(5 ILCS 175/Art. 10 heading)
ARTICLE 10. SECURE ELECTRONIC RECORDS AND SIGNATURES

    (5 ILCS 175/10‑105)
    Sec. 10‑105. Secure electronic record.
    (a) If, through the use of a qualified security procedure, it can be verified that an electronic record has not been altered since a specified point in time, then such electronic record shall be considered to be a secure electronic record from such specified point in time to the time of verification, if the relying party establishes that the qualified security procedure was:
        (1) commercially reasonable under the circumstances;
        (2) applied by the relying party in a trustworthy
     manner; and
        (3) reasonably and in good faith relied upon by the
     relying party.
    (b) A qualified security procedure for purposes of this Section is a security procedure to detect changes in the content of an electronic record that is:
        (1) previously agreed to by the parties; or
        (2) certified by the Secretary of State in
     accordance with Section 10‑135 as being capable of providing reliable evidence that an electronic record has not been altered.
(Source: P.A. 90‑759, eff. 7‑1‑99.)

    (5 ILCS 175/10‑110)
    Sec. 10‑110. Secure electronic signature.
    (a) If, through the use of a qualified security procedure, it can be verified that an electronic signature is the signature of a specific person, then such electronic signature shall be considered to be a secure electronic signature at the time of verification, if the relying party establishes that the qualified security procedure was:
        (1) commercially reasonable under the circumstances;
        (2) applied by the relying party in a trustworthy
     manner; and
        (3) reasonably and in good faith relied upon by the
     relying party.
    (b) A qualified security procedure for purposes of this Section is a security procedure for identifying a person that is:
        (1) previously agreed to by the parties; or
        (2) certified by the Secretary of State in
     accordance with Section 10‑135 as being capable of creating, in a trustworthy manner, an electronic signature that:
            (A) is unique to the signer within the context
         in which it is used;
            (B) can be used to objectively identify the
         person signing the electronic record;
            (C) was reliably created by such identified
         person, (e.g., because some aspect of the procedure involves the use of a signature device or other means or method that is under the sole control of such person), and that cannot be readily duplicated or compromised; and
            (D) is created, and is linked to the electronic
         record to which it relates, in a manner such that if the record or the signature is intentionally or unintentionally changed after signing the electronic signature is invalidated.
(Source: P.A. 90‑759, eff. 7‑1‑99.)

    (5 ILCS 175/10‑115)
    Sec. 10‑115. Commercially reasonable; reliance.
    (a) The commercial reasonableness of a security procedure is a question of law to be determined in light of the purposes of the procedure and the commercial circumstances at the time the procedure was used, including the nature of the transaction, sophistication of the parties, volume of similar transactions engaged in by either or both of the parties, availability of alternatives offered to but rejected by either of the parties, cost of alternative procedures, and procedures in general use for similar types of transactions.
    (b) Whether reliance on a security procedure was reasonable and in good faith is to be determined in light of all the circumstances known to the relying party at the time of the reliance, having due regard to the:
        (1) information that the relying party knew or
     should have known of at the time of reliance that would suggest that reliance was or was not reasonable;
        (2) the value or importance of the electronic
     record, if known;
        (3) any course of dealing between the relying party
     and the purported sender and the available indicia of reliability or unreliability apart from the security procedure;
        (4) any usage of trade, particularly trade conducted
     by trustworthy systems or other computer‑based means; and
        (5) whether the verification was performed with the
     assistance of an independent third party.
(Source: P.A. 90‑759, eff. 7‑1‑99.)

    (5 ILCS 175/10‑120)
    Sec. 10‑120. Presumptions.
    (a) In resolving a civil dispute involving a secure electronic record, it shall be rebuttably presumed that the electronic record has not been altered since the specific point in time to which the secure status relates.
    (b) In resolving a civil dispute involving a secure electronic signature, it shall be rebuttably presumed that the secure electronic signature is the signature of the person to whom it correlates.
    (c) The effect of presumptions provided in this Section is to place on the party challenging the integrity of a secure electronic record or challenging the genuineness of a secure electronic signature both the burden of going forward with evidence to rebut the presumption and the burden of persuading the trier of fact that the nonexistence of the presumed fact is more probable than its existence.
    (d) In the absence of a secure electronic record or a secure electronic signature, nothing in this Act shall change existing rules regarding legal or evidentiary rules regarding the burden of proving the authenticity and integrity of an electronic record or an electronic signature.
(Source: P.A. 90‑759, eff. 7‑1‑99.)

    (5 ILCS 175/10‑125)
    Sec. 10‑125. Creation and control of signature devices. Except as otherwise provided by another applicable rule of law, whenever the creation, validity, or reliability of an electronic signature created by a qualified security procedure under Section 10‑105 or 10‑110 is dependent upon the secrecy or control of a signature device of the signer:
    (1) the person generating or creating the signature device must do so in a trustworthy manner;
    (2) the signer and all other persons that rightfully have access to such signature device must exercise reasonable care to retain control and maintain the secrecy of the signature device, and to protect it from any unauthorized access, disclosure, or use, during the period when reliance on a signature created by such device is reasonable;
    (3) in the event that the signer, or any other person that rightfully has access to such signature device, knows or has reason to know that the secrecy or control of any such signature device has been compromised, such person must make a reasonable effort to promptly notify all persons that such person knows might foreseeably be damaged as a result of such compromise, or where an appropriate publication mechanism is available (which, for State agencies, may include the official newspaper designated pursuant to Section 4 of the Illinois Purchasing Act where appropriate), to publish notice of the compromise and a disavowal of any signatures created thereafter.
(Source: P.A. 90‑759, eff. 7‑1‑99.)

    (5 ILCS 175/10‑130)
    Sec. 10‑130. Attribution of signature.
    (a) Except as provided by another applicable rule of law, a secure electronic signature is attributable to the person to whom it correlates, whether or not authorized, if:
        (1) the electronic signature resulted from acts of a
     person that obtained the signature device or other information necessary to create the signature from a source under the control of the alleged signer, creating the appearance that it came from that party;
        (2) the access or use occurred under circumstances
     constituting a failure to exercise reasonable care by the alleged signer; and
        (3) the relying party relied reasonably and in good
     faith to its detriment on the apparent source of the electronic record.
    (b) The provisions of this Section shall not apply to transactions intended primarily for personal, family, or household use, or otherwise defined as consumer transactions by applicable law including, but not limited to, credit card and automated teller machine transactions except to the extent allowed by applicable consumer law.
(Source: P.A. 90‑759, eff. 7‑1‑99.)

    (5 ILCS 175/10‑135)
    Sec. 10‑135. Secretary of State authority to certify security procedures.
    (a) A security procedure may be certified by the Secretary of State, as a qualified security procedure for purposes of Sections 10‑105 or 10‑110, following an appropriate investigation or review, if:
        (1) the security procedure (including any technology
     and algorithms it employs) is completely open and fully disclosed to the public, and has been so for a sufficient length of time, so as to facilitate a comprehensive review and evaluation of its suitability for the intended purpose by the applicable information security or scientific community; and
        (2) the security procedure (including any technology
     and algorithms it employs) has been generally accepted in the applicable information security or scientific community as being capable of satisfying the requirements of Section 10‑105 or 10‑110, as applicable, in a trustworthy manner.
    (b) In making a determination regarding whether the security procedure (including any technology and algorithms it employs) has been generally accepted in the applicable information security or scientific community, the Secretary of State shall consider the opinion of independent experts in the applicable field and the published findings of such community, including applicable standards organizations such as the American National Standards Institute (ANSI), International Standards Organization (ISO), International Telecommunications Union (ITU), and the National Institute of Standards and Technology (NIST).
    (c) Such certification shall be done through the adoption of rules in accordance with the provisions of the Illinois Administrative Procedure Act and shall specify a full and complete identification of the security procedure, including requirements as to how it is to be implemented, if appropriate.
    (d) The Secretary of State may also decertify a security procedure as a qualified security procedure for purposes of Sections 10‑105 or 10‑110 following an appropriate investigation or review and the adoption of rules in accordance with the provisions of the Illinois Administrative Procedure Act if subsequent developments establish that the security procedure is no longer sufficiently trustworthy or reliable for its intended purpose, or for any other reason no longer meets the requirements for certification.
    (e) The Secretary of State shall have exclusive authority to certify security procedures under this Section.
(Source: P.A. 90‑759, eff. 7‑1‑99.)

    (5 ILCS 175/10‑140)
    Sec. 10‑140. Unauthorized use of signature device.
    (a) No person shall knowingly or intentionally access, copy, or otherwise obtain possession of or recreate the signature device of another person without authorization for the purpose of creating, or allowing or causing another person to create, an unauthorized electronic signature using such signature device. A person convicted of a violation of this subsection shall be guilty of a Class A misdemeanor.
    (b) No person shall knowingly alter, disclose, or use the signature device of another person without authorization, or in excess of lawful authorization, for the purpose of creating, or allowing or causing another person to create, an unauthorized electronic signature using such signature device. A person convicted of a violation of this subsection shall be guilty of a Class 4 felony. A person convicted of a violation of this subsection who has previously been convicted of a violation of this subsection or Section 15‑210 shall be guilty of a Class 3 felony. A person who violates this Section in furtherance of any scheme or artifice to defraud in excess of $50,000 shall be guilty of a Class 2 felony.
(Source: P.A. 90‑759, eff. 7‑1‑99.)