Please use a Javascript-enabled browser. 051206en03006
news.gov.hk  
 From Hong Kong's Information Services Department
*
December 6, 2005
*
*

Security

*
Private sector invited to run e-Cert services
*
Betty Fung
Self sustainable: Deputy Government Chief Information Officer Betty Fung said the Government's aim is to see e-Cert services become self-financed.

In the first half of 2006, Hongkong Post will invite the private sector to submit proposals on providing digital certificate services in collaboration with the post office, or to provide them on its behalf.

 

Successful bidders will be awarded the contract before the year's end, to take over the operation in early 2007.

 

Talking to the media today on the findings of a business review of the Hongkong Post Certification Authority, Deputy Government Chief Information Officer Betty Fung said the ultimate aim of the exercise is to see e-Cert services become self-financing.

 

She said the authority's operation requires substantial funding through cross-subsidisation from Hongkong Post's other trading-fund operations or from the Government. This is not sustainable in the longer term.

 

Mrs Fung hoped the exercise could identify a suitable business partner or contractor who will be better placed to develop new value-added services and e-commerce applications that can drive the use of e-Certs and engender a self-financing operation.

 

Gov't support until March 2008

"To attract private-sector participation in providing the e-Cert services, we will consider ways to enhance the business case of the exercise," she said. 

 

For example, bidders may propose their preferred collaboration and business models, and provide value-added services and applications under separate commercial brands to generate other income sources, in addition to running the e-Cert scheme.

 

In the event there is no successful bidder, Mrs Fung said the Government will support the authority's operation until the end of March 2008 to allow sufficient time for existing e-Cert subscribers and business partners to switch to other authentication solutions.

 

The proposed approach strikes a balance between cutting longer-term public funding support for the authority through private-sector participation, and allowing a suitable transition period to cater for users' operational needs, she explained.

 

1.47m e-Certs issued

To facilitate the development of e-commerce by instilling trust in the security and integrity of electronic transactions, the authority was set up in January 2000 to issue recognised e-Certs.

 

The authority now issues seven types of recognised e-Certs, which are accepted for close to 70 types of e-government services and more than 20 types of e-commerce services.

 

As at mid-November, the authority had issued about 1.47 million personal and organisational e-Certs, including over 1.2 million free personal e-Certs embedded in smart ID cards.

 

Mrs Fung said the authority has supported the Digital 21 Strategy by spearheading the development of the public key infrastructure to facilitate the development of e-government and e-commerce, and helped ensure a recognised certificate authority was in place to serve the community upon the enactment of the Electronic Transaction Ordinance in 2000.

 

It has also successfully raised the awareness of the community of the importance of conducting e-business transactions in a secure manner, she added.

 

Usage rate only 10%

Despite the authority's efforts to promote e-Cert, Mrs Fung said the usage rate remains unsatisfactory.

 

A survey in November 2004 showed only about 10% of those who had their e-Certs embedded in smart ID cards from June to August had used them.

 

Mrs Fung said the e-Cert is more readily used for those government-to-government, government-to-business and business-to-business transactions that have high security, integrity and authentication requirements. 

 

However, for the majority of busines-to-consumer and government-to-citizen electronic transactions, using simpler authentication methods such as a one-time password or PIN is preferred and there is no absolute need to use e-Cert to meet the security or authentication requirements, she said.