have you used digital signatures?

[duncan drennan]

I've been trying to find out a bit more about digital signatures and exactly what their validity is in South Africa. Paul Jacobson posted an article on his blog in response to a question I asked him.

The starting point for a discussion about digital signatures in the context of South African law is the Electronic Communications and Transactions Act which was passed in 2002 or so. The ECT Act started with the basic premise that digital communications are no less valid than paper based communications. An important consideration that was taken into account when the Act was drafted is that the Act should be technology neutral so that it isn't quickly dated as technologies evolve. This translated into an Act that sets out certain features and technology neutral requirements for things like digital signatures which can be used to determine whether the signature concerned (in this example) are satisfactory.

Full article on Jacobson Attorneys Blog

I'm busy trying to find out more and would really like to know what you think of this - please read through the blog. There are a whole bunch of other issues which can also be impacted by this (such as electronic tax invoices). I'll try to elaborate on this shortly.

Do any of you sign anything digitally? Ever thought about how this could change the way you do business?

[Dave A]

SARS has made it plain that they accept electronic tax invoices.

ELECTRONIC TAX INVOICES
Vendors may now issue tax invoices to their customers electronically instead of in paper format. The tax invoices must contain:
- the name,
- address and VAT registration number of the seller,
- the name and address of the purchaser,
- a serialised invoice number,
- the date,
- the words “tax invoice”,
- a proper description of the goods or services supplied,
- the date of issue,
- the volume or mass of the goods,
- the consideration for the supply and the VAT charged or a statement that VAT is included in the price charged and the rate of VAT charged.

Tax invoices must be sent in encrypted format (at least 128 bytes), over a secure line or contain an electronic signature. The recipient of the supply must confirm in writing that he or she will accept electronic invoices for the purpose of claiming input tax. No other tax invoice may be issued and all copies extracted by the recipient must bear the words “copy tax invoice”.

Debit and credit notes may accordingly also be issued electronically, subject to the requirements set out in the VAT Act.
from VAT News September 2002.

This was followed up later.

VATNEWS 20 set out the requirements for vendors who wish to issue tax invoices, debit notes and credit notes in electronic format instead of the traditional paper version (hard copy). It is however not practical to verify beforehand that each vendor meets all the requirements, as this can only be ascertained when conducting an audit. Since the requirements have already been published in the VATNEWS, it is not necessary for vendors to make
individual applications for approval in this regard.

Vendors wishing to implement this electronic system must however ensure that they do not replace their existing paper based documentary systems before they meet all the requirements.

Note that it is an offence not to keep proper records as specified in section 55 of the VAT Act, whether these are in paper or electronic format.
from VAT News September 2003

Lastly, from page 56 of VAT 404 - 31st March 2004

11.6 ELECTRONIC TAX INVOICES
VATNEWS 20 sets out the requirements for vendors who wish to issue tax invoices, debit notes and credit notes in electronic format instead of the traditional paper version (hard copy). It is however not practical to verify beforehand that each vendor meets all the requirements, as this can only be
ascertained when conducting an audit. Since the requirements have already been published in the VATNEWS, it is not necessary for vendors to make individual applications for approval in this regard.

Vendors wishing to implement an electronic system must however ensure that they do not replace their existing paper based documentary systems before ensuring that they meet all the requirements. The requirements for these electronic documents are as follows:-
o The arrangement applies to tax invoices, debit or credit notes. The mandatory information as set out in sections 20(4), 21(3)(a) and 21(3)(b) respectively must appear on these documents;
o The intended recipients must confirm in writing that they are prepared to accept electronic documents under the conditions set out. (This authorisation must be retained by the supplier for a period of five years after the last electronic document issued to the recipient);
o Documents must be transmitted in encrypted form of at least 128 bit encryption format;
o Both the supplier and the recipient of the supply must retain the documents in readable and encrypted form for a period of five years from the date of the supply. They must also have access to the necessary codes or other means available to enable SARS auditors to compare the documents in readable form with those in encrypted form;
o If a service provider is used, that person must also retain the documents for a period of five years; and
o The transmitted electronic document will constitute the original tax invoice, credit or debit notes. Hard copies extracted from the system must bear the words “computer generated copy tax invoice”, “computer generated copy credit note” or “computer generated copy debit note” thereon. All further copies must also bear such words.
o No other tax invoice, credit or debit note may be issued in respect of the specific supply, unless such document is marked as a copy of the original document.

Actually, this gets quite interesting...

[duncan drennan]

SARS has made it plain that they accept electronic tax invoices.

I was reading VAT 404 last night and this morning and the tax invoice was one of the issues that I wanted to get to.

There are two basic requirements for a digital signature, namely,

1. The identity of the signer can be confirmed
2. The integrity of the document can be confirmed

I've been having a look at SARS requirements and trying to figure out exactly what they are. If I understand correctly then there only requirement is to ensure that the document does not get tampered with. Interestingly enough I've received invoices that do not conform to this, and therefore are not valid tax invoices (i.e. input VAT cannot be deducted!).

It's relatively easy to meet SARS requirements by using a PDF file and encrypting it with freely available software.

With a contract you want to make sure that both the identity and the integrity requirements are met. That requires the encryption/signing to be done in such a way that it is uniquely traceable to the person signing the document, and the law is a bit iffy on what is acceptable in this regard.

[Dave A]

This clearly is the crux:

Tax invoices must be sent in encrypted format (at least 128 bytes), over a secure line or contain an electronic signature. The recipient of the supply must confirm in writing that he or she will accept electronic invoices for the purpose of claiming input tax. No other tax invoice may be issued and all copies extracted by the recipient must bear the words “copy tax invoice�.

The rest is standard fare applicable to any tax invoice.

It's that word "or" that really caught my attention.
So it needs to be encrypted - I think Duncan's on the money with the encrypted pdf
.and.
{sent over a secure line (https) .or. contain an electronic signature}

Which means an encrypted pdf does not cut the mustard on its own.

As usual, when I see things like this I start running scenarios. Like is it even legal to send an unencrypted pdf that looks like a tax invoice? Could the vendor be in trouble here, even if a hard copy is sent as follow-up? Would that unencrypted version be considered a proforma invoice or an illegal copy?

I think I need to email myself a test invoice to see if our software is encrypting the pdf. But that would still leave the digital signature or secure line issue. Not to mention the written confirmation issue, which could defeat the "convenience" of using electronic tax invoices in the first place.

[duncan drennan]

Not to mention the written confirmation issue, which could defeat the "convenience" of using electronic tax invoices in the first place.

I think that it may be okay to have an email saying they are happy with this. Refer to Paul's blog,

One important consequence of the Act is the fact that a data message, like an email, has just about the same effect as a fax or letter in our law:

Information is not without legal force and effect merely on the grounds that it is wholly or partly in the form of a data message. (Section 11(1))

Now I'm not 100% sure what SARS accepts as written confirmation, but I think that a normal email (i.e. unsigned) would be suffice (may be wrong) here.

It's that word "or" that really caught my attention.
So it needs to be encrypted - I think Duncan's on the money with the encrypted pdf .and. {sent over a secure line (https) .or. contain an electronic signature}

Which means an encrypted pdf does not cut the mustard on its own.

I'm not sure if I agree. The VAT NEWS is a bit ambiguous - what you've interpreted with an AND could possible be an OR. So it could be that is must be encrypted OR over a secure line OR digitally signed.

Now I'm going to back that up with what is in the VAT 404 guide,

Documents must be transmitted in encrypted form of at least 128 bit encryption format;

There is no mention of specifics on the VAT 404 guide (i.e. encrypted/secure line/digital signature). Each of those three options can effectively offer a "128 bit encryption format" so I think that any of them is acceptable.

Again it comes back to the intention. My understanding is that SARS wants to make sure the invoice has not been tampered with (to obtain a tax advantage).

Just to add to this I know that FNB offers the facility to obtain your bank statements (which also form a tax invoice) via email. They send a PDF file which anyone can open, but which is encrypted so that it cannot be modified. This is obviously deemed acceptable by SARS else I'm pretty sure they wouldn't be doing it.

[Dave A]

I'm not sure if I agree. The VAT NEWS is a bit ambiguous - what you've interpreted with an AND could possible be an OR. So it could be that is must be encrypted OR over a secure line OR digitally signed.

I agree it's ambiguous. I've taken a position so that someone can prove me wrong Not convinced yet.

I posted a comment on Paul's blog last night, but it's awaiting moderation. I'll hold on to see if it is released before I resort to raising the point here. Paul comes up with some good stuff and it would be great to increase his exposure.

[duncan drennan]

I agree it's ambiguous. I've taken a position so that someone can prove me wrong Not convinced yet.

I've contacted SARS about this...if I don't get a response by early next week I'll call them.