USPS electronic verification is in the mail
The Postal Service, Microsoft and a technology company called Authentidate have developed a system called Electronic Postmark for verifying that a document's content is the same as when a user saved it. The service, introduced in October, is in some ways more a notary public's stamp than a postmark, intended particularly for those affixing their electronic signatures to documents relayed online.
After downloading a free add-on program, or plug-in, for Word, a user can purchase Electronic Postmarks and insert them into any Word document. The plug-in is compatible with Word XP and Word 2003. Once the document is signed, the Postmark locks it down, preventing further changes within Word.
Of course, for the expert, there are still means of tampering with the document, Peter R. Smith, chief operating officer for Authentidate, pointed out. Some programmers could "actually go to the 0's and 1's, the binary code, and mess with it," he said.
As a safeguard, the plug-in also creates a hash code, a unique string of letters and numbers, based on the size and formatting of the document. This digital fingerprint is then sent over the Internet to a database maintained by Authentidate, where it is stored for at least seven years. When another user opens the file, Word regenerates the hash code, connects to the database and checks the new code against the old one. If the fingerprints do not match, then the user knows the document has been altered. Because the actual document is not sent to the database, the creators of the service say privacy is uncompromised.
An altered document is not necessarily one that has been tampered with. A faulty data transmission could also change the file and, thus, the resulting hash code. "If you buy a bottle of Tylenol, and the seal has been broken on it, nobody knows whether there's been a crime committed at that point," Mr. Smith said. "But you sure throw that bottle in the trash."
Electronic Postmarks can be purchased from the Postal Service site (www.usps.com) for 10 to 80 cents each, depending on the number purchased. The Postal Service estimates sales to date in the tens of millions, though only 5 to 10 percent have been used so far (postmarks purchased but not yet used remain in electronic accounts).
Documents carrying the Electronic Postmark must also be signed electronically, using what is called a digital certificate, an electronic representation of the user's identity. One brand of these certificates, GeoTrust, is available through a link on the Postal Service site. The GeoTrust certificate is $19.95 and lasts one year.
Authentidate plans to develop the postmark technology for other software, including Adobe Acrobat, Microsoft Excel and PowerPoint, and e-mail programs.
Lauren Weinstein, a founder of People for Internet Responsibility, an online advocacy group based in California, questioned the Postal Service's wisdom in turning to a private vendor like Authentidate to develop the service.
"You want to be able to trust what's inside," Mr. Weinstein said in a telephone interview, adding that since Microsoft and Authentidate own the software, only those companies know precisely how electronic postmarking works. "There's going to be a lot of people that are going to claim that this is bad just because Microsoft is involved."
Others have expressed concern that an Electronic Postmark attached to e-mail could amount to a government-endorsed e-mail tax, something that might be mandated to ensure secure delivery of a document.
"It's a novel idea," said Chuck Chamberlain, the manager of business development for the Postal Service of that suggestion, but added that it was hardly feasible.
Mr. Smith also dismissed the viability of such a mandate. "This is only by election of a user, where they see value to doing it," he said.
