Who's out there?

A new digital signature service will allow businesses to authenticate their identity to customers. But, as Guy Clapperton reports, the market is in its infancy.

Thursday February 5, 2004
The Guardian

The self-employed will either have submitted their tax returns last Friday - Saturday, at a pinch, if your local office was open - or will be sitting and praying for their accountants to get on with it and save them more than they'll be paying in fines for late delivery. In the incorporated business world, the deadlines are more fluid, but they tend to gravitate around April. For such companies, there is one month after the end of each quarter to submit your VAT return or else face penalties.
The frustrating thing about all of this is that for some time, the government has allowed businesses to process a lot of these transactions electronically. The difficulty has been that small businesses don't necessarily have a dedicated IT person and therefore don't have time to look into security issues, set up passwords and other procedures. This is why the British Chamber of Commerce has set up Chamber SimplySign. It is a digital signature service that is about to become available from the BCC subsidiary, ChamberTrust.

The deal is that, for £25, businesses can get an electronic passport to underpin an electronic identity that will work with government sites, on emails between customers and suppliers, and anywhere else that establishing someone's identity is paramount. These IDs can be obtained from www.simplysign.co.uk.

One prospective user is Jan Klin, proprietor of IT Consultancy Jan Klin Associates. "I travel a lot and contact people through websites and on email. It is important that my customers can have absolute verification that it's me they're dealing with," he says. He believes the complexity has put a lot of businesses off this sort of technology in the past. "Before, you needed to know exactly what you were doing, carry out certain checks to make sure your emails were properly encrypted," he says. "It's much, much easier to use now."

Essentially, using the service means any email can be encrypted so that only the intended recipient can open and read it. No extra equipment is necessary: a PC with an internet browser will do nicely.

Kathy Riley, head of business development for the BCC, happily admits that many of the government interfacing and other security functions in the product were already available. For VAT returns "you could Pin and password, for example. But what we're trying to do is to give businesses added value, so you can do your VAT return but also send secure emails, for example."

Riley adds that electronic VAT returns will shortly be followed by electronic payments, at which point electronic verification will become vital. "What we're trying to do is educate people about digital identities," she says.

To an extent, the BCC - whose technology in this case is supplied by security experts Trustis - is in the position of trying to sell the first telephone. However, the legal framework is in place: a digital signature will have the same force as one in hard copy when it comes to contracts, for example. But using them is far from common at the moment.

Klin says: "I think the reason it's not been taken up so far is that business owners aren't aware of it and they don't understand how it works or why it's important. As an IT consultant, I do." But Riley is keen to stress that users do not need to understand the technical underpinnings to find the service useful. She compares it to telephones: "You pick up the phone and there's a dialling tone, you don't need to understand exactly how it works." That's the position she wants to reach with digital signatures. Unfortunately, it leaves the BCC in the position of selling the first telephone, which is fine until you want to make a call and no one else has one.

Tony Naggs, IT adviser for BusinessLink in Hertfordshire, gives the scheme a cautious welcome, preferring to see it as an awareness-raising exercise. "It's great that they're doing it, it's an excellent idea, but the problem we have is that digital signatures are voluntary," he says, "until someone like Microsoft puts it in the next edition of something like Outlook. It'll be fine having a digital signature but if the person you're sending to hasn't got it, so what? I know I can prove it's me, but if you haven't got the keys on your computer, you can't check." It would take a radical move like this from a software player for signatures to reach critical mass, he suggests.

Naggs applauded the BCC for setting up the Chamber SimplySign scheme because the concept needs establishing. "There's a huge problem in that small and medium businesses don't have any understanding of [digital signatures]." And take-up will remain sluggish, he suggests, as long as there is no compulsion to encrypt and check messages in this way.

"What we've got is total agreement that it's important to be secure," he says, "but at this stage it's all: 'wouldn't it be nice if' and 'you can do this if you want'."