Electronic Signatures Begin to Make Their Mark

by Jeff Morris

It is slowly but surely becoming possible to conduct secure, legally binding transactions online. Forward-thinking companies are finding ways to make e-signatures easy for customers to use and simple for the company to manage. Each business process has its own unique challenges, so there are few one-size-fits-all approaches.

Before it could process mortgage loan applications online, QuickenLoans had to find a way to let customers sign separate portions of loan documents rather than entire documents at once. The company found that a process signature, which records all the steps in approving and signing a loan application and produces an audit trail, was the best answer. The University of Alabama at Birmingham wanted to provide secure access to documents and data — for example, to let researchers use sensitive and confidential information on supercomputers and let administrators sign and approve online documents from any location. The school chose to use digital certificates managed by an outsourcer. The Kansas Department of Transportation needed to collect multiple approvals on documents and create a visible signature that would show up on faxes to subcontractors. The department's approach has been to use electronic forms and workflow software along with a client-based e-signature application.

QuickenLoans Tackles a Sticky Problem

CASE STUDY: QuickenLoans
CHALLENGE: Find a way to let consumers apply for mortgages online without downloads or complicated technology.
SOLUTION PROVIDER: Silanis Technology, Montreal, www.silanis.com

Think, for a moment, of some of the long legal documents you've had to sign — such as a mortgage loan agreement. Did you have to sign in just one place, or did you need to look over specific areas and sign your initials to verify that you'd actually read all that fine print?

When QuickenLoans, the Livonia, MI-based online loan provider, decided to offer mortgages online, the company needed a way to capture multiple signatures. In a conventional loan setting, applicants presented with a mound of paper could simply look for all the ubiquitous sticky notes pasted into their documents, initialing the tagged passages — usually with someone there to guide them. But how could an online service complete that same process?

As fast as its Internet-based personal loan process was, QuickenLoans' mortgage process inevitably bogged down due to signature requirements.

"Here's our [current] application process in a nutshell," explains systems architect Kevin McCallum. "A customer goes onto our Web site, works with a banker and we prepare a document package. We FedEx the documents to the customer, who reviews them, signs them and sends them back. It's a five-day process, and the biggest customer fallout occurs during that document turnaround."

QuickenLoans wanted to keep the entire process online, so in the summer of 2000, product manager Anna Allred started reviewing e-signature technologies. Having had three years of experience with online documents through its personal lending business, the company knew it wanted a "zero-download" solution.

"Downloads lead to a bad customer experience," asserts Allred. "Maybe 25 percent of the population can download something and get it to work. Even technology-savvy people had trouble getting digital certificate downloads to work; one of the things nobody mentions is that digital certificates can't use Netscape browsers."

Another drawback of some e-signature solutions such as signature pads or smart cards is they require additional hardware. "By requiring the consumer to install and manage additional hardware," says Allred, "we'd be confining ourselves to a very small market indeed."

Allred ultimately reviewed 36 different vendors, but none of them met the company's requirements — chief among them, the ability to convert secure digital documents to HTML. One vendor, Montreal-based Silanis Technology, came back to QuickenLoans and asserted that they could turn the application into a zero-client application. "And that," says Allred, "is what we were waiting for."

Silanis not only offered a thin-client approach, it offered a way to resolve the "sticky" situation. "None of the products we looked at addressed [the multiple-signature] problem," recalls McCallum. "In every instance, there was a single signature for the entire document, rather than the ability to sign/initial specific sections."

After getting an approval for the Silanis process from Countrywide, QuickenLoans' correspondent lender (the company to which it subsequently sells its loans), development and testing began.

To ensure the end product would be user-friendly, QuickenLoans ran a focus group covering the entire online mortgage application process. "We learned that we needed to do a better job of explaining to consumers up front exactly what they were signing," notes McCallum. "There was a lot of confusion among focus group members, many of whom had trepidations because they thought they were actually closing on a house. Once they were provided with more information and understood the loan application process, they were much happier."

The finished solution is now being rolled out after extensive testing. Allred says she is convinced QuickenLoans made the right choice. "Probably half the companies we looked at in August 2000 have since been acquired or shut down," says Allred. "Silanis built this solution to meet our exact requirements."

To apply for mortgages on the Web, QuickenLoans customers answer 50 to 70 questions. QuickenLoans' underwriting system corroborates the information and generates loan documents, which are presented to the ApproveIt Web Server as PDFs. ApproveIt's approval and signing engine presents E-Sign consent forms, disclosures and documents for the customer to "sign." A recording engine captures every action the customer takes.

In the new process (see graphic above), borrowers can see a list of all documents in the package and choose to view or sign them. Pages have electronic yellow "stickies" along the margins wherever signatures are required. Borrowers, who have already authenticated themselves by answering 50 to 70 questions, sign these documents by clicking on buttons. These signatures are bound into the document when it is submitted.

Aside from the reduced paperwork and faster processing, Allred and McCallum say they are happiest with the level of security and verification provided by the digital signature process.

"When paper documents are returned, we need to go through them and physically check whether they've been signed in all the right places," notes McCallum. "The way this system is configured, a customer must sign everywhere it's required or the document cannot be submitted."

Every event leading up to the signature — every click and keystroke — is bound into a one-way hash algorithm that can't be duplicated: The clickstream is unique on both sides of the transaction.

"The entire transaction is recorded," reiterates Allred. "While the stickies add another layer of complication, we think it is essential that the customer has viewed every point that needs to be read."

There is another reason why this level of verification may be needed. "Sooner or later," says Allred, "an e-signature case is going to go to court. If it can be shown definitively that a customer went through the entire process and viewed and signed all the documents, that's a very strong legal argument."

University Takes On Digital Certificates

CASE STUDY: University of Alabama at Birmingham
CHALLENGE: Issue digital certificates to employees, researchers and students to ensure secure online access to and approval of documents.
SOLUTION PROVIDER: Digital Signature Trust, Salt Lake City, www.digsigtrust.com

Dr. Clair Goldsmith has seen the unlimited potential of digital certificate technology, but he's also seen how long it takes to get the systems up and running. As vice president of Information Technology at the University of Alabama at Birmingham, Goldsmith is in the thick of several different digital certification initiatives.

"It's a slow process," says Goldsmith. "Of course, nothing ever goes as fast as you'd like. And there are always stumbling blocks along the way — like when the Governor cuts your funding," he adds, half-jokingly.

The university will be launching three pilot programs this fall for administrative, research and instructional users, respectively, with up to 100 users involved in each test. All will utilize TrustID, an outsourced public key infrastructure (PKI) technology from Salt Lake City-based Digital Signature Trust.

The university selected Digital Signature Trust in November 2001, but Goldsmith says it will take some time to prepare for the pilot projects. "PKI is complex," he explains. "It's easy to talk about in theory, but the actual preparation is something that needs to be taken one step at a time."

Perhaps the most painstaking and time-consuming part of the process, says Goldsmith, is setting up an authoritative directory of individuals. The directory requires a predetermination of exactly who has the right and the need to access specific materials, as well as which individuals must sign off on which documents.

"In some instances, documents require more than one signature," explains Goldsmith, which necessitates configuring the system so that the correct individuals see a document and have signature authority. Sometimes, even the order in which users sign off must be configured.

Each of the university's pilot programs presents unique challenges. Researchers, for example, require secure access to supercomputers containing sensitive and confidential information. The instructional technology pilot requires that students be able to use their certification logons for secure access from any location. Similarly, administrators need the ability to sign documents and complete any administrative process no matter where they may be.

Going through an exacting configuration methodology helps open a lot of eyes about the technology's potential, says Goldsmith.

"As we explain what we're doing," Goldsmith says, "we get people like the graduate school vice president who says, 'Hey, if it can do this, then I could also use it for ...,' or the legal department member who realizes that digital signatures would be very useful in something like registering inventions. The possibilities are endless."

One possibility that appears close to realization is the ability to send digitally signed electronic grant forms to the National Institutes of Health (NIH). In late January, the University of Alabama at Birmingham, along with the University of Wisconsin-Madison and Dartmouth College, participated in a successful demonstration in which NIH received electronic grant applications signed by researchers and administrators of all three schools. Each of the institutions issues different kinds of digital certificates, yet all were verified and validated immediately to assure the submissions' authenticity. The test was enabled through the Higher Education Bridge, a PKI bridge deployed on the Internet by Educause, a Washington, D.C.-based nonprofit that promotes information technology in higher education.

As Goldsmith notes, the University of Alabama at Birmingham ranks among the top 20 universities for research funding, with $165 million of NIH funds flowing into the institution's various projects at any one time. The ability to submit grant requests to NIH electronically will be a huge advantage, making the process not only more efficient, but more secure.

Beyond exchanging digitally signed documents with government agencies, other academic institutions and business partners, the university hopes to use the technology for student loan agreements, distance learning programs, financial statements and a host of other uses. The first step will be, "getting our directory house in order," says Goldsmith, adding that he expects to have a uniform, campuswide resource in place by fall. What's after that? The possibilities are endless.

KS DOT Puts Processes in High Gear

CASE STUDY: Kansas Department of Transportation
CHALLENGE: To streamline processes such as user ID requests
SOLUTION PROVIDER: Accelio, Ottawa, www.accelio.com and Silanis Technology, Montreal, www.silanis.com

At the headquarters of the Kansas Department of Transportation (KDOT) in Topeka, KS, Cindy Wade and Allan Haverkamp have been finding ways to streamline internal processes and reduce paperwork.

With jurisdiction over the construction and maintenance of 10,000 miles of state roadways, KDOT has 3,100 employees, some 1,800 of whom are on workstations. The procedures and forms needed to "move" the department were typical of any state bureaucracy. As an example, Wade, infrastructure solutions manager, points to the department's User ID Request Form, which requires seven signatures, including those of four administrators, to authorize access to various systems. It's easy to imagine the time involved in routing such a document. The department recognized that there must be a better way to do things.

Back in 1996, a KDOT study identified the need for an electronic workflow. The study concluded that by converting forms and data to PDF files, routing them electronically and storing them in a document management system, the department would realize significant cost savings by eliminating printing and filing — not to mention the greater efficiency in eliminating data entry. At the time, the State of Kansas didn't have a digital signature initiative, but, says Wade, KDOT recognized that e-signatures would be needed for a digital workflow process to work.

KDOT compared workflow solutions that were available at the time, but it was not until mid-1999 that the department selected and began installation of FormFlow 99 e-forms and InTempo workflow from Ottawa-based Accelio (then known as JetForm). Due to the nature of the department's procedures (particularly the need to fax documents to vendors), Wade and Haverkamp felt that visual e-signatures would be required. For that purpose they brought in ApproveIt Desktop software from Silanis Technology. This client-based software lets users create e-signature files that are encrypted and stored on their hard drives. When they're ready to apply signatures to documents, they click the e-signature option on their toolbars, enter their passwords and apply the signature.

An e-signature capture project was begun, initially encompassing all KDOT employees at or above the Bureau Chief level. Signature capture devices were given to all personnel clerks, who were put in charge of capturing and maintaining up-to-date authorized employee signatures. (The State of Kansas now has an RFP out to acquire Certification Authority technology. When that happens, the state will issue digital signatures for all Kansas employees.)

The ApproveIt signature system is as secure as a password-based system can be, says Haverkamp, KDOT's information resource specialist. The process is completely encrypted so that not even an administrator can look up an employee password.

With e-signatures in place, various aspects of the digital workflow were tested. Starting slowly with a few procedures, the system quickly picked up speed. Today, about 20 production workflows are in operation.

"Turnaround times have improved dramatically," attests Wade. "For example, a form needed for out-of-state travel used to take one to two weeks to be approved. Now, all that's needed is to click on a URL in an email, go into the document and apply the authorized signature. It's practically instantaneous."

Another workflow improvement is winning praise in the state's highest office. Requests from the Governor's office for tracking departmental correspondence used to take 10 to 14 days to complete. A response is now usually available in four days.

As for that User ID request form, the document originates in FormFlow 99 and is routed electronically to all seven signatories through InTempo. Each signatory is presented with a single appropriate place to sign with the ApproveIt system.

While the electronic workflow and signature processes have thus far been used exclusively for internal operations, tests are currently underway to offer online capabilities to the public. Testing will go on internally for a year, after which it should become possible to apply online for permits to build driveways fronting on state roads.

In the meantime, additional internal capabilities are slated to go online, including travel reimbursement requests. Currently, some 50 form-based processes have been digitized.

"When will all 700 of our forms be digitized?" muses Wade. "Probably not until after I retire," she laughs, adding that some may never be converted because it's simply not cost-beneficial to do so.

Just going through the exercise of reviewing all departmental forms and procedures to determine the best ways to digitize them has, in itself, helped to reduce bureaucracy, according to Wade.

"We have to review every aspect of the way we do things, because automated workflow is not exactly like the paper process," she says. "We wind up asking, 'Do we really need this many signatures on the form? Can we reduce that number? Is this person simply reviewing the document or actually approving it?' In the end, even if we don't decide to digitize a particular process, we've made the department more efficient."

Jeff Morris (jpm55@earthlink.net) is a freelance writer based in South Salem, NY.