Computers Today June 1998 Master File: Hurdles in the Long Stride

What are the risks involved in e-commerce, and how the infotech giants are realigning their business to make secure tools available.

Even two years ago, as shops began conducting business on the Internet, what deterred many users from shopping online was the question of security. How safe would it be to use your credit card online? While such a concern is shared by many users, the risk has now been reduced. This has come about due to the development of secure Internet protocols and payment systems, and server solutions that can handle electronic transactions. They indicate the potential that industry players see in the 'electronic commerce' marketplace.

Cisco has one of the early success stories of using the Internet to enhance competitive advantage. The Cisco Connection Web site, now available in 14 languages and with 49 country pages, is claimed to be the largest Internet commerce site. Winning in the 21st century—touted as the "knowledge economy era"—requires more than investing in Internet application technologies, feels John Chambers, president and CEO, Cisco Systems Inc. Predicting that e-commerce will be the primary means by which business will be conducted in the next 10 years, he said it is important for both a business and its partners to start now in making the Internet a part of their business processes and strategies.

Duty Free on the Net

Last month, the World Trade Organisation came to a decision to keep global electronic commerce duty free, and agreed to evolve a programme to deal with its development on the Internet. The new agreement, involving trade ministers of 132 countries, bars governments from collecting any tariffs on such transactions for at least a year. It, of course, has incurred wrath from non-governmental organisations since such an exercise would benefit corporates of developed countries; governments, by the way, would lose the option of a revenue-earning source.

In a related development, the Global Internet Project (GIP) presented the European Union (EU) with its recommendations on e-commerce last month. EU wants to develop a global charter covering technical standards, illegal content, licences, encryption, and data privacy on the Internet and other electronic networks. GIP's proposal covers security and authentication, telecoms infrastructure, taxation and customs, international commercial principles, intellectual property, standards and interoperability, regulation of content, and import and export regulations. GIP members include Netscape, NetworkMCI Services, AT&T WorldNet Service, British Telecom, Deutsche Telekom, Fujitsu, GTE, IBM, NEC, Oracle, Sun Microsystems, and Visa International.

For companies eying the Internet, e-commerce still has risks to be overcome, though they are not the same ones that got the most attention two years ago, said Mark Greene, vice-president, electronic payments and certification, IBM, in a keynote address at Internet World Canada, last year.

According to Greene, the security risks attached to e-commerce are well on the way to being solved. He pointed to the Secure Electronic Transaction (SET) initiative that major credit-card issuers Visa International and Mastercard are backing. The SET project, obtaining assistance from Microsoft Corp., IBM Corp., Netscape Communications Corp., SAIC, GTE, Terisa Systems and Verisign, aims to deliver a transparent encryption system suitable for all electronic transactions using PCs.

According to Glenn Kramer, director, Software Systems Architecture, Verifone, while SET protocols will take a while to ramp up, the other, more critical, is the open trading protocol which supports end-to-end transactions with parameters for payment and delivery not only on credit cards but on smart cards which can be linked on a download-upload mode to bank accounts of subscribers.

The use of public key encryption may also go a long way in allaying users fears of safety. One incentive to use public keys are lower costs. According to Forrester Research Inc., this 20-year old technology can save large companies as much as $5 million annually "due to lower networking and help-desk costs".

To the widespread use of the Internet, and the development of security standards and protocols, the addition of electronic payment systems makes dealing online much more feasible. The types of solutions available today include third-party payment organisations and credit card payment systems on the Net. DigiCash, France, was the first third-party payment organisation, in 1994, to implement a virtual money system, with which clients and merchants could transact business in relative safety. DigiCash and later third-party payment organisations developed payment and merchant systems based on the RSA security system for transmitting encrypted data over the Internet.

Taken in conjunction with the development of secure Internet protocols (Netscape's Secure Sockets Layer, Enterprise Integration Technologies' Secure-HTTP, MasterCard and Visa International's SET, and the Joint Electronic Payment Initiative), third-party organisations have attracted banks and credit card companies to the Internet. Some of the third-party payment offerings now available are CyberCash, Ecash, First Virtual Payment System and ClickShare.

CyberCash is a realtime, secure, digital signature-based credit card authentication service, developed by CyberCash Inc. It acts as an intermediary between the consumer, the merchant and the credit card clearing house. Ecash, on the other hand, is digital money that is downloaded by an Ecash client from a participating bank and stored on a customer's local computer. Ecash can be spent at merchant systems that accept it; accepting merchants, in turn, must deposit Ecash receipts at a participating bank.

ClickShare is a micropayment system that allows merchants to participate in a transaction-handling system that consolidates charges over a billing period.

Of the credit card payment systems available now on the Net, ICVERIFY, from ICVERIFY Inc. is the most popular. ICVERIFY processes and authorises credit card transactions online. Since it uses text files for authorisation, processing and reporting, it can be easily integrated into applications developed in any language, for online payment.