Legal Problems of E-commerce Security

5.5 Legal Problems of E-commerce Security

5.5.1 Security Problems in E-commerce

Now many customers are still in a wait-and-see position toward e-commerce. Why? Because the development of e-commerce is becoming more and more dependent on the Internet, which makes e-commerce very fragile. Once the network is attacked and cannot work properly or even falls into paralysis, the e-commerce of the whole society will be trapped by a dangerous crisis. Thus security problems of the network or e-commerce are being attached more and more importance by consumers of all countries.

The current main hidden dangers of security in e-commerce include: system block, information distortion, information counterfeit, and illegal denial of transaction.

1. Security elements in e-commerce

Security problems in e-commerce have a wide extent. Firstly, it is a very complicated management problem. Secondly, it involves technological problems. Thirdly, it is a legal problem. The final solution of e-commerce security problem has to be ensured by the improvement of relevant laws. Generally speaking, security elements in e-commerce include validity, authenticity. Confidentiality, which means the information will not be divulged to unauthorized person or

5 E-commerce and the Law

entity; data integrity, which requires uniformity of the data and prevent the unauthorized input, deletion, modification or damage of the data. Reliability, undeniability and controllability: reliability means to ensure that authorized user will not be denied illegally of the access to information and resources. Undeniability means to establish efficient responsibility system and prevent the entity from denying its act. Controllability means to control the ways by which the person or entity uses the resources.

2. General situation of e-commerce security legislation

Legislation abroad outline: In order to solve the new legal problems brought by e-commerce, all countries in the world have begun to carry out legislation, e.g. The Model Law on Electronic Commerce by the UN Commission on International Trade Law, the Framework for G1obal Electronic Commerce in America, and so on. Recently the British government has published the opinion soliciting draft of the Electronic Communication Act. This draft has been brewing for a long time whose main objective is to promote the development of Britain’s e-commerce and provide legal guarantee for all circles of society to establish their confidence in e-commerce.

To ensure system security in e-commerce system, there are generally two kinds of guarantees both technically and legally. Security technology is not absolute and no single technology can withstand all security risks. When such security accidents occur, there must be some relevant people to be held legally responsible. That means while formulating e-commerce transaction laws we have to establish laws concerning e-commerce security to ensure e-commerce activities can be in proper progress and develop healthily.

3. Current status of e-commerce security legislation in China

In China, the legal protection of e-commerce began from the Regulations for Safety Protection of Computer Information Systems in 1994. To enforce the safety protection of computer information systems, China has formulated a series of laws and regulations according to different circumstances, which make the relevant systems more standardized and systemized. These laws and regulations include the Computer Information Network and Internet Security, Protection and Management Regulations, the Measures Governing the Computer Information System Security Product Quality Test and Sales Licenses, the security Requirements for Computer Field, the Classified Criteria for Security Protection Levels of Computer Information Systems and so on.

5.5.2 Legal Systems Concerning the E-commerce Security

Legal systems concerning the e-commerce security include the secure level systems of computer information, systems of prevention and controlling of damageable

Introduction to E-commerce

data, systems of sales license for security products and systems of Internet management.

The grade of computer information system security refers to the grade of information system protection ability ascertained by the state supervision and administrative department of information security based on the sensitivity, nature of application and importance of the information processed by the computer information system and according to the relevant state criteria.

Damageable data refers to the information harmful to both computer systems and society in the forms of computer program, image, character and sound in the computer information systems or its storage media. Damageable data is characteristic of being invisible, detrimental, illegal and expandable and of various representations.

Laws and regulations concerning the prevention and controlling of damageable data detrimental to computer information system includes the Measures on the Prevention and Control of Computer Virus, the Rules for the Protection of Computer Information System Security and the Evaluation Criteria for Anti-virus Products of Computer Systems.

Security products sales license refers to the legal certificate issued upon examination and approval by the computer administrative and supervision department under the State Public Security Administration which allows the license holder to sell software and hardware products specifically for the protection of computer information system security. The state has already promulgated the Measures Governing the Computer Information System Security Product Quality Test and Sales Licenses. The security products feature legality, security and technology.

The systems of sales license for security products: The License Management Measures provides that the license system applies when the security-specific products within the territory of PRC come into the market for sale. Before the products come into the market, the producers must apply for the license of the security-specific products of computer information system.

Other relevant laws and regulations include the Measures Governing the Examination and Approval of the Undertaking of Open Operation of Telecommunications promulgated in 1993 by the Ministry of Posts and Telecommunication, the Rules for the Protection of Computer Information System Security, the Interim Rules for the Internet Management of Computer Information Systems, the Measures for Implementing the Interim Rules for the Internet Management of Computer Information Systems, the Measures Governing the Internet Entry-Exit Channels of Computer Information Systems, the Measures of the Internet Management of Public Computers in China, the Measures of the Management of China’s Public Multimedia Communications and so on promulgated in 1994 by the Ministry of Public Security. These administrative rules and regulations constitute a law system of the Internet of computer information systems in China.

5 E-commerce and the Law

5.5.3 Legal Responsibilities for the Violation of E-commerce

Security Laws

In a wider scope e-commerce security laws belong to one of the administrative laws, with the public security organs at all levels as their governing departments. To a certain extent, law is a discipline concerning responsibility; without the guarantee of legal responsibility, laws cannot be executed well. In administrative laws, administrative responsibility takes a particularly important role.

1. Administrative penalty

Administrative penalty is a kind of administrative action taken by some particular administrative organs of the state to punish the individuals or organizations that violate administrative orders and it falls into the category of administrative sanctions.

2. Administrative responsibilities for the violation of e-commerce security systems

(1) That for the violation of damageable data administrative systems: fine; deprive the offender of the qualification of testing anti-virus products for computers. (2) That for the violation of security products systems: warning; suspension for amendment; fine; revocation of sales license; confiscation of illegal gains.

(3) That for the violation of Internet security administrative systems: warning, confiscation of illegal gains, fine, stop connecting to Internet and suspension for amendment for no more than six months, revocation of sales license or getting rid of the qualification to connect to Internet. If the act violates the administration of public security, the offender shall be punished according to the Regulations of the PRC on Administrative Penalties for Public Security.

(4) That for the violation of the Interim Rules for the Internet Management of Computer Information Systems: ordered to stop connecting to Internet; warning; fine; confiscation of illegal gains.

(5) That for the violation of security protection level regulations: warning or suspension for amendment.