.3% in 2015.4 Additionally, in the last two years, the absolute value of exports has recorded negative growth. 

1.2 The time and cost expended to comply with numerous Government border regulations are two of the factors that impede export growth. Shifting from manual documentation systems to fully functioning electronic processing platforms can help to save money and time for traders, which will in turn improve Sri Lanka’s trade competitiveness. For example, Malaysia’s enabling of e-document processing platforms in Port Klang cut processing time for certain documents from 12 hours to 15 minutes and reduced document error rates from 40% to 5%.5

    Similarly, Singapore’s electronic trade platform processes export documentation within four hours of submission and processes import documentation within one hour of submission, which is significantly lower than Sri Lanka’s processing times (see Table 1).

1.3 Adopting information and communication technology (ICT) towards digitalising the economy is a stated policy priority of the Sri Lankan Government.6 In middle income countries, digitalisation is a viable method of improving service delivery of the public sector, arresting rent seeking behaviour, reducing inefficiencies, and facilitating faster access to markets.

1.4 Inefficiencies in border administration undermine not only Sri Lanka’s trade competitiveness but also its potential to realise broader economic policy objectives. For example, fast and effective border procedures are crucial to realising policy priorities such as increasing Foreign Direct Investment (FDI), entering global value chains and becoming a regional logistics hub. Adopting electronic trade platforms can significantly enhance the efficiency of border administration and therefore help to improve trade competitiveness.

1.5 The acceptance of e-signatures and e-documents is an important aspect of electronic trading platforms. The weak implementation of electronic platforms has undermined the efficiency of border procedures. Consequently, Sri Lanka is ranked low in many international indicators that measure the efficiency of procedures governing cross-border transactions. The Global Trade Enabling Index 2016, compiled by the World Economic Forum, ranks Sri Lanka 97th out of 136 countries in efficiency and transparency of border administration. Sri Lanka, which was ranked 87th in 2014, fell by 10 places in just two years, and fares poorly in comparison to regional peers such as Thailand (44th), India (75th) and Vietnam (86th). Table 1 shows that Sri Lanka lags behind its competitor countries on time taken to comply with trade documentation requirements for trade.

1.6 In this context, accepting e-signatures is a small yet critical step for the Government towards making e-document processing effective; however, it could be a giant leap for the country in terms of improving its international competitiveness in trade and logistics.

2.    Enabling legal framework in place since 2006, but not implemented

2.1 The legal framework necessary to facilitate the acceptance of e-signatures is already in place. The Electronic Transactions Act (ETA)7 No. 19 of 2006 (Section 7) gives e-signatures the same legal weight as traditional hand-written signatures, with a few exceptions.8

    Further, the provisions of the Act supersede any existing legislation that requires hand-written signatures for authentication. 

2.2 However, Sri Lanka has made little progress over the last decade in using e-signatures to speed up e-document processing. The Ministry of Finance and the Sri Lanka Customs Department installed a “Paperless Single Window” document-processing platform, to eliminate the manual submission of documents. However, traders are still required by certain institutions to physically submit documents in paper format with hand-written signatures to complete the processing. Hence, despite the large sums of money spent to set up this platform, Sri Lanka has failed to realise the economic efficiencies and benefits of e-document processing.

2.3 In certain instances, documents transmitted internationally in trade-related transactions require accredited digital signatures. Accredited digital signatures are issued by accredited CSPs. Locals CSPs are usually accredited by an internationally accredited NCA due to cost efficiency. The Government of Sri Lanka mandated ICTA to work in collaboration with Sri Lanka Computer Emergency Response Team (CERT) to establish a functioning NCA under the Extraordinary Gazette No. 1829/29 issued on 24 September 2013. However, a functioning NCA is yet to be established. This lethargy has resulted in the absence of an accredited CSP in Sri Lanka, which hinders the international acceptance of documents bearing digital signatures.

3. Reasons given for the non-acceptance of e-signatures are unsubstantiated

    Many State agencies have the infrastructure and systems in place to receive documents electronically. Yet there is widespread reluctance to accept e-signatures. The most frequently cited reasons by Government agencies are discussed below. Upon careful examination, justification for the non-acceptance of e-signatures appears unsubstantial.

3.1 There is a need to amend existing Acts

    A frequently cited reason for the non-acceptance of e-signatures is that the legislation governing the activities of the respective agencies requires hand-written signatures and that agencies are unable to accept e-documents and e-signatures without amendments to these laws.

• This argument is unfounded. As mentioned above in 2.1, Section 7 of the Act states that its provisions on signatures supersede any other law that requires hand-written signatures for the authentication of any information or communication. Therefore, no amendments to current legislation are necessary to make e-signatures acceptable.

3.2 A National Certification Authority is required for acceptance of e-signatures?

    Another reason cited is that currently there is no functioning NCA with powers to accredit local CSPs.

•     This argument is not applicable, with one exception. The legal framework in Sri Lanka: (a) allows flexibility for institutions to use any type of e-signature; and (b) does not require CSPs, which issue digital signatures, to be accredited. In fact, Section 20(2) of the Act states that there is no legal basis for preventing un-accredited CSPs from providing services within the country.
•     Presently, the financial sector in Sri Lanka processes a significant number of financial transactions using digital certificates. These digital certificates are certified by a CSP that has no external accreditation but has the confidence of the financial sector. Therefore, Sri Lanka’s financial sector has been willing and able to use digital certificates issued by a local CSP, even in the absence of a functioning NCA to provide accreditation. This provides an empirical confirmation that despite the absence of a functioning NCA to accredit CSPs, Sri Lankan institutions can accept e-signatures and even digital signatures.
•     There is one exception to the non-applicability of the argument in international trade. Despite permissibility under Sri Lankan law, some receiving countries require authentication of a digital signature through an accredited CSP to accept submitted documents. This means that a subset of documents transmitted internationally cannot be fully processed without an accredited CSP.

3.3 Is there a lack of capacity? Another frequently cited reason for the non-acceptance of e-signatures and e-documents is a lack of capacity, variously described as; lack of IT infrastructure, lack of experts with technical knowledge, and lack of funds to address these deficiencies.

•     These reasons are a smoke-screen. The findings by VR suggest that the lack of administrative will and action is generally misrepresented as a lack of capacity.
•     The following observations support this analysis.
•     At present, State organisations that have the installed and functioning capacity to accept e-documents and e-signatures still require submission of physical documents with handwritten signatures to process transactions.
•      The Government has already allocated funds to address capacity constraints. In its budgets for the years 2016 and 2017, the Government allocated Rs. 10 billion9 and Rs. 15 billion10 to implement its above-mentioned policy of digitalising the economy. Capacity for the public sector to effect the envisaged digital transformation is bolstered by the Government’s commitment to make available the skills and resources needed11 through 1) its e-Government policy and 2) the public position of the Ministry of Telecommunications and Digital Infrastructure.

4. Bureaucratic lethargy is compounded by corruption incentives

4.1 Resistance to change from bureaucrats who benefit from the lack of transparency and efficiency in manual administrative systems is a common problem faced by countries that are attempting to introduce electronic trading platforms. A survey among trade experts by the United Nations Economic and Social Commission for Asia and the Pacific (UNESCAP) on the costs associated with implementing electronic trade/single window platforms revealed that resistance by staff within relevant organisations to be one of the main costs that delays implementation.12,13

4.2 Transparency International’s Corruption Perceptions Index 2016, which measures the perceived level of public sector corruption, ranks Sri Lanka 95th out of 176 countries, with a poor score of 36 out of 100. According to the study, in Sri Lanka, there were numerous complaints of people being forced to offer inducements to facilitate manual transactions.

4.3 This situation in Sri Lanka is consistent with newer theories on corruption, which suggest that it ‘sands’ the wheels of Government instead of ‘greasing’ them. That is, corrupt bureaucracies work to keep inefficient systems in place in order to extract rents from those keen to overcome the opaque, unpredictable, delayed and difficult processes that they face.

4.4 Manual systems also help to cover the tracks of corrupt actions. For example, there are no records of the points of delay in manual document processing. Physical documents can also be altered, replaced, or removed without evidence of the culpable party. In contrast, e-signature enabled electronic systems require log-ins, which create digital footprints that can be used to trace in the event of suspected corruption.

III. Recommendations to move forward

The following two recommendations are a means of moving Sri Lanka forward in adopting e-signatures despite past administrative lapses and resistance.

1. Issue central guidelines to accelerate the acceptance of e-signatures in Sri Lanka

•      The ETA No. 19 of 2006 specifies that if any authority requires the use of e-documents (including e-signatures), it can recommend to the subject Minister the particular regulations/guidelines that it wishes to adopt.14 Although this Act has been in place for over 10 years, there is no record of a single public authority taking this action in this time period.
•     The issuance of such guidelines is provided for under Section 8 of the ETA.
•      This course of action obviates the need for independent action by each public authority and fast tracks the implementation of these guidelines. In India, which has more complex administrative structures than Sri Lanka, the Ministry of Communications and Information Technology gave effect to e-signatures by publishing a full set of guidelines in 2010.15
•      In Sri Lanka, the Ministry of Telecommunications and Digital Infrastructure can be appointed the centralised authority that publishes these guidelines. The guidelines will need to include: (a) the manner and format in which such electronic records shall be created, retained, filed or issued by the Government; (b) the types of e-signature that are acceptable for different types of documents; and (c) the manner and format in which such e-signatures are placed and the audit criteria that should be possessed by any CSP used.
•      The advantages of well drafted, centrally issued guidelines are that: 

        (a) they are a more efficient and effective means of setting up guidelines for Government agencies compared to the alternative method of individual agencies passing their own guidelines according to the Act;

        (b) they enhance clarity, coherence, predictability and uniformity across State agencies with respect to the criteria and format required in accepting e-signatures; and

        (c) they help to overcome any administrative lethargy or uncertainty that agencies may have about the legal validity of e-signatures.

2. Activate National Certification Authority for digital signatures issued in Sri Lanka to be certified internationally

•      As described in Section 2.3, the failure of ICTA to activate a NCA has had some repercussions: the absence of an accredited CSP in Sri Lanka has prevented the use of digital signatures in certain cross-border transactions.
•      There are three options to move forward: (a) re-task ICTA or the Central Bank of Sri Lanka - both of which have the requisite administrative capability to set up an internationally accredited NCA in 2017; (b) assist one or more local CSPs to seek accreditation directly from a global certification authority; or (c) invite an internationally accredited CSP to set up services in Sri Lanka.

(The Economics Research Team of Verité Research compiled this study in collaboration with the Import Section of the Ceylon Chamber of Commerce. The team from Verité Research comprised Buddhika Perera, Subhashini Abeysinghe, Sabrina Esufally and Anushan Kapilan with the overall research and editorial supervision of Nishan de Mel and Malathy Knight.)

Footnotes

1 Digital signatures are a complex form of electronic signatures that require a user certificate (which is designed using cryptography) to uniquely identify the bearer of the certificate as the originator of the document. 

2 A National Certification Authority (NCA) is a trusted third party digital certificate issuer, that is trusted by both the Subject (owner of the certificate) and the party relying upon the certificate. NCA can accredit and certify Local CSP and pass on the trust placed on them to the CSP’s effectively “Accrediting” or increasing the credibility of the CSP. NCA’s themselves are often “Accredited” by global Certification Authorities that pass on the trust placed on them to the NCA’s. 

3 CSPs are service providers that maintain a registry of owners of the certificates required for digital signatures and ensure that each certificate is uniquely tied to the owner of the certificate. 

4 Central Bank of Sri Lanka, ‘Annual Report’, (2015)’, available at:  http://www.cbsl.gov.lk/pics_n_docs/10_pub/_docs/efr/annual_report/AR2015/English/content.htm [accessed on: January 2017]. 

5 United Nations Network of Experts for Paperless Trade in Asia and the Pacific, ‘Case of Malaysia’s National Single Window’, Towards a Single Window Trading Environment, (2010), available at:  http://www.unescap.org/sites/default/files/brief4.pdf [accessed on: January 2017]. 

6 Ministry of Finance, ‘Budget Speech 2017’, p. 72, available at:  http://treasury.gov.lk/documents/10181/28027/Budget+Speech+2017/a092d16a-68ec-46d5-8e279e3c00243aa8?version=1.1 [accessed on: January 2017]. 

7 The Electronic Transactions Act (ETA) provides for the creation of a Certification Authority (CA), a regulatory entity set up to perform oversight functions in relation to Certification Service Providers (CSPs). In this context, the CA has the power to: identify the criteria that will form the basis for the accreditation of CSPs; issue licences to CSPs to perform their functions under the Act; and, mandate CSPs to maintain records and registers in the performance of their functions. 

8 The applicability of the Act does not extend to, inter alia, execution of a Will, a Bill of Exchange, a Power of Attorney, a Trust, and a contract for the sale or conveyance of immovable property or any interest in such property. 

9 Ministry of Finance, ‘Budget Speech 2017’, p. 40, available at:  http://treasury.gov.lk/documents/10181/28027/Budget+Speech+2017/a092d16a-68ec-46d5-8e279e3c00243aa8?version=1.1[accessed on: February 2017]. 

10 Ibid, p. 74. 

11 Sirimanna, Bandula. ‘Sri Lanka leapfrogs to a digital government, says Telecom Minister’, The Sunday Times, (02 October 2016), available at: http://www.sundaytimes.lk/161002/business-times/sri-lanka-leapfrogs-to-a-digital-government-says-telecom-minister-210840.html [accessed on: February 2017]. 

12 United Nations Economic and Social Commission for Asia and the Pacific, ‘An Exploration of the need for and cost of selected trade facilitation measures in the context of the WTO negotiations’, Studies in Trade and Investment, (2006), p 36, available at http://www.unescap.org/sites/default/files/tipub2426.pdf [accessed on: January 2017]. 

13 The other costs accounted for were regulatory setup costs, institutional setup costs, human resources training setup costs, and equipment setup costs. 

14 Electronic Transactions Act No. 19 of 2006, Section 8 (2). 

15 Controller of Certifying Authorities, India, ‘e-authentication guidelines for e-Sign – Online Electronic Signature Service’,(07 June 2016), at http://www.cca.gov.in/cca/sites/default/files/files/Guidelines/CCA-ESIGNAUTH.pdf [accessed on: 27 March 2017].

What are e-signatures?

Just as hand-written signatures are means of signing documents in paper format, e-signatures are a means of signing documents in electronic format. e-signatures can take many different forms, including:

•     Electronically typed names (such as those typed at the at the end of a form);
•     Scanned hand-written signatures which are then placed on an e-document;
•     Electronically replicated hand-written signatures (such as those made on electronic sign pads);
•     Signatures based on a unique representation of characters (e.g. pin codes and passwords);
•     Biometric signatures (e.g. fingerprints or retina scans); and
•     Digital signatures1 (encrypted certificates)

Digital signatures offer a high standard of security as they enable the unique identification of the signatory and the tracking of modifications to the e-document throughout the use. This level of security can be important for governments and businesses, especially when the document requires international acceptance or verification for litigation purposes.