SOUTH PACIFIC COMPUTER LAW:
PROMOTING E-COMMERCE IN VANUATU
AND FIGHTING CYBER-CRIME IN TONGA

stephen e. blythe

ABSTRACT
                                                                      
Vanuatu and Tonga have enacted different types of computer laws. Vanuatu’s Electronic Transactions Act (‘ETA’) is designed to increase the reliability and integrity of E-commerce transactions. The ETA provides for legal recognition of electronic records and electronic signatures and allows them to be used to comply with statutory mandates pertaining to: original documents; written form; delivery; retention; and ink signatures. The ETA includes contract formation rules relating to attribution, acknowledgement of receipt, and time/place that an electronic message has been sent/received. In order to increase the authenticity and accuracy of electronic messages, the ETA established a compulsory system of licensing of Certification Authorities (‘CA’), the verifiers that an electronic message has been sent by a specific party and that the message has not been altered since it was transmitted. In order to be licensed, a CA must meet stringent requirements pertaining to knowledge of electronic signatures and computer information systems. A CA is generally liable to its subscribers or relying third parties for erroneous information contained in certificates it has issued, with some exceptions. On the other hand, an internet service provider is generally not liable for information contained in the electronic messages it disseminates, with some exceptions. Vanuatu’s E-Business Act (‘EBA’) allows foreign entities to use Vanuatu as a tax haven by renting an E-commerce website without having to establish a formal corporation. The Kingdom of Tonga enacted the Computer Crimes Act (‘CCA’) which prohibits these activities: tampering with another’s computer or obtaining information from it; interfering with another’s computer data or computer system; and trafficking in illegal computer devices. Substantial procedural powers are granted by the CCA to law enforcement authorities. In looking for ways to improve the computer laws of these nations, Vanuatu and Tonga can learn from one another. Vanuatu is in need of a computer crimes law which prohibits computer tampering and violation of security of computer information; Tonga has such a law—the CCA—and Vanuatu can consider it. Tonga is in need of an electronic transactions statute which provides for the legal recognition of electronic records and electronic signatures; Tonga may also want to enact a law giving tax advantages to foreign entities that rent a Tonga-based website for use in international E-commerce transactions. Vanuatu already has such statutes—the ETA and the EBA—and Tonga can consider them.
OBJECTIVES OF THE ARTICLE
                              
The objectives of this article are to: (1) introduce the reader to the South Pacific nations of Vanuatu and Tonga; (2) explain the role of electronic signatures, cryptology, public key infrastructure, and Certification Authorities; (3) analyse Vanuatu’s Electronic Transactions Act and E-Business Act; (4) analyse Tonga’s Computer Crimes Act; and (5) make recommendations for improvement of the computer laws of these two nations.

REPUBLIC OF VANUATU

The Republic of Vanuatu (‘Vanuatu’) entails more than 80 islands in a chain lying in the South Pacific Ocean, about 75% of the distance on a line drawn from Hawaii to Australia. More than sixty of the islands are inhabited. The land area is slightly larger than the U.S. State of Connecticut. British and French immigrants settled in these islands in the nineteenth century. From 1906 until the islands achieved their independence in 1980, they were ruled jointly by Great Britain and France and were referred to as the New Hebrides. Ninety-four percent of the citizens of Vanuatu are of Melanesian ethnicity. More than 15% of the nation’s population (206,000) live in the capital city of Port Vila on Efate Island.

Vanuatu’s Economy

Eighty percent of the population of Vanuatu make their living on small farms; the major products are copra, coconuts, timber, beef, cocoa, root extracts and kava. Offshore financial and banking services are another source of income; Vanuatu has more than 2,000 registered firms in this sector. The country is well known as a tax haven for expatriates. 	Tourism is the fastest growing industry and now accounts for more than 40% of Gross Domestic Product. More than 50,000 tourists went to Vanuatu in 2004, most of them coming from Australia and New Zealand. During the 1990’s, economic growth was tepid. Economic development has been rather hamstrung by the scarcity of export products, the continual problem of natural disasters (including earthquakes and tsunamis) and disadvantageous distances to foreign markets and between the islands of the country. To achieve more economic development, the government has begun to target more growth for the livestock farming and tourism industries. The government’s efforts seem to be paying dividends: in real terms, Vanuatu experienced an economic growth rate of 3.2% in 2004. Over the long run, E-commerce may also become a positive influence on the economy. In order to stimulate its development, the government of Vanuatu enacted several statutes pertaining to electronic transactions. Two of those statutes comprise one of the focal points of this article.
                                                                     
KINGDOM OF TONGA

The Kingdom of Tonga (‘Tonga’) consists of an archipelago of 169 islands, 36 of which are inhabited. Two-thirds of the population lives on its main island, Togatapu, and almost all citizens of Tonga are of Polynesian ethnicity. Twenty-five percent of Tonga’s population—34,000 persons—live in the capital city of Nuku’alofa on Togatapu island. Once referred to as the Friendly Islands, Tonga lies about two-thirds of the distance between Hawaii and Australia. Its total land mass is about 4 times the area of Washington, D.C., U.S.A. Tonga became a kingdom in 1845 and a constitutional monarchy in 1875, and is currently the only monarchy in the Pacific region. Although Tonga came under British control in 1900, it regained independence in 1970 and is now a member of the United Nations. In 2005, Tonga became a member of the World Trade Organization.

Tonga’s Economy

Two-thirds of the exports of Tonga are agricultural products: squash, coconuts, copra, bananas, vanilla beans, cocoa, coffee, ginger and black pepper.  The number-one cash crop is pumpkin squash; this crop was brought in from outside in 1987 and comprises 96% of the exports purchased by Japan. Tonga’s over-emphasis on pumpkin squash as a cash crop can be risky, however; in 2002, Tonga’s harvest of that item was reduced due to international price competition. Tonga’s economy was also shocked in recent years by the East Asian financial crisis and three typhoons which hit the islands during 1998-2001. The unemployment rate is 13%. 
	Nevertheless, Tonga has been experiencing an increase in its Gross Domestic Product. In addition to agriculture, the government of Tonga is also beginning to nurture other sources of economic growth. Promotion of tourism, development of the fishing industry, and upgrading of the nation’s communication and transportation infrastructure are examples. Tourism especially seems to hold promise for the country; the annual number of arrivals has been in excess of 33,000. Other more bizarre ideas for economic development have often been advocated in recent years, but with little success. Tonga continues to depend upon the remittances of the one-third of its citizens currently living overseas, most notably in New Zealand, Australia and the United States.
	An event of September, 2005 brought the government of Tonga to the edge of bankruptcy by early 2006. That event was a massive increase in pay given to striking government workers. The pay increases were enormous, amounting to 60-80% per worker. Tonga’s Finance Minister has forecast a huge deficit in the government’s budget for the 2006-07 fiscal year. The deficit threatens to have a detrimental impact on Tonga’s economy; it could lead to high inflation, a reduction in foreign trade, more unemployment and less creation of new jobs, and a diminishment in the quality and quantity of government services. The Minister hopes that remittances from expatriate Tongans will be increased so that the government’s health services do not have to be significantly reduced.                                             

ELECTRONIC SIGNATURES, CRYPTOLOGY, PUBLIC KEY INFRASTRUCTURE AND CERTIFICATION AUTHORITIES

Electronic Signatures

In 1995, the U.S. State of Utah became the first jurisdiction in the world to enact an electronic signature law. An electronic signature may be defined as ‘any letters, characters, or symbols manifested by electronic or similar means and executed or adopted by a party with the intent to authenticate a writing.’ There are many forms of electronic signatures; examples include ‘a name typed at the end of an e-mail message, a digitized fingerprint, a digitized image of a handwritten signature that is attached to an electronic message, a retinal scan, a pin number, or a digital signature.’ One type of electronic signature—perhaps the most sophisticated—is the digital signature. In the Utah statute, digital signatures were given legal recognition, but other types of electronic signatures were not. Although the Utah statute provides for relatively more security in electronic transactions, its technological-exclusivity is burdensome and overly-restrictive. Forcing users to employ digital signatures gives them more security, but this benefit may be outweighed by the digital signature’s disadvantages: more expense, lesser convenience, more complication and less adaptability to technologies used in other nations, or even by other persons within the same country. 
	In drafting an electronic transactions law for Vanuatu, its creators apparently decided to give a preference to the electronic signature which affords the greatest reliability and security—the digital signature. However, despite the fact that Vanuatu recognizes the security advantages afforded by the relatively greater sophistication of the digital signature, the digital signature was not granted a monopoly. Unlike the Utah statute, Vanuatu allows other types of electronic signatures to be employed. This technological open-mindedness is commensurate with a global perspective and allows parties in Vanuatu to more easily consummate electronic transactions with parties from other nations.

Digital Signatures:  Three Aspects
                     
If the parties to an electronic transaction employ a digital signature, that decision will have these effects: (1) adoption of asymmetric cryptology; (2) utilization of public key infrastructure (“PKI”); and (3) interaction with a Certification Authority.
	In order for a digital signature to attain the same legal status as an ink-on-paper signature, asymmetric key cryptology must have been employed in its production. Such a system employs double keys—one key is used to encrypt the message by the sender, and a different, albeit mathematically-related, key is used by the recipient to decrypt the message.   The sender has a private key, known only to her, used to generate the digital signature, and the recipient uses the public key, often available online, to verify that the proper party created the message and that it has not been altered during transmission. This is a very good system for electronic transactions, since two stranger-parties, perhaps living far apart, can confirm each other’s identity and thereby reduce the likelihood of fraud in the transaction.
	In order to use this cryptology for electronic ‘signing,’ a person must first apply for issuance of a pair of keys—a private key and a related public key. A prospective subscriber of a Certification Authority (“CA”) requests the CA to confirm her identity. After verification of the applicant’s identity, payment of fees and compliance with other requirements, the new subscriber will be issued the private key which corresponds to the public key contained in the Certificate. The Certificate confirms the identity of the subscriber to the world and will be placed in a public repository, most often the CA’s website. Whenever the subscriber digitally signs a message, the CA confirms the signature of the sender and informs the recipient of the encrypted message which “public key” is necessary to decode the message. At that point, the recipient is able to access the public key which is used to decrypt the sender’s message. 

VANUATU’S ELECTRONIC TRANSACTIONS ACT
                                   
Purposes  

The Electronic Transactions Act (“ETA”) was enacted on 12 September 2000 and went into effect on 6 November 2000. Its purposes are to: (1) to help Vanuatu become known as an ‘international business centre;’ (2) to increase E-commerce by enhancing the integrity and security of electronic transactions; (3) to recognize the legal validity of electronic documents and electronic signatures as bona fide alternates for paper documents and ink signatures; (4) to increase the confidence of the general public in electronic transactions; (5) to help create a ‘legal and business infrastructure’ which is essential to the achievement of secure electronic transactions; and (6) to regulate E-commerce transactions, but also to encourage E-commerce development through the operation of free market forces, and to achieve as much self-regulation of the E-commerce industry as possible. The government of Vanuatu has stated that it used the 
E-commerce law of the Commonwealth of Bermuda as a model for the ETA.
                    
E-Government

The ETA does not mandate any agency of the government to use electronic documents. 
However, if the Minister gives notice in the Gazette that a named agency will henceforth ‘receive and process’ electronic records pertaining to specifically-named matters, then the government becomes obligated at that point to accept and use electronic documents as an alternative to paper documents.

ETA Inapplicable in Some Situations

Electronic documents are unacceptable substitutes for: (1) paper wills and other documents of testamentary disposition; (2) paper documents which convey or transfer real property; and (3) paper documents pertaining to any category of ‘transactions, persons, matters or things’ as specified in an order of the Minister. 

Selected Definitions

The ETA defines twenty-four terms; two of them are presented here. 

Accredited Certificate (hereinafter ‘Certificate’): a Certificate issued by an accredited certification service provider which confirms the identity of the Certificate holder and verifies the electronic signature of that person. 

Authorized Certification Service Provider (hereinafter ‘Certification Authority’ or ‘CA’): a licensed person who is authorized to issue Certificates pursuant to 
ETA s 20(20). 

Legal Recognition of Electronic Records

Mere Fact of Electronic Form Insufficient to Avoid Recognition

No denial of legal recognition, accuracy, ‘admissibility or enforceability’ will be allowed based on the mere fact that: (1) the information is in electronic form; or (2) is referenced in an electronic record which purportedly results in such legal effect.

Electronic Records Can Comply With Requirement to Be ‘In Writing’

If a law or statute requires information to be in writing to be recognized, or characterizes information as mandated to be in written form, the electronic form will suffice if: (1) it is “accessible;” and (2) it can be retained for use at a later time.

Electronic Records Can Comply With Delivery Requirement

If a law mandates that information must be delivered to a person, that requirement will be deemed met if the information is in the form of an electronic record, and: (1) the sender of the electronic record requires the receiver to acknowledge it; and (2) the receiver acknowledges the receipt of the electronic record. This will hold regardless whether the law creates an affirmative obligation for delivery, or the law warns of resulting effects if the delivery is not made.

Electronic Record Can Comply With Signature Requirement

If a law mandates the affixation of a person’s signature on a paper document, this will be met with an electronic record provided: (1) some means is employed to identify the person and to show that she ‘intended to sign or otherwise adopt’ the electronic record’s information; and (2) the means used is reliable, in consideration of the reason for creation of the electronic record or the communication of it, or any ‘relevant agreement.’ This will be the case regardless of whether there is an affirmative duty to sign, or the law provides deleterious results if a person fails to sign.

	Electronic signatures which are supported by a Certificate issued by an accredited CA will definitely comply with a law’s requirement for a signature on a paper document. However, an electronic record meeting these requirements will not be refused ‘legal effect, validity, and enforceability’ merely because: (1) it is not an E-signature; or (2) it is not supported by a Certificate.

 Electronic Records Can Comply With Original Requirement

If a law mandates that an original paper document must be presented in order to meet a legal requirement, or if a law requires that a paper document must be stored in its original form, that mandate is met if: (1) there is a ‘reliable assurance’ that the electronic document, from the time of its creation until the present, has not been altered; and (2) if required to be presented, the information contained in the electronic record will be an accurate representation of the original. This rule holds regardless of whether there is an affirmative duty for presentation or retention in the original form, or the law dictates consequences if the original is not retained or presented. 

Electronic Records Can Comply With Retention Requirement

If electronic records are mandated by law to be stored, that mandate will be complied with by the storage of records in electronic form, provided: (1) the information is accessible and can be stored for reference at a later date; (2) the format used in the electronic form is identical to the one in which it was ‘generated, sent or received,’ or the format is a correct depiction of that information; and (3) the location and date of the transmission and reception is also stored.

Admissibility of Electronic Records and Evidential Weight Granted to Them

In a court of law, the rules of evidence shall not be construed in a manner that will refuse to admit an electronic record into evidence: (1) merely because of its electronic form; or (2) if it is the ‘best evidence’ available, merely because it is not in its original form.

	Factors to consider in determination of the evidential weight to be given an electronic record include: (1) the degree of trust and reliance that can be given the electronic record, taking into account the means of generation, storage and communication; (2) whether the electronic record’s integrity has been maintained since it was created, i.e., the trustworthiness of the record and whether there is assurance that it has not been altered; (3) the means of identification of the sender; and (4) other relevant factors.

Rules Pertaining to E-Commerce Agreements

Contract Formation

In the absence of a contrary agreement between the parties, a contractual offer and acceptance may be in electronic form. In communication between the sender and the receiver as they negotiate a contract, declarations or other statements shall not be denied legal effect merely because they are in electronic form.

Attribution

An electronic record may be assumed to have been sent from a particular sender if: (1) the record was sent as a result of the sender’s acts; (2) the record was sent as a result of the sender’s agent’s acts; or (3) the record was sent from the sender’s computer system.
Attribution of an electronic record may be proven by any number of methods, including the reliability and integrity of a computer system’s security system which indicates the party who sent a message.

Acknowledgement of Receipt 

The following rules are applicable if either: (1) the sender has requested the receiver to acknowledge receipt of the message; or (2) the parties have agreed that an acknowledgement is to be sent from the receiver to the sender. 

1.	If the parties have not agreed as to the form or the method of the acknowledgement, then the acknowledgement may be given by: (a) any form of communication of the addressee, including automated communication; or (b) any conduct of the receiver that is ‘reasonably sufficient’ to indicate reception.
2.	If the sender states that the electronic message requires an acknowledgement, then the message is assumed never to have been sent until the sender receives the acknowledgement.
3.	If the sender has not stated the message is conditional until receipt of acknowledgement, and no acknowledgement has been received by sender within the specified time or the time agreed to (or, if no time had been specified or agreed), then after a ‘reasonable time,’ the sender: (a) may inform the receiver that no acknowledgement has been received, and may specify a future time certain for its receipt; and (b) if the acknowledgement referred to in (a) is not timely received, then the sender, after notice to the receiver, may act as though the message had never been sent.
4.	When the sender receives an acknowledgement from the receiver, the sender may assume that the message has been received, but this assumption does not also necessarily mean that the message received is identical to the one that was sent.

Assumed Time and Place of Sending and Receiving

Unless the sender and the receiver have agreed to the contrary, an electronic message is assumed to have been sent when it enters a computer system not under the control of the sender.
	Unless the sender and the receiver have agreed otherwise, the time of receipt is ascertained using the following rules. If the receiver has pinpointed a specific computer system the message should be sent to, receipt is assumed to occur when it enters that specific computer system; or, if the message is sent to one of the computer systems under the receiver’s control, but it is not the specific one that was requested, then receipt is assumed to occur when the receiver first becomes aware that the message has arrived at that computer system; or, if the receiver has not designated a computer system for the message to be sent to, receipt is assumed to have occurred when it enters a computer system belonging to the receiver or that fact comes to the attention of the receiver.
	Unless the parties have a contrary agreement, then the message is assumed to have been sent from the sender’s place of business, and received at the receiver’s place of business.

Electronic Signatures

Certified E-Signatures Definitely Comply With Signature Requirement

An electronic signature which is confirmed by a Certificate issued by an accredited CA will definitely meet the requirements of ETA s 11(1)(a) and (b).

Criteria Required for Issuance of a CA’s Licence

In order to become a CA, an application must be filed with the Minister in charge of telecommunications. The application must be made on the official form which is provided by the Minister and the application fee must be paid. The licence will be issued by the Minister if she finds that: (1) the applicant has the requisite ‘knowledge and expertise’ necessary for the issuance of Certificates; (2) the applicant has the ‘technical capabilities’ necessary for the provision of Certificates; and (3) meets other criteria to be determined by the Minister.

The Minister will give notice in the Gazette to the general public whenever a new CA has been licensed and is authorized to issue Certificates.

Criteria Required for Revocation of a CA’s Licence  

If the Minister is of the opinion that a CA is no longer is qualified to be a CA, then the Minister will so inform the CA: (1) of her intention to revoke the CA’s licence; (2) the reasons for the revocation; and (3) that the CA should submit a written statement within fourteen days justifying why the licence should not be revoked. Whereupon, the CA’s statement will be considered by the Minister, and a decision regarding revocation will be made within seven days after receipt of the statement. If the Minister decides to revoke the licence, publication will be made in the Gazette, and the revocation will become effective on the date stated in the notice.  

Recognition of Foreign CA’s   

Realizing that E-commerce is an international phenomenon, the Republic of Vanuatu grants reciprocal recognition to foreign CA’s and foreign-issued Certificates. Under the ETA, foreign-licensed CA’s are allowed to apply for a Vanuatu CA license. If the license is approved, Certificates issued by the foreign CA will have the same legal rights as Certificates issued by domestic CA’s. After publication of public notice, payment of the fees, and compliance with the other criteria, the Certificates and the CA’s are treated as if they were domestic in origin. The ‘other criteria’ are: (1) in the case of Certificates, whether the criteria they met when they were issued abroad are substantially equivalent to the criteria required of Certificates in Vanuatu; and (2) in the case of CA’s, whether the criteria they met when they were licensed abroad are substantially equivalent to the criteria required of CA’s in Vanuatu.

The Minister may, of course, revoke the recognition of foreign CA’s or foreign Certificates if she later finds that either the CA, or the Certificate, no longer meets the criteria. The Minister’s procedure regarding revocation of a foreigner’s Vanuatu-issued CA licence (and of a Certificate originally issued abroad that was previously recognized in Vanuatu) is the same as for the revocation of a domestic party’s Vanuatu-issued CA license.

The Certificate Holder May Use a Pseudonym

It is acceptable for a CA to issue a Certificate to a subscriber whereby the subscriber lists an assumed name on the Certificate, instead of the subscriber’s real name. In such a situation, the CA will keep the true identity of the subscriber on file and will ordinarily not reveal it to third parties. However, if the subscriber is accused of the commission of a computer crime involving the Certificate, the CA is obligated to disclose the subscriber’s personal information, including her name, to the law enforcement authorities if they request it. In that situation, the CA must keep a record of the information given to the police and inform the subscriber at once.

Liability of the CA

The CA is liable to relying third parties for: (1) the truthfulness of all information contained in the Certificate as of the issue date, unless a contrary statement appears on the Certificate; (2) its assurance that the subscriber held the private key (the signature creation device) on the date of issuance, which corresponds to the public key (signature verification device) listed or identified in the Certificate; and (3) if the CA generates both the private key and the public key, assurance that the two keys function together in an acceptable manner. 

	There is no CA liability if: (1) a relying third party either knew, or should have known, that the Certificate had been revoked; (2) the subscriber or subscriber’s agent provided false information in the application for the Certificate, the false information appears on the Certificate, and the CA can show that it was diligent in its attempt to verify the information given by the applicant or the agent; or (3) the CA has listed limitations in the Certificate on how it can be used (which may include the maximum financial value of transactions that the Certificate can be used for), and these limitations have been communicated to relying third parties, and the actual uses exceeded the limitations expressed in the Certificate.

Computer Security Methods
                     
Encryption Devices

It is acceptable for a person in Vanuatu to use any encryption device so long as the person came into possession of it in a lawful manner. However, the Minister is authorized to promulgate regulations pertaining to the ‘use, import, and export’ of such devices, and to prevent the export of encryption devices altogether or to restrict their export.

Data Processing Security Standards

In order to maintain the privacy of personal information, the Minister is authorized to issue regulations for data processing of said information, regardless of the information’s country of origin. Such regulations may include: (1) voluntary adoption of secure methods by data processors; (2) publication in a register of the names of data processors who have voluntarily adopted the higher standards of information security; (3) the foreign countries to which the high standards apply; and (4) the different standards applied to information originating in various countries. Data processors who have voluntarily agreed to comply with the said standards must do so. If they fail to do so, it is a criminal offence; the maximum punishment is six months’ imprisonment, 1 million Vatus, or both.

Liability of Intermediaries

General Rule: No Liability

An intermediary is not civilly or criminally liable for the content of a message if the intermediary was not the creator of the message, and: (1) the intermediary did not know that dissemination of the message would be grounds for liability; or (2) the intermediary did not know any related facts or circumstances which would have made it reasonable to suspect there was liability; or (3) the intermediary has complied with the ETA s 27 procedure if the intermediary has become aware of the existence of a civil or criminal penalty, or became aware of facts or circumstances which should have led the intermediary to conclude there was a reasonable likelihood of liability.

There is no affirmative duty on the part of an intermediary to monitor any electronic message, information, or record in order to be able to ascertain whether there may grounds for liability. However, the intermediary is responsible for carrying out any contractual responsibilities it has to its customers, and is responsible for general obedience to the law.

Liability for Defamatory Information

If the intermediary definitely knows that information it is transmitting is defamatory, it must immediately: (1) stop transmitting that information; and (2) inform the client that it will no longer provide a service to transmit that information. Furthermore, the intermediary must inform the Minister or the law enforcement authorities at once regarding the defamatory information and the name of the client the information emanated from.
	In many situations, however, the intermediary will not definitely know that the information is defamatory. However, if the intermediary is aware (or should be aware) there is a likelihood the information is defamatory, the intermediary must immediately: (1) obey the Code of Conduct described in ETA s 28 if said Code applies to it; and (2) inform the Minister. Whereupon, the Minister may order the intermediary to: (1) remove the information and cease to transmit it; (2) stop providing all services to the party that originated the objectionable material; or (3) stop providing all service to the person that originated the objectionable material, with respect to that category of material.
	The intermediary is immune from any legal liability for any actions taken when it knows the material is defamatory, or when it responds to the order of the Minister in cases where there is a reasonable belief that the material is defamatory.

Intermediaries’ Code of Conduct

The Minister may ask an organization representing a group of intermediaries (or ‘E-commerce service providers’) to draft a Code of Conduct and to submit it to the Minister. If the Minister approves it, the Code of Conduct will be published in the Gazette and will be applicable to all those entities specified in the notice.
If no organization represents a group of intermediaries, or that organization has not responded to the Minister’s request to draft a Code of Conduct, then the Minister may draft it and publicize it in the Gazette.
	The Code of Conduct may include the following: (1) types of services to be provided; (2) types of customers permitted to use the service; (3) types of electronic information permitted; (4) the impact of the Code of Conduct upon the contractual rights of customers; (5) information required to be disclosed by intermediaries (e.g., name, address, E-mail address, and registration information); (6) utilization of a ‘quality accreditation mark’ indicating that the intermediary follows the Vanuatu Code of Conduct; (7) actions to be taken if the intermediaries’ customers send ‘spam’ via E-mail; (8) electronic business activities which are prohibited by Companies Act or the International Companies Act; (9) publication of any material which is illegal under the laws of Vanuatu; (10) customer complaint procedures; and (11) dispute resolution procedures, including electronic ones.
	Intermediaries must comply with an approved Code of Conduct. The first time the Conduct of Conduct is violated, the Minister will send a written warning to the firm. The warning may also include an order to make a correction in behaviour or to cease the behaviour. If the party persists in the violation, the intermediary’s maximum punishment is a fine of 100,000 Vatus for each day that the violation continues.

Authorization to Promulgate Regulations

The Minister is empowered to issue regulations containing details for the effective implementation of the ETA. Any party violating the regulations may be fined up to 50,000 Vatus.

VANUATU’S  E-BUSINESS ACT

The E-Business Act (‘EBA’) was enacted on 12 September 2000 and became effective on 6 November 2000. Its purpose is to regulate E-commerce websites based in Vanuatu which have been rented by international business firms looking for a tax haven. The EBA creates an Internet Free Trade Zone whereby individuals and firms can consummate E-commerce transactions while taking advantage of Vanuatu’s low business income tax rates. Vanuatu-based websites—referred to as ‘cybersuites’ in the EBA —are rented to foreign parties so that they may engage in E-commerce without the necessity of establishment of a formal international corporation with directors, shareholders and a registered office. Cybersuite proprietors are provided assistance in the creation of the website and its maintenance.

Selected Definitions

Cybersuite: an account created and kept by a business firm as a cybersuite account. 
Generally, a cybersuite is a “separate legal entity” unless the EBA provides otherwise. A cybersuite must pay an annual fee of 40,000 Vatus to the government.
A cybersuite may enter into a contract with another cybersuite. A cybersuite is required to maintain an account with the National Bank of Vanuatu, to be used for all transactions it enters into.
	Cybersuite proprietor: a person who has entered into a cybersuite contract with a business firm.
	Cybersuite Contract: a contract entered into between a cybersuite proprietor and a business firm. This contract will regulate the rights and responsibilities of the business firm and the cybersuite proprietor pertaining to the cybersuite. Ordinarily, cybersuite contracts: (1) explain the “voting and economic rights” of the cybersuite; (2) allow for the cybersuite proprietor or the business firm to raise capital by entering into debt or issuing equity shares; (3) detail when funds are to be conveyed to the cybersuite proprietor’s account; and (4) determine whether economic or voting privileges are exclusive or not exclusive. 
                   
Cybersuite Contracts and E-Commerce Contracts

Pursuant to the EBA, business firms may enter into contractual agreements with any person. Notwithstanding any other law, business firms: (1) may engage in E-commerce transactions; and (2) may consummate E-commerce contracts or cybersuite contracts. Neither an E-commerce contract nor a cybersuite contract of a business firm may be declared ‘voidable or unenforceable’ because, at the time of contracting, one or more of the parties lacked contractual capacity.

Licence May Not Be Required

A party to an E-commerce contract, or a party to a cybersuite contract, is not required to hold a business licence issued within Vanuatu. Furthermore, they are not obliged to obtain authorization pursuant to any law of Vanuatu to commit acts within Vanuatu in furtherance of rights and responsibilities existing because of an E-commerce contract or a cybersuite contract.

Legal Recognition of E-Commerce Contracts and Cybersuite Contracts

The mere fact of the electronic form of cybersuite contracts and E-commerce contracts is insufficient justification for denial of their legal ‘effect, validity, enforceability or admissibility.’ 

Vanuatu Law Controls

Unless the parties agree otherwise, the laws of Vanuatu are controlling with respect to an E-commerce contract or a cybersuite contract. These contracts will be assumed to have been formed in Vanuatu.

Cybersuite and E-commerce Accounts

Electronic business activity must be recorded in either an E-commerce account or a cybersuite account. Accounting rules mandate that each business firm carrying on electronic transactions keep a separate account of the activities. The accounting records must indicate the property that has been assigned to each E-commerce or cybersuite account.
Assets and Liabilities

Pursuant to the cybersuite contract in effect, a business firm must indicate all of its assets which have been assigned to the cybersuite. If a business firm has an E-commerce account, all assets and liabilities that pertain to its E-commerce activity must be earmarked. Notwithstanding the provisions of any other law, the assets of a cybersuite comprise a trust which is held by the business firm for the benefit of the cybersuite proprietors.
	The EBA has no effect on the rights of a cybersuite proprietor to: (1) receive a return on its investment in the cybersuite; or (2) have the cybersuite liquidated and the assets distributed to the cybersuite proprietors that have an ownership interest in said assets.

Revenue, Expenses and Income

If a business firm earns regular income, interest income or acquires property as a result of investment in a cybersuite account or an E-commerce account, said income or property must be recorded in the respective cybersuite/E-commerce account. If a business firm incurs ‘expenses, fees or losses’ as a result of its cybersuite or E-commerce activities, they must be recorded in the respective account.

Treatment of Property

Generally, business firms have discretion to make decisions in reference to the property assigned to an E-commerce account in accordance with their best business judgment.
A business firm owning a cybersuite account is in a different situation, however; they are not allowed to commingle the cybersuite account property with property held in other parts of the business, or substitute property from one part of the business firm with property once held by a cybersuite account. 

Cybersuite Termination

A business firm may liquidate a cybersuite if: (1) all cybersuite contracts and E-commerce contracts relating to that cybersuite have been completed; and (2) the obligations of all relevant parties—including the business firm, all parties which had contracted with the business firm, and the cybersuite proprietor—have been discharged. If any property remains in the cybersuite after the rights of all other parties have been satisfied, said property belongs to the cybersuite proprietor. However, no cybersuite property can be used to pay any creditor.

Securities

A business firm is allowed to issue one or more classes of securities pertaining to one or more cybersuites, provided this is not prohibited in the cybersuite contract. At the time of their issuance, each security must be recorded in the business firm’s records, with the name of the particular cybersuite identified. A business firm has managerial discretion to make decisions as to the price, terms and conditions of the securities.
Any proceeds received from the sale of the securities should be credited to the relevant cybersuite account. A business firm is allowed to use cybersuite assets for the purpose of redemption or repurchase of securities. 

TONGA’S COMPUTER CRIMES ACT
            
The Computer Crimes Act (‘CCA’) was enacted by the Tonga Legislative Assembly on 8 September 2003 and was signed into law by King Taufa’Ahau Tupou IV on 18 November 2003. Its purpose is to ‘combat computer crime and to provide for the collection and use of electronic evidence.’ 

Selected Definitions

The CCA defines ‘computer’ very broadly, as an ‘electronic, magnetic, optimal, electrochemical, or other data processing device, or a group of such interconnected or related devices, performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device or group of such interconnected or related devices…’  However, the following items are exempted from the definition and do not fall under the jurisdiction of the CCA: automatic typewriters, automatic typesetters, portable calculators, similar non-programmable devices, or such other devices as may be excluded by the Minister in a public notice.
	A ‘protected computer’ is a computer used in the achievement of a governmental function, or a computer used in the achievement of a private-sector function which impacts a significant number of members of the general public. Specifically, such activities include: (1) the Kingdom of Tonga’s national defence, national security or international relations; (2) public safety efforts of law enforcement officials, and confidential information sources used by them; (3) emergency services, e.g., fire departments, hospitals and ambulances; (4) public utilities, including communications facilities and public transportation; (5) public-key-infrastructure (‘PKI’); and (6) banking services.	
	‘Hinder’ has a specific meaning under the CCA. It refers to the carrying out of the following specified acts in furtherance of a computer crime, i.e.:  (1) turning off the electricity to a computer; (2) inference with the operation of a computer via “electromagnetic interference;” (3) any action which ‘corrupts’ a computer; or (4) contaminating computer data by actions of ‘inputting, deleting or altering.’
	‘Seize’ also has a specific meaning under the CCA relating to acts of  execution of a computer crime. These acts include:  (1) production and retention of computer data without authorization, even if the production or retention involves utilization of equipment at the site of the computer system; (2) without authorization, removal of computer data from a computer system, or prevention of others from retrieving it from a computer system; or (3) removal of a printout of computer data from the computer site.
	A ‘service provider’ refers to any entity, public or private, that enables its subscribers to communicate via computers. This term also refers to other entities which process or store computer data on behalf of its clients.
‘Traffic data’ consists of computer data pertaining to a communiqué achieved via a computer system. The computer system that produces and transmits the message itself will also create and transmit the traffic data. The purpose of the traffic data is to indicate the communiqué’s ‘origin, destination, route, time, date, size, duration or the type of underlying services.’

‘Long Arm’ Jurisdiction

Of course, acts carried out within the borders of the Kingdom of Tonga in furtherance of a computer crime will be in violation of the CCA. Since the internet is an international phenomenon, knowing no borders, it is also possible for persons or entities located in foreign countries to effectuate computer crimes impacting the Kingdom of Tonga. For that reason, the CCA claims ‘long arm’ jurisdiction over foreign individuals and entities committing acts which have an illegal impact within Tonga. Those foreign-based parties will be assumed to have been within Tonga at the time the acts were committed; and/or their computer, or its program or data, will be assumed to have been in Tonga at that time.

Criminal Offences

Obtaining Illegal Access to a Computer

It is a crime to wilfully, without legal excuse:

1.	Access a computer system. The maximum punishment will be a fine not exceeding $10,000, imprisonment for two years, or both; and to
2.	Access a ‘protected’ computer—one used in carrying out a governmental function, or one used in carrying out a private-sector function which impacts a significant number of people. Obviously, this is a more serious offence than (1), above and is deserving of a more stringent maximum punishment: a fine of $100,000, imprisonment for twenty years, or both.Actual knowledge of the culprit that the computer was a ‘protected’ one is not required; it will be sufficient if the person either knew, or should have known, that it was a protected computer.

Furthermore, for both of the above crimes, there is no need to prove that the suspect had actual knowledge that access to the computer, program or data was prohibited. Knowledge of the suspect will be presumed if there was an obvious warning presented to the accused, informing her that access to the computer, program or data was prohibited.

 Interference with Computer Data

It is a crime to, wilfully or recklessly, with no lawful excuse:

1.	damage or corrupt computer data;
2.	change computer data to the extent that it becomes unusable, is nonsensical or worthless;
3.	interfere with computer data, or meddle with others’ utilization of computer data so that it is impossible to use the data in the manner desired; or
4.	prevent access to others who have a legal right to obtain possession of the data.

The maximum punishment is a $10,000 fine, two years’ imprisonment, or both.

Interference With a Computer System

It is a crime, either wilfully or recklessly, with no excuse, to either:
1.	‘hinder’ a computer system by interference with its functions; or
2.	‘hinder’ a person who is using or operating a computer system.  

The maximum punishment is a $5,000 fine, an imprisonment of one year, or both.

Illegal Interception of Computer Data

It is a crime to wilfully, without a legal excuse, to technically intercept the following:

1.	Data or a message that is being transmitted to a computer, from a computer, or within a computer; or
2.	A computer system’s ‘electromagnetic emissions’ that contain computer data.

For commission of either act, the maximum punishment will be a $5,000 fine, one year’s imprisonment, or both.

Trafficking in Illegal Computer Devices

It is a crime to:

1.	a.  Wilfully or recklessly, without legal excuse, engage in trafficking (i.e., production, sale, procurement, importation, exportation, distribution or supplying) of devices or computer programs which are intentionally created for the purpose of violation of the Computer Crimes Act, Section 4, 5, 6 or 7; or
b.	Wilfully or recklessly, without legal excuse, engage in trafficking (i.e., production, sale, procurement, importation, exportation, distribution or supplying) of a ‘computer password, access code or similar data’ which is intentionally designed to be used to facilitate the access of a computer system.  

2.	Have in one’s possession an item referenced in (1)(a) or (1)(b), above, with the intent that the item be used by any person to violate the Computer Crimes 
Act, Section 4, 5, 6, or 7. If more than one such item is possessed, it is presumed that she had the intent for all of the items to be used in furtherance of violation of the Computer Crimes Act, Section 4, 5, 6 or 7.

The maximum punishment for both of the aforementioned offences is a fine of $20,000 and imprisonment for four years, or both.

Procedural Powers

Warrants Allowing Search and Seizure by Police

If sworn evidence is presented to a judge, magistrate or other court official, and based upon said evidence, the court official is satisfied that reasonable grounds exist to suspect that a certain ‘computer, computer system, computer data or data storage medium’:

1.	may be ‘material evidence’ in proving an offence listed in the Computer Crimes Act;  or
2.	is now in possession of a person due to the commission of an offence listed in the Computer Crimes Act;

then said court official may issue a warrant allowing a police officer to enter the premises at which the said items are located in order to search and/or seize the said items.

The police officer or other person effectuating the search and seizure must, at the time it is carried out or ‘as soon as practicable,’ make a list of the items in question, with date and time searched/seized, and give a copy of the list to the person occupying the premises or the person in charge of the computer system.

Ordinarily, the police officer effectuating the search and seizure should grant access to the person who had custody of the computer system for the purpose of copying computer data from the system, or the police officer may make the copy and then give it to said 
person. However, he police officer may refuse to grant access or copies of the seized material if giving the access or providing the copies would:

1.	violate a criminal law; or 
2.	would prejudice an ongoing related criminal investigation, an ongoing unrelated criminal investigation, or any pending or possible criminal proceedings that may occur based upon these investigations.

Assisting Police 

Any person possessing or controlling an item that is the subject of a Search and Seizure under Section 9 of the Computer Crimes Act has a duty to permit the relevant police officer to do the following (and to assist her if necessary):

1.	Obtain access to the computer in question, or the computer data storage medium in question, to search data located in it;
2.	Obtain and copy said data;
3.	Use the said computer equipment to produce copies; and 
4.	Produce an ‘intelligible output’ from the computer system in a readable format.

Any person refusing, with no legal excuse, to permit a police officer to effectuate a lawfully-issued warrant, or who refuses to assist the police officer if required to do so, commits a crime. The maximum punishment will be a fine of $10,000, two years’ imprisonment, or both.

Production of Data

A police officer may apply to a judge, magistrate or other court official for the issuance of a court order to compel the production:

1.	of specific computer data, or a ‘printout or other intelligible output’  of said data, by the person in charge of the computer system;
2.	of information pertaining to subscribers by an internet service provider; or
3.	of a compilation of specific computer data by the person having access to the computer system, and presenting it to a specified third party.

Disclosure of Information Pertaining to Traffic of Computer Data

A police officer may apply to a judge, magistrate or other court official for the issuance of a court order demanding the following information pertaining to a computer system under investigation:

1.	the service providers used; or
2.	the path travelled by some specific information under investigation.

In order for the order to be issued, the court official must be satisfied that the specific data in question is ‘reasonably required’ in order to achieve the successful completion of a criminal investigation or proceeding. 

Data Retention

A police officer carrying out an investigation of an alleged computer crime may give notice in writing to a person in charge of a computer system to preserve certain specified required data for up to seven days, provided that the police officer believes the security of the data may be in jeopardy. If more time is needed by the police officer, she may apply to a judge, magistrate or other court official for an extension not to exceed fourteen days.

Interception of Suspect’s Communiqués by Police or Internet Service Provider

If a judge, magistrate or other court official is satisfied that ‘reasonable grounds’ are present indicating that the content of a suspect’s communiqués and related data is necessary for the completion of a criminal investigation, the said official may issue a court order which:

1.	requires an internet service provider to monitor a subscriber’s communiqués and to submit the collected data to the police; or
2.	allows the police to directly monitor communiqués of the suspect and to collect the necessary data.

Interception of Traffic Data

A police officer investigating a computer crime may issue a written notice to the person in charge of a computer system. The notice may request said person to: (1) make a record of the traffic of a specified type of communication during a period in question; and (2) give the police the record of the data traffic after it has been compiled, or assist the police in making the record. In the alternative, a court official may issue a court order permitting a police officer to gather by ‘technical means’ said data pertinent to a specific communiqué referenced in the order.

Rules of Evidence

In cases of alleged violation of Section 6 of the Computer Crimes Act (Interference With a Computer System), the mere fact that evidence presented in court has been generated by the computer system in question does not automatically prevent it from being admitted.

Breach of Subscriber’s Confidentiality by Internet Service Provider

It is a crime for an Internet Service Provider to disclose, without legal 
excuse, confidential information of the subscriber pertaining to: (1) the fact that a court order has been issued as part of a criminal investigation of the subscriber, pursuant to Criminal Crimes Act ss. 11, 12, 13, 14 or 15; (2) any specific acts carried out pursuant to said court order; or (3) any data gathered pursuant to the said court order.

The maximum punishment for this crime is a $50,000 fine, ten years’ imprisonment, or both.

Notwithstanding the above, it is not a crime for an Internet Service Provider to disclose information as required pursuant to ss 11-15 of the Computer Crimes Act.

Implementation Regulations to be Adopted

If the Cabinet gives permission, the Minister responsible for telecommunications will be responsible for the drafting of implementation regulations in order to achieve full execution of the Computer Crimes Act.

SUMMARY AND RECOMMENDATIONS

Vanuatu

Summary

The Republic of Vanuatu’s Electronic Transactions Act (‘ETA’) is designed to stimulate E-commerce in the country by improving the integrity and security of electronic transactions. The ETA recognizes the legal validity of electronic documents and electronic signatures as acceptable substitutes for paper documents and ink signatures, respectively; accordingly, electronic records may be used to comply with a statutory writing requirement, delivery requirement, original document requirement and retention requirement, and an electronic signature attached to an electronic document may be used to comply with a statutory requirement for a paper-and-ink signature. If all parties are in agreement, an E-commerce contract may be in electronic form. If a sender of an electronic message demands an acknowledgement of receipt, the message is not considered to have been received until the sender obtains the acknowledgement. Specific rules pertaining to attribution of electronic messages, and time/place of sending/receiving electronic messages, have been developed.
	In order to achieve more reliability and integrity in the utilization of electronic signatures in E-commerce, the ETA has created a compulsory system of licensing of Certification Authorities (‘CA’). The CA’s role is to ascertain the identity of its subscribers and to attest that the electronic signature used by those subscribers belongs to them. An unusual characteristic of Vanuatu law is that a subscriber is allowed to use a pseudonym so long as the CA knows the real identity of the subscriber and keeps that information on file. The prospective CA must possess a high degree of expertise in reference to electronic signatures and computer information systems. If at any time the government believes that a CA is no longer qualified to carry out its duties, the government may suspend or revoke the CA’s license. Because E-commerce is an international phenomenon, the ETA provides for reciprocal recognition of CA’s with licenses issued by foreign nations that have licensing standards that are at least as stringent as those of Vanuatu. The CA may incur legal liability to its subscribers and to relying third parties if any information contained in the certificate is inaccurate, if the subscriber does not hold the private key on the date of issuance of the certificate, or if the private key and the public key do not have a functional interactive relationship. However, the CA’s liability may be limited if the relying third party knew of the inaccuracies in the certificate, the subscriber provided false information and the CA showed due diligence, or the CA has listed limitations on liability in the certificate.
	As a general rule, intermediaries such as internet service providers are not liable for the content of the electronic messages which they disseminate. Notwithstanding this general rule, intermediaries may incur liability for defamation if they have knowledge that certain material is defamatory. If an intermediary suspects that material is defamatory but does not have knowledge, then the intermediary should inform the Minister in charge of telecommunications and await her determination on the matter before dissemination of the material. 
	Vanuatu’s E-Business Act (‘EBA’) is a remarkable statute because it allows foreign individuals and entities to rent a website in Vanuatu and to use that website to carry out international E-commerce activity, without having to establish a formal international corporation with directors, shareholders and a registered office. The EBA creates an ‘Internet Free Trade Zone’ in which website-renters are able to take advantage of Vanuatu’s low business income tax rates. Renters are even provided assistance in the creation of their websites.

Recommendations 

Vanuatu’s statutes are a good beginning in promotion of E-commerce; they do not go far enough, however. These additions need to be made: (1) consumer protections need to be included in order to give more notice to cyber-buyers, to give them a brief window of opportunity to back out of an online purchase, and to give them more security against the possibility of cyber-fraud; (2) a detailed list of computer crimes needs to be added in order to inhibit hackers from commission of privacy violations and to protect against computer tampering (refer to the Tonga portion of this article for an example of a computer crimes statute); and (3) mandatory requirements for governmental agencies to begin to allow citizens to utilize electronic documents and signatures should increase governmental efficiency, cut costs and allow taxes to continue to be kept at a low level.

Tonga

Summary

If Vanuatu is in need of a computer crimes law, it can refer to the Kingdom of Tonga’s Computer Crimes Act (‘CCA’). The CCA allows ‘long arm’ jurisdiction. Under the CCA, the following activities are defined to be crimes and offenders may incur fines and/or imprisonment:  obtaining illegal access to a computer; interfering with another’s computer system; unlawfully intercepting computer data; and trafficking in illegal computer devices. To enforce the CCA, the police may be granted warrants authorizing them to search a suspect’s premises, to seize a suspect’s computer system or contraband items, to intercept a suspect’s electronic communiqués, or to require a suspect to retain specific computer data for a given amount of time. Any party suspected of violation of the CCA must cooperate fully with the police and produce any computer data that is requested. Internet service providers may also be compelled to allow the police to have access to any computer-borne information pertaining to a subscriber that is suspected of violation of the CCA. 

Recommendations

Just as Vanuatu can learn from Tonga, Tonga can also learn from Vanuatu. Tonga needs to enact: (1) a comprehensive electronic transactions statute comparable to Vanuatu’s ETA in order to stimulate the growth of E-commerce by improving the reliability and integrity of E-commerce transactions; and (2) a statute comparable to Vanuatu’s EBA in order to foster the development of Tonga as a tax haven for foreign entities seeking to carry out international E-commerce transactions. These statutes could be easily implemented and might result in the government’s reaping of substantial cash inflows with little or no detrimental effects. Given the Tongan government’s current financial crisis, such new means of increasing the flow of funds into its coffers should be experimented with.