The University Record, February 18, 1998
By Theresa Hofer
Information Technology Division
“Sign on the dotted line” is being replaced by “sign on the digitized pad” as a growing number of organizations are saving digitized images of their clients’ signatures. At the University, however, the trend is being reversed: digitized signatures from U-M ID cards are being deleted from a database in which they had been stored. The action is being praised as both a process improvement and an effort to protect the privacy of the personal information of members of the University community.
According to Robert E. Russell, assistant director for systems and bank cards in Financial Operations, the signatures originally were stored to make it easier for users to obtain replacement ID cards. The signatures were not being used, however, in any other process and they were difficult to print in a legible format, so it was decided to eliminate the signature from the ID card. “Therefore,” says Russell, “we had no need for the database. By deleting the database, we eliminated any risk associated with storing digitized signatures.”
The issues surrounding stored digitized signatures came to national attention in 1996 when United Parcel Service (UPS) announced that it was making the digitized signatures of package recipients available for its customers to view online. Customers with the appropriate tracking software can dial in to the company’s mainframe computer and bring up the signature of the person who signed for a package.
As a safeguard, UPS allows only the person who sent the package to view the recipient’s signature. In addition, it provides no mechanism that would allow the viewer to capture the signature or print out the screen.
Nonetheless, privacy advocates are concerned that the mere existence of such databases increases the risk of fraud. Virginia Rezmierski, director of the Information Technology Division’s Office of Policy Development and Education, says: “In a digitized form, your signature can be reproduced exactly. Therefore, the capability for fraud in a stored digitized signature is very great.”
Rezmierski also notes that a high percentage of fraudulent acts are committed from within organizations. “That doesn’t mean that we at Michigan have bigger problems than anyone else,” she says, “but it does mean that you have to ensure that extraordinarily good security measures are taken to protect that data.”
Rezmierski applauds the decision to delete the stored signatures at the U-M as a good example of the principle of minimization. “This is one of eight nationally recognized principles of ‘Fair Information Practices,'” she says. “You collect the very minimum amount of sensitive information that you absolutely have to have to manage a business need. If you don’t need it, don’t store it, don’t collect it.”
Russell notes that eliminating the digitized signature has an added benefit. “It was time-consuming to capture and print the digitized signature,” he says. “This will speed up the card production process.”
University members whose ID cards include a digitized signature will not need to change their cards, since the signature on the card itself poses no greater risk than a signature on any other piece of identification. Those who prefer a card without the signature, however, can replace their card for $15. For more information, call 936-2273 or send an e-mail message to [email protected].
ID cards can be obtained at the following locations: Entre Plus Office, Pierpont Commons; G270 Wolverine Tower; Room 100, Student Activities Building; and Room C158, Med Inn Building.
Signatures: Digital or Digitized?
“People get confused about digital vs. digitized signatures,” says Robert E. Russell, assistant director for systems and bank cards in Financial Operations. “They’re totally different things, but the terms are so similar.”
A digital signature is a sequence of bits added to a digital document such as an e-mail message. It is created by performing calculations on the message itself; when the message arrives, complementary calculations are done. If the results match, the recipient has confirmed not only the identity of the originator, but also that the message was not changed on the way. Although a digital signature does not look like a handwritten signature on a paper document, when properly applied, it serves the same purpose, assuring the recipient of authentication and integrity.
A digitized signature is an image of a person’s handwritten signature that has been reproduced in its identical form and stored in an electronic file for reuse on a computer. A digitized signature could be compared to a high-quality signature stamp: it’s convenient, but there could be a problem if it gets into the wrong hands.
