An important characteristic of ink-on-paper signatures is that they can be
individually studied and analyzed by forensic handwriting experts, then
compared to other existing samples for authentication. Perhaps the most
significant challenge to the validity of an electronic signature is the issue of
authentication, since few technology providers support their technology with
verifi cation tools. If a signature cannot be attributed to the purported signatory,
it is worthless. Electronic signatures are no exception to this, and must be
capable of authentication to be valid and binding. Insist that a technology
provider have authentication tools and training in-place before selecting their
solution.

Systems that embed an electronic  signature image into an electronic document
have less legal weight than faxed or photocopied
signatures. Like "rubber-stamp" signatures, the object representing the
signature is a superficial representation with no data linking the image to a
biometric performance, and unlike a fax transaction, there is no 3rd-party
record of the transmission. A bitmap, tif, or jpg image is not useful to a forensic
examiner as it provides no detailed characteristics for analysis as is provided
with original pen data.

The most accurate, reliable, and secure method of capturing an electronic signature is in
the form of raw pen events. A file of this type contains no images or analysis of
the electronic signature, just the pen events and position converted at high speed. This
data has the additional advantage of being stored in a database or bound to
the contents of a document very securely since it does not exist as a common
image file format. It cannot be easily copied, viewed or used as a reference
for forgers since there is no embedded image. Furthermore, since all original
captured pen events are present in the electronic signature itself, a forensic expert can
later examine it point-by-point using specialized signature analysis software, if
available.

In general, when deciding which electronic signature system best suits the
needs of your business, use traditional paper-based practices as a gold
standard. If a specific technology mimics or matches these practices closely, it
is probably a safe and reliable choice. The more technical shortcuts a system
employs, such as creating multiple signatures with one stroke of a pen or
keypad, or saving flat images in place of real, forensic-quality signatures, the
more likely the system is to encounter difficulties and fraud in practice. With old
ink-on-paper characteristics as your guide, your electronic signature document solution
should be a signature success.

Signature capture hardware manufacturers have their own specifications,
data formats, and software methodologies that affect security, authentication,
and legality.

For the sake of privacy and legal enforceability, an electronic
signature capture must remain under the "sole control of the signer" to be valid under
the national ESIGN electronic commerce law. To satisfy this requirement, an electronic signature must be placed or linked into the relevant document directly, with no interlopers
or copies, and then bound to the document in such a way as to render document
tampering detectable. Without these critical features, it would not be possible to
prove that a signatory did indeed assent to the terms of the written agreement,
or that the language in the document was identical in form to the state in which
it was initially signed.

There is no substitute for an effective security policy which prevents viruses,
worms and data sniffers from residing on a client or server computer.
Encryption gimmicks in a signature pad connected to a PC provide a false sense
of security if a rogue program or keyboard, printer, screen, memory, or usb data
sniffer is also on the PC.
 
Matters can be made worse if overly powerful and
un-necessary processors and operating systems are employed in electronic
signature devices, due to latent bugs and viruses or internal data storage
and encryption; as these techniques further jeopardize and remove security
monitoring and update capability from the hands of IT personnel.