Developing Liability Standards for Electronic Commerce

Amit YORAN <amit@riptech.com>
Riptech Security Consulting Group
USA

Abstract

This paper suggests a method for evolving legal standards for liability arising from electronic commerce (EC) transactions. For EC to flourish as a viable alternative to traditional commercial transactions, each party to an online transaction must determine what, if any, liability is associated with a given transaction. According to an Office of Technology Assessment study entitled Information Security and Privacy in Networked Environments, "Legal standards for electronic commercial transactions have not been fully developed and have undergone little review by the courts." The development of legal standards is based upon the principle of due care. "Due care" is that which an ordinarily prudent person would have exercised under the same or similar circumstances in a standard commercial transaction.

The paper seeks to identify the "due care" required by a given action in an electronic transaction based upon risk associated with that role. It provides a framework for the development of legal standards that are based on the principles of risk analysis, which are well known to computer professionals. Development of such standards will promote the growth of EC because parties to these transactions will be able to assess their exposure to liability based upon "real-world" factors, as opposed to arbitrarily imposed judicial standards.

The paper will analyze an electronic transaction within the framework of role-based risk analysis (RBRA) as a model for the development of legal standards. The RBRA model (which was first presented at the 1997 National Information Systems Security Conference) is a risk analysis model that refines traditional risk analysis to account for the multiplicity of parties involved in networked environments such as EC.

The paper will use RBRA as a basis for analyzing potential liabilities for the use and transmission of digital signatures to authenticate an online transaction. Although this is only one part of the EC transaction, it will be used in this paper to clarify how such analyses will benefit all parties involved.

The parties or actors involved in this transaction are 1) customer, 2) merchant, 3) acquiring bank, 4) settlement bank, 5) third-party software vendor (e.g., Verisign), and 6) Internet service provider. Each of these participants plays a role in ensuring that the digital signature can be used to verify a transaction and meet the legal requirements that a transaction be authentic, verifiable, and unable to be repudiated. Consequently, each actor may be subject to liability for failure to do so. The paper analyzes each actor's risk using RBRA and suggests liability guidelines based upon the predictability of such risk. The establishment of these guidelines will enable all parties to an EC transaction to better understand their roles, responsibilities, and risk and allow them to make an informed decision to engage in an electronic commercial transaction.

The remainder of the paper will examine the impact of statutes such as the Uniformed Commercial Code on our analysis.

Contents

• 1. Introduction
• 2. Risk analysis
• 3. Suitability of role-based risk analysis to electronic commerce
• 4. Role-based risk analysis of electronic commerce
• 5. RBRA analysis
• 6. Applying negligence law to RBRA
• 7. Risk allocation
• 8. Conclusion
• 9. Notes

1. Introduction

Both risk analysis and principles of due care need further development. Neither approach is necessarily always appropriate and therefore neither is always sufficient to provide a strong defense against liability in the case of monetary loss related to loss, theft, or exposure of networked information. A combination of the two approaches will likely provide improved protection. [1]

This paper seeks to combine risk analysis and due care principles, as proposed in the Office of Technology Assessment (OTA) report in order to suggest a methodology for developing legal standards for liability arising from electronic commerce transactions. For electronic commerce to flourish as a viable alternative to traditional commercial transactions, each party to an online transaction must determine what, if any, liability is associated with a given transaction. According to an OTA study entitled, Information Security and Privacy in Networked Environments, "Legal standards for electronic commercial transactions have not been fully developed and have undergone little review by the courts." The development of legal standards is based on the principle of due care. Due care has been defined as "Just, proper, and sufficient care, so far as the circumstances demand it; the absence of negligence. That care which an ordinarily prudent person would have exercised under the same or similar circumstances." [2]

This suggests a framework for the development of legal standards that are based on a synergy of the principles of risk analysis, which are well known to computer professionals and the due care standard required by the law. Development of such standards will promote the growth of electronic commerce because parties to these transactions will be able to assess their exposure to liability based on "real world" factors, as opposed to arbitrarily imposed judicial standards.

The paper will analyze an electronic transaction within the framework of role-based risk analysis (RBRA) as a model for the development of legal standards. The RBRA model (which was first presented at the 1997 National Information Systems Security Conference) is a risk analysis model that refines traditional risk analysis to account for the multiplicity of parties involved in networked environments, such as electronic commerce.

2. Risk analysis

Risk analysis is the process of identifying security risks, determining their magnitude, and identifying areas needing safeguards. Risk analysis is a part of risk management.

One method of managing risk is to apply a well-known risk analysis (RA) model to determine a cost-effective and efficient method of reducing risk. Traditional risk analysis methodologies have existed for many years. [3] Traditional RA is conducted using the following methodology:

1. Identify assets -- These assets can be any part of the information "system." They can include hardware, software, data, people, documentation, and supplies.
2. Determine vulnerabilities -- Vulnerabilities are any person, threat, act, or idea that may cause a loss in information secrecy, integrity, availability, or any other defined information security goal.
3. Estimate likelihood of exploitation -- This estimation is based on controls in place and probabilities that these controls are overcome.
4. Compute expected annual loss -- The expected annual loss factors in loss of business opportunity, cost of data recovery and reconstruction, loss in sales, and loss in public relations among others.
5. Survey new controls -- Other controls and countermeasures are evaluated in relation to the defined vulnerabilities.
6. Project annual savings of control -- This weighs the costs of implementing controls against possible associated losses.

3. Suitability of role-based risk analysis to electronic commerce

In scenarios where information and responsibilities are distributed among different entities, a role-based methodology is more intuitive and lends itself toward a more accurate depiction of the process. This model enables the actors to more easily and efficiently address the different responsibilities, threats, and countermeasures for each role as required. Standard risk analysis methods are not capable of accurately modeling the modern distributed business process, whereas the RBRA model provides greater comprehension and a clearer depiction of the scenario.

Risk analysis for electronic commerce must allow parties to ensure that vulnerabilities are detected and mitigated, but also that the other questions that are basic to the success of any commercial transaction are addressed. One of the most important is the attribution of legal and therefore fiscal liabilities.

Role-based risk analysis is well suited to electronic commerce because its focus is on actors who impact electronic commerce transactions, as opposed to traditional risk analysis, which only examines the system involved in electronic commerce. Because RBRA focuses on actors with an electronic commerce system, it has natural congruity with the principles of due care.

4. Role-based risk analysis of electronic commerce

There are many payment technologies currently available and in use on the Internet. All of these technologies facilitate the same electronic commerce transaction scenario:

A consumer accesses a merchant site using his browser over the Internet. Then when a consumer makes a purchase, a number value will be assigned (+1 to +4) based on the likelihood of exploitation. The higher the likelihood that a vulnerability will be exploited, the greater the duty of care will be imputed. Conversely, the more expensive or difficult a potential defense or fix is, a value (-1 to -4) will be assigned. This rough calculus will determine the "duty of care" required by measuring likelihood of exploitation against the cost/expense or remediation.

5. RBRA analysis

Perhaps the best way to convey the need for role-based risk analysis is to provide several scenarios where the security of a system is breached and damages occur. Consider a scenario where a vendor has set up an electronic commerce site on the Internet and is accepting online transactions posted via a Web site using Secure Sockets Layer (SSL). As designed, and under normal circumstances, the controls implemented were deemed to be and are in fact adequate commensurate with the transaction taking place. In our scenario, an electronic commerce vendor is using a Microsoft Internet Information Server Web site, with a digital certificate signed by Verisign. A consumer connects to the site via a Netscape Web browser and after seeing a message that a "secure connection" had been established, purchases goods from the site. There are obviously many places where the electronic commerce transaction process can break down. Consider the following examples to be a small subset of where the attribution of negligence can be made:

1. There is a programming bug in the Web server software that causes the transaction to be weakly encrypted, such that third parties can easily observe or modify the transaction data.
2. There is a programming bug in the Web browser software chosen by the consumer that causes a similar breach in security to the transaction.
3. Although both Microsoft and Netscape's implementations are correct, there is an inherent weakness in the security protocols used and again, third parties can observe or modify the transaction data.
4. Perhaps all of the parties in the transaction perform their duties correctly, and compromise of one of the party's Internet Service Providers provides a hacker with ample time and opportunity to mount a successful attack using an unpublished technique against the transaction process.

This example clearly illustrates where multiple actors within the electronic commerce transaction process can be effected.

6. Applying negligence law to RBRA

The RBRA analysis of a given situation allows for application of the legal doctrine of negligence. First, the defendant must have owed the plaintiff a duty of care to exercise ordinary or reasonable care in performing a role or providing a product in the electronic commerce model. Second, the defendant must have breached that duty. Third, that breach must be the proximate cause of injury to the plaintiff that resulted in economic harm or damages.

"Duty of care" and "breach of duty" are legal terms of art. They are an expression of what an actor ought to do in a given circumstance. It has been pointed out that in the negligence context, the traditional risk utility formula is applied to determine whether the cost of a precaution is warranted. Therefore, an actor would have a duty to take a precaution if the cost of a potential precaution is less than that of the potential harm multiplied by the gravity of its potential injuries. [4] If an actor fails to prevent a potential harm that is very foreseeable (the risk level is high) and the cost of a potential defense is lower, then the actor would be deemed to have breached his duty. If this calculus is applied to an example of potential risk outlined earlier, the application of the negligence doctrine becomes possible.

In the first example given, there is a bug in the Web server software that results in weak encryption. If RBRA is applied to this scenario, the following determinations may be made:

• The consumer would most probably not owe a duty to any of the other parties to detect the bug. For the consumer the risk is high (+4), however, the cost of a potential defense is high, if it is at all possible for a consumer to avoid (-5). Therefore the potential liability would be limited. The role of the consumer is that of trans-actor.
• The merchant has the most control over the electronic commerce transaction. In the case of many larger online vendors the merchants design and maintain their own electronic commerce applications. In this instance, the merchant is both a trans-actor and a facilitator. If the merchant is maintaining its own electronic commerce application, it would have a duty to implement technology that is suitable. While the risk level in this case is high (+4) the difficulty of detecting the bug would also be high (-4). Hence the merchant, acting as a facilitator would have intermediate risk level. In this case, the duty might be limited to remediating only known software flaws.
• The ISP has limited risk if it is merely acting to transport network traffic (+1). In general, ISPs only have a duty to warn of known problems. Hence we will assign a +4 for the duty to prevent harm.
• The third-party vendor. The Web server manufacturer clearly has a high duty of care to prevent bugs that compromise the security of its software. The forseeability of harm caused and its potential harm are very high (+4). However, the third-party software vendor should have quality control and testing in place so that the difficulty and cost of preventing a bug are diminished (-1). Based on this analysis, the third party software vendor would have the highest duty of care as compared with any of the other actors in the model.

7. Risk allocation

The ultimate goal of developing this area of law and risk analysis is to promote the growth of electronic commerce. The optimal standard of due care should be one that increases use of electronic commerce and distributes risk in a fashion that will also promote this goal. In the example presented above, the third party software vendor is the actor in the electronic commerce model that can do this. In general, the facilitators will be able to bear the majority of the risks for liability in electronic commerce. Facilitators are commercial entities with the resources to undertake the mitigation of the potential harm arising from electronic commerce transactions. In addition, facilitators will be receive a direct economic benefit from electronic commerce. In contrast, trans-actors are individual consumers and small businesses doing business online. Liability for these actors should be limited relative to facilitators.

8. Conclusion

According to the Clinton administration's 1997 report on electronic commerce, A Framework for Global Electronic Commerce,

Private enterprise and free markets have typically flourished ... where there are predictable and widely accepted legal environments supporting commercial transactions.... Fully informed buyers and sellers could voluntarily agree to form a contract subject to this uniform legal framework, just as parties currently choose the body of law that will be used to interpret their contract. [5]

At this time however, no such universally accepted legal regime exists for assigning risks associated with electronic transactions. In the meantime, issues relating to liability will be decided by courts, applying legal constructs such as the negligence doctrine. Hopefully, courts will use tools such as role-based risk analysis in order to develop case law that encourages electronic commerce.

9. Notes

[1] U.S. Congress, Office for Technology Assessment, Information Security and Privacy in Networked Environments, Government Printing Office, September 1994.

[2] Henry C. Black, M.A., Black's Law Dictionary, West Publishing, 1979.

[3] Hoffman, Lance J. Risk Analysis and Computer Security: Bridging the cultural gaps, Presented at the 9th National Computer Security Conference, National Bureau of Standards, Gaithersburg, MD, September 1986.

[4] Commercial Law of Internet Security, Vol 10:2 High Tech Law Journal (1995).

[5] A Framework For Global Electronic Commerce, http://www.ecommerce.gov/framewrk.htm.