Regulatory Compliance Using Digital Signature

Here is a short summary of how the US Army and OCSE/ACF/HHS were able to eliminate paper from a crucial business process requiring signatures using Infomosaic digital signature products

My Photo
Name:Manoj K. Srivastava
Location:Ellicott City, Maryland, United States

Monday, June 27, 2005

US Army FDM Application

Application Name: US Army Financial Disclosure Management Information Application
Funded by: The Office of Judge Advocate General (JAG)[1], Virginia
Developers: US Army[2], Communications Electronics Command (CE-COM)[3], Software Engineering Center (SEC)[4], Fort Monmouth, NJ


Legal Background

In 1978, the Ethics in Government Act (EIGA)[5] established a comprehensive code of ethics for federal officials in the entire government. EIGA mandates government officers to file public financial disclosure statements (SF 278)[6] in order to make it possible to identify conflicts of interest. The law requires public disclosure in such detail to give the public enough information to make an informed judgment about an official’s compliance with the ethics laws.

In the US Army, regular and reserve military officers whose pay is O-7 and above, including the Brigadier General, Major General, Lieutenant General, and General, have to file SF278 forms in conjunction with the ethics law, within 30 days of assuming their position.[7]

Problem

The Office of the Judge Advocate General in Virginia (JAG[8]) provides legal assistance to Army personnel worldwide. In conjunction with the SF278 forms, they sought an application that would simplify the filing process for use by their clients, senior level Army management worldwide, while utilizing digital signature technology to provide access by the appropriate people. Typically, the process involves filling out the paperwork manually or electronically, sending the form to the Office of Government Ethics (OGE), having the information approved, and posted on public records. A report is not considered "filed" until it is received in the designated office.[9] This process can be long and arduous, especially when users want to access the information or need to file within the 30 days of assuming their position.

The problem was addressed to the Software Engineering Center (SEC) to develop an application to handle their needs and provide a secure method of using the digital signature technology (PKIs) for their users.

Solution

Purpose of Application: to electronically send SF278 forms to appropriate users on a secure program

The Software Engineering Center (SEC), headed by Steven Weiner, developed the Financial Disclosure Management Information Application, launching the production version on 3/31/05. The purpose of the application is to allow appropriate users the ability to enter and access financial information using a secure electronic method that verifies user certificates. The application simplifies the process of filing the SF278 form, eliminating the long process of filling, mailing, and approving forms, which can take up to several weeks to process while crossing many unnecessary channels.

This new Financial Disclosure Management Application uses the Infomosaic SecureXML Java Applet for accessing Common Access Card (CAC) or Smart Card based PKI certificates to create cryptographically secure W3C standard compliant XML signatures. This system uses a J2EE Application Server along with the Infomosaic SecureXML Signature on the server side for signature digest calculation, certificate validation and signature verification. The application uses the SecureXML Java Applet on the client side for access to user certificate and private key for digest encryption, an integral part of digital signing. The number of users of this system is expected to be approximately 40,000.

The Infomosaic SecureXML Java Applet provides seamless integration with ActivCard Gold and Litronic NetSign CAC middleware for CAC demographic data access in addition to private key access for signing, from both Microsoft Internet Explorer and Mozilla Firefox browsers. It works with both the Sun as well as the Microsoft Java Virtual Machines when using Internet Explorer for document signing. The Infomosaic SecureXML Java Applet requires zero client side installation and setup allowing the US Army to effortlessly deploy the Defense Financial Disclosure Management System world-wide to the Army personnel already in the field.

Summary of Benefits

The foreseen benefits include efficiency in filing process, reduction in paper/mailing costs, and convenience for all users.

Speeds up filing process for officers who need to meet their deadline of 30 days to fill out the form, helps them to avoid late fines, etc.

Process can be done entirely online, where officers can fill out the form online, and have it electronically sent and verified by all necessary individuals.

[1] JAG site
[2] US ARMY, Fort Monmouth Site
[3] http://www.monmouth.army.mil/CELCMC/
[4] SEC website
[5] EIGA site
[6] SF278 form
[7] National Institutes of Health Ethics Program
[8] The Judge Advocate General
[9] US Dept of Health & Human Services Site