Memorandum by The National Computing Centre
Limited
SUMMARY
The National Computing Centre[88]
offers the following responses to the House of Lords inquiry:e-Commerce:
Policy Development and Co-ordination in the EU.
What needs to be done to create confidence and
to stimulate e-commerce?
An approach which recognises the virtuous circle
which will be created by involving all stakeholders. We must be
cautious of concentrating the focus on trust service providers
alone.
Will codes of conduct and co-regulation provide
sufficient protection? Is there a case for intervention by national
governments and the EU?
The business and legal community are making
considerable steps in creating the e-commerce framework. They
require national and EU government to intervene to create, modify,
or repeal laws which do not support the cross-border opportunities
offered by e-commerce.
Should existing EU institutions' internal structures
be changed, or new ones created to improve policy development
and co-ordination?
e-Commerce is a conglomerate of existing information
technology, business and communal opportunities. Existing institutions
should be strengthened to support and grow the infrastructure.
How can structural change be brought about fast
enough to accommodate to the growth of e-commerce?
Revolutionary change should be avoided. e-Commerce
has been used by many organisations for many years and it is to
these organisations we should turn for the case studies and lessons
learnt from which policies for change may be derived.
INDEX
| 1. | Preface
|
| 2. | Trust in e-commerce |
| 3. | An Overview of the Proposed Scheme
|
| 3.1 | Under Development
|
| 4. | Consumers |
| 4.1 | What the Consumers Want
|
| 5. | Suppliers |
| 5.1 | Who's Who?
|
| 5.2 | Marks out of five
|
| 6. | Trust Service Providers
|
| 6.1 | Trust in TSP
|
| 7. | Awarding Authorities |
| 7.1 | The CAFE Model
|
| 8. | Regulatory Authority |
| 8.1 | Will We Need One?
|
| 9. | Weltanschauung |
| 10. | Summary |
| 10.1 | Advantages from the CAFE Scheme
|
| 11. | Conclusions |
PREFACE
This paper specifically addresses the following questions
posed by the House of Lords inquiry:
E-COMMERCE:
POLICY DEVELOPMENT
AND CO-ORDINATION
IN THE
EU
(1) What needs to be done to create confidence and to
stimulate e-commerce?
(3) Will codes of conduct and co-regulation provide sufficient
protection? Is there a case for intervention by national governments
and the EU?
(5) Should existing EU institutions' internal structures
be changed, or new ones created, to improve policy development
and co-ordination?
(6) How can structural change be brought about fast enough
to accommodate to the growth of e-commerce?
It regards e-commerce as being built on the following foundations:
1. INTRODUCTION
The National Computing Centre Limited (NCC) was established
in 1966. NCC is a membership organisation, a company limited by
guarantee and an independent research and technology organisation.
NCC's activities concentrate on supporting and developing research
programmes, which generate new knowledge on the effective use
of IT and provide a cost-effective gateway to knowledge, participation,
and services for its member companies. Supporting activities include
the development, supply and support of data management software.
NCC has no shareholders and all profits are reinvested to
promote the more effective use of Information Technology.
NCC's primary products are knowledge, skill and experience.
NCC's membership services provide products and services to NCC
members that seek to meet their needs for timely, comprehensible
and reliable information on current and emerging issues relating
to the use of IT to support business and organisational requirements.
As champions of the user, the National Computing Centre is
concerned that despite proposed levels of excellence, the focus
of e-commerce policy is biased towards the supplier community
and within this, concentrated on the Trust Service Providers.
2. TRUST IN
E-COMMERCE
Trade information, goods, or money with someone you don't
know? It's hard enough to do this when you know that you can stroll
into their shop, office or factory to discuss terms or possibly
iron out a problem. What if their premises are in the next town,
another European country, or on the other side of the world? How
can you be sure that they have registered premises at all?
The designs in this paper will not guarantee the total elimination
of all risks, but they can reduce the risk of danger to an organisation
and individuals from fraud, negligence, or even just common human
error. It can underpin any emerging e-commerce infrastructure
and allow it to grow.
The Consumer Assurance Framework for e-commerce (CAFE) is
a scheme to promote trust in e-commerce. Trust underpins all other
aspects including access and understanding. It will allow consumers
to have confidence in Internet transactions. CAFE will deliver
a method for business to manage the selection and retention of
Trust Service Providers (TSPs), and a code of practice for the
stakeholders themselves. It will ultimately deliver a package
to promote excellence in electronic commerce and create a hub
for international electronic business.
CAFE will pave the way for effective e-commerce through standards,
certification and education, for business to implement and for
consumers to make well-informed choices. Such a virtuous circle
will help to produce a truly market-driven environment.
It is also important to recognise that the scope of electronic
commerce extends beyond the popular image of credit card transactions
over the Internet. Knowledge trading is one other example. The
use of micro payment systems is another. The definition in the
recent Cabinet Office report ([email protected]) is
excellent as it summarises the activity without the distraction
of financial activity:
"Electronic commerce is the exchange of information across
electronic networks, at any stage in the supply chain, whether
within an organisation, between businesses, between businesses
and consumers, or between the public and private sectors, whether
paid or unpaid."
CAFE will embrace this definition by building on the foundations
set out in the diagram below. CAFE will draw together the supplier
led initiatives such as tScheme for Trust Service Providers, TrustUK
for traders, and the financial institution-based Identrus.
3. AN OVERVIEW
OF THE
PROPOSED SCHEME
The proposed scheme envisages the following stakeholders
in e-commerce, all of whom will benefit from a formal scheme whether
voluntary or enforced by legislation.
— Trust Services Providers;
— Awarding Authorities; and
— Regulatory Authorities.
The proposed scheme would allow for a stakeholder taking
on different roles pertaining to different relationships with
other stakeholders. For example, a customer of one stakeholder
may be the supplier of another. CAFE is an umbrella, and a focal
point for other initiatives which concentrate on single aspects
of the supply chain.
3.1 Under Development
CAFE is a research and development project of the National
Computing Centre. Some of the ideas in this paper may become part
of the final specification but currently, all are just suggestions
and examples of how the proposed scheme may operate.
The National Computing Centre has identified the need for
CAFE to allow IT business users to find their way through the
many pathways which lead to e-commerce in all its forms. CAFE
recognises that there are national and private schemes, and proposals,
being announced from all quarters; CAFE will bring the issues
back to street level, in practical terms, which can be understood
by the ordinary business community. For some, EDI will continue
to be the way forward, for others it may be XML to refer to only
two pieces of the jigsaw. It is important not to be distracted
by one company selecting a different solution over another. Summary
rejection of established standards is throwing the baby out with
the bathwater—"progress is bad things happening faster"
some may say.[89] If
the community is to become a centre of excellence, it must pool
its strengths and present a picture which will make the world
confident when it clicks on domains in the EU. CAFE can provide
these credentials.
4. CONSUMERS
4.1 What the Consumers want
Consumers want to be able to make informed choices and this means
that they will need reliable information on price, quality and
the safety of products. They need to know about returns policies
and other contractual rights.
Electronic commerce is not new but the opportunity for many
individuals and companies freely to do business with each other
electronically is, thanks to the rapid growth of Internet and
related technologies.
Purchasing electronically or passing sensitive information
over the Internet needs to be underpinned by a simple mechanism
to instil confidence. The proposed scheme will deliver a tiered
level of certification (such as the proposed online "hallmark")
for Internet sites to which information may be sent safely. This
would initially be identified by an "approved site"
symbol. A developed scheme would successfully negotiate with Internet
tool (such as browsers) providers to incorporate an electronic
certification mechanism that would warn customers of the security
rating of a site.
CAFE will research and define the user requirements for the
security and integrity of e-commerce transactions. This may be
based on already accepted work.
5. SUPPLIERS
5.1 Who's Who?
To draw a diagram which shows the range of activities going on
in electronic commerce and relate that to the many roles within
those activities would probably produce a figure as complex as
the Internet itself.
On the Internet, one supplier may be the customer of another
whilst receiving its Internet services directly from that supplier.
Another organisation may receive the same services through an
independent third party. Or more simply: suppliers who trade electronically
may provide their own service or use a trusted third party. The
same site certification rules would apply in both instances. Suppliers
would be expected to make trading only available from sites which
were "stamped" with the accredited symbol. To receive
permission to use an accredited symbol, a supplier would need
to comply with certain rules contained in codes of practice; different
codes of practice would be required for the different situations.
5.2 Marks out of five
When the UK Government called for comments on its proposed
electronic commerce strategy, industry raised the concern that
award schemes require high investment from those seeking certification.
CAFE proposes a tiered approach which will allow organisations
to select a level of certification commensurate with levels of
business risk. It will also apply opportunities for self-assessment
which will require no external costs to the organisations involved.
Individuals may be able to make informed choices after thinking
through a few short questions which could be printed on a mousemat.
For example:
|
| Grade | Means . . .
|
|
| 1 | Complies with basic codes of practice
|
| 2 | Complies with advanced codes of practice
|
| 3 | Complies with advanced codes of practice and BS 7799
|
| 4 | Complies with advanced codes of practice and BS 7799, ISO 9000
|
| 5 | Complies with advanced codes of practice and BS 7799, ISO 9000, and rules of recognised regulatory authorities such as the British Banking Association, the Financial Services Authority, and the Association of British Insurers
|
|
Alternatively, these grades could be translated into simple
checklists that can be applied by users with varying levels of
expertise to carry out a risk assessment of what they are trying
to achieve by e-commerce.
CAFE would bring under its umbrella the best practices from
around Europe and, if appropriate, beyond. This would serve the
very important purpose of building on current successes and the
experience of IT practitioners and the users in the different
fields of commerce, and the supporting professions. It will be
important to recognise the e-business opportunities are built
on new ways of doing the activities that have been in place for
centuries.
CAFE would bring national initiatives such as TrustUK into
the framework.
6. TRUST SERVICE
PROVIDERS
6.1 Trust in TSP
The hub of the proposed scheme will be a set of rules or
guidelines (depending on the market drive for a mandatory or voluntary
code of practice) for Trust Service Providers. Certification or
accreditation against these rules would be tiered to allow for
different grades of transactions (for example: sensitive or non-sensitive
information) and different grades of service provider, as shown
in the table below.
This will allow for truly third-party encryption services
and (say) a large corporation which wished to offer products and
services to its customers over an "extranet".
The proposed scheme would award ratings based on the level
of independence of the services provider and the technologies
that are offered. The proposed scheme would be sufficiently flexible
to incorporate current technologies and encompass future innovation.
The rating system would allow service providers to gain low-level
accreditation easily, and then build up the level of approval
commensurate with the opportunities its market offers. This will
minimise the cost and potential bureaucracy of the early accreditation.
Ratings for the service providers would work like the system
for suppliers. However, a higher entry level would be expected.
For example:
|
| Grade | Means . . .
|
|
| 1 | It would not be appropriate to make low grades available for Service Providers
|
| 2 | It would not be appropriate to make low grades available for Service Providers
|
| 3 | Complies with advanced codes of practice and BS 7799
|
| 4 | Complies with advanced codes of practice and BS 7799, ISO 9000
|
| 5 | Complies with advanced codes of practice and BS 7799, ISO 9000, and rules of recognised regulatory authorities such as the British Banking Association, the Financial Services Authority, and the Association of British Insurers
|
|
CAFE would bring national initiatives such as tScheme into
the framework.
7. AWARDING AUTHORITIES
7.1 The CAFE Model
Accreditation of service providers would be through suitably
qualified assessment bodies. These assessment bodies would in
turn be accredited to certify service providers by a "regulatory"
or "guiding authority". This will be a self-supporting
scheme by charging for their services (cf. ISO 9000 and BS 7799).
See the figure below.
THE CAFE MODEL
8. REGULATORY AUTHORITY
8.1 Will We Need One?
CAFE will include methods for self assessment by contributors
to the supply chain. CAFE will also use similarly accessible methods
for individuals and organisations to carry out second-party assessments
of good practice to manage the risk in procurement decisions.
These may be applied using fast-track, short checklists or more
in-depth analysis.
After initially establishing the proposed scheme, NCC may
hand over the running of the proposed scheme to a suitable organisation;
the United Kingdom Accreditation Service (UKAS) may be approached.
It may be appropriate to expand the remit of (say) TrustUK. This
level of the model will very much be governed by industry opinion
and detail of legislation. The success of the proposed scheme
will rely on:
— the manageability of the codes of practice;
— legislation or market driven;
— the credibility of the hallmark/certificate;
— the independence from any market sector;
— the independence from any part of the model: suppliers,
consumers, service providers etc;
— feedback from the public either directly, by survey,
or investigation into (say) types of litigation or alternative
dispute resolution, to test the effectiveness of codes of practice
and purchasers decisions based on them.
9. WELTANSCHAUUNG
There is already significant work being done nationally and
internationally which CAFE will collate and direct to the diverse
stakeholder participants of e-commerce. As a corollary, CAFE will
also make contributions to organisations such as the Global Business
Dialogue and the World Intellectual Property Organisation. These
organisations are already providing direction for the e-commerce
agenda; CAFE will take a positive, pragmatic view to steer through
the industry enablers and political policy makers to provide practical
guidance to the doers. The flexibility and scalability of the
CAFE framework means that the scheme can provide a practical vehicle
for e-minister or e-envoy to deliver whatever the social and economic
agenda suggests.
At least some of the cloud of uncertainty which surrounds
e-commerce is clearing. This is happening through traditional
processes and so validates the need for the framework. Recent
reports have identified that good e-commerce is susceptible to
the same mistakes as any other discipline. Project planning procedures
must be in place and reviewed in no less detail than (say) traditional
engineering projects. The wide variety of user types means that
social implications must be considered even more so than an application
which is rolled-out in company. CAFE will take note of the trends
for e-commerce uptake so that implementers can scale their e-commerce
to fit with the outlook and keep the business model up to date.
Initial research for CAFE already suggests that business should
be wary of whirlwind romances with innovative technology which
may alienate them from the silent majority of loyal customers
who may take longer to woo to the Internet; some may never make
the transition, others may have another electronic path which
may be equally as effective for the activities in hand.
10. SUMMARY
10.1 Advantages from the CAFE Scheme
This proposed scheme will develop mechanisms that:
— are eminently scalable, and easily customised
to fit the needs of the e-commerce market place as a voluntary
or a statutorily backed scheme;
— are based on guidelines already internationally
endorsed by users, solicitors, lawyers and trusted third party
organisations;
— will contain a framework into which additional
licensing criteria can be slotted or impractical licensing criteria
removed;
— will provide an umbrella for any other standardisation,
legislation, or voluntary practice required for technically detailed
areas such as encryption, digital signatures etc. Also, insurance
for transactions may be considered depending on the use of accredited
services;
— the opportunities for contributing and encouraging
the e-commerce market are shown in the figure below.
These will provide the yardsticks to measure conformity to
the CAFE model. This is another feature keeping CAFE in line with
recent reports: an opportunity for a time-based (say annual) status
report, providing key indicators for continuous improvement.
11. CONCLUSIONS
(Conclusions as at Summary)
21 February 2000
88
Daniel Dresner, Head of Standards, The National Computing
Centre Limited, Oxford House, Oxford Road, Manchester M1 7ED,
Telephone: 0161 242 2352, Fax: 0161 242 2499, E-mail: [email protected] Back
89
As popular author Terry Pratchett writes. Back
| 
