LCQ9: Digital certificates and Smart ID Cards
*********************************************

     Following is a question by the Hon Charles Mok and a written reply by the Secretary for Commerce and Economic Development, Mr Gregory So, at the Legislative Council meeting today (February 26):

Question:

     The Government started promoting Electronic Service Delivery many years ago, introduced the Hongkong Post e-Cert (e-Cert) in 2000 and started issuing smart identity (ID) cards to members of the public in June 2003. In this connection, will the Government inform this Council:

(1) of the number of e-Certs expected to be issued in each of the years from 2000 to 2014 when the authorities launched the e-Cert in 2000, and the actual numbers of e-Certs issued and renewed respectively in each year of the same period, with a breakdown by type of e-Cert;

(2) whether it knows the annual revenue, expenditure and profit/loss situation of the e-Cert business since 2007; if it cannot provide the relevant figures, of the reasons for that;

(3) of the government services which currently accept e-Certs or other recognised digital certificates for verification of the identity of service users; the government departments providing those services, the details of such services and the person-times using e-Cert each year; whether the authorities will take measures to boost the person-times using e-Certs or other recognised digital certificates; if they will, of the details of the measures and the expected effectiveness;

(4) of the government departments which currently make use of the data storage and processing functions of the chips embedded in smart ID cards to provide public services, as well as the details of those services; whether the Government has plans to introduce new technology in the second-generation smart ID cards; if so, of the details; whether there is any government department which has planned to make use of new technology to provide public services; if so, of the details and implementation timetable; and

(5) of the designed service life of the current smart ID cards; the up-to-date number and percentage of smart ID cards replaced due to damage of the chips; as the authorities stated last year that they were planning to conduct a study on the smart ID card system, of the progress and outcome of the study; whether it has plans to replace the ID cards of members of the public with the second-generation smart ID cards; if it has, of the details and timetable??

Reply:

President,

     My reply to the five-part question is as follows:

(1) Under the Electronic Transactions Ordinance (Cap.553), Postmaster General is a public certification authority (Note) who can issue digital certificates (known as "e-Certs" for those issued by Hongkong Post Certification Authority) to individuals and organisations for the conduct of legally binding electronic transactions that require identity authentication. The number of digital certificates estimated to be issued every year from 2000 to 2014, as well as the actual numbers of digital certificates issued and renewed are detailed at Annex A.

(2) Since April 2007, Hongkong Post Certification Authority has outsourced the operation of its e-Cert services to a contractor who shoulders the full cost of the operation and can directly collect e-Cert fees. Information on its operation is commercially sensitive and cannot be provided.

(3) At present, 41 types of e-government services require the use of digital certificates for digital signature or identity authentication. Over the past three years, the cumulative number of transactions using e-services with digital certificates exceeds 150 million (details at Annex B).

     Digital certificates ensure the confidentiality of electronic transactions, and enable users to digitally sign in an electronic transaction, thus ensuring its non-repudiation as well as the authenticity and integrity of the information transmitted in the transaction. Although digital certificates are not widely adopted internationally yet, the underlying technology base is still considered as an effective measure to augment high security electronic transactions. In view of this, the Office of the Government Chief Information Officer actively promotes the use of digital certificates in e-services that require authentication. In recent years, a number of government departments have launched new systems and services that make use of digital certificates. Examples include the "Smart Warrant Card System" of the Hong Kong Police Force, as well as the upcoming new services of Immigration Department's address record update and Student Financial Assistance Agency's e-submission service.

     In the new 2014 Digital 21 Strategy, we propose to provide free digital certificates to all Hong Kong residents, with a view to driving the wider use of digital certificates in online services requiring authentication, thus allowing the public to use e-services in a secure manner.

(4) The chip embedded in the Smart Identity (ID) Card supports multiple applications. The ID card data contained in the chip, including names in Chinese and English, ID card number, date of birth and date of issue, can be used by authorised government departments. Government departments that make use of ID card data to provide services include Immigration Department, Leisure and Cultural Services Department, Department of Health and Hospital Authority (details at Annex C).

(5) Hong Kong Smart ID Cards are made of durable materials, and are designed to last no less than 10 years. From June 2003 to late December 2013, Immigration Department had issued more than 11 million Smart ID Cards. There are 55 000 cases involving card replacement due to damage, representing 0.49% of total number of cards issued.

     As for future development, Immigration Department is conducting a consultancy study on the Next Generation Smart Identity Card System, which is expected to be completed in the middle of this year. No concrete timetable for replacement has been drawn up.

(Note) Apart from the Postmaster General, Digi-Sign Certification Services Limited is also a recognised certification authority that can issue digital certificates.

Ends/Wednesday, February 26, 2014
Issued at HKT 15:15

NNNN