From: Motise, Paul J.
Sent: Tuesday, August 28, 2001 1:58 PM
To: Butler, Jennie C
Subject: Material For Part 11 Docket on Time Stamp Guidance
Hi Jennie,
 
Would you please place the attached PDF file in the part 11 time stamp guidance docket (00D-1542)? 
The attached is a datasheet for the Datum Trusted Time Stamp Server SA100.  The brochure is covered by copyright, but per the following message, we have permission to place it in the public docket.
 
Thanks.
 
Paul
 
-----Original Message-----
From: Jeff Peterson [mailto:jpeterson@datum.com]
Sent: Tuesday, August 28, 2001 1:46 PM
To: 'Motise, Paul J.'
Subject: RE: Timestamp Guidance

Paul,
 
Thank you very much for the information.  You can publish any information that I have provided on your docket page, but please use this updated stampserver datasheet.  We have just made some minor changes to the platform. 
 
I look forward to seeing the revised draft this Fall, and if there is anything else we can provide, please let me know.
 
Cheers,
Jeff Peterson
-----Original Message-----
From: Motise, Paul J. [mailto:PMOTISE@ORA.FDA.GOV]
Sent: Tuesday, August 28, 2001 12:57 PM
To: 'Jeff Peterson'
Subject: RE: Timestamp Guidance

Mr. Peterson,
 
Thanks for your message and document on your trusted time stamp server.  It is important that we try to keep up with products and services that enable the regulated industry to comply with our requirements.
 
We are preparing a series of guidance documents on part 11, to assist industry in their compliance efforts.  One of the guidances will be about time stamps.  All guidances will be published in draft form for public comment, before being finalized.  I expect the time stamp document to publish in draft later this fall.
 
In the meantime, I would like to include your message and brochure in our public docket for the time stamp guidance.  However, your copyright notice gives me pause.  To include your brochure in the public docket (which is posted to the Internet) we would need your permission.  Please advise.  Thanks.
 
P. Motise
 

Paul J. Motise
Consumer Safety Officer
Office of Enforcement. HFC-240
U.S. Food and Drug Administration
5600 Fishers Lane
Rockville, MD 20857

Phone: 301-827-0383
Fax:     301-827-0482
E-mail: pmotise@ora.fda.gov

-----Original Message-----
From: Jeff Peterson [mailto:jpeterson@datum.com]
Sent: Tuesday, August 21, 2001 11:36 AM
To: 'PMOTISE@ORA.FDA.GOV'
Subject: Timestamp Guidance

Mr. Motise,
 
We are currently working with a group of pharmaceutical companies, helping them with there efforts to become 21cfr part 11 compliant. I have been appointed to do the bulk of the research for this industry.  I know you cannot endorse or recommend any third party solutions, but I was hoping to get some guidance on any changes you may see coming in the actual time stamp for electronic documents. I also wanted to let you know that the technology is now out there and that time stamps from a server or system clock cannot be trusted. 
 
Datum has actually worked with government agencies for over 30 years in precision timing devices, but we are relatively new in the Pharmaceutical/Chemical industry.
 
Timestamping seems to be a very small part of the regulation, but I think it is a very important element.  If people can change the time of the system or server clock, they can change the order of any audit log or clinical trial. 
 
The electronic event logs generated by these new systems will eventually take the place of today’s paper trails. The time of an event or transaction is a ubiquitous component of these largely invisible audit trails. The importance of these time/date elements varies:

·          System logs are the only means of tracking the order of events. "Forensic preparedness" dictates that your system be auditable and that intruders be unable to cover their tracks. Trusted Time guarantees that the order of events will be preserved and available when you need it.

·          Transaction logs document the flow of vast amounts of money, from payroll data through bank transfers. When things go wrong, the electronic audit trail is often the only key to the sequence of events. Trusted Time stamps are secure from tampering by internal and external actors.

·          The use of digital signatures almost demands the use of Trusted Time. The only practical way to assure that a signed document outlives the certificate that generated the signature is with use of a signed time stamp. Datum Trusted Time implements explicitly the Time Stamp Authority model specified in the IETF PKIX digital signature protocols.

The time used in computer systems is no longer the simple, taken for granted data element that it has been. The evolution from few, centralized computing elements to thousands of networked devices increases the risk to your business from lack of synchronization. The dependence on all digital data increases, to unacceptable levels, the risk to these pharmaceutical companies from errors of omission or commission in securing and preserving your precious audit trail. Trusted Time is designed to supplement the unreliable time used in these systems with a secure, auditable resource.
 
 
I have enclosed a quick 2 page datasheet for your review and would value any feedback you may have to offer.  We are in MD quite often, so please let me know if you would like me to come down and show you the details on what we are doing.
 
I apologize for the long email, I know your plate is pretty full right now.  Again, any guidance would be extremely helpful and appreciated.
 
Cheers,
 
 
Jeff Peterson
 
jpeterson@datum.com
Datum EBS
direct: 781.372.3616
cell:  781.953.5067
fax:  781.372.3650
http://www.datum.com/tt