SSR 96-10p: POLICY INTERPRETATION RULING ELECTRONIC SERVICE DELIVERY

SSR 96-10p

EFFECTIVE/PUBLICATION DATE: 12/30/96

PURPOSE: This Policy Interpretation Ruling represents the Social

Security Administration's (SSA) policy for allowing our customers to

communicate with us electronically through access methods such as the

Internet, video conferencing, and dial-up phone systems. By such methods,

we will be able to accept reports, requests, applications, and other

information. The Ruling also sets out our policy making electronic and

digital signatures the functional equivalent of traditional handwritten

signatures in certain situations which will be separately specified by

SSA. We call these efforts to provide electronic service options to our

customers electronic service delivery (ESD).

ESD includes the use of the specific technologies noted above, other

current technologies, and future and as yet unidentified technologies

which allow SSA's customers to transact business with us via

Agency-approved methods. By expanding our service delivery options, we are

continuing our efforts to provide world class service to our customers.

Information submitted by our customers using ESD technologies which are

consistent with the principles described below and meet

- accepted industry standards; and

- SSA privacy, security, fraud detection and prevention, and

authentication standards

will be considered by SSA to be the functional equivalent of information

submitted using traditional paper-based methods.

Determination of the appropriate ESD technologies for a given service will

be based upon our evaluation of the sensitivity of the information,

potential service impacts on our customers, and the risk factors including

fraud detection, prevention, and prosecution, and cost/benefit

considerations.

AUTHORITY: This Ruling is published under the authority of the

Commissioner of Social Security in accordance with 20 CFR 422.406.

PART I

gies for a given service will

be based upon our evaluation of the sensitivity of the information,

potential service impacts on our customers, and the risk factors including

fraud detection, prevention, and prosecution, and cost/benefit

considerations.

AUTHORITY: This Ruling is published under the authority of the

Commissioner of Social Security in accordance with 20 CFR 422.406.

PART I

INTRODUCTION: As noted in the Agency's Strategic Plan [1] and described in more detail in our

Business Plan [2] , SSA is expanding the

service options available to our customers in new and innovative ways as

technological advances allow. Agency ESD initiatives, based on proven

secure technology, will provide our customers with access to SSA to

conduct their business in new ways which are convenient for them and

efficient for both them and SSA.

SSA has historically relied upon paper-based systems of information

collection. Technological advances have reached the point where the use of

electronic information collection is efficient, cost-effective, and

frequently our customers' preferred method of doing business.

Paper-based information collection systems are perceived as being secure

largely because they are the only information collection systems with

which most individuals are familiar.

The following excerpt from a law journal article provides a historical

perspective of the security features of paper- based information

collection:

- Message integrity is the assurance that the content of a

communication is complete and has not been changed prior to receipt.

- Originator authentication provides assurance that the

communication originated from the named source. This is most commonly

provided by the handwritten signature, or historically, by the seal of the

author.

ty features of paper- based information

collection:

- Message integrity is the assurance that the content of a

communication is complete and has not been changed prior to receipt.

- Originator authentication provides assurance that the

communication originated from the named source. This is most commonly

provided by the handwritten signature, or historically, by the seal of the

author.

- Non-repudiation is a stronger form of authentication which

relates to the ability of a disinterested third party to reasonably

conclude that the identified originator intended to be bound by the

substance of the communication. This function is most commonly performed

by the original autograph signature affixed to a document having facially

adequate message integrity.

- Confidentiality is the ability to limit access to the

information contained in a communication. This has generally been

accomplished with some combination of security markings, envelopes, seals,

trusted messengers, and by the use of codes and

ciphers. [3]

The transfer of information in traditional paper-based systems is known as

"writing." ESD technologies allow the transfer of information by other

than traditional paper- based methods. SSA is adopting a definition of

writing which is consistent with modern legal usage and includes

electronic information transfer. For example, the U.S. Code includes a

definition of writing which is consistent with SSA's purposes:

This SSA policy making electronic information collection and distribution

the functional equivalent of traditional handwritten information

collection and distribution is in accord with U.S. law and the Federal

Rules of Evidence as shown in these definitions. Accordingly, as SSA

approves the use of specific ESD technologies, the products of those

technologies will be considered writings by us.

SSA policy making electronic information collection and distribution

the functional equivalent of traditional handwritten information

collection and distribution is in accord with U.S. law and the Federal

Rules of Evidence as shown in these definitions. Accordingly, as SSA

approves the use of specific ESD technologies, the products of those

technologies will be considered writings by us.

POLICY INTERPRETATION: It is the policy of SSA to treat information

received and distributed via Agency- approved ESD technologies as the

functional equivalent of information received and distributed using

traditional paper-based methods.

SSA s approval of ESD technologies for use by our customers will mean

that the approved technologies provide a sufficient level of security and

reliability that they can be an acceptable substitute for traditional

paper-based information collection systems as described above, for the

purpose of conducting the business of the Agency. Decisions about which

ESD technologies are suitable for use with SSA will be made with

appropriate input from the SSA components involved in the proposed

activity.

PART II

SSA requires a handwritten signature in only a limited number of

situations (e.g., applications for benefits). The circumstances where a

signature is required is an issue that is beyond the scope of this Ruling.

We are expanding the meaning of the term "signature" to include electronic

and digital methods that serve the purpose of originator identification,

authentication, and non-repudiation to the extent that is technologically

possible and feasible for SSA s activities.

ications for benefits). The circumstances where a

signature is required is an issue that is beyond the scope of this Ruling.

We are expanding the meaning of the term "signature" to include electronic

and digital methods that serve the purpose of originator identification,

authentication, and non-repudiation to the extent that is technologically

possible and feasible for SSA s activities.

POLICY INTERPRETATION: It is the policy of SSA that information for

which SSA requires a signature may be signed using SSA-approved signature

methods including handwritten, electronic, or digital methods. Approved

signature methods will reasonably ensure, to the extent technologically

possible and feasible for SSA s activities, that the signer can be

identified and that the signer cannot later repudiate the submission of

the information.

CONCLUSION: The early paragraphs of this Policy Interpretation

Ruling listed the four essential security characteristics of paper-based

information collection. These two policy interpretations were developed to

ensure that the four security characteristics described earlier are

maintained in all ESD technologies approved by SSA. Originator

authentication and non-repudiation are addressed as aspects of the

electronic and digital signature policy. Message integrity and

confidentiality, although not specifically described in the policy

statement endorsing ESD, are implicitly contained in the limitation

statement that all ESD technologies must be approved by

SSA. [6]

tained in all ESD technologies approved by SSA. Originator

authentication and non-repudiation are addressed as aspects of the

electronic and digital signature policy. Message integrity and

confidentiality, although not specifically described in the policy

statement endorsing ESD, are implicitly contained in the limitation

statement that all ESD technologies must be approved by

SSA. [6]

SSA approval of a particular ESD technology will require assurance that

the technology is consistent with all appropriate laws and directives.

Since the appropriate technology and levels of security will vary based

upon the sensitivity of the business application, SSA's selection of the

appropriate technology or technologies for a given usage will be based

upon consideration of the service impacts on our customers, a risk

analysis including fraud detection, prevention, and prosecution concerns,

and an analysis of the costs and benefits related to the technology.

In summation, it is SSA policy that all information received and

distributed via Agency-approved ESD technologies is the functional

equivalent of information received and distributed using traditional

paper-based methods. It is also the policy of SSA that information for

which a signature is required, can be signed using electronic or digital

technologies approved by SSA, provided that the electronic or digital

signature reasonably ensures that the signer can be identified and that

the signer cannot later repudiate the submission of the information.

d and distributed using traditional

paper-based methods. It is also the policy of SSA that information for

which a signature is required, can be signed using electronic or digital

technologies approved by SSA, provided that the electronic or digital

signature reasonably ensures that the signer can be identified and that

the signer cannot later repudiate the submission of the information.

These two policy interpretations are being issued to facilitate the

Agency's attempts to better serve our customers through the use of ESD

technologies. It is not intended that our customers always must conduct

business with SSA electronically. Rather, we are providing our customers

with an optional way of doing business with us while ensuring that the

information provided to, or distributed by, SSA through electronic methods

is as secure and reliable as it must be for the purpose for which it is

used.

EFFECTIVE DATE: This Policy Interpretation Ruling is effective

December 30, 1996.

[1] SSA Pub. No. 01-001 (September

1991).

[2] SSA Pub. No. 01-008 (April

1996).

[3] Peter N. Weiss, Security

Requirements and Evidentiary Issues in the Interchange of Electronic

Documents: Steps Toward Developing a Security Policy, The John Marshall

Journal of Computer & Information Law , Vol. XII, No. 3, pp. 431-432

(October 1993).

[4] 1 U.S.C. § 1.

[5] Fed. R. Evid. 1001(1). The Advisory

Committee notes to this rule make it clear that writings can be created by

mechanical or electronic techniques or other forms of information

compilation.

[6] For a detailed description of the

security features of electronic information transfers in general and

digital signatures in particular see generally , M. Baum, Federal

Certification Authority Liability and Policy (U.S. Dept. of Commerce,

NIST-GCR-94-654 (June 1994)).