Digital signature: legal validity and uses

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

You signed digitally: are you protected?

You sent a contract, the other side clicked “Confirm”, and now they refuse to perform. They say: “I didn’t really sign anything.” This happens, and if you did not check exactly what kind of signature you received, they may be right.

The Electronic Signature Law, 5761-2001, sets three levels of digital signature. The difference between the levels is not only technical: it decides whether your signature will hold up in court.

What is the difference between the three types of signature?

A simple signature is any digital mark attached to a file: an X in a PDF, a username in an email, a click on “Confirm” in a form. There is no real identity check here. A court can accept it as evidence (section 3(a)), but the other side can dispute it relatively easily, and in a contract, a party that designed the way of signing bears the burden of proving that the other party signed (section 3A).

A secure electronic signature (חתימה אלקטרונית מאובטחת) is usually based on encryption (for example RSA or ECDSA), is unique to the signatory, is created with a signature device under the signatory’s sole control, and makes it possible to detect any change to the document after signing (section 1 of the Law). It is stronger: a message signed with it is prima facie evidence that it was not changed after signing (section 3(b)), and it does not need a certification authority. But it is still not the highest level under Israeli law.

A certified electronic signature (חתימה אלקטרונית מאושרת) is the level that really counts. It is a secure electronic signature for which a registered certification authority (CA) has issued a certified electronic certificate, and on its own it meets any signature requirement set in legislation (section 2(a)(1) of the Law), except for a handwritten will, which cannot be signed electronically at all (section 2(b)(2)). It is also prima facie evidence that the message was signed by the holder of the signature device (section 3(b)(3)). When the law requires a document to be signed, this is the safe way to meet the requirement.

For which documents may a digital signature not be used at all?

Even a secure electronic signature does not suit every document. The Law expressly limits the use of an electronic signature only for the documents listed in the First Schedule to the Law (section 2(b)), and these are wills only: a will under section 20 or 22 of the Succession Law, 5725-1965 (חוק הירושה, התשכ״ה-1965), and a memorandum of an oral will can be signed only with a certified electronic signature, while a handwritten will cannot be signed electronically at all. Real estate transactions and family law documents are not listed in this Law. For a handwritten will, the handwritten signature is a legal requirement, not a matter of choice.

For all other documents (employment contracts, commercial agreements, undertakings, invoices, digital government documents), when the law requires a signature, the requirement can also be met with an electronic signature that is not certified, if the purposes of the signature requirement are met with a sufficient level of certainty in the circumstances (section 2(a)(2)).

Who is authorized to provide a secure digital signature in Israel?

Certification authorities, the bodies that issue certified electronic certificates for a certified electronic signature, must register in a register kept by the Registrar of Certification Authorities, who operates in the Ministry of Justice (within the Privacy Protection Authority); the Ministry of Communications is not involved in this. They must meet the conditions of section 11 of the Law, including reliable hardware and software systems protected against intrusion, and a bank guarantee, another security or insurance to compensate anyone harmed by an act or omission of the certification authority.

In practice, international business contracts usually use services such as DocuSign with a PKI certificate, Adobe Sign, or government systems such as those of the Israel Tax Authority. A signature through such a service is not necessarily a “certified electronic signature”: it is certified only if the certificate was issued by a certification authority recorded in the register (sections 1 and 9) or by a foreign certification authority that the Registrar recognized and registered (section 22). To check the list of registered certification authorities, you can go to the website of the Registrar of Certification Authorities at the Ministry of Justice.

Businesses: for which uses is it most worthwhile to adopt a digital signature?

A secure digital signature saves significant time and costs in several situations: recurring customer contracts (sent, signed and returned in minutes, without printing), government documents (applications, licenses, reports), and bank transactions that require identity verification.

The rule: the more important the document, and the more likely a dispute about it in the future, the more you should make sure you use an authorized provider with full records. This is not only a question of convenience: it decides whether you can enforce the contract if a dispute arises.

Your secure signature device was stolen or exposed? What the law requires

1. Keep the signature device safe (for example a smart card or a private key) and take every reasonable measure to prevent its use without your authorization (section 7(a)(1) of the Electronic Signature Law, 5761-2001).
2. Have you learned that control of the signature device has been compromised? Notify at once anyone who can reasonably be expected to rely on your signature in routine dealings, and anyone you know is very likely to rely on it (section 7(a)(2)).
3. With a certified electronic signature, also notify at once the certification authority that issued the certificate for you (section 8(a)(3)).
4. Record when and whom you notified: a person who has met these duties will not be liable for damage caused by the use of their signature device without their authorization (sections 7(b) and 8(b)).