Hongkong Post established the first recognized certification authority (HKPCA) in January 2000 with two primary objectives:

1. to support the Government's Digital 21 Strategy by spearheading the development of the public key infrastructure (PKI) to facilitate the development of e-government and e-commerce in Hong Kong; and
2. to offer the public CA services as a commercial venture under the trading fund operation and as a new business initiative.

Over the past 5 years, Hongkong Post has been promoting the adoption of e-Cert in e-business applications in various business and government services in Hong Kong and raising the awareness of the community of the importance of conducting e-business transactions in a secure manner. Hongkong Post has successfully created a critical mass of e-Cert users through the one-year-free e-Cert offer under the smart ID card programme. HKPCA has issued more than 1.47 million personal and organizational e-Certs, including 1.2 million free personal e-Certs embedded in smart ID cards which are readily available for use in secure e-businesses and e-government services.

The Government has recently completed a business review on HKPCA operations, the e-Cert services and its financial arrangement, and has come to the view that the current mode of operation of and funding for the HKPCA, which requires substantial funding support through cross-subsidization from the postal services or the Government, is not sustainable in the longer term. The Government has decided to explore the feasibility of having the private sector operating the e-Cert services and possible synergy that can be unleashed. In this connection, Hongkong Post will conduct a Request for Proposal (RFP) exercise in the first half of 2006 to identify a suitable business partner to collaborate with the HKPCA in providing the e-Cert services. The aim of the RFP exercise is to engender a self-financing public CA operation.

If a successful bidder is identified, Hongkong Post will award the contract before end of 2006 to enable the selected bidder to take over the HKPCA operation in early 2007. In the event that there is no successful bidder, the Government will support the HKPCA's operation until end March 2008 so as to allow sufficient time for existing e-Cert subscribers and business partners of HKPCA to complete the necessary transitional arrangements and switch to the service of other recognized CAs or other authentication solutions. HKPCA will continue the provision of our quality services to the public at least up till end March 2008, pending the result of the RFP exercise.

[Press release...]

For enquiries, please call 2921 6633 or email to enquiry@hongkongpost.gov.hk.

1. Can I still apply for embedding an e-Cert on Smart ID Card?

Yes. Citizens who have not applied for embedding an e-Cert on their smart ID card can still do so at one of our 20 designated post offices or at the e-Cert counter at one of the 9 Smart ID Card Centres to enjoy the one-year-free e-Cert offer.

2. Are citizens still offered free smart ID e-Cert?

Yes. Citizens may still apply for the e-Cert on smart ID card with one-year free use period.

3. When will the free use period of my smart ID e-Cert expire?

Each Smart ID e-Cert has a lifespan of 3 years. The first batch of Smart ID e-Cert was issued in June 2003, and will become invalid when their 3-year lifespan start to expire in June 2006.

If your Smart ID e-Cert is issued on or before 31.3.2006, you will still enjoy free use of your e-Cert until 31.3.2007 or end of its 3-year lifespan, whichever date is earlier.

Smart ID e-Cert to be issued on or after 1.4.2006 will have a free use period of one-year until further notice.

4.Should I stop using my Smart ID e-Cert now if HKPCA will be terminated?

The termination of HKPCA would only be determined after the completion of the RFP exercise in the second half of 2006.

At present, you may continue using your Smart ID e-Cert.

If the e-Cert service is to be terminated, we will make proper announcement.

5. Can I renew my Smart ID Card e-Cert when its 3-year lifespan expires?

Yes. You can do so at one of the 20 designated post offices.

[Each Smart ID e-Cert has a lifespan of 3 years. The first batch of Smart ID Card e-Cert was issued in June 2003, and will become invalid when their 3-year lifespan start to expire in June 2006.]

6. Can I remove the e-Cert from my Smart ID Card?

Customers can go to the 20 designated post offices or the e-Cert counters at 9 Smart ID Card Centres to request for removal of their e-Cert on smart ID cards.

Alternatively, if your personal computer has been installed with a suitable smart card reader, you can make use of the e-Cert Control Manager software to remove the e-Cert in the smart ID card.

[The e-Cert Control Manager software can be downloaded from the e-Cert web site at www.hongkongpost.gov.hk, and bundled with the installation CD of the smart card reader on sale at counters.]

7. Will there be any changes in existing e-Cert services, procedures or service level?

No. Before the result of the RFP exercise is known in the second half of 2006, the existing e-Cert services will remain unchanged.

8. Will there be further promotion activities for e-Cert?

Hongkong Post will not carry out further promotion programmes for e-Cert. The existing "Use More Get More" programme will continue until end-January 2006.

9. If Hongkong Post is going to close down the e-Cert services, would I, being a consumer, still get value from applying the service?

Hongkong Post is going to conduct a Request for Proposal (RFP) exercise to invite private sector to participate in the provision of Hongkong Post e-Cert services. It is only in the event there is no successful bidder, the Government will support the HKPCA's operation until end March 2008. As the result of the RFP is still unknown, customer can still use the e-Cert to enjoy the various online services as usual.

10. Is the termination of the e-Cert scheme also means that security measure adopted by other online service providers is equivalent or even better than the function or value provided by e-Cert? If yes, what value do I get from applying e-Cert now? If no, what are the alternatives provided if the e-Cert scheme terminate in 2008?

The PKI technology behind e-Cert is still recognized by the IT industry as the most mature technology available to address the full range of "authenticity", "confidentiality", "integrity" and "non-repudiation" issues of electronic transactions.

Unlike PKI, other technologies including "One-time Password" and "Short Message Service (SMS)" being used by some online service providers are sufficient to satisfy the "two-factor authentication" requirements, but may not address the other issues of confidentiality, integrity and non-repudiation which only e-Cert will be able to address.

For example, an e-Cert can be used to support digital signatures and encryption of emails or electronic files while the One-time Password and SMS technology are not designed for such functions.

If the e-Cert scheme is to be terminated in 2008, citizens may still apply for recognized digital certificates from other recognized CAs in HK.

11. If HKP is to terminate the e-Cert service, will HKP transfer the existing e-Cert users to other recognized CAs or service providers?

HKP will not transfer the existing e-Cert customers to other service providers.

12. Would the existing e-Cert users be notified of the termination in advance?

HKPCA will announce the termination at least 60 days in advance.