How an e-Signature Failure Derailed a €3bn Swiss-Austrian Transport Deal

Last week order for 186 double-decker trains was nullified due to a legal formality surrounding the Qualified Electronic Signature used to ink the deal. Guillaume Forget, Managing Director and e-signature specialist of Cryptomathic GmbH, unpacks what went wrong and highlights what businesses everywhere can learn from the debacle.

On 21^st September 2021, the Swiss-based train manufacturer, Stadler, announced that it lost a €3bn contract with the Austrian Federal Railways ÖBB due to a legally impermissible electronic signature on the purchase agreement.¹

The consequences of such a failure are serious. The costs inherent to a multi-billion public tender are counted in millions and the episode could delay delivery by a year or more. And now Stadler has no assurance, whatsoever, that it will still be awarded the contract.

What went wrong?

From a technical point of view, the e-signature was not flawed. It was the surrounding legal framework that failed.

The contract was governed by Austrian Law and needed to be signed with a Qualified Electronic Signature (QES). The Austrian Signature Law² is directly derived from EU law, the Electronic Identification and Trust Services (eIDAS) regulation,³ which warrants that a QES has the equivalent legal effect of a handwritten signature.

Stadler used a QES to sign the contract. So far so good.

The problem lies with the Trust Service Provider (TSP) used to deliver the signature service. Stadler used a Swiss TSP which means the QES is thereby considered qualified under Swiss Signature Law (ZertES).⁴ From a technical point of view, a QES under ZertES and a QES under eIDAS are almost identical. They follow the exact same technical standards together with a very similar certification framework. The main difference lies in the liability of the services rendered. EU and EEA countries follow the eIDAS framework, which offers cross-border interoperability between all EU and EEA member states. In other words, what is qualified in Germany will have the exact same legal effect as what is qualified in Austria.⁵

This interoperability is, however, strictly limited to the EU member states. The eIDAS and ZertES regulations allow for the possibility to establish a recognition agreement with third-party countries, but, in this case, none had been negotiated or entered into. In 2017, at a Cryptomathic conference in Zurich, the head of the legal data processing unit at the Federal Office of Justice confirmed that even though the underlying standards are the same, interoperability is not automatically provided in the absence of a mutual recognition agreement between the EU and Switzerland.

Inevitably then, the Austrian Federal Administrative Court declared that Switzerland is not part of the EU and that the jurisdictions are not aligned.

To avoid this procedural flaw, Stadler could have signed using a Qualified Electronic Signature, delivered by a trust service provider legally domiciled and supervised in an EU or EEA country and duly registered in the EU trusted lists. Any other service provided from third-party countries such as Switzerland or the UK would not be fit for purpose.

Most providers including DocuSign and Adobe offer, by default, qualified seals or simple electronic signatures. The electronic signatures are admissible in court but do not provide legal certainty; they would not have satisfied the requirements for the Austrian contract.

Key learnings: Multi-jurisdictional deals need legal certainty

This case demonstrates the critical importance of selecting the right e-signature partner and solution provider to ensure that the transaction cannot be repudiated due to a procedural flaw. Assurance or even high assurance that the contract is signed is not enough for sensitive operations or high-value transactions. Legal certainty is required.

Countries in the EU are in the fortunate position to have a legal framework where certain types of accredited trust services are granted the same legal effect as handwritten signatures. This principle of equivalence means that a document, which is ‘duly’ signed electronically, will be regarded as legally equivalent to the paper-based version with a handwritten signature. In case of dispute, the burden of proof is in the hands of the opposing party and the TSP is liable for the damage. The liability caps are defined with the TSP and usually follow the liability requirements set out in the national law where the TSP is registered. Similar legislation is in place in Switzerland, but there is no mutual recognition yet.

This principle of equivalence is however not present in all jurisdictions. The US eSign Act, for instance, grants legal recognition and court admissibility for electronic signatures and records, but it does not provide full legal certainty.

Regardless of the contract or jurisdiction, here are five golden rules that businesses need to observe to avoid falling into procedural traps:

1. There is no legal certainty without a duly performed identification process of the signee.

Solutions, where you do not present official ID documents, will never allow you to obtain legal certainty. There is a plethora of solutions, which rely only on invites by email, phone, or messaging. Without formal ID Proofing, either face to face or remotely, there is no certainty that the signee really is who they claim to be.

2. There is no legal certainty if you are not the signee.

Open the signed PDF in Adobe and check the signature panel. Do not rely on the information added in the new document as it has no legal value whatsoever. If you sign as a legal or physical person, you should recognize your name as displayed in figure 1, below. If your name is not included here, you are not the legal signee.

Figure 1 : Only those persons displayed in the signature panel are the legal signees.

3. The service provider must be admissible.

There is always a section in your contract which will state which jurisdiction applies to the contract. It is very important to verify that the service provider is legally domiciled in the same jurisdiction or in a jurisdiction that offers cross-border interoperability.

Contract	Certificate
Any EU or EEA Law	The provider shall be in the EU Trusted list for QES
Other jurisdiction	Service provider in the same jurisdiction

It is, however, not straightforward to verify where the certificate provider is legally domiciled. On the signature panel, check the certificate details of the issuer as shown in Figure 2 and Figure 3 where we see signatures using TSPs established in the US and in the EU respectively.

Figure 2: Here the Issuer is based in the US and the signature is therefore not permissible for an EU contract

Figure 3: Here is the statement that this is a Qualified Electronic Signature according to EU Regulation (eIDAS). Such verification would have saved Stadler!

Please note that many PDF readers do not present electronic signatures (e.g., Google Chrome).

4. There is no legal certainty if the signee does not retain a level of control

One of the easiest ways to spot a potential issue here is to look at the consent mechanism. Generally, a signee needs to demonstrate consent to a signature operation. This consent needs to be strongly bound to the signature operation and is typically provided using two-factor authentication, using an app or SMS-based one-time passwords.

Any solution that is simply based on username/password or with a static mechanism (e.g. scratching a signature on a pad or mobile phone) will not be regarded as sufficiently strong to deliver the level of security required to safeguard against replay or man in the middle attacks.

5. Without technical non-repudiation, there is no legal certainty

This aspect is more difficult for a non-expert to verify, i.e. to establish the assurance that someone cannot deny the validity of the e-signature. When you read something in your web browser or in your mobile app, how can you be sure that the text you read is genuine, from the right source, and agree on the content it displays?

Cryptomathic introduced the concept of What You See Is What You Sign (WYSIWYS) and implemented a solution that ensures, with a high degree of assurance, that the document(s) received at the beginning of the signature flow is/are truly rendered to the user, that they provide their willful consent, that the signed documents have not been altered and are signed for long-term archive. Finally, we also store the logs and can reproduce the visual experience days and years after the signature operation.

The legal framework for awarding contracts electronically with the Austrian Railways is based on Austrian law and incorporates amongst others, the EU regulation on electronic identification and trust services for electronic transactions in the internal market, i.e. all EU and EEA member states. Any bidder, therefore, needs to apply a QES issued from a TSP registered in the EU. Similar legislation is in place in Switzerland but, critically, there is no current mutual recognition between the EU and Switzerland that supports the level of legal non-repudiation required by orders of this magnitude.

Most electronic signature providers offer qualified seals or simple electronic signatures by default. These assets are admissible in court but do not provide legal certainty, which is the key issue here.

Bottom line: the lawyers at Stadler should have stressed the importance of the legal domicile of the TSP in this cross-border transaction.

If you have questions or need the advice to implement your e-signature solution, please do not hesitate to contact Cryptomathic.

References and Further Reading