Disclosure Records of Recognized Certification Authorities

Disclosure Record for the Postmaster General

(This is page 29 of the disclosure record for the Postmaster General maintained by the Government Chief Information Officer ("GCIO") under section 31(1) of the Electronic Transactions Ordinance (Cap. 553) ("ETO"). Click this link to go back to page 1 of the disclosure record.)

Assessment Report and Statutory Declaration (1 January 2018 - 31 December 2018)

In accordance with section 43(3) of the ETO, the GCIO must publish in the disclosure record for the Postmaster General as a recognized certification authority the dates of and the material information in the assessment report and statutory declaration on the certification authority ("CA") services of the Postmaster General. Only those parts of the report and statutory declaration containing material information are herewith published.

The Postmaster General is hereinafter referred to as the "Hongkong Post CA".

Assessment Report

A. Date of the Report

• The date of the report is 20 January 2019.

B. Material Information

1. The assessment report was prepared by the assessor for the period between 1 January 2018 and 31 December 2018.

Recognized CA Practices

2. In the assessor's opinion, in all material respects:
   1. the management assertions in respect of Hongkong Post CA's compliance with the sections of the Code of Practice (Note 1) set out in Part 3A of Appendix 3 to Practice Note 870 (Note 2) for the period from 1 January 2018 to 31 December 2018 are reasonable. In particular, Hongkong Post CA has:
      1. disclosed its business practices in its CPS (Note 3) in accordance with the ETO applicable to a RCA (Note 4), the Code of Practice and the MRCP (Note 5) and provided its services in accordance with its disclosed business practices;
      2. reasonably complied with the requirements in respect of the use of a trustworthy system to support its operations in accordance with section 37 of the ETO, the Code of Practice and the MRCP; and
      3. reasonably complied with the requirements in respect of the recognition of its certificates in accordance with the provisions of the ETO applicable to a RCA, the Code of Practice and the MRCP;
   2. no information came to the attention of the assessor during the course of the assessment that would indicate that the management assertions in respect of Hongkong Post CA's compliance with the sections of the Code of Practice set out in Part 3B of Appendix 3 to Practice Note 870 for the period from 1 January 2018 to 31 December 2018 are not reasonable; and
   3. based on the conclusions drawn in paragraphs (a) and (b) above, the management assertions in respect of Hongkong Post CA's compliance with the provisions of the ETO applicable to a RCA for the period from 1 January 2018 to 31 December 2018 are reasonable.

Financial projections (Note 6)

3. In the assessor's opinion, in all material respects, the accounting policies upon which Hongkong Post CA's cashflow projections for the two 6-month periods intervals from 1 November 2018 to 30 April 2019 and from 1 May 2019 to 31 October 2019, financial position forecasts as at 30 April 2019 and as at 31 October 2019, and projection of operating costs for the period from 1 November 2018 to 31 January 2019, in respect of the Hongkong Post CA's operations relevant under the ETO are based, are consistent with those normally adopted by Hongkong Post CA and conform with generally accepted accounting principles adopted in Hong Kong, and the financial projections have been properly compiled on the basis of the assumptions made by the management of Hongkong Post CA.
4. It has been ascertained from Hongkong Post CA that the amount of the net current assets (i.e. current assets less current liabilities) as shown in the unaudited management accounts of Hongkong Post CA for the 7 months period ended 31 October 2018 was nil.
5. It has been ascertained from Hongkong Post CA that the 90-day projection of operating costs from 1 November 2018 to 31 January 2019 was nil.
6. A comparison of the figures in the above paragraphs reveals that both net current assets and the projected 90-day operating costs were nil.
7. The assessor has not carried out any verification work on the unaudited management accounts of Hongkong Post CA for the period ended 31 October 2018.

Potential liabilities

8. Due to the nature of the industry in which Hongkong Post CA operates, there is uncertainty in determining Hongkong Post CA’s potential liabilities given the limited history of past claims (both in Hong Kong and other parts of the world for risks of this nature).
9. In the assessor's opinion, in all material respects, the management assertions that Hongkong Post CA with Certizen as its agent has implemented and maintained appropriate procedures to determine and manage Hongkong Post CA's potential liabilities in relation to the issuance of certificates are reasonable.

Statutory Declaration

A. Date of the Declaration

• The date of the declaration is 15 January 2019.

B. Material Information

• A responsible officer of Hongkong Post CA declares that Hongkong Post CA has, from 1 January 2018 until 31 December 2018, complied with the provisions of the ETO and the provisions of the Code of Practice which have been set out under paragraph 2 of Appendix 2 of the Code of Practice, and the provisions of the MRCP.

Notes

1. Code of Practice for Recognized Certification Authorities issued by the GCIO under section 33 of the ETO.
2. Practice Note 870 "The Assessment of Certification Authorities under the Electronic Transactions Ordinance" issued by the Hong Kong Institute of Certified Public Accountants.
3. Certification practice statements.
4. Recognized certification authority.
5. Certificate Policy for Mutual Recognition of Electronic Signature Certificates Issued by Hong Kong and Guangdong.
6. The financial projection period (i.e. 1 November 2018 and 31 October 2019) for the assessment is specified by Hongkong Post CA following the practices of previous assessments.
7. The above information is disclosed in accordance with section 31(2) of the ETO.