Electronic records, electronic signatures and e-governance

1. Authentication by digital signature: section 3

• Section 3(1): a subscriber may authenticate an electronic record by affixing his digital signature.
• Section 3(2): authentication is effected by the use of an asymmetric crypto system and hash function which envelop and transform the initial electronic record into another electronic record.
• Hash function (Explanation): an algorithm mapping one sequence of bits into another, generally smaller, set (the “hash result”), so that the same record always yields the same hash result, and it is computationally infeasible (a) to reconstruct the original record from the hash result, or (b) for two records to produce the same hash result.
• Section 3(3): any person can verify the record by using the subscriber’s public key.
• Section 3(4): the private key and public key are unique to the subscriber and constitute a functioning key pair.

How it works. An asymmetric crypto system is a secure key pair: a private key to create the signature and a public key to verify it (section 2(1)(f)). The sender hashes the message and encrypts the hash with his private key. The recipient decrypts it with the sender’s public key and compares it with a fresh hash of the message. A match proves origin (authentication) and that the message is unaltered (integrity).

2. Electronic signature: section 3A

Inserted in 2008 to make the law technology-neutral. A subscriber may authenticate a record by any electronic signature or authentication technique that is reliable and specified in the Second Schedule. It is reliable if (section 3A(2)):

1. the signature creation data or authentication data are linked to the signatory and to no other person;
2. that data was, at the time of signing, under the control of the signatory and no other person;
3. any alteration to the signature after affixing is detectable;
4. any alteration to the information after authentication is detectable; and
5. it fulfils other prescribed conditions.

The Central Government may add or omit techniques in the Second Schedule by notification, laid before Parliament (section 3A(4), (5)). The Second Schedule has been used to notify e-authentication techniques such as Aadhaar e-KYC based electronic signing (“eSign”). Remember: every digital signature is an electronic signature, but not every electronic signature is a digital signature (section 2(1)(ta)).

3. Electronic governance: sections 4 to 10

Section 9 is a favourite trap: the Act enables e-governance but does not compel the Government to go electronic.

4. Electronic contracts: section 10A

Where, in forming a contract, the communication of proposals, acceptance of proposals, and revocation of proposals and acceptances are expressed in electronic form or by electronic records, the contract shall not be deemed unenforceable solely on the ground that electronic form was used. Section 10A does not create a new law of contract: offer, acceptance, consideration, capacity and free consent still come from the Indian Contract Act, 1872. It only removes the objection of form. Remember too that a contract for sale of immovable property is outside the IT Act (First Schedule).

Even before section 10A, the Supreme Court in Trimex International FZE Ltd. v. Vedanta Aluminium Ltd., 2010 INSC 57, held that a contract (including an arbitration agreement) concluded by an exchange of e-mails is binding once the essential terms are agreed, even though a formal signed contract was to follow and was never executed.

5. Attribution: section 11

An electronic record is attributed to the originator if it was sent:

1. by the originator himself;
2. by a person who had authority to act on behalf of the originator for that record; or
3. by an information system programmed by or on behalf of the originator to operate automatically.

Clause (c) is why an auto-generated order confirmation binds the company that set up the system.

6. Acknowledgment of receipt: section 12

• 12(1): if the originator has not stipulated a form or method, acknowledgment may be given by any communication by the addressee (automated or otherwise) or by any conduct sufficient to show receipt.
• 12(2): if the originator stipulated that the record is binding only on receipt of acknowledgment, then until it is received the record is deemed never to have been sent.
• 12(3): if no such stipulation, and no acknowledgment comes within the agreed or a reasonable time, the originator may give notice fixing a reasonable time; if still none, he may, after notice, treat the record as never sent.

7. Time and place of despatch and receipt: section 13

All rules apply “save as otherwise agreed” between originator and addressee.

• Despatch (13(1)): when the record enters a computer resource outside the control of the originator.
• Receipt (13(2)): (a) if the addressee has designated a computer resource, receipt is when the record enters it; if sent to a non-designated resource of the addressee, receipt is when the addressee retrieves it; (b) if no resource is designated, receipt is when it enters the addressee’s computer resource.
• Place (13(3)): deemed despatched where the originator has his place of business, and received where the addressee has his place of business, even if the server is elsewhere (13(4)).
• 13(5): more than one place of business means the principal place of business; no place of business means the usual place of residence; for a body corporate, the usual place of residence is where it is registered.

These rules matter for the court’s territorial jurisdiction in contract disputes: acceptance by e-mail is received where the offeror carries on business, not where his mail server sits.

8. Secure records and signatures: sections 14 to 16

• Section 14: where a security procedure has been applied to an electronic record at a specific point of time, it is a secure electronic record from that time to the time of verification.
• Section 15: an electronic signature is a secure electronic signature if (i) the signature creation data was, at the time of affixing, under the exclusive control of the signatory and no other person, and (ii) it was stored and affixed in the prescribed exclusive manner. For a digital signature, the signature creation data is the private key.
• Section 16: the Central Government prescribes security procedures and practices for sections 14 and 15, having regard to commercial circumstances and the nature of transactions.

Proof of these records in court is dealt with in the note on electronic evidence under the Bharatiya Sakshya Adhiniyam, 2023.

How AIBE asks this

Questions here are section-matching: which section gives legal recognition to electronic records (4) or signatures (5), which validates e-contracts (10A), or which fixes the time of despatch (13). The technical terms in section 3 (asymmetric crypto system, hash function, public key used to verify) also appear as one-liners. A trap option often says the Government is bound to accept electronic filings; section 9 says it is not.

Quick check

1. Under section 3(2), authentication of an electronic record is effected by:
   (A) a password and OTP
   (B) an asymmetric crypto system and hash function
   (C) a symmetric key and biometric
   (D) a scanned handwritten signature
   Answer

   (B). Section 3(2) names the asymmetric crypto system and hash function.
2. A digital signature is verified by:
   (A) the subscriber’s private key
   (B) the Controller’s private key
   (C) the subscriber’s public key
   (D) the hash result alone
   Answer

   (C). Section 3(3): any person can verify the record using the subscriber’s public key.
3. Validity of contracts formed through electronic means is provided by:
   (A) section 4
   (B) section 10A
   (C) section 11
   (D) section 81A
   Answer

   (B). Section 10A, inserted in 2008, bars treating a contract as unenforceable solely because electronic form was used.
4. Unless otherwise agreed, despatch of an electronic record occurs when it:
   (A) is composed by the originator
   (B) enters a computer resource outside the control of the originator
   (C) is read by the addressee
   (D) is acknowledged by the addressee
   Answer

   (B). Section 13(1).
5. Section 9 of the IT Act provides that:
   (A) every government department must accept electronic records
   (B) no person can insist that a government department accept documents in electronic form
   (C) electronic records must be retained for seven years
   (D) the Electronic Gazette replaces the Official Gazette
   Answer

   (B). Sections 6, 7 and 8 confer no right to insist on electronic acceptance.