@eLaw.com.hk by yip tse & tang, solicitors + notaries 葉謝鄧律師行

HKSARG's website was hacked twice

HKSAR Government's website at http://www.itsd.gov.hk was hacked twice on 10 and 11 of June, 2000. Hacker successfully posted insulting short messages of “ Own3d by the crows” and “ hacked by o analista” on the web page on 10 June and “Hacked by The Crows –Owned by id3nt FXXK Government!! Hacking for Justice”was shown on the page on 11 June. As a result, the website was forced to suspend. Fortunately, the website being hacked was a standalone website. It did not affect the websites of other government departments.

This was the first reported incident that HKSAR Government's website was successfully hacked. If the hacker can be arrested, he can be prosecuted for criminal damage (misuse of computer). However, the culprit was not traceable and it did not result in any arrest or prosecution.

Hong Kong Domain Name Registration Company Limited ("HKDNR")

HKDNR is a wholly owned subsidiary of Hong Kong Internet Registration Corporation ("HKIRC"). It is the operation arm of the HKIRC.

It is responsible for the administration of Internet domain names under '.hk' country-code top-level domain. It assumed the responsibility of registration and assignment of Internet domain names ending with '.hk', '.com.hk', '.org.hk', '.gov.hk', '.edu.hk' , '.net.hk' and '.idv.hk'.

The Board of Directors of HKDNR comprises 13 members from six different classes, namely "User Class", "Service Provider Class", "IT Industry Class", "Commercial and Industry Class", "Tertiary Institution Class" and "Government Class".

HKDNR is a non-profit -making company where it pays no dividends to its shareholders. It charges for Domain Name registrations in order to cover its operational costs. Domain Name registration fees are periodically reviewed. The Company will not scrutinize applications for Domain Names, other than in respect of technical restrictions and application qualifications. Nor will it make judgments as to whether the registration or use of a Domain Name infringes the rights of any third parties. HKDNR will employ latest technology to deliver cost-effective service to Customers.

Conflict between an Internet domain name and a registered trademark

"Cybersquatter" refers to a person who registers a trademark as a domain name hoping to later profit by reselling the domain name to the trademark owner. An aggressive cybersquatter may even send messages to the trade mark owner soliciting a sale. Passive cybersquatter may just leave the domain name unused or direct it to a one-page homepage indicating that the domain name is "for sale".

In the USA, a trade mark owner believing that someone has taken a domain in bad faith, he can either sue under the provisions of the Anticybersquatting Consumer Protection Act (ACPA), or he can follow the arbitration procedures set out by the Internet Corporation of Assigned Names and Numbers (ICANN). The ACPA in the USA defines cybersquatting as registering, trafficking in, or using a domain name with the intent to profit in bad faith from the goodwill of a trademark belonging to someone else. Hong Kong does not have an equivalent legislation. Trade mark owners may however resort to the general laws of trade mark infringement and sue the cybersquatter in Court.

The ICANN arbitration procedure is often regarded by intellectual property lawyers to be faster and less expensive, and the procedure does not necessarily require a solicitor to be engaged.

Past statistics show that Courts and arbitrators generally side with trademark owners in these disputes and order the cybersquatter to "transfer" the trademarked domain names to tthe trademark owners. Respondents defending in good faith may rely on the Applicant's "bad faith" or "reverse hijacking" to resist the Applicant's attempt to "bully" the Respondent.

HiTRUST.COM (HK) Incorporated Limited

HiTRUST.COM (HK)

HiTRUST was incorporated in Hong Kong in August 2000. It is a joint venture of HiTRUST Incorporated and the New World Group.

Being a Recognized Certificate Authority certified by Hong Kong government as well as a VeriSign International Affiliate, HiTRUST.COM (HK) is specialized in the provision of managed digital certificate services to help enterprises sharpen its competence in the trust e-commerce world.

HiTRUST Incorporated

Founded in March 1998, HiTRUST's core business is the provision of solutions for secure eCommerce. In April 2000, HiTRUST.COM Incorporated was officially established with capital of about US$100 million. The major shareholders include Acer Group, HSBC, New World Group, AIG and VeriSign. The continuous growth of HiTRUST has been achieved through an unrivalled commitment to, and focus on, commercially successful, secure eCommerce.

Targeting the Greater China region, HiTRUST has been successfully providing leading-edge, trusted total solutions and customized, high added-value services including Commerce Content, eBusiness Operation, ePayment & eBilling, Financial Services Software, Application Server and eCommerce Security to the region's corporations, telecommunication companies, financial institutions and service providers.

HiTRUST's success depends on its product offerings and reputation for value and trust in the secure eCommerce industry. Early on, HiTRUST identified the opportunities developing in the region and has expanded its business operation into Taiwan, Hong Kong, Shanghai and Beijing, by opening its branch offices and strategic investment in eCommerce related businesses. In the future, HiTRUST will continuously offer industry-leading technologies and services to customers in the Greater China region and its brand will remain at the head of the region's secure eCommerce industry.

Use of Digital Certificates on Internet Trading

Since February 2001, HKEx has offered secure Internet trading services with the application of a digital certificate.

By using a digital certificate issued by a recognised certification authority such as the Postmaster General of HKSAR Government, Digi-Sign, investors are able to place order through the Online Trading Service securely and directly to their brokers' trading systems over the Internet.

In addition, Digi-Sign accepts non-HK citizen to apply for ID-Cert using a valid travel document and this can enable cross-border investors to conduct trusted and secure transactions on the Net.

Hong Kong Jockey Club's Online Betting Service (eWin)

Digi-Sign Certification Services Limited (Digi-Sign) is a recognised Certification Authority under the Electronic Transactions Ordinance. The ID-Certs issued by Digi-Sign can be used to authenticate a wide range of trade transactions online. ID-Cert holders can use their digital certificates with Hong Kong Jockey Club's eWin service for betting on the Internet.

The Hong Kong Jockey Club's eWin service is an efficient and secure way of betting on football matches, horse races and buying Mark Six. Through its website, you can access the latest odds and results, study the extensive racing information database. To make your online betting securely, simply use your ID-Cert with the eWin service.

Personal ID-Cert can be applied online at the secure web server of Digi-Sign.

More information on eWin service can be found on the Hong Kong Jockey Club's website http://www.hongkongjockeyclub.com

Liability

The conditions on using a digital certificate will deal with the liability of the certificate owner and the CA. The following is taken from the Certificate Practice Statement (CPS) of CA of the University of Science and Technology and are quoted here as an example:

Liability of Certificate Owner

Without limiting other certificate owner obligations stated in the CPS, certificate owners are liable for any mis-representation they make in certificates to third parties that, reasonably rely on the representations contained therein.

Liability of HKUST CA

HKUST CA :

· Does not warrant the accuracy, authenticity, completeness or fitness of any unverified information contained in certificates or otherwise compiled, published, or disseminated by or on behalf of HKUST CA.

· Shall not incur liability for representations of information contained in a certificate, provided the certificate content substantially complies with the CPS.

· Does not warrant "non-repudiation" of any certificate or message (because non-repudiation is determined exclusively by law and the applicable dispute resolution mechanism).

Certificate Repository

Certificate Internal Database is a database to keep track of the pending certificate request, issued or revoked certificate, private Certificate Revocation List (CRL), etc. Only RA and CA have the rights to update this database. A web user interface will be provided for users to query the status of their certificate requests and any issued or revoked certificate. Various fields in certificate, such as serial no, expiry date, subject name, etc will be indexed. This will allow faster queries based on these standard attributes.

A high performance directory server, based on the IETF LDAP standard, is used as a public repository of Certificate Revocation List (CRL), user and CA certificates. Its design is based on the RFC 2587 schema. A standard LDAP interface will be provided to native client for retrieving certificate for applications like S/MIME or SSL client authentication.

Concept of Public Key Infrastructure (PKI)

PKI covers the use of public key cryptography for authentication and access control of a user, guaranteeing the integrity and non-repudiation of documents signed by the user, and confidentiality of data.
PKI employs a pair of keys for each user: a private key which is known only to the user himself, and a public key which is published by some authority, in the form of a digital certificate (certificate for short).

In signing a document or an e-mail, a user signs using his own private key so that others can use the signer's public key to verify the authenticity and non-repudiation of documents or e-mail. Since only the user has his own private key to sign, non-repudiation is established.

Before sending an encrypted e-mail to a receiver, the sender installs the receiver's certificate in the sender's e-mail program which supports the use of PKI technologies. The program can, on the sender's instruction, encrypt an e-mail using the receiver's public key. The receiver, on receiving the encrypted mail, can use his private key to decrypt the mail. Since only the receiver has his own private key, the encrypted mail will only be readable by him. Others, even if they can get hold of a copy of the encrypted mail over the network, would not be able to read the encrypted mail as they do not have the receiver's private key to decrypt the mail. The use of PKI saves the trouble of maintaining and distributing the same encryption/decryption key between the sender and the receiver.

The e-mail program Netscape Messenger v4.7x supports the signing and encryption of e-mail using 1024-bit RSA keys and certificates.

By using strong public key cryptographic algorithms, such as 1024-bit RSA keys which the HKU CA and Hongkong Post are employing, it is practically impossible for anyone to crack the private key from the public key within the life-time of a private key.

HKU Certification Authority (HKUCA)

HKU Certification Authority (HKUCA), run by the HKU Computer Centre, set up public key infrastructure (PKI) to issue HKU digital certificates (HKU-Cert) from 22nd September 2000 to current HKU staff and students (HKU members).

Personal: the HKU-Cert of a HKU member serves as his digital identity for him to authenticate himself and sign electronically in using HKU Electronic Services Delivery (HKUESD) of digital signature applications.

Server: from 1st February 2002, HKUCA also issues HKU-Cert (Server) to administrators of computer servers approved by HKUCA. The server named in a HKU-Cert (Server) can use the certificate in applications employing Secure Socket Layer (SSL) encryption.

According to the University, HKUCA is not seeking Recognized CA status, as defined in the Electronic Transactions Ordinance, from the Director of Information Technology Services Department of the HK SAR Government. Therefore, HKUCA is not subject to the governing rules and regulations set out in the Electronic Transactions Ordinance.