PIAC, security companies don’t see eye to eye on liability in cases of failure

The private sector and the Public Interest Advocacy Centre (PIAC) may be heading for a showdown over the lobby group's push for better consumer protection in electronic transactions. As provinces across the country prepare to enact the Uniform Electronic Commerce Act (UECA), PIAC has made a public stand in favour of further legislation that would put liability in the event of technological problems squarely on the shoulders of technology vendors and the merchants who buy security software. At issue is the fallibility of security software, and who should pay when things go wrong. No system is foolproof, and headlines of late have been rife with high-profile hacks and hijackings of personal financial information. While PIAC would like to ensure that the costs of "technological failures" are borne either by technology vendors or merchants who buy the systems, private sector executives warn that any attempt to legislate liability would stifle the security business in this country. Fraud : The Unmanaged Risk(Ernst & Young 2000 Survey)About 45% of Canadian companies believe computer related fraud is likely. Worldwide, 60% of companies are concerned that computer fraud is a threat. Worldwide, about 85% of companies believe they are adequately protected. Worldwide, about 25% of companies believe personal use of equipment or software constitutes fraud -- 86% feel such fraud is likely or very likely. 40% of companies globally believe unauthorized or improper use of the Internet constitutes fraud -- nearly 66% of high technology companies believe it is. In a letter dated June 6 and circulated to provincial ministers responsible for consumer affairs and provincial ministers of justice, PIAC representatives say, "legislation should clearly place the responsibility and liability for technology failures on certificate authorities, manufacturers, or the businesses dictating the authentication technology to be used." Certificate authorities (CA) are the companies or bodies that issue and manage digital certificates proving individuals' identities. As an example, PIAC points to the Canadian Code of Practice for Consumer Debit Card Services, recently revised in 1996, which limits consumers' liability. PIAC's suggestion has private sector security companies politely pointing out the drawbacks of the stance, arguing they can't continue to innovate, or even do business in this country, if they're being held to an unreasonable standard of liability. "You can't legislate software to be flaw-free," says Paul Van Oorschot, VP and CTO at Ottawa-based Entrust Technologies Ltd - one of two giants in the digital security field. "What I think you want to do is encourage the reputable companies to go in and do a best-in-class, best-available type of solution. But, beyond that, be very careful legislating liability," he told Canadian NEW MEDIA. Rather than legislation, Van Oorschot recommends that governments and courts recognize the value of reasonable standards of doing business in the current technological climate. "You could have the government legislate that businesses that are currently using the technology have to make sure that they've done due diligence and that they're using a best-in-class technology. There would be kind of an expectation of doing the best you can with the available technology. If there was some kind of technology failure across the board, I don't think you want to try and hold any business responsible for that kind of thing. You need some kind of a reasonable standard." Ian Cumming, EVP of JAWS Technologies Inc, Toronto, agrees. JAWS acts as a security outsourcer, recommending and managing security systems for other companies. Cumming says recent surveys show that up to 89 per cent of companies believing themselves to be secure haven't implemented best-practice systems, and software vendors shouldn't be held responsible for faulty implementations by users. Unless technology vendors and integrators are in complete control over the environment in which their systems are used, Cumming says it's unfair to demand liability from them. The debate over liability arises as several provinces get set to pass the UECA. Initially drafted by the Uniform Law Conference of Canada in October 1999, the legislation is meant to speed the legal adoption of electronic forms, signatures, and transactions. Saskatchewan, Manitoba and Ontario have already introduced bills in their respective legislatures modeled on the UECA. The legislation has been praised for removing some uncertainty from electronic transactions, but PIAC is asking the provinces to consider even stronger measures to protect consumers. PIAC counsel Philippa Lawson drafted the letter, which works from the premise that, "a practical effect of permitting businesses to use electronic means of communicating with their customers, without further safeguards against abuse, may be to undermine existing consumer protection law." It remains to be seen whether the provinces will enact changes to the UECA regarding existing requirements to provide information to consumers, though many of PIAC's proposals are unlikely to be overly contentious. For example, PIAC is asking for assurances that individuals or customers will have to provide express consent to receive information electronically. It's also recommending that important documents continue to be physically delivered to customers instead of being posted to web sites with an accompanying email notification - something Lawson said clears up an unintentional vagueness in the original draft legislation. Internet law authority Michael Geist, however, warns against tinkering with the legislation, arguing that bolstered consumer protection is a matter for further legislation. "While I appreciate a desire to have increased consumer protection for ecommerce, my view would be that there are better ways of approaching that," the University of Ottawa law professor notes. "I think it's particularly important that the various Canadian provinces try to adhere to what's found in the UECA as it's drafted at the moment because it's based on an international standard-. It's important for Canada to become part of that growing trend towards international ecommerce law, and the extent to which we deviate significantly from that, I think, we risk being left behind - at least from a legal framework perspective." Geist says the potential exists for consumers to begin demanding even greater reliability from security software. "As people become more accustomed to dealing with companies and others in the online environment, and have a greater expectation of the kinds of demands they can make then there is the potential for people to say we're not going to tolerate these kinds of things," he told Canadian NEW MEDIA. Lawson says she understands that with some minor exceptions, changes may not be needed to the UECA legislation, but she is eager to see items like protection for consumers and liability issues legislated before problems can arise. While specific safeguards may eventually be implemented by the courts through decision, Lawson says that's not enough. "The problem is, you're expecting ordinary consumers, many of whom simply don't have the money and can't afford to go to court, to take these cases to court. They can't do that. Consumers get screwed all the time. It costs thousands of dollars, tens of thousands of dollars sometimes, to take these kinds of things to court," she says. "We would rather have the rule clarified up front in statutes so that it's clear to everyone from the get-go," she adds. "(Liability) is an important one because it really does affect the incentives for these companies to build in appropriate safeguards-. If they know right from the beginning that they are going to be responsible, then they're not going to put something out in the market until it's fully ready, or without the appropriate warnings."

PIAC, security companies don’t see eye to eye on liability in cases of failure

News | 06/14/2000 4:00 am EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us