Michael Chung, director of product development, marketing and sales at Hong Kong Post (HK Post), said the department cannot keep pace with e-Cert operating expenses and outsourcing would help reduce the government's financial burden.
Chung said the operating loss totaled HK$15 million for e-Cert services during the 2004-5 financial year. Total investment within the five years of operation was HK$208 million with a cumulative loss of HK$$89.4 million, he said.
"We have decided to explore the feasibility of having the private sector operating the e-Cert services and the possible synergy that can be unleashed," said Betty Fung, the deputy government chief information officer.
Launched in January 2000, e-Cert aims to secure online transactions using the public key infrastructure (PKI) technology. However, since the launch, the service has not generated significant endorsement from the public.
As of mid-November 2005, Chung said HK Post had issued 1.47 million e-Certs, with 1.2 million e-Certs embedded in Hong Kong's smart ID cards free of charge. According to a recent online survey by Computerworld Hong Kong, 60 percent of 119 respondents said they've never used their e-Cert embedded in their smart ID card, while 24 percent said they do not have an e-Cert.
Fung said the lack of awareness was not responsible for the low adoption rates, citing a lack of applications for high-level security protection instead. "[The] e-Cert has a very high security level, which may not be required for the most common online transactions," she said. "There is not an absolute demand for a high security standard in most simple online transactions."
Chung said the lack of user friendliness was one of the reasons for low adoption when the service was first available. "Since the technology was not mature, it was complicated to install e-certs when we first launched the service," he said. "We realized the challenge and have made changes in the process, now it is no different from installing any software in your PC."
Details of the Request for Proposal (RFP) for the outsourcing scheme will be issued in the first half of 2006. The contract is expected to be awarded to the successful bidder before the end of 2006 with the takeover of the operation starting in early 2007, Fung said. If there is no successful bidder, the government will suspend the e-cert service by March 2008, she added.
"To attract private sector participation in providing e-cert services, we will consider ways to enhance the business case of the RFP exercise," said Fung. "For example, bidders may propose their preferred collaboration and business models for consideration by HK Post, and provide value-added services."
Under the RFP, the Postmaster General at HK Post will remain a recognized certificate authority and be responsible for the performance of the e-Cert operation partner. But the outsourcing operator will receive income generated from the e-Cert and value-added services, Fung said.