Preserving Evidence

Lawmakers have classified electronic documents as more susceptible to forgery than analogue documents. The physical signature is replaced by a digital code (the signature), whose lifespan is limited due to technical reasons. Furthermore, electronic documents lack the “embodiment function” of paper documents – i.e., a connection between the content of a declaration, for example, and a sheet of paper – which enables subsequent tampering to be proven indefinitely. In addition to secure storage, a separate system for long-term evidentiary preservation (Section 371a of the Code of Civil Procedure) is therefore required, in accordance with the requirements of Technical Guideline 03125 (TR-ESOR). Among other things, the system serves as a reference system, keeps signatures “fresh” and provides proof of the uninterrupted integrity and authenticity of the document – even over long and very long periods of time.

BSI Technical Guideline 03125 (TR-ESOR)

• ETSI (European Telecommunications Standards Institute) standards
• The EU’s eIDAS regulation (electronic IDentification, Authentication and Trust Services)

 The TR-ESOR of the Federal Office for Information Security (BSI) already fully integrates the European legal requirements of eIDAS and the relevant ESTI standards. Thus, certification according to TR-ESOR is valid throughout Europe.

As an IT system that preserves evidentiary value, the proNEXT Archive Manager generates an electronic archive timestamp for archived documents and signatures and then automatically re-signs the hash tree. This component offers all the cryptographic extensions necessary to ensure the evidentiary value of electronic documents in accordance with Section 371a of the German Code of Civil Procedure. In addition to archives, the software can also be integrated into document management systems and/or e-file solutions and is certified according to BSI 03125 TR-ESOR.

1. Complete automation:
The system requires no manual intervention to preserve evidential value. The retention period is determined prior to archiving.

2. Fair cost model:
Costs are incurred only once per document – not annually.

3. TR-ESOR certification:
The proNEXT Archive Manager is the only system on the market with the latest TR-ESOR certification (version 1.3).

4. GDPR compliance:
There is a clear separation between documents in the DMS and evidential assets. The deletion of evidential assets from “rejected” documents (e.g., upon expiration of the selected retention period) occurs automatically. No fragments remain in the system after deletion.

5. No capacity limits:
There is no software-imposed upper limit on the number of archived documents. The solution is also suitable for large and very large archiving systems. The software imposes no limits on the number of access channels (the interfaces through which documents are added to the system).

No documents are stored in the proNEXT Archive Manager. It is used neither for storing nor for processing documents. The proNEXT Archive Manager is a separate/additionally required system for the “long-term preservation” (eIDAS Regulation) of evidentiary assets (Section 371a of the Code of Civil Procedure), in accordance with the requirements of Technical Guideline 03125 (TR-ESOR). It contains (only) the hash values of documents archived, for example, in a DMS or specialized process.

Among other things, it serves as a reference system, keeps signatures “fresh” and provides proof of the uninterrupted integrity and authenticity of the document – all this over any desired period of time.

The proNEXT Archive Manager thus supplements the existing DMS infrastructure with the function of evidentiary preservation.

The main advantages are:

• The documents remain fully “traffic capable”.
• The evidential value is tied to the document and not to the system (as with soft WORM systems, for example), so its proof can be provided at any time via an “evidence record”. The effort is minimal.
• The system runs in the background. All processes are automated.
• By law, TR-ESOR-compliant systems are given preferential treatment over others with regard to proving integrity and authenticity, see, for example, Article 45i (2) eIDAS Regulation 2.0.
• The recognition of evidential value applies throughout the EU.

Repeatedly “oversigning” documents can only solve the technical problem of the limited lifespan of electronic signatures, but does not offer a solution to the legal problem of the lack of “embodiment” function of digital documents. Furthermore, manually “oversigning” individual documents is not TR-ESOR-compliant and is time-consuming, very expensive and error-prone. Moreover, instead of signatures, a TR-ESOR-compliant system merely requires a timestamp for all hash values transferred to the system per unit of time (usually per day). This is made possible by hash tree technology, which allows any number of hash values to be combined into a single hash value. Only an automated solution such as the proNEXT Archive Manager meets the requirements for audit-proof archiving and evidentiary preservation.

According to the eIDAS Regulation, the uninterrupted validity and inalterability of the document must be proven in order to preserve its evidential value. In the event of an interruption, such proof would be complex and entail considerable risks. This applies particularly to interruptions that occurred some time ago at the beginning of the statutory retention period.

It is therefore recommended to ensure the preservation of evidential value as soon as possible after the receipt or creation of a document by transferring it (on the same day) to a TR-ESOR-compliant system.