Digital workflows and e-signatures
Following procedures for information governance when working from home raises many questions, and the need for solutions is substantial. In particular, there is a need for digital solutions, with or without an e-signature.
Do you need a signature at all?
We sign a lot of documents out of tradition and habit, rather than because it is a formal requirement. In other words, many documents do not need to be signed at all.
A survey has been done identifying the internal SLU documents that are usually signed (Swedish only).
Work is in progress providing more detailed instructions for approvals and signatures for different kinds of documents.
When do you need a physical signature?
There are few documents that legally require a physical signature on paper. At SLU, those that do include contracts regarding the purchase and sale of real estate, as well as signatures for the university’s annual report.
Contracts with external parties can sometimes be difficult to sign electronically. Contact the Legal Affairs Unit you are not sure what kind of signature is required.
What are e-signatures and when should they be used?
An electronic signature, or e-signature, is encrypted data in electronic form, logically associated with other data in electronic form.
An e-signature is not visible but consists of data that can be validated by a computer. Sometimes this is combined with a scanned image of a person's written signature. However, a scanned image is just a way of making a document look like what we are used to.
Scanning a written signature and pasting it into a document is not the same as an e-signature. Unfortunately, scanned signatures are sometimes used as if they were signatures written on paper. Avoid using scanned signatures.
Edusign, the Sunet system for e-signatures
SLU has an agreement with Sunet giving us access to their solution for e-signatures, Edusign. With Edusign, you can upload pdf files (and XML files) and sign them using your SLU login. The signature is linked to your employee ID at SLU, unlike the Swedish bank ID which is linked to your personal bank account. Edusign follows the technical framework for Swedish authorities drafted by the Agency for Digital Government (Digg). Several people can, in turn, sign the same document using Edusign. You will find instructions in this quick guide to using Edusign.
An eduSign signature can be validated using the Sunet validation service, and as the validation does not require a login, external parties outside the higher education sector can also use it to validate signatures. There is a quick guide describing how to validate signatures. Edusign adds a page to the pdf file listing all signatures, with the date of signing. No scanned signatures are displayed in the document.
Edusign is primarily intended for documents sent to external parties, or for decisions and minutes from the university board, the vice-chancellor's decision meetings, the faculty boards, deans etc. Many of the documents we handle internally at SLU do not require an Edusign signature. Instead, they can be signed or approved within the different IT systems we use, such as Public 360, Primula or Proceedo. Read more about digital workflows in Public 360 below.
E-signatures for digital degree certificates
The Division of Educational Affairs uses e-signatures for digital degree certificates. The certificates are created digitally and can be handled electronically throughout their life cycle. The signatures in Adobesign are valid and legally binding electronic signatures with support for e-archiving and long-term preservation. However, this is an expensive solution and so far SLU has only decided to use it for digital degree certificates.
What are digital workflows and when should they be used?
A digital workflow is when information is handled within a records management system.
At SLU, digital workflows are used in Public 360 (P360):
Cases and documents are created in P360 and every part of the approval process leaves a trace. There are film clips explaining how to start an approval workflow and how to reply to a request for approval (Swedish with English subtitles). Bear in mind that documents must have the status "Under arbete/Reserved" before you can start an approval workflow.
Less complicated cases are handled outside P360, with the decision-making process documented through approval, which is done by email outside P360. The document and the approval email are registered together in P360, see the temporary procedure below.
Most of our internal documents, like minutes and decisions, can be handled using digital workflows. Today, documents are printed and signed on paper even when there is no formal requirement to do so.
Digital workflows will be created for several processes at SLU to ensure the quality of transparency and traceability in our information governance. The Vice-Chancellor's Office is currently in the process of identifying possible digital information workflows. This is a long-term project.
Temporary procedure during the coronavirus pandemic
To handle digital workflows during the pandemic, there is a temporary procedure for approving documents that do not need a physical or electronic signature.
Background – digitalisation in public administration
Public administration must be innovative, efficient and ensure legal certainty. Partly to face the challenges of the future, partly to sustain good, democratic institutions in society. Sweden’s goal is to be the world leader in taking advantage of the possibilities offered by digitalisation.
However, digitalisation is not about new technology that solves everything with a keystroke. Rather, it is 80 per cent changing the way we work and 20 per cent technical solutions. This means that if we are to become truly digital, we need new procedures for information governance.
Trusted services in public administration
The Swedish government has appointed a committee of inquiry looking into the possibilities of increasing and standardising the use of trusted services in public administration (committee directive 2020:27). The final report has been postponed until 30 June 2021. An interim report (SOU 2021:9) was published in February 2021 (Swedish only).
Pilot study on signatures
The Swedish National Archives have published a pilot study (Swedish only) (RA-KS 2021/18) on using and handling signatures using electronic materials and methods.
Frequently asked questions about Edusign
Can students and external users use Edusign?
Students and staff at SLU can use Edusign. Users who do not work at a higher education institution can request an eduid.se login (Swedish personal identity number required).
Users at organisations who do not have an Edusign agreement with Sunet cannot initiate signautres, but can sign if invited by SLU.
Organisations with Sunet agreements: https://wiki.sunet.se/display/SWAMID/SWAMID+Members
How do I use Edusign?
You will find detailed instructions in the Quick guide to using Edusign and the Quick guide to validating Edusign signatures.
Can a document have both physical and digital signatures?
No. A digitally signed document that is printed is considered a copy. If an agreement is signed digitally by one part and physically by another, both versions must be archived.
Can I add an SLU id to a document that has already been signed?
No, the SLU id must be added before the document is signed as signing it makes it write-protected. However, you can add the id to the file name - this does not affect the signature.
I'm using Adobe Acrobat to validate a document that has been signed in Edusign, why does it say that the signature isn't verified and the identity unknown?
This is because documents signed in Edusign cannot automatically be validated using Adobe Acrobat Reader. You need to use the Edusign validation service. You can, however, change the settings in Adobe Reader to accept Edusign signatures as valid signatures. This is explained on page 6-10 in the quick guide to validating signatures.
Can different e-signing services be combined?
You cannot combine other e-signature services like Docusign, Zealid or Trustweaver with Edusign. If you try to, one of the signatures will usually end up being invalid.
Can I validate signatures that have been made using other services?
In some cases, these will have their own validation services. Check for information next to the signature or on the web pages of the supplier.
Error messages and solutions
You can sometimes get an error message when you upload or sign a document using Edusign.
javax.crypto.BadPaddingException: Given final block not properly padded
A document that has already been signed using a service other than Edusign, or other services that comply with the DIGG technical framework, cannot also be signed in Edusign.
The document can be signed in Edusign only.
PDF contains an encryption dictionary, please remove it with setAllSecurityToBeRemoved() or set a protection policy with protect()
It is not possible to sign password-protected PDFs in Edusign.
Remove the password protection and try again.
Something went wrong with the batch file upload operation. Try again later!
Your session has expired.
Log in again.
- Link to the Edusign login page
- Quick guide to using Edusign
- Quick guide to validating Edusign signatures
- Interim procedure for approving documents using a digital workflow (SLU ID: SLU.ua.2020.1.1.1-1601)