Electronic Communications and Transactions Act Internet Service Providers’ Association Ant Brooks

Act 25 of 2002 n n The objective of the ECT Act is to enable and facilitate electronic communications and transactions n n Act 25 of 2002, published in Government Gazette No on 2 August 2002 n n Came into force on 30 August 2002

II: National e-strategy n n Great to see government putting energy into a national strategy for electronic transactions and universal access n n A 3-year national e-strategy will be developed – –Minister has 24 months to do this (too slow?) n n Aims include: – –“provide Internet connectivity to disadvantaged communities” – –“stimulate public awareness, understanding and acceptance of the benefits of Internet connectivity and electronic transacting”

III: Electronic transactions n n Puts a solid legal framework in place for electronic data messages and transactions – –conclude contracts online – –sign documents n n Adds a degree of legal certainty to a rapidly growing area of business n n Electronic messages can be submitted as evidence in court – –evidentiary weight is based on the integrity of the message – –replaces the Computer Evidence Act

III: Electronic transactions n n An electronic agent can do binding business on your behalf n n One likely impact on the Internet industry – –increased demand for the storage of records

IV: E-government n n Encourages (or at least allows) government departments to interact electronically – –online submission of tax returns – –online licensing n n SA Post Office is a preferred authentication provider n n Other providers can also be designated as preferred – –subject to universal access commitments

V: Cryptography n n All cryptography providers must register with the Department n n Where does cryptography get used? – –electronic transactions need to be secure – –encryption is used for almost all business transactions – –cryptography services and products are therefore ubiquitous n n Registration recommended for any ISP that: – –hosts secure web sites – –provides any form of secure remote login service – –provides any software containing cryptography n n Windows, Internet Explorer, Netscape

V: Cryptography n n Problems – –international applicability – –threat to open source development – –minimal apparent value

VI: Authentication n n Department accredits authentication providers, products and services – –Department can also revoke accreditation and audit n n Legal to provide authentication products or services without accreditation – –but illegal to falsely claim to be accredited n n Accreditation required to provide advanced signatures – –advanced signatures are required for electronic transactions with government – –(recall: SA Post Office is a preferred provider for authentication)

VII: Consumer protection n n Doing business on the web means providing: – –name and legal status – –physical address and telephone number – –web site and address – –membership of self-regulatory or accreditation bodies – –any code of conduct that applies – –registration number, office bearers, place of registration – –description of the good or services – –full price and manner of payment – –terms of agreement – –delivery times – –how to obtain a record of the transaction – –refunds policy – –dispute resolution code – –privacy policy – –duration of the agreement (where applicable) – –cooling-off rights of the customer

VII: Consumer protection n n Customer gets a 7-day cooling off period for the return of goods – –limited; doesn’t apply to all goods and services. n n Spam! – –unsolicited commercial communications must give the consumer an option to be remove from that mailing list – –consumer can request the origin of their personal information – –sending further spam after a complaint constitutes an offence

VIII: Protection of personal information n n Principles outlines for collection of personal information – –with permission of subject – –must disclose purpose – –information must be duly protected – –can develop statistical profiles n n Voluntary adoption – –all or nothing deal

IX: Critical databases n n Minister has sweeping powers – –can declare any database critical which is “of importance to the protection of the national security [...] or the economic and social well-being of its citizens” – –can also prescribe how the database is managed – –can audit critical database administrators n n Problems – –open to abuse – –threat to international data hosting business?

X: ZA domain name n n Government’s Domain Name Authority (DNA) – –to be established by the Minister within one year – –board appointed indirectly by the Minister – –it will become illegal to administer a second-level.ZA domain, or update a zone file, without a licence n n Problem – –the global domain name system is run by ICANN under contract with the US Department of Commerce – –ICANN cannot be forced to re-delegate.ZA the proposed DNA – –re-delegation requires Internet community support

X: ZA domain name n n Optimistic view – –further compromise and discussion between government and industry will lead to a new.ZA admin that meets everybody’s needs n n Pessimistic view – –unlicensed second-level domain admins shut down and.ZA subdomains cease functioning – –lengthy legal tussle over jurisdiction and government’s right to appropriate asset

XI: Limitation on ISP liability n n Protection for ISPs from liability for... – –information passing through the network (mere conduit) – –information hosted for others (hosting) – –cached information (caching) – –search engine links (information location tools) n n Requirements – –must belong to a recognised body – –that body must have a code of conduct – –must have a take-down notification process n n Take-down notification – –high costs – –copyright content?

XI: Limitation on ISP liability n n Australian Broadcasting Authority – –from 1 Jan 2001 to 31 May 2001 – –635 complaints, 29 sites taken down – –US$330,000 per year – –4.5 million users – –only child porn and unprotected X-rated material n n UK Internet Watch Foundation – –estimates for 2002 – –18,000 complaints, only 1% resulting in a take down – –US$400,000 per year, 5 full-time staff – –20 million users – –only child porn

XII: Cyber inspectors n n Department staff can be appointed as cyber inspectors n n Cyber inspectors can – –surf the Internet looking for illegal activities – –investigate cryptography and authentication providers – –assist the police and other organisations where needed n n Procedure – –a warrant is required prior to entering premises or accessing information systems – –it is an offence to obstruct or hinder a cyber inspector

XIII: Cyber crime n n Fine or up to five years in prison for... – –breaking into a system – –denial of service attack n n Fine or up to twelve months in prison for... – –intercepting or interfering with data – –designing a tool to circumvent security measures – –pretending to be an accredited authentication provider – –hindering a cyber inspector – –pretending to be a cyber inspector

Conclusion n n The Electronic Communications and Transactions Act brings important legal certainty to doing business on the Internet n n Some sections of the Act will cause headaches for the Internet industry and the Internet community