South African Post Office submission on the Electronic Communications and Transactions Bill

TABLE OF CONTENTS
I SUBMISSIONS TO PORTFOLIO COMMITTEE................................................1

II INTRODUCTION....................................................................................................2

(A) The South African Post Office ............................................................................2

(B) Outline of submissions .......................................................................................2

III BACKGROUND .....................................................................................................4

(A) The Post Office as role player ............................................................................4

(B) History and services ...........................................................................................4

(C) Unique universal service provider and universal access....................................5

IV REQUIREMENTS FOR ADVANCED ELECTRONIC SIGNATURES..............7

(A) Current position ..................................................................................................7

(B) Shortcomings of the requirements .....................................................................8

(C) Proposed amendments ......................................................................................8

(D) Substantiation of the proposed amendments.....................................................9

V PREFERRED AUTHENTICATION SERVICE PROVIDERS ............................10

(A) Current position .................................................................................................10

(B) Shortcoming ......................................................................................................10

(C) Proposed amendment .......................................................................................11

(D) Substantiation of the proposed amendment......................................................11

VI CERTIFICATION OF COPIES..............................................................................16

(A) Current position .................................................................................................16

(B) Shortcomings ....................................................................................................16

(C) Proposed amendment .......................................................................................17

(D) Substantiation of amendment............................................................................17

VII REGISTERED POST REQUIREMENT ...............................................................18

(A) Current position .................................................................................................18

(B) Shortcomings ....................................................................................................18

(C) Proposed amendment .......................................................................................19

(D) Substantiation of amendment...........................................................................19

VIII CONCLUSION.......................................................................................................20

0

1. The following are submissions on the issues outlined below and dealing with the Electronic

Communications and Transactions Bill ("the Bill") to the Parliamentary Portfolio Committee on

Communications.

I

SUBMISSIONS TO PORTFOLIO COMMITTEE

(A) The South African Post Office

2. A national postal service has traditionally been the most basic and most common means by which information can be widely communicated and distributed. It is also strategically positioned through its vast retail and distribution network to receive and deliver information and goods, as well as allow the population access to a point of collection in addition to delivery services. Furthermore, the national postal service is unique in its critical ability to serve the entire South African population scattered across widespread geographical areas of the country and across language and income barriers.

3. Hence the Post Office serves as an important medium of communications and transactions on behalf of the Government and its structures, the business community, public bodies and individual citizens. This is especially true with regard to the communication and "transactive" needs of lower-income groups and rural populations.

4. Growth in the electronic communication medium has impinged dramatically on the traditional postal services that various national post offices have historically delivered. Globally, this has resulted in national postal services fast evolving and positioning themselves to embrace electronic communications and to extend and add to their existing service offerings.

5. The South African Post Office Limited ("the Post Office") is strategically repositioning itself to provide new and innovative services in the digital world. It has a pivotal role to play as a result of its unique position in the South African society. The proposals outlined below will both advance the objectives of the Bill and enable the Post Office to play this role more effectively and at the same time transform itself into a vibrant and essential entity in the national life of South Africa.

(B) Outline of submissions 6. The Post Office enthusiastically welcomes the Bill and believes that it will promote and facilitate the information economy in South Africa and universal access to that economy by all people in this country. Below, we outline our proposals on four aspects which, we submit, will further improve the Bill.

(i) Requirements for advanced digital signatures

9. It is submitted that there is a need for the designation of preferred authentication service providers in the Bill to give public bodies the option of referring to such designation for their clause 29 requirements. This is to provide a guide to public bodies that need to identify which authentication service providers are suitable and appropriate to deal with the Government where the public bodies do not have the capacity to make such an assessment.

10. We propose that the Post Office be named in the Bill as a preferred authentication service provider, while at the same time allowing other authentication service providers to apply for such designation.

(iii) Certification of documents as true copies
11. Further submissions are made in respect of clause 18(2) which deals with the certification of documents as true copies in the electronic environment. At present, there is a gap in the Bill which will significantly reduce the ability of entities to convert paper-based documents into electronic documents and then to provide certified copies of such documents in electronic format.

12. The proposed amendment is aimed at filling this gap with an appropriate provision in the Bill. This will also promote the use and growth of electronic communications and transactions, not only in fields of document retention and archiving, but also in the service to the general public.

(iv) Sending by registered post

13. Many pieces of legislation require documents or notices to be sent by prepaid registered post or a similar service. There is no provision in the Bill that covers this situation for electronic documents.

15. The widespread fear of doing business electronically, particularly in issues of trust and the lack thereof, a perceived lack of security and the accelerating pace of change of technology, continue to be the biggest barriers to the growth of e-commerce and e-communications.

16. It is our view that, given the Post Office's existing infrastructure and pervasive presence throughout the country and its history of acting as a certification authority in the paper-based world, it is in a special position to immediately offer secure electronic transacting. It can also provide what is commonly accepted by the business community and the population at large as the most practical, secure means of identification, namely that of "face-to-face" physical identification.

(B) History and services

25. It is in this context that the Post Office has a huge role to play and a unique competitive advantage, namely the ability to offer face-to-face authentication of identity through our various branches, both as an authentication service provider in the first instance, but also as a value-added service to other authentication service providers. It must be remembered that existing authentication service providers have found it very difficult to offer face-to-face authentication and a series of different so-called classes of certification has evolved (eg Class 1 where only an e-mail address is authenticated, Class 2 where an email address, physical address and some other attribute are authenticated).

26. The Post Office has the following characteristics:

27. The Bill deals with the issue of electronic signatures in clause 1 where the terms "electronic signature" and "advanced electronic signature" are defined; in clause 13 where the legal recognition, validity and requirements for electronic signatures are dealt with; by implication in clause 29 where the power of public bodies to specify requirements for data messages is dealt with; and by clauses 38 and 39 that deal with accreditation and criteria for accreditation of signature products.

28. The definition of an "electronic signature" in clause 1 is very broad and is to a large extent only dependent on the intention of the person attaching such signature to a data message. It is submitted that no change to this definition is necessary or possible as it will run counter to the stated object of the Bill to enable electronic transactions.

29. Clause 13 of the Bill recognises the validity of electronic signatures in general, but also stipulates that, in certain instances, it is mandatory to use an advanced electronic signature, namely where it is required by law. In such instances, a signature that meets the requirement of the definition in clause 1 is mandatory. Clause 13(1) stipulates that "where a signature is required by law, that requirement in relation to a data message is only met if an advanced electronic signature is used".

30. An advanced electronic signature in clause 1 is defined as "an electronic signature which results from a process which has been accredited by the Authority as provided for in clause 38 of the Bill".

31. Clause 29 empowers public bodies to stipulate their requirements for electronic transactions. They are entitled to specify the type and form of any message and where it has to be signed and the type of signature to be used. This would enable public bodies to specify that they will only receive advanced electronic signatures or that they will only do so in specified cases.

32. Clause 39 deals with the requirements or criteria for the accreditation of electronic signature products. It is submitted that the aim of improving the security and trustworthiness of electronic signatures can best be achieved by effecting a change to the criteria in clause 39. At present, it is required that the signature (a) must be uniquely linked to the user; (b) that it must be capable of identifying the user; (c) that it is created using means that can be maintained under the sole control of that user; and (d) that it will be linked to the data or data message to which it relates in such a manner that any subsequent change to the data or data message is detectible.

REQUIREMENTS FOR ADVANCED ELECTRONIC SIGNATURES
(B) Shortcomings of the requirements

33. Worldwide, one of the most significant factors inhibiting the growth of electronic trade and transactions has been fear about the security of electronic transactions. A lot of effort has been aimed at improving the security of electronic transactions by using various means of identification and authentication. The provision and use of electronic signatures are slowly gaining acceptance in the market, although they still remain under-utilised.

34. Electronic signatures issued by authentication service providers provide a great deal of security to the user of that signature (the signatory) depending on the type of electronic signature and technology used. However, the Achilles heel of electronic signatures today remains the issue of identification. Most authentication service providers rely on credit card numbers to effect identification and only rarely on faceto- face identification. This is not only not very reliable, it also excludes the majority of the population from this method of identification because they do not use credit cards such a system would be inconsistent with the Bill's object of promoting universal access.

35. The legal certainty of transactions and electronic signatures would be much improved if all electronic signatures were underpinned by face-to-face identification as this would provide greater certainty and security to the receiver of an electronic signature. This is a service which the Post Office is uniquely positioned to render to the public and to authentication service providers.

(C) Proposed amendments

36. It is submitted that the following new subclause (bA) to clause 39(1) will have the desired result: "1(bA) is based on the face-to-face identification of the user, bearing an identity card (as defined in the Identification Act No 68 of 1997) or a passport (as defined in the Aliens Control Act No 96 of 1991), by the authentication service provider, or another authentication service provider, acting as its agent."

(D) Substantiation of the proposed amendments

37. Although the proposal to require face-to-face identification is new and not based on international precedent, it is a reasonable requirement to be introduced for the following reasons: 37.1. The validity of the identification process will be enhanced. The most practical manner in which a person can be identified at present is by face-to-face verification of the person against his or her identity document, passport or similarly recognised document. Requiring face-to-face identification will build this reliability into every advanced electronic signature. 37.2. It will provide increased security, reliability and trustworthiness for all transactions where an advanced electronic signature and the concomitant legal certainty of transactions are required. A party receiving a data message signed with an advanced electronic signature will have the assurance that the person signing the message is indeed the person he or she claims to be. 37.3. This improvement in the trust in the system will also advance the use of and trust in electronic communications, transactions and commerce through improved security, reliability, and trust, the lack of which is still the biggest impediment to electronic transactions today. 37.4. The suggested amendment is practicable. The Post Office, for example, has the ability and resources to provide this service with immediate effect. It can also act as an agent for other authentication service providers that do not themselves have the capacity to perform face-to-face identification. Any other authentication service provider may also act as an agent to perform such a function. 37.5. The submission is therefore in no way unrealistic or overly burdensome when weighed against the advantages it could achieve. 37.6. The feasibility of the proposed method of face-to-face identification is increased by the flexible provision that a number of suitable forms of identification may be used by the users to identify themselves. In particular, provision is made for foreign nationals in possession of a valid passport to be identified.

(A) Current position

38. Chapter IV of the Bill facilitates e-government and clause 29 of the Bill enables any public body that decides to accept electronic filing to specify by notice in the Government Gazette its requirements for such filing. The entitlement of public bodies to specify their requirements in this way is in line with international best practice and is necessary for the Government to ensure that electronic filing is consistent with the technical, policy and business needs of its various components.

39. In particular, in terms of clause 29(d), a public body may specify "the identity of or the criteria that must be met by any authentication service provider used by the person filing the data message."

40. Chapter VI of the Bill deals with the accreditation of products and services of authentication service providers. Part I of the Bill (clauses 34 37) establishes an accreditation authority ("the Authority") and sets out the duties of the authority. Part II (clauses 38 42) sets out the process and criteria for the accreditation of authentication products and services by the authority. Significantly, the framework of the Bill does not provide for the accreditation of authentication service providers. Hence, the accreditation process in the Bill does not necessarily assist public bodies in the task of identifying those authentication service providers that are suitable for the Government's purposes.

(B) Shortcoming
41. The problem is that the task of vetting individual authentication service providers or specifying the criteria they have to meet will probably fall outside the technical and administrative capacity of the vast majority of the public bodies in South Africa. Other provisions of the Bill, such as those for the accreditation process, do not currently assist public bodies in the task of specifying requirements under clause 29(d) of the Bill.

42. It is submitted that there is a need for the designation of preferred authentication service providers in the Bill to give public bodies the option of referring to such designation in their clause 29 requirements. For reasons that are more fully motivated below, it is appropriate to name the Post Office in the Bill as a preferred authentication service provider, while at the same time allowing other authentication service providers to apply for such designation.

PREFERRED AUTHENTICATION SERVICE PROVIDERS
(C) Proposed amendment

43. It is submitted that the following proposed amendments would appropriately provide for preferred authentication service providers. 43.1. A definition be added to clause 1: "preferred authentication service provider" means the South African Post Office Limited and any other authentication service provider designated as such by the Authority, based upon criteria that may be prescribed by the Authority: 43.2. Clause 29(d) be deleted and substituted with: "(d) the identity of or criteria to be met by any authentication service provider used by the person filing the data message or that such authentication service provider must be a preferred authentication service provider;"

(D) Substantiation of the proposed amendment

44. The substantiation will, first, elaborate on the need to provide for preferred authentication service providers in the Bill, secondly, deal with the proposed criteria for designation as a preferred authentication service provider, and thirdly, explain why the Post Office should be named in the Bill as a preferred authentication service provider. The need to provide for preferred authentication service Providers

45. The process of accreditation of authentication products and services in the Bill does not relate direct to authentication service providers and because accreditation is voluntary, any person without prior authority of any other person may sell or provide authentication products or services to public bodies (clause 36). Some of these service providers may not meet the technical needs and policy objectives of the Government. But many public bodies, such as the smaller municipalities, do not have the know-how or capacity to evaluate the suitability of providers of authentication services and therefore need guidance from a designation that will indicate which providers of authentication services have met the objective criteria for designation as being preferred for the Government.

46. An international example of where a government has established a designation to provide quality assurance and assessment of suitability specifically for government agencies is Australia's Gatekeeper. According to its FAQ, "Gatekeeper accreditation confers a recognised, trusted status to companies supplying services to the Commonwealth." Gatekeeper accreditation is granted to organisations (so far seven companies, including Australia Post) that have met all the Gatekeeper Accreditation requirements. Gatekeeper was set up before Australia's equivalent of the Bill, the Electronic Transactions Act 1999 (Cth), and hence Gatekeeper is not governed by any legislation. However, an Australian Cabinet decision requires all Government agencies to use a Gatekeeper-accredited organisation when an on-line authentication system is required.

47. Note that, unlike Gatekeeper, the amendment proposed in this submission will not make it compulsory for public bodies to deal only with preferred authentication service providers. Under the proposed terms, public bodies that decide to accept electronic filing will still be free to specify their own requirements and accordingly may deal with (a) all service providers (including those whose authentication products and services have not been accredited or recognised); (b) any specified authentication service provider; (c) authentication service providers that meet their own criteria; or (d) a preferred authentication service provider. Hence the proposed preferred authentication service provider designation will only be a guide and provide another option for those public bodies that decide to specify requirements for authentication service providers.

Proposed criteria for designation as a preferred authentication service provider
48. Clause 39(2) of the Bill provides a list of criteria for authentication service providers that the Authority will consider when deciding whether to accredit their authentication products and services. Clearly, such criteria are relevant to the consideration of whether any authentication service provider can be designated preferred. However, additional criteria are necessarily to evaluate whether an authentication service provider is suitable and appropriate for dealing with the Government.

49. In formulating the criteria for designation to be prescribed by the Authority, we propose that the Authority consider, inter alia, the Gatekeeper accreditation criteria; the broad policy objectives of the South African Government; and the objectives of the Bill, in particular the need to promote the attainment of universal access and thereby counter the legacy of disadvantage that afflicts many communities in South Africa who were denied access to technology in the past. Possible criteria may include: (a) whether the applicant is an authentication service provider; (b) the factors listed in section 39(2); (c) whether the applicant complies with Government procurement policy; (d) the applicant's ability to promote universal access; (e) the accessibility of the applicant by the public, including its geographical presence; (f) the applicant's capacity to perform face-to-face recognition required in section 39(1)(bA) (g) any other relevant factor which may be prescribed by the Authority.

Why the Post Office should be named a preferred authentication service provider 50. The specific naming of a preferred authentication service provider in the Bill would speed up the implementation of the provisions of the Bill that concern public bodies. Those public bodies that wish to draw up requirements in terms of clause 29 without delay and wish to incorporate the designation of preferred authentication service provider could begin drafting such requirements even before the Bill becomes law. Those public bodies that specify the designation of preferred authentication service provider could implement such requirement as soon as the Bill becomes law and even before the Authority has begun its work.

51. Other authentication service providers, as soon as they have been designated by the Authority as preferred, would then automatically meet the requirements of those public bodies that require preferred authentication service providers without every public body having to update their requirements.

52. Legislative precedent exists for granting a named statutory body certain rights for which other institutions have to apply. In terms of section 32C(1) of the recently amended Telecommunications Act, No 103 of 1996 ("the Telecommunications Act"), Sentech Limited is granted a licence to provide an international telecommunication gateway service enabling it to operate as a carrier of carriers and multimedia services to any person who requests such service. Under section 32C(3) of that Act, other institutions may apply for multimedia services licences.

53. Unlike the case with the provision of authentication services and products under the Bill, the Telecommunications Act permits only licensees to provide a telecommunication service [section 32(1)]. Therefore, in relation to their respective competitors, the Telecommunications Act puts Sentech in a far more powerful position to provide telecommunication services because by explicitly granting Sentech a licence, Sentech is able to provide services that others are prohibited from providing. Whereas, even if the Post Office were named a preferred authentication service provider, other service providers would nevertheless have the right to provide authentication products and services, including to public bodies.

54. The Post Office should be named in the Bill as a preferred authentication service provider for the following reasons:

54.1. The Post Office meets each of the proposed criteria for designation as a preferred authentication service provider.

54.2. The core function of the Post Office is to securely and reliably handle and deliver written communications for businesses and people in all reaches of the country. The strategic vision of the Post Office is to continue to play a leading role in facilitating communication in the information economy for the benefit of both the information rich and poor. 54.3. With its unparalleled presence in cities, towns and villages throughout the country and its extensive contact with people who were previously disadvantaged through a lack of access to technology, the Post Office is ideally suited to give practical expression to the Bill's objective of providing universal access. 54.4. Sound practice requires Parliament, as far as possible, to harmonise the Bill with the policy objectives of existing legislation. The existing legislation concerning the Post Office and the policy framework to which it gives expression seeks to promote the financial viability of and service delivery by the Post Office for the public benefit. The proposed naming of the Post Office as a preferred authentication service provider would achieve this by promoting the Post Office as an institution at the forefront of the information economy and enable it to continuously evolve its electronic communication products to the benefit of all South Africa's people.

(A) Current position