@eLaw.com.hk by yip tse & tang, solicitors + notaries 葉謝鄧律師行

訂購

售價$75

各大書店有售

或致電

葉謝鄧律師行查詢 28668080
　
或
　

書本格式

頁數 168

出版 香港生產力促進局數碼出版組

發行 香港生產力促進局
編輯及製作 黃小芬小姐
廖美媚小姐
黃少君小姐
林秀梅小姐
林密小姐

版次 2002 年 10 月第1版印刷

ISBN 962-8040-67-7

E-mail scam hits bank customers

Scammers forged bank's identity and sent emails in massive scale (i.e. spamming). This is called 'branded fake'. Quite often, the e-mail addresses were randomly generated and it then by chance ‘hit’ the bank's customer. UK customers of MBNA had that experience in February 2004 which was widely reported in the news.

The faked emails came with a variety of subject lines such as "MBNA's OfficiaI Notice," "Attention all MBNA users" and "0fficial Notice for all users of MBNA." The message falsely claimed that the “bank” is putting in a new security system to "help you avoid frequently fraud transactions and to keep your investments in safety".

Customer logging in the fake page will have their personal bank information or identity stolen and relayed directly to the crooks who adopted spamming as a cheating tool.

Very often, the link on the email will lead the customer to a site bearing a ‘look and feel’ (colour, lay-out and even fonts) highly similar to the true site but in any event, the site will have a professional look in order not to arouse the customer's suspicion.

To avoid such kind of fraud, customers are advised to note the following:

1. Ensure that the emails truly come from the bank.

2. Don’t click on any links provided in the emails without thoughts

3. Before deciding to take any actions including clicking on the link, visit the true site first

4. If customer has doubts or is not sure, telephone the bank's customer hotline and enquire. Make sure that the telephone number is the number of the true bank.

5. Compare the domain name of the site if you have accidentally clicked on the link with the true site.

6. Report to the bank if you suspect there is a fraud or attempted fraud or you have been cheated.

7. Informing the bank IMMEDIATELY on being cheated is VERY IMPORTANT. This will enable the bank to take immediate step to ban the crook on dealing with your bank account.

In the past few years, many banks in UK and US as well as in Hong Kong had been bit by phishing scams. In Hong Kong, fraudsters were found to attempt to cheat banks’ customers by releasing fake web-site using domain names highly similar to the true banks. To give a few examples, they are: HSBC, DBS and Bank of East Asia.

In December 2003, NatWest of UK temporarily suspended its internet banking facility after some of its customers were sent fraudulent e-mails asking them to divulge their account details.

In October 2003, Nationwide and NatWest in UK were targeted by a similar hoax as was the Halifax, while in September fraudsters tried to trick customers of Lloyds TSB and Barclays.

On 7 December 2001 in UK, a five-strong Net fraud gang has been sentenced to a total of just under eight and half years for a conspiring to defraud online banks.

The four men and one woman made bogus multiple credit card applications with Egg, Cahoot, Smile, Marbles, MBNA, and SonyCard.

The gang, hailing from Buckinghamshire and Northamptonshire, were arrested by officers from the National Crime Squad in August 2000 after a six month operation.

LI MAN WAI v. SECRETARY FOR JUSTICE - [2003] HKCFA 34; FACC000006/2003, 6 November 2003

The is a Court of Final Appeal decision.

The appellant was charged with obtaining access to a computer, namely, the Inland Revenue Department's (IRD) computer system, with a view to dishonest gain for himself or another, contrary to s.161(1)(c) of the Crimes Ordinance, Cap 200. He was acquitted after trial before a magistrate, Ms J M Livesey. Section 161(1)(c) of the Crimes Ordinance with which the appellant was charged provides:

"(1) Any person who obtains access to a computer -

(c) with a view to dishonest gain for himself or another;

whether on the same occasion as he obtains such access or on any future occasion, commits an offence ..."

Upon an application by the prosecution pursuant to s.105 of the Magistrates Ordinance, Cap 227, the magistrate stated a case for the opinion of a judge of the Court of First Instance. Beeson J, having heard submissions from the parties, ordered the case to be remitted to the magistrate with a direction that she convict the appellant and pass sentence accordingly.

As directed by the judge, the magistrate subsequently convicted the appellant and fined him $1,000. The appellant appeals to this Court on the ground of substantial and grave injustice.

The Facts

The facts are not in dispute. Since the end of 1996, the appellant has been employed as an Assistant Assessor of the IRD. As required for the discharge of his duties, he made an Affirmation of Secrecy under s.4(2) of the Inland Revenue Ordinance, Cap 112, stating, among other things, that he would at all times preserve and aid in preserving secrecy with respect to all matters that may come to his knowledge in the performance of his duties under that Ordinance.

For the purpose of gaining access to the IRD's computer system, the appellant was assigned a user identity and a password which he used in the performance of his duties. All staff of the IRD, including the appellant, received regular reminders of the importance of observing the official secrecy provisions.

On 11 July 2000, using his user identity and password, the appellant gained access to the IRD computer system and obtained the identity card number and address of the complainant who was one of his colleagues and whose record as a taxpayer was kept in that system. He had no business in handling the complainant's tax matters and he obtained such information without the authority of the IRD or the complainant's consent.

The appellant then made use of such information in applying for membership of the World Wide Fund for Nature Hong Kong on behalf of the complainant. In the application form, he also included his own name and credit card number to enable payment of the entrance fee and he signed to authorize payment through his credit card. The complainant had not requested the appellant to make the application on her behalf.

Held:

It is accepted that there was an unauthorised access by the appellant to IRD's computer system. It is further accepted (although the appellant argued to the contrary in the courts below) that he had obtained a gain within the meaning of s.161(2) from the system by extracting the relevant information relating to the complainant. The remaining issue is whether there was dishonesty on the part of the appellant. It is common ground that this issue is to be determined by the application of the Ghosh test to the facts.

Evidence of Dishonesty:Any ordinary reasonable person would be aware that members of the public, particularly taxpayers, expect that their personal information kept by the IRD is protected and not released without their permission. Any public officer would be aware of the need and importance of maintaining such confidentiality. It was precisely for this purpose that the appellant was provided with a user identity and password for gaining access to the computer and was required to and did make an Affirmation of Secrecy under s.4(2) of the Inland Revenue Ordinance. IRD staff including the appellant were reminded of the importance of this obligation by the IRD's regular circulars. The appellant must have known that his access to the computer was unauthorized and that the IRD would not have given approval. He must be aware that this would be a breach of the trust which the IRD had placed in him as an employee and which the public had placed in him as a public officer. He must be aware that this would seriously affect the integrity of the IRD computer system and was an abuse of his position.

On the other hand, it is not disputed that the appellant did not intend to obtain and had not obtained any personal financial gain. On the contrary, he paid the entrance fee to join the WWF and he did what he did for purely personal or benevolent reasons. What is more significant is that in the application form for membership, he had put down his own name and credit card number. It is thus clear that he never intended to conceal his own identity or involvement in it. He did not try to cover his tracks. Indeed it might well be that he wanted the complainant (and possibly other people as well) to know that it was he who had done it. This is a conduct which could reasonably be regarded as inconsistent with dishonesty.

In the present case, it cannot, in my view, be said that the only reasonable conclusion which could have been open to a tribunal of fact was that the appellant was dishonest. It cannot be said that the magistrate's verdict is perverse.

There has been a departure from the accepted norm: the judge was not entitled to intervene. The Court therefore allowed the appeal and set aside the conviction and sentence.

Court: Chief Justice Li, Mr Justice Bokhary PJ, Mr Justice Chan PJ, Mr Justice Ribeiro PJ and Mr Justice Litton NPJ
Date of Hearing: 27 October 2003
Date of Judgment: 6 November 2003

Digi-Sign Certification Services Now Available in Macau

Digi-Sign Certification Services Limited (Digi-Sign) announced today that TEDMEV (Transferencia Electronica de Dados - MACAU EDI VAN S.A.) and CTM (Companhia de Telecomunicacoes de Macau, S.A.R.L.) have been appointed to market Digi-Sign's Super SSL (Secure Socket Layer) and VPN (Virtual Private Network) certificates in Macau.

The cooperation provides a more convenient and efficient means for traders, government departments and major organisations in Macau to apply for digital certificates without the need to do it online or purchase from overseas organisations.

Digi-Sign's Super SSL Server Certificates:

They are issued to organisations which are the registered owners of the domain names or are otherwise authorised to use the domain names. The Super SSL Server Certificate is chained to the CyberTrust Root Certification Authority in USA. CyberTrust Root CA is embedded in most of the browsers including Netscape and Internet Explorer.

Digi-Sign's VPN Certificate:

It acts as a user or device passport to authorise the use of the VPN. VPN technology implements secure Internet protocol (IP) tunnels between their corporate sites as well as to business partners and remote users. The complete integration of Digi-Sign's certificates into proven VPN technology is suitable for corporations who require secure communications between their headquarters and branches, or between customers and suppliers.

Patrick Chung, Digi-Sign CEO and Tradelink Deputy CEO, said, "We welcome the opportunity of working closely with TEDMEV and CTM to promote secure online transactions in Macau. With the use of Digi-Sign's Super SSL Server Certificate and VPN Certificate, we can expect to see Macau a more secure and trusted marketplace for the conduct of electronic transactions."

Survey: Hong Kong's IT Sector Could Double with Decrease in Piracy Rate

Study shows a 10 percent decline in the piracy rate in Hong Kong could create fifteen hundred jobs, US$40 million in tax revenue and US$ 0.5 billion in new business opportunities

Increased copyright protection for software could provide a welcome boost to the Hong Kong economy by creating new jobs, business opportunities, and increases in tax revenue.

According to a global research study by IDC, a 10% drop of the local piracy rate from 53% to 43% could double the Hong Kong IT sector within the next 4 years, from US$2.6 billion to US$4.3 billion. The reduction would add another US$630 million to Hong Kong's economy and increase local industry revenues by more than US$0.5 billion. This would generate an additional US$40 million in tax revenue for the Hong Kong Government and create nearly 1,500 jobs in the IT industry - almost as many as there are currently employed in Hong Kong's emerging software sector.

Commissioned by the Business Software Alliance (BSA), the study, Expanding Global Economies: The Benefits of Reducing Software Piracy, assessed the information technology industry's impact in 57 countries around the world, including 14 countries in Asia.

“This report reveals not only how significant the software sector has been for Hong Kong' s economic growth, but also how it could be an engine for powering our transition to a knowledge-based economy, where innovation and ideas can flourish” said Ringo Wong, Chairman of the BSA Hong Kong.

"The protection and enforcement of intellectual property rights is an important factor in developing the local IT industry. Only a low piracy rate encourages entrepreneurs to invest in developing innovative products and services. This growth of entrepreneurial activities creates jobs and drives spending in Hong Kong, which ultimately results in higher tax revenue for the Government. In short, everyone benefits," Wong added.

Hong Kong has reduced its piracy rate by 11 points since 1996, unleashing significant economic growth. Between 1995 and 2001, Hong Kong's IT sector has increased by an average of 6.7 percent per year, generating almost US$1 billion in revenues.

Wong applauded the Hong Kong Government's efforts to step up enforcement and work proactively to further reduce Hong Kong's piracy rate. He said: “The IDC study reveals how beneficial a lower rate would be to the development of Hong Kong's IT sector and long term economic growth. A key challenge moving forward will be ensuring effective criminal enforcement against the illegal use of software in the business environment, a damaging form of software theft that accounts for well over half of the industry's total losses each year.”

Wong also announced that BSA just joined hands with the Intellectual Property Department to produce an anti-piracy television spot and MTR poster campaign. Both are currently under preparation. A re-designed local website was launched in March 2003 to provide information on BSA's activities and support tools (www.bsa.org/hongkong).

BSA hopes that these initiatives will raise additional public awareness for the importance of strong intellectual property rights protection.

Asian Countries Benefit Most from Piracy Reductions

Globally 40 percent of software programs sold in 2001 were pirated. A reduction to 30 percent would add 1.5 million jobs, increase economic growth by US$400 billion and generate US$64 billion in new taxes to help governments fund public programs like education, health care and law enforcement, the IDC study suggests.

In Asia, nearly 54 percent of software programs were pirated. Reducing the rate 10 points to 44 percent by 2006 could create 1.1 million new jobs, increase economic growth by US$170 billion, and generate another US$15 billion in tax revenues.

The Revenue

Based on estimates from the Organisation for Economic Cooperation and Development, (OECD), this revenue could provide:

More than 7 million computers for schools in Asia, or

Health care for 7.5 million people in Asia, or

College degrees for 1.6 million people in Asia or

Internet access for more than 4.6 million people in Asia for four years, or

Primary education for roughly 930,000 children in Asia

Growth of Asian IT Sector Could Double with Piracy Reduction

The report also shows that the growth of the information technology industry, driven largely by the software and related services sector, accelerates with software piracy reductions. The global IT industry grew 26 percent between 1996 and 2002. The industry is predicted to grow 34 percent between 2001 and 2006. However, for Asia alone, the growth of the IT industry between 2001 and 2006 is predicted at 54 percent. With a 10-point drop in the software piracy rate in Asia, that growth is set to record a staggering 93%, the IDC study has found.

Studies clearly show that achieving a drop is both realistic and achievable. Many countries that have worked hard to reduce piracy have seen significant economic benefits or rapid acceleration of the growth in their IT industries. Korea, for example, since achieving a 22 percent piracy rate reduction, has enjoyed enormous economic benefits, with its software sector growing 20 percent annually and doubling in size.

"For the 57 countries studied, we found that the economic impact of even a slight reduction in the amount of pirated software can be dramatic. Therefore, the benefits of lowering software piracy can be substantial to the local economy," said Robin Giang, Research Manager, IT Investment and Strategy Research of IDC Asia/Pacific. "More importantly, local industry would gain more than the multinational importers, mostly because so many of the benefits would accrue to local services and channels firms, and because local software firms, which cannot spread their risk across geographies with lower piracy rates, would have the wherewithal to reinvest in their businesses."

Governments Play a Key Role in Unleashing Potential IT Sector Growth

In addition to detailing the solid economic benefits of reducing software piracy around the globe, the IDC report lays out a framework for reducing piracy rates. Specifically, the report outlines steps and policy changes governments can take to strengthen and better enforce intellectual property protection laws. It also encourages governments to lead by example and to embrace programs to educate consumers about their responsibilities, and the harm piracy causes innovators, copyright owners, and the economy.

Local governments can stimulate greater IT sector growth and benefits in a number of ways:

1. Fight piracy by organised crime by stepping up criminal investigations and prosecution of intellectual property infringements. This will make it easier for the industry to provide referrals. Specialized training for investigators and prosecutors for high-tech crimes should be provided. Further assistance should also be provided to foreign law enforcement officials in order to get at the borderless nature of these crimes.

Reduce optical piracy by implementing strict licensing controls on the operation of optical disc mastering and replication facilities.

Combat internet piracy by adopting stricter laws, specifically tailored to address digital and online piracy. Adopt new laws that enable governments to battle digital piracy, shutdown websites that offer pirated software and prohibit the production or trafficking in tools that circumvent technological protection measures for intellectual properties.

2. Increase education and awareness of copyright laws. Encourage legal use of legitimate software and explain the legal consequences of software piracy. Governments and businesses should work together to launch comprehensive educational campaigns to reduce piracy.

Lead by example and communicate the message that governments would not tolerate piracy. Software management policies will serve as a catalyst for greater software protection in both the public and private sectors.

For more details about the study, please visit the BSA Web site: www.bsa.org/IDCstudy.

HKSAR v. TSUN SHUI LUN - [1999] HKCFI 77; HCMA000723/1998, 15 January 1999

This is an appeal (against conviction and sentence) from the Magistrate's Court heard by the Chief Judge of the High Court, Hon. Patrick Chan.

The appellant was convicted after trial of obtaining access to a computer with a view to dishonest gain for himself, contrary to section 161(1)(c) of the Crimes Ordinance, Cap.200. He was sentenced to 6 months imprisonment. He now appeals against both conviction and sentence.

Background

In April 1998, the appellant was employed as a technical assistant by Dr Ooi who was a radiologist of the University of Hong Kong attached to the Radiology Department of the Queen Mary Hospital. The appellant's duties included making literature searches, arranging appointments for patients, liaising with other research assistants in the Hospital, and generally helping Dr Ooi in her research.

The Hospital's computer system had a Radiology Information System ("RIS") which contained some patients' medical records. In her research, Dr Ooi had access to the RIS. To prevent unauthorised access to these medical records, there was a security system in the computer. Access could only be gained to the RIS by the use of a password. Such password would be changed every now and then. Since the appellant was helping Dr Ooi, he too was given the password. But this was given only for the purpose of and to facilitate the discharge of his duties.

The Facts

At 8:30 am on 2 April 1998, the Secretary for Justice was admitted to the Queen Mary Hospital for urgent treatment. Dr Chu who attended to her decided that computerised X-ray tomographic scanning ("CT scan") was required for diagnosis. The Secretary for Justice was then sent to the Radiology Department at about noon for scanning. A report was then prepared by the Consultant Radiologist. Some time in the morning, during a conversation, Dr Ooi disclosed to the appellant that it was a very famous lady who required the CT scan. The appellant guessed that it might be the Secretary for Justice. Dr Ooi then indicated that this was confidential.

Between 3:30 pm and 6:00 pm, Dr Chu operated on the Secretary for Justice. The report of the CT scan had been input into the RIS.

At about the same time in the afternoon, the appellant made use of the password given to him by Dr Ooi and entered the RIS. He printed out a copy of the CT scan report. He took it home and showed it to his wife. After that, he threw it away.

On that day, the Government issued a Note to Editors of the local news media stating that the Secretary for Justice was admitted to hospital "for observation due to enterogastric disorder". This was reported on television in that evening and in the Ming Pao and Apple Daily newspapers on the following morning, 3 April.

Some time on 3 April, the appellant again entered the RIS using the password and printed out another copy of the CT scan report. He took the copy to see two of his friends, a Mr Cheung and a Mr Ho who were research assistants in another department and showed it to them. In the afternoon, the appellant faxed the copy report to the Ming Pao and Apply Daily. On the following day, the Ming Pao and the Apply Daily published a story about it with a copy of the CT scan report.

Investigations started in the Hospital concerning this leak in the days that followed. The appellant was arrested on 9 April after it was traced to Dr Ooi's password. Under caution, the appellant admitted in two video-recorded interviews that he had accessed the RIS on 2 and 3 April and obtained copies of the CT scan report and that he had anonymously faxed a copy to two newspapers on 3 April. He also said that the reason for his doing so was because he thought the public had the right to know the truth. During the interviews, he further said that he "began to regret because (he) felt that (he) shouldn't do what (he) had done" and that he hoped the Secretary for Justice would forgive his foolish behaviour.

Held:

The offence with which the appellant was charged and of which he was convicted is s.161(1)(c) of the Crimes Ordinance.

The gravamen of the offence with which the appellant was charged was his obtaining access to the Hospital's computer with a specific view in mind. The actus reus of the offence was the access to the Hospital's RIS and this admittedly took place on 3 April while he was in the Hospital. The prosecution did not rely on his making a printout from the computer or his transmission of a copy by fax to the newspapers. These of course came after his access to the computer and at a later stage. The printout and the fax were only evidence which might cast light on his state of mind at the time of his access to the computer. There was evidence (and this came on his own admission) that at the time of his access into the computer on 3 April, he had decided to print out a copy and to leak it to the press. That was the purpose of his access on the second occasion. He had in fact committed the actus reus of the offence by obtaining access to the computer on the previous day. But it could be argued that on that previous occasion, he was doing it out of curiosity and without a view to dishonest gain to himself.

The situation on 3 April is quite different. On this later occasion, he gained access to the computer for a specific purpose : to obtain information in the form of a printout of the CT scan report for the purpose of sending it to the newspapers. The question is whether that was with a view to dishonest gain. If it is, then it falls within s.161(1)(c). The fact that he did it because he thought "the public have the right to know the truth" or he wanted to reveal the Government's "lies" is merely his motive. For the purpose of a s.161 offence, there is or should be any difference between gaining access without authority and gaining access in excess of authority. The section makes no distinction between the two.
The Court was satisfied that any ordinary and reasonable person would have considered such conduct as not only discreditable, dishonourable or inappropriate, but also dishonest and reprehensible . It is not only conduct which people would dislike or detest but conduct which they would regard as wrong and totally unacceptable.

In the circumstances of the case, it is not difficult to draw the inference, which is the only reasonable inference, that the appellant knew and must have realised that it was dishonest conduct to have access into the computer, print out a copy and leak it to the press.

Conclusion

For these reasons, I take the view that the learned magistrate had come to the right conclusion. There was access into the computer by the appellant. He did it in excess of his authority. At the time he did so, he intended to obtain the confidential information in the computer for the purpose of and with a view to printing out a copy and leaking it to the press. That is a gain within the definition in section 161. It was dishonest conduct and he knew it was dishonest. There is no merit in the appeal against conviction and it must be dismissed.

Sentence: Community Service Order substituting 6-month of imprisonment

The appeal against sentence was allowed. The Court set aside the sentence of 6 months imprisonment and ordered that the appellant should serve 100 hours of community service within the next 12 months in accordance with the directions of the probation officer.

Coram : Hon Chan, CJHC in Court
Date of Hearing : 8 January 1999
Date of Judgment : 15 January 1999

Two more private companies become recognized CA: HiTRUST and JETCO

The Director of Information Technology Services (the Director), Mr Alan Wong Chi-kong, today (April 29) granted recognition to HiTRUST.COM (HK) Incorporated Limited (HiTRUST) and Joint Electronic Teller Services Limited (JETCO) as recognized certification authorities under the Electronic Transactions Ordinance (Cap. 553).

To foster the development of electronic commerce in Hong Kong, the Government has taken the initiative under the "Digital 21" Information Technology Strategy to provide a secure environment for the conduct of electronic transactions by members of the public.

As part of this initiative, the Government has established the voluntary recognition scheme for certification authorities under the Electronic Transactions Ordinance.

A certification authority issues digital certificates to subscribers, allowing them to conduct electronic transactions with other parties in a secure manner.

"The Government encourages the private sector to provide services as certification authorities. To keep regulatory control to the minimum, there is no mandatory licensing requirement for certification authorities to operate in Hong Kong. Instead, certification authorities may apply to the Director for recognition under the voluntary recognition scheme," said a spokesman for the Information Technology Services Department (ITSD).

Being a recognized certification authority will enhance public confidence in using the service of the certification authority, because the Director will only grant recognition to a certification authority which has reached a trustworthy standard acceptable to the Government.

With recognition granted by the Director to HiTRUST and JETCO, there are now four recognized certification authorities operating in Hong Kong.

The other two recognized certification authorities are Digi-Sign Certification Services Limited that was granted recognition by the Director in July 2001, and the Postmaster General who is a recognized certification authority as provided under the Electronic Transactions Ordinance. The Postmaster General started operation of the Hongkong Post Certification Authority in January 2000.

"It is encouraging to see that there are now multiple recognized certification authorities operating in Hong Kong, providing the public with more choices. It demonstrates business interests and opportunities in the local market in respect of the provision of certification authority services that will facilitate and drive the public to conduct more electronic transactions in a secure manner," the spokesman added.

Under the voluntary recognition scheme, the Director may also grant recognition on application to digital certificates issued by a recognized certification authority. The Director has granted recognition to two types of digital certificate that HiTRUST will issue to individuals and organisations, and to one type of digital certificate that JETCO will issue to individuals.

More details of the voluntary recognition scheme are available on the web site of ITSD (http://www.itsd.gov.hk/itsd/caro/ecaro.htm).

Under the Electronic Transactions Ordinance, the Director needs to maintain a disclosure record for each recognized certification authority. The disclosure records for HiTRUST and JETCO are also available on the ITSD web site.

End/Monday, April 29, 2002

HiTRUST.COM (HK) AWARDED Recognized Certification Authority by HKSAR government

The Hong Kong Information Technology Services Department ('ITSD') has granted recognition to HiTRUST.COM (HK) Incorporated Limited ('HiTRUST') as a Recognized Certification Authority ('RCA') under the Electronic Transactions Ordinance (Cap. 553) ('ETO').

Various types of digital certificate services are currently being offered by HiTRUST, ranging from server certificate for SSL secure web site, individual certificates for secure messaging, to device certificate deploying on mobile phone or cable modem.

According to the regulation set in the ETO, only the digital signatures generated by using RCA's digital certificate are regarded as statutory signatures and subsequently under the protection of the ETO.

Being a RCA, according to the voluntary recognition scheme for certification authorities under the ETO, it is regarded to be qualified in protecting consumers' interests and in general enhance public confidence in electronic transactions.

Aspects concerned are Certificate Practice Statement, certificate generation and issuance procedures, liability and insurance coverage, disaster restoring plan, information security, facilities security, personnel security and corporate financial viability, etc.

Under the ETO, ITSD needs to maintain a disclosure record for each recognized certification authority. The disclosure records for HiTRUST can be found on the ITSD web site at https://secure1.info.gov.hk/itsd/english/caro/esub43.htm.

Hongkong Post and Guangdong Electronic Certification Authority cooperate on Cross Certification Arrangement

Hongkong Post today (March 20) announced an arrangement to step up the cooperation between Hongkong Post Certification Authority and Guangdong Electronic Certification Authority in the area of cross certification.

Mr Luk Ping-chuen, the Postmaster General, signed a "Cross Certification Cooperation Arrangement" with Mr Sun Xiaohe, Vice President of the Guangdong Electronic Certification Authority Ltd today in Guangzhou. The two parties will explore the establishment of a reliable and seamless cross-certification system between the two Certification Authorities in Hong Kong and Guangdong. In addition, they will explore joint procurement and development of open PKI based applications to facilitate secure transactions over the Internet. This collaboration signifies Hongkong Post's initiative in promoting closer ties with the certification authorities in the Mainland and in fostering e-commerce activities between Hong Kong and Guangdong.

Mr Luk said, "We are delighted to be able to establish closer cooperation relationship with Guangdong Electronic Certification Authority. Such cooperation will enhance both parties' positioning as major leading Internet hub in South China and help promote e-commerce in the region."

Mr Luk added, "Hongkong Post will continue to explore opportunities to enlist more partners to promote cross-certification co-operation in order to promote the use of digital certificate around the world."

The ceremony was witnessed by Ms Adeline Wong, Principal Assistant Secretary, Information Technology and Broadcasting Bureau of the Hong Kong Special Administrative Region Government and Mr Xu Zhibiao, Director of Guangdong Information Industry Department.

Hongkong Post is the first public certification authority in Hong Kong recognised under the Electronic Transactions Ordinance enacted in January 2000. The digital certificates issued by Hongkong Post, officially known as the e-Cert, allows people to authenticate the identity of digital certificate holders on the Internet. Hongkong Post e-Certs play an integral part of the new Smart ID Card replacement exercise scheduled to commence in mid-2003. Under this Scheme, each of the 6.8 million smart ID cardholders will be offered an option to embed a Hongkong Post e-Cert on their Smart ID Cards. With all these efforts, the Hongkong Post Certification Authority services will continue to provide a solid infrastructure and foster a secure and trusted e-commerce environment in the region.