E-Sign on the Dotted Line

Historically, the financial aid process started with a thick packet of papers called the Free Application for Student Aid, or the FAFSA. Loan applicants filled out the complicated forms and sent them to the Education Department's Office of Student Financial Assistance (SFA). The agency processed the forms and then sent the applicant a promissory note. After signing those loan papers, students received their money and got on with the vagaries of college life. When they finished college, they began to repay their loans.

This entire process was paper-based until 1996. That year, SFA introduced the application online, a move that is increasingly popular with a generation of students accustomed to surfing the World Wide Web. The process improved even more in June 2001, when SFA introduced a system enabling students to electronically sign their loan documents without ever touching a sheet of paper. The entire process is cheaper, quicker and easier, Education officials say. And electronic signatures have made the entire revolution possible.

Signed, Sealed, Delivered

Loan applications on the Web have proved exceedingly popular. In 2000, 690,000 applications were filed online compared with 1.3 million in just the first six months of 2001. To apply for a loan online, a student must register for a personal identification number, or PIN. A simple Web form asks for the student's vital statistics, such as name, date of birth, Social Security number, street address and e-mail address. SFA uses the identification numbers to verify whether students are who they say they are online. The agency has issued more than 13 million PINs.

After SFA processes a loan request and verifies that a student has enrolled in a college, the office posts on its Web site an electronic, PIN-protected promissory note addressed to that student. Once online, students can type in their PINs. Then, in a 10-step process, they click through each page of loan information, confirming that they have read the digital document and understand their commitment to pay back the loan. The documents are recorded with date and time stamps. At the end of their digital documents, the students type in their PINs once more, to confirm their electronic signatures.

The SFA then checks the students' PINs and their electronic promissory notes against a new authentication service, the Student Authentication Network (STAN), which functions as an electronic notary. In need of such a service, SFA convinced the loan industry to create the network, which was developed by NCS Pearson Inc., an education software developer based in Eden Prairie, Minn. Launched in June 2001, STAN processed almost 6,000 e-authentications in its first week in operation. SFA pays NCS Pearson 25 cents for each PIN verification.

Power of the E-Pen

Greg Woods, SFA's chief operating officer, says the agency reengineered the electronic promissory note system in just nine months. "We reengineered the entire system from front to back to be a paperless process," he says. "We knew how to do e-signatures technically. But first, we had to secure a commitment from our lawyers to back up and enforce these electronic processes. We had to be sure we could take an electronic record and convince a judge that in fact the money had been borrowed."

SFA had to work hand in hand with Education's Office of the General Counsel. "We wanted to be sure the loans would be enforceable and satisfy applicable legal requirements," says an Education lawyer who asked not to be named. Two key laws, the 2000 Electronic Signatures in Global and National Commerce Act, or E-Sign, and the 1998 Government Paperwork Elimination Act, gave electronic signatures legal grounding, the lawyer says.

E-Sign makes the electronic form of signatures, contracts and other official records legally equivalent to those written on paper. The Office of Management and Budget's guidance for implementing E-Sign says the law "promotes the use of electronic contract formation, signatures and record keeping in private commerce."

The paperwork elimination law not only calls for the federal government to automate its key processes by 2003, but also to use electronic signatures when possible. And where E-Sign is specific in creating equivalency between the written and electronic worlds, the paperwork law is vague about how agencies should implement electronic signatures. OMB's guidance on the paperwork law affirms that numerous techniques for electronic signatures exist but leaves implementation decisions to the agencies. The key, OMB officials say, is to match the electronic signature mechanism to the level of security and authentication needed. The guidance distinguishes among three types of mechanisms, which "offer varying levels of assurance."

Shared secrets, at the lowest level of security, consist of PINs and passwords. This is not to suggest PINs and passwords are insecure. Shared secrets are the least technical and most inexpensive of all electronic signature options.

Biometric technology includes fingerprint, face, palm and retinal scans as well as voice recognition. Where PINs and passwords can be stolen or cracked, it is nearly impossible to replicate human characteristics such as a thumbprint.

Cryptographic digital signatures, or public key infrastructure (PKI), are at the highest level of security. PKI technology is used to encode data while in transit on a network and depends on digital certificates-electronic identifiers-unique to specific users. A PKI-equipped network can transform basic e-mail into official correspondence. For instance, the National Institute of Standards and Technology uses a PKI to sign and transmit everyday forms such as expense reports and requisitions. The Patent and Trademark Office uses the technology to accept patent applications online from registered patent attorneys.

Combinations of electronic signature technologies "may provide even higher levels of assurance than single approaches," OMB's guidance states. For instance, biometric devices such as smart cards, which contain microchips that store electronic data to identify their users, also can hold digital certificates used in a PKI.

E-Sign of the Times

The distinction between using these technologies solely for authentication as opposed to signing official documents online is an important one, says Arabella Hallawell, a senior analyst with the Gartner Group, a Stamford, Conn., market research firm. Authentication verifies one's identity, she says, while e-signatures record and file a person's acceptance of a contract's terms-such as SFA's digital document.

SFA investigated all the electronic signature options available on the market when building the electronic promissory note. "We looked at smart cards, digital signatures, biometrics," Coleman says. "The bottom line is that a lot of the infrastructure required for those technologies is not there yet. We decided to build on our already existing PIN infrastructure."

Coleman says it is vital for a project as sweeping as electronic signatures to include an agency's operational, legal and technology staffs. SFA is already beginning to see the benefits of moving so many of its processes online. "In the paper world you have mailing costs, storage costs and retrieval costs," he says. "In the electronic world, once SFA has recaptured the cost of its initial investment, we are betting unit costs will start to go down."

SFA already is developing a system that will allow graduates to make their monthly loan payments online. Woods wagers that in a year and a half, SFA will have completely automated the student loan process. "Soon, we'll have a process where the student makes first contact, applies, registers at a university, gets their loan package, goes through school and repays their loan with never ever having touched a piece of paper," he says. "I'm not sure [the Government Paperwork Elimination Act] even dreams about that."