Implementation Workshop Report

Transcription

1 INTRA ASEAN S e c u r e Tr a n s a c t i o n s Implementation Workshop Report

2 Project Contributors Project Advisors Surangkana Wayuparb Chaichana Mitrpant Pitinan Kooarmornpatana Executive Director, ETDA Deputy Executive Director, ETDA Division Director, Office of IT Infrastructure, ETDA Legal Advisors Ploy Charoensom Phichayaluk Kamthongsuk Acting Division Director, Office of Legal Affair, ETDA Legal Development Manager, Office of Legal Affair, ETDA Editor Werachai Prayoonpruk Specialist and Manager, Office of IT Infrastructure, ETDA Graphics Nattapong Worapivut Assistant Division Director, Office of Electronic Transactions Promotion, ETDA Acknowledgements and Special Thanks ASEAN Member States ASEAN Secretariat Thai Customs Department Office of Electronic Transactions Promotion, ETDA Office of IT Infrastructure, ETDA i

3 Table of Contents Project Contributors...i Table of Contents... ii List of Figures... iii 1. Overview Background Objectives E-transaction Classification Methodology Survey Focus Group Workshop Topic Selection Summary of the Implementation Workshop Conclusions and Recommendations Appendix A: Pre-Activity Questionnaire Appendix B: Recommendation for Mutual Recognition Arrangement on e-service Classification regarding ATIGA Form D Appendix C: Annex 7 of ATIGA Appendix D: Summary of Questionnaire Response on Education Grants Topic Appendix E: Workshop Photo Gallery ii

4 List of Figures Figure 1: 15 common electronic government services... 3 Figure 2: Registration of New Business Risk assessment result from preliminary workshop... 4 Figure 3: Driver License Risk assessment result from preliminary workshop... 4 Figure 4: Level of impact corresponding to impact category... 5 Figure 5: 15 common electronic government services sorted by readiness status... 7 Figure 6: End-to-End ATIGA Form D Flow... 9 Figure 7: End-to-End ATIGA Form D Flow with Acknowledgements... 9 Figure 8: ATIGA Form D Risk assessment result from workshop iii

5 1. Overview 1.1 Background In 2015, the ASEAN Member States elevated themselves and successfully established the ASEAN Economic Community (AEC), which aims to strengthen relationships and cooperation and promote better flow of capital and human resources in order to enhance the regional economy, standard of living and social welfare of their people. Obviously, information technology will play a critical role as a platform-creating tool for digital economy development. One particularly powerful mechanism of information technology is the electronic transactions owing to its speed, convenience, and borderless characteristics. The volume and value of electronic transactions among the Member States have been increasing every year. This demonstrates increasing popularity of electronic transactions. Besides, ASEAN electronic commerce market has, according to the A.T. Kearney analysis, the largest growth potential of as much as 25 percent annually. However, to fully utilize potential and benefits of electronic transactions among ASEAN Member States, it is necessary that we have solid legal, regulations and compliance as well as technical framework and standards so that we can build trust and promote secure electronic transactions. With the Intra-ASEAN Secure Transactions Framework, a technology-neutral and risk-based approach for determining level of assurance suitable for different electronic transactions has been established. However, for real cross-border transactions to be effectively conducted, the implementation part of the framework is still needed. Thailand, as a project proponent country, proposed the Intra-ASEAN Secure Transactions Implementation Workshop with the objective to develop further the Intra-ASEAN Secure Transactions Framework by creating electronic transaction classification and recommendations for the Mutual Recognition Arrangement (MRA) model which includes common recognition criteria of foreign electronic signature among ASEAN Member States. The project supports secure electronic transactions development in ASEAN in accordance with ASEAN ICT Masterplan 2015, under Strategic Thrust 2, Initiative 2.4 promoting the secure transaction within ASEAN. 1.2 Objectives The objectives of the project are to: create electronic transaction classification and recommendations for the Mutual Recognition Arrangement model increase trust and promote secure and efficient electronic transactions through proper selection of electronic authentication mechanism initiate sharing of online identity and authentication across cross-border systems - 1 -

6 2. E-transaction Classification 2.1 Methodology Existing studies and sources of information related to this project are very limited due to the fact that the project of this kind is considerably new to ASEAN Member States. The project team, therefore, implemented the project by gathering information from multiple sources using different approaches Survey The four-page questionnaire consisting of 7 sections is the initial step of information gathering. It is used to collect information about the electronic service of study, which includes the functional needs for authentication and requirements regarding identity proofing and authentication, and also as a guide to ease the understanding process of the framework. The survey has been circulated to ASEAN Member States after the e-service of study was agreed in the Special TELSOM meeting in July 2015 at Jakarta, Indonesia. The survey form can be referred from Appendix A: Pre-Activity Questionnaire Focus Group Focus group technique is applied for in-depth analysis on the e-service of study and also for studying interrelated aspects which can be used as supplementary information during the workshop. The focus group activities include the meetings with top financial institutions, governmental agencies such as the Customs Department, and Certification Authorities (CA) and CA regulators within selected ASEAN Member States Workshop Workshop is the final stage of the project methodology. It is designed to allow full-fledged discussion as well as allow participants to perform in-depth analysis regarding the risks associated with the e-service of study. Information gathered from earlier stages i.e. survey and focus group meetings are used as inputs for discussion in the workshop. The results obtained from the workshop will be the e-transaction classification which is the cornerstone of the recommendation on Mutual Recognition Arrangement model. Before the actual workshop in September 2015, Thailand, by Electronic Transactions Development Agency (Public Organization) or ETDA, hosted the special E-Authentication Workshop to discuss and create electronic transaction classification for government e-services - 2 -

7 so that the project team could observe additional insights as well as improve the flow of the actual workshop. There were 12 participants joining the workshops including 4 representatives from ASEAN Member States plus 8 speakers and accompanies. The participants were divided into two groups. At the beginning of the session, the framework was explained altogether with the workshop methodology. Then, the facilitator presented 15 common electronic government services collected from the study of ASEAN e-government Strategic Action Plan by Merlin's Solution International. The first group selected New business registration as a topic for doing workshop, while the second group selected Driver license. Service 1. Public Identification Document/ Profile Record 2. Birth, Marriage and Death Certification Description Online National Register of personal identification and profile records (Public ID, Biometric, Criminal Records) Online National Register (Apply, Request, Delivery) for birth, marriage, and death in traditional and e-document supported format 3. Registration of new Business Application to obtain a new business establishment 4. Vehicle Registration Apply for new/ Used/ Imported all types of vehicles (car, motorcycle, truck, boat, plane etc.) with fee payment 5. Passport/Travel Document/VISA Apply or Request to obtain Departure, Arrival, Stay, and Permission 6. Work Permit 7. Announce of Movement/Migration/Immigration 8. Medical Certificate and Medical Records Apply for all types of Work Permit with Evident submission and fee payment Announcement of moving including change of Address and Apply of migration or immigration Interactive advice on the Medical Certification and Medical Records application/approval and availability of services and appointments in different hospitals 9. Driver License Apply or Request to obtain Driver License 10. Enrolment of Education and Education Certified 11. Professional Certification 12. Customs Declaration of Goods, Logistic Facilitation and Quarantines 13. Online Import/Export Payment and Taxation 14. Education Grants Online service procedure to enroll students in a university or another institution of higher education subsidized by an official administrative body Online service procedure to obtain Professional prove of Qualification and deliver certifications Online Public service related Customs declarations (National Single Window) Import/Export taxes (Declaration, Notification of Assessment and e- Payment Online service procedure to obtain student grants for higher education and provide education certificate 15. Public Data Online service support to providing National public data for social benefits Figure 1: 15 common electronic government services Source: ASEAN e-government Strategic Action Plan by Merlin s Solution International - 3 -

8 The groups discussed and decided that both New business registration and Driver license e-services required the highest level of assurance of LoA4. Details of risk assessment are shown in the two figures below. However, both groups could not provide further information in the area of identity proofing and authentication mechanism and proposed to follow the guidelines as stated in the framework. Figure 2: Registration of New Business Risk assessment result from preliminary workshop Figure 3: Driver License Risk assessment result from preliminary workshop - 4 -

9 Lessons learned from the workshop are two folds. First, clarity of risk assessment criteria needs to be improved so that it is more transparent and easier when determining the level of impact (i.e. Low, Moderate, or High) corresponding to each category. Secondly, the framework should also mention about the process of risk mitigation; as in reality, system implementation to satisfy LoA4 requirements will be costly and may not always be appropriate for every e-service. Adoption of LoA4 should, therefore, be carefully considered during the process of risk mitigation. Impact Categories 1. Inconvenience, distress, or damage to standing or reputation Impact Values of Authentication Failure Low Moderate High Limited and short-term inconvenience, distress or embarrassment to any party Serious short term or limited long-term inconvenience, distress or damage to the standing or reputation of any party Severe or serious long-term inconvenience, distress or damage to the standing or reputation of any party 2. Financial loss or agency liability Insignificant or inconsequential unrecoverable financial loss or agency liability to any party Serious unrecoverable financial loss or agency liability to any party Severe or catastrophic unrecoverable financial loss or agency liability to any party 3. Harm to agency programs or public interests Limited adverse effect on organizational operations or assets, or public interests. Examples: (i) mission capability degradation to the extent and duration that the organization is able to perform its primary functions with noticeably reduced effectiveness (ii) minor damage to organizational assets or public interests Serious adverse effect on organizational operations or assets, or public interests. Examples: (i) significant mission capability degradation to the extent and duration that the organization is able to perform its primary functions with significantly reduced effectiveness (ii) significant damage to organizational assets or public interests Severe or catastrophic adverse effect on organizational operations or assets, or public interests. Examples: (i) severe mission capability degradation or loss of to the extent and duration that the organization is unable to perform one or more of its primary functions (ii) major damage to organizational assets or public interests 4. Unauthorized release of sensitive information Limited release of personal, government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a low impact as defined in FIPS PUB 199 Release of personal, government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a moderate impact as defined in FIPS PUB 199 Release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a high impact as defined in FIPS PUB Personal safety Minor injury not requiring medical treatment Moderate risk of minor injury or limited risk of injury requiring medical treatment Risk of serious injury or death 6. Civil or criminal violations Risk of civil or criminal violations of a nature that would not ordinarily be subject to enforcement efforts Risk of civil or criminal violations that may be subject to enforcement efforts Risk of civil or criminal violations that are of special importance to enforcement programs Figure 4: Level of impact corresponding to impact category Source: OMB M Section 2.2. Risks, Potential Impacts, and Assurance Levels - 5 -

10 An additional understanding gained from organizing the workshop is that it practically makes more sense to focus the discussion on one or two e-services rather than to cover everything due to the fact that those services are different in nature and requirements. Besides, performing risk assessment on any e-service also requires participants to have knowledge and experience relevant to that particular e-service. 2.2 Topic Selection The project team proposed to the ASEAN TELSOM (Telecommunications and Senior Officials) and related meetings that the topic of this study should meet certain criteria. First, it must be relevant to the context of ASEAN and focus on e-government services. Second, it should have potential for future implementation or as a model for implementation, where applicable, at the regional level. Additionally, the project team recognizes that the framework, though uncomplicated, requires some learning curve; so, a basic topic can ease the participants to comprehend and go through the risk assessment process. In order to meet the criteria, the 15 common electronic government services were sorted in terms of ASEAN Member States readiness status. The group of three most-ready e-services is shown in Figure 5. Additionally, the European Union s success case in cross-border electronic transactions was also studied. The case study on STORK pilots 1, which was started in 2008, revealed that education-related services such as Safer Chat and Student Mobility were among the pilots that were put into production. Since ASEAN also have education-related service among the group of most-ready electronic services, Education Grants was proposed as a topic for discussion in the workshop. Later, the questionnaire focusing on Education Grants has been circulated to ASEAN Member States for 6 weeks. However, the questionnaire response rate is mediocre. Only one complete questionnaire was submitted to the project team. The response from Lao PDR is summarized in Appendix D: Summary of Questionnaire Response on Education Grants Topic. During the special ASEAN TELSOM meeting in July 2015, the project team suggested to change the topic of study and welcomed any topic proposal from ASEAN Member States. Applying the same criteria for topic selection, the ATIGA Form D was proposed with the justifications that it is a service related to logistic facilitation of Customs process. Besides, ATIGA Form D is the first pilot document to be exchanged via the ASEAN Single Window. It has been under discussion in the ASW-TWG (Meeting of the Working Group on Technical Matters for the ASEAN Single Window) in which the project team of ETDA also participated. The result from this project can therefore be beneficial to the ASW-TWG. This proposal was accepted by the Member States. The meeting concluded that the project shall continue and focus on ATIGA Form D. 1 Interoperability Solutions for European Public Administrations (ISA). (2011). Towards a Trusted and Sustainable European Federated eid system (Final Report)

11 Figure 5: 15 common electronic government services sorted by readiness status Source: Bolliger & Company (Thailand) processed from various sources - 7 -

12 2.3 Summary of the Implementation Workshop The ASEAN e-authentication Workshop is a part of the Intra-ASEAN Secure Transactions Implementation Workshop project. The workshop was held on 1 September 2015 in Bangkok, Thailand. The attendees to the workshop included two delegates from Indonesia and Lao PDR; representatives from Thai Customs Department, Office of the Public Sector Development Commission (OPDC), Policy Authority of Thailand National Root Certification Authority; and speakers. The goal of the workshop is to perform in-depth analysis regarding the risks associated with the electronic ATIGA Form D processes. The expected outcome of this workshop would be an agreement on e-service classification which is the cornerstone of the recommendation on Mutual Recognition Arrangement. The ASEAN Trade in Goods Agreement or ATIGA Form D is a form of certificate of origin exchanged among ASEAN Member States. It is issued by a government to exporters so that it can be used by counterpart importers for a preferential tariff. ATIGA Form D is the first pilot document to be transformed into electronic and transferred through the ASEAN Single Window. The paper-based ATIGA Form D is a two-page form consisting of 13 sections to fill in information. (Please refer to Appendix C: Annex 7 of ATIGA for form sample). The Figure 6: End-to-End ATIGA Form D Flow and Figure 7: Endto-End ATIGA Form D Flow with Acknowledgements are described using the pilot scenario of electronic document transfer between Malaysia and Thailand. There are 4 key actors involved in this process including 1) Certification Issuing Authority (CIA), 2) Exporter, 3) Customs Department, and 4) Importer. In this scenario, an exporter who wishes to export certain goods eligible for a preferential tariff will make a request for a certificate of origin or ATIGA Form D from the CIA. Once the CIA has approved the request, the exporter will receive an ATIGA number. An electronic ATIGA Form D will also be sent to the Customs Department of the importing country. Before Customs clearance and utilization of ATIGA Form D for preferential tariff, the importer needs to prepare import declaration form that includes a valid ATIGA number. When all documents are ready, Customs Department will approve the use of ATIGA Form D and respond the exporting country s CIA with the utilization status. Workshop key-visual - 8 -

13 Figure 6: End-to-End ATIGA Form D Flow Source: U.S. Agency for International Development (USAID) Figure 7: End-to-End ATIGA Form D Flow with Acknowledgements Source: U.S. Agency for International Development (USAID) Remark: The figures are extracted from USAID document presented during the 31 st ASW TWG Meeting regarding the ASW Pilot (Live) Project. Participating ASEAN Member States include Indonesia, Malaysia, Singapore, and Thailand. From the document, the scenario of electronic document transfer between Malaysia and Thailand has been used

14 Analysis Report In order to arrive at the electronic transaction classification for ATIGA Form D processes, risk assessment model in accordance with the Intra-ASEAN Secure Transactions Framework was adopted. According to the framework, there are six impact categories. For each impact category, the risk levels (low, medium, or high) were assessed based on the impact and the likelihood to occur of authentication failure. The result of analysis is summarized in Figure 8. The impact on financial loss or agency liability was rated at high level; while the impact on reputational damage was rated at low level. From the risk assessment, it was agreed that LoA4 is required for this electronic service. Justification for high risk of financial loss is that the importing country will not be able to properly collect import tax, which in turn impacts the collection of both value-added tax (VAT) and excise tax. Based on an unnamed source, the amount of financial loss can be more than a hundred million US dollars per year. Obviously, this seriously harm the economy of a country. Moreover, authentication failure can damage the trustworthiness of electronic form of ATIGA Form D and also the reputation of the issuer of the document. Figure 8: ATIGA Form D Risk assessment result from workshop Upon identifying the assurance level of an e-service, appropriate mechanisms can be chosen for identity proofing of a user during the service registration and for authentication of a user during the service access. The requirements on identity proofing and verification have been discussed on the view of Certificate Issuing Authority. It requires an exporter to register for an online system account by submitting registration form and supplementary documents in-person. About the authentication mechanism, it was agreed that a minimum of two-factor

15 authentication with proper control over the authorization process is required to access the online system associated with the ATIGA Form D processes. There was no conclusion on identity proofing and authentication mechanism. The discussion regarding identity proofing and authentication mechanism to be applied on electronic ATIGA Form D was quite limited due to the fact that the delegates from ASEAN Member States are not familiar with Customs processes and, in particular, the ATIGA Form D

16 3. Conclusions and Recommendations The ASEAN Economic Community (AEC) to be launched by the end of 2015 will bring more capital flow and movement of resources among the ASEAN Member States. Certainly, this opens extensive opportunities to both private and public sectors. Business executives may decide to open new branches or to penetrate markets in other Member States as a part of their business growth strategies. Besides, government agencies within the community may collaborate, join development efforts and introduce new cross-border public services to better promote standard of living and social welfare of the ASEAN people. On the one hand, electronic transactions play a key role in enabling these initiatives. On the other hand, as electronic transactions can happen in different forms and use different technologies, there exists both technical and legal challenges that should be put into considerations. From the study of the European Union success case, three key success factors are identified: 1) cooperative efforts of stakeholders 2) legal framework and common specifications regarding cross-border authentication and electronic signature; and 3) cross-border pilots. From the ASEAN s viewpoint, there are multiple agreements on regional cooperation including but not limited to the e-asean Framework Agreement, the ASEAN ICT Masterplan 2015, and the upcoming ASEAN ICT Masterplan Under the ASEAN ICT Masterplan 2015, the Intra- ASEAN Secure Transactions Framework was developed to support cross-border authentication. According to the report Review of e-commerce legislation harmonization in the Association of Southeast Asian Nations by the United Nations Conference on Trade and Development (UNCTAD), each Member State is continuously working on the harmonization of legal framework governing the use of electronic signature. Therefore, the remaining gap that ASEAN should address is to develop a cross-border pilot. This project has raised the ATIGA (ASEAN Trade in Goods Agreement) Form D as a topic of study. The justification of topic selection is that it is an e-government cross-border transaction that has high impact and benefits multiple stakeholders including but not limited to government agencies, import/export companies, and citizens. It aligns with regional effort on cross-border interoperability. Moreover, there is high potential of elevating this as a collaborative pilot project as well as elevating its result on other international fora. The study has revealed that despite of sophistication in ATIGA Form D process, risk assessment and LoA model can be adopted to gain insight on e-service classification. However, before actual cross-border authentication and data interchange can be deployed at the regional levels, it is necessary that ASEAN Member States have a consensus regarding the approach as well as the result of risk assessment and LoA. In addition, it is recommended that ASEAN Member States work towards establishing a Mutual Recognition Arrangement (MRA) and discuss in further details regarding legal compatibility and technical interoperability of authentication schemes when considering cross-border electronic transactions. A recommendation for MRA model has been proposed in Appendix B: Recommendation for Mutual Recognition Arrangement on e-service Classification regarding ATIGA Form D based on the inputs gathered from the workshop

17 For the guiding path towards long-term integration of ASEAN electronic services, it is recommended that ASEAN Member States adopt this mutual recognition arrangement template where minor deviations are acceptable. From this model arrangement, ASEAN should continue its efforts in creating a harmonized framework in the region

18 Appendix A: Pre-Activity Questionnaire Introduction This questionnaire is a part of the Intra-ASEAN Secure Transactions Implementation Workshop project which is a continuing phase of the Intra-ASEAN Secure Transactions Framework. The project supports secure electronic transactions development in ASEAN in accordance with ASEAN ICT Masterplan 2015, under Strategic Thrust 2, Initiative 2.4 promoting the secure transaction within ASEAN. The objective of this project is to develop further the e-authentication Framework by creating electronic transaction classification and recommendations for the Mutual Recognition Arrangement (MRA) model which includes common recognition criteria of foreign electronic signature and digital certificate among ASEAN Member States. The questionnaire has been circulated from 28 th April 2015 to 29 th May 2015 prior to the implementation of the Intra-ASEAN Secure Transactions Implementation Workshop project. It comprises of four pages separated into seven sections. Thailand, as the project proponent would like to seek for your kind assistance to convey the enclosed questionnaire to ASEAN Member States to complete and submit to Mr. Werachai Prayoonpruk (werachai@etda.or.th) by Friday 29 th May 2015, at the latest. * Remark: Due to low response rate, the deadline is extended to Friday 12 th June The result of the questionnaire will be taken as basis for the discussions at the workshop. For further information, please contact: Mr. Werachai Prayoonpruk T: Ext M: F: Electronic Transactions Development Agency (Public Organization) Ministry of Information and Communication Technology of Thailand

19 PRE-ACTIVITY QUESTIONNAIRE This questionnaire is a part of the Intra-ASEAN Secure Transactions Implementation Workshop project. The project supports the ASEAN ICT Masterplan 2015, under Strategic Thrust 2, Initiative 2.4 promoting the secure transaction within ASEAN. The project aims to develop further the Intra-ASEAN Secure Transactions Framework by creating electronic transaction classification and recommendations for the Mutual Recognition Arrangement model which includes common recognition criteria of foreign electronic signature and digital certificate among ASEAN Member States. This worksheet follows the structure of Risk Assessment Reference Framework for Electronic Authentication Annex B and aims to facilitate the assessment of level of assurance for a subject electronic service, which specifically requires authentication of client, as described in the Intra- ASEAN Secure Transactions Framework. i. Assess potential risks of the electronic. ii. Map identified risks to the application Level of Assurance. iii. Determine the requirements on identity proofing & verification. iv. Determine the requirements on authentication mechanism. 1. Description of Electronic Service: ATIGA FORM D The ASEAN Trade in Goods Agreement (ATIGA) FORM D is the certificate of origin issued by a national government to exporters so that it can be used by counterpart importers for a preferential rate. Functional Needs and Requirements for Authentication:

20 2. Risk Assessment of the Electronic Service The electronic service shall be assessed on their level of potential damages or impacts, under six different categories in accordance with the Framework. Instructions: - Check (X) the appropriate level of impact (one check per each category). - Provide justifications. Impact Categories 1. Inconvenience, distress, or damage to standing or reputation Level of Impact No Lo Mo Hi Justifications 2. Financial loss or agency liability 3. Harm to agency programs or public interests 4. Unauthorized release of sensitive information 5. Personal safety 6. Civil or criminal violations No = No impact Lo = Low impact Mo = Moderate impact Hi = High impact * Please refer to Table 3: Potential impact categories and values on page 9 10 from Intra- ASEAN Secure Transactions Framework Report for details. The document is bundled with questionnaire package and can also be downloaded from

21 3. Map identified risks to the application Level of Assurance Based on the assessed profile of impacts under six different categories, an overall assurance level will be determined by finding the lowest assurance level whose impact profile meets or exceeds the potential impact for every category determined in the previous step. Instructions: - Fill the level of impact (copied from part 2). - Determine the suitable Level of Assurance on the last row. Impact Categories 1. Inconvenience, distress, or damage to standing or reputation Level of Impact LoA1 LoA2 LoA3 LoA4 Low Moderate Moderate High 2. Financial loss or agency liability Low Moderate Moderate High 3. Harm to agency programs or public interests 4. Unauthorized release of sensitive information No Low Moderate High No Low Moderate High 5. Personal safety No No Low Moderate High 6. Civil or criminal violations No Low Moderate High Lowest assurance level with impact profile that meets or exceeds the levels of all categories (highest level with one or more boxes checked) 4. Any adjustment to the Level of Assurance? Yes / No If yes, please provide details on the adjustment:

22 5. Level of Assurance assigned for the electronic service Instructions: - Fill in the blank the LoA level (Number 1 to 4). LoA 6. Identity Proofing and Verification Requirements Please explain registration requirements of your country for the electronic service and provide the list of documents used during the identity proofing and verification process. If there is no particular service provided in your country, please provide registration requirements of a service with equivalent Level of Assurance. 7. Authentication Requirements Please explain authentication requirements exercised in your country for the electronic service or any service with equivalent Level of Assurance. - End of Worksheet

23 Respondent Information Name of Respondent: Company / Organization: Position / Job Title: Job Description: IT Management IT Staff Non-IT Management Software Developer Auditor Lawyer Researcher Others Address: Telephone Number (country area number): Address: Type of Organization: Govt. Ministry / Agency Govt. / State Owned Enterprise University / Research Institution Locally-owned Enterprise Multinational Others Your cooperation will benefit to the ASEAN community. If you need any further information or have any inquiry, please feel free to contact werachai@etda.or.th or ext

24 Appendix B: Recommendation for Mutual Recognition Arrangement on e-service Classification regarding ATIGA Form D Introduction ASEAN is working toward the integration of community and the establishment of ASEAN Economic Community. As part of this, multiple agreements and numerous regional cooperative efforts have been deployed to drive the accomplishment. In accordance with ASEAN ICT Masterplan 2015, under Strategic Thrust 2, Initiative 2.4 promoting the secure transaction within ASEAN, the Intra-ASEAN Secure Transactions Implementation Workshop was initiated with the objective to develop further the Intra-ASEAN Secure Transactions Framework by creating electronic transaction classification and recommendations for the Mutual Recognition Arrangement (MRA) model which includes common recognition criteria of foreign electronic signature among ASEAN Member States. This MRA is based on the understanding that there are differences among identity proofing approaches and authentication mechanisms used by ASEAN Member States. As such, a common framework on Level of Assurance and risk assessment is adopted to determine mechanism of identity proofing and authentication suitable for different electronic transactions. Purpose Aiming to enhance trust and to promote secure cross-border electronic transactions in ASEAN; with the purpose to secure cross-border electronic transactions associated with ATIGA Form D through the adoption of a common framework on Level of Assurance and risk assessment and the recognition of suitable identity proofing schemes and authentication mechanisms; with the following principles: building on technological-neutrality and Level of Assurance approach in accordance with available international standard, acknowledging common recognition criteria of foreign electronic signature among ASEAN Member States,

25 Arrangement ASEAN Member States agree in principle to apply the framework on Level of Assurance and risk assessment for determining electronic transaction classification. ASEAN Member States continue to exchange information and share experience and practices in the areas including but not limited to risk assessment, identity proofing and verification, and authentication mechanism

26 Appendix C: Annex 7 of ATIGA 1. Goods consigned from (Exporter's business name, address, country) ANNEX 7 Original (Duplicate/Triplicate) Reference No. ASEAN TRADE IN GOODS AGREEMENT/ ASEAN INDUSTRIAL COOPERATION SCHEME CERTIFICATE OF ORIGIN (Combined Declaration and Certificate) 2. Goods consigned to (Consignee's name, address, country) FORM D Issued in (Country) See Overleaf Notes 3. Means of transport and route (as far as known) 4. For Official Use Departure date Preferential Treatment Given Under ASEAN Trade in Goods Agreement Vessel's name/aircraft etc. Preferential Treatment Given Under ASEAN Industrial Cooperation Scheme Port of Discharge Preferential Treatment Not Given (Please state reason/s)... Signature of Authorised Signatory of the Importing Country 5. Item number 6. Marks and numbers on packages 7. Number and type of packages, description of goods (including quantity where appropriate and HS number of the importing country) 8. Origin criterion (see Overleaf Notes) 9. Gross weight or other quantity and value(fob) 10. Number and date of invoices 11. Declaration by the exporter 12. Certification The undersigned hereby declares that the above details and statement are correct; that all the goods were produced in It is hereby certified, on the basis of control carried out, that the declaration by the exporter is correct.... (Country) and that they comply with the origin requirements specified for these goods in the ASEAN Trade in Goods Agreement for the goods exported to... (Importing Country)... Place and date, signature of authorised signatory... Place and date, signature and stamp of certifying authority 13 Third Country Invoicing Accumulation Back-to-Back CO Exhibition De Minimis Issued Retroactively Partial Cumulation

27 OVERLEAF NOTES 1. Member States which accept this form for the purpose of preferential treatment under the ASEAN Trade in Goods Agreement (ATIGA) or the ASEAN Industrial Cooperation (AICO) Scheme: BRUNEI DARUSSALAM CAMBODIA INDONESIA LAO PDR MALAYSIA MYANMAR PHILIPPINES SINGAPORE THAILAND VIETNAM 2. CONDITIONS: The main conditions for admission to the preferential treatment under the ATIGA or the AICO Scheme are that goods sent to any Member States listed above must: (i) (ii) (iii) fall within a description of products eligible for concessions in the country of destination; comply with the consignment conditions in accordance with Article 32 (Direct Consignment) of Chapter 3 of the ATIGA; and comply with the origin criteria set out in Chapter 3 of the ATIGA. 3. ORIGIN CRITERIA: For goods that meet the origin criteria, the exporter and/or producer must indicate in Box 8 of this Form, the origin criteria met, in the manner shown in the following table: Circumstances of production or manufacture in the first country named in Box 11 of this form (a) Goods wholly obtained or produced in the exporting Member State satisfying Article 27 (Wholly Obtained) of the ATIGA Insert in Box 8 WO (b) Goods satisfying Article 28 (Non-wholly obtained) of the ATIGA Regional Value Content Percentage of Regional Value Content, example 40% (c) Change in Tariff Classification Specific Processes SP Combination Criteria Goods satisfying paragraph 2 of Article 30 (Partial Cumulation) of the ATIGA The actual CTC rule, example CC or CTH or CTSH The actual combination criterion, example CTSH + 35% PC x%, where x would be the percentage of Regional Value Content of less than 40%, example PC 25% 4. EACH ARTICLE MUST QUALIFY: It should be noted that all the goods in a consignment must qualify separately in their own right. This is of particular relevance when similar articles of different sizes or spare parts are sent. 5. DESCRIPTION OF PRODUCTS: The description of products must be sufficiently detailed to enable the products to be identified by the Customs Officers examining them. Name of manufacturer and any trade mark shall also be specified. 6. HARMONISED SYSTEM NUMBER: The Harmonised System number shall be that of in ASEAN Harmonised Tariff Nomenclature (AHTN) Code of the importing Member State. 7. EXPORTER: The term Exporter in Box 11 may include the manufacturer or the producer. 8. FOR OFFICIAL USE: The Customs Authority of the importing Member State must indicate ( ) in the relevant boxes in column 4 whether or not preferential treatment is accorded. 9. MULTIPLE ITEMS: For multiple items declared in the same Form D, if preferential treatment is not granted to any of the items, this is also to be indicated accordingly in box 4 and the item number circled or marked appropriately in box THIRD COUNTRY INVOICING: In cases where invoices are issued by a third country, the Third Country Invoicing box should be ticked ( ) and such information as name and country of the company issuing the invoice shall be indicated in box

28 11. BACK-TO-BACK CERTIFICATE OF ORIGIN: In cases of Back-to-Back CO, in accordance with Rule 11 (Back-to-back CO) of Annex 8 of the ATIGA, the Back-to-Back CO box should be ticked ( ). 12. EXHIBITIONS: In cases where goods are sent from the exporting Member State for exhibition in another country and sold during or after the exhibition for importation into a Member State, in accordance with Rule 22 of Annex 8 of the ATIGA, the Exhibitions box should be ticked ( ) and the name and address of the exhibition indicated in box ISSUED RETROACTIVELY: In exceptional cases, due to involuntary errors or omissions or other valid causes, the Certificate of Origin (Form D) may be issued retroactively, in accordance with paragraph 2 of Rule 10 of Annex 8 of the ATIGA, the Issued Retroactively box should be ticked ( ). 14. ACCUMULATION: In cases where goods originating in a Member State are used in another Member State as materials for finished goods, in accordance with paragraph 1 of Article 30 of the ATIGA, the Accumulation box should be ticked ( ). 15. PARTIAL CUMULATION (PC): If the Regional Value Content of the material is less than forty percent (40%), the Certificate of Origin (Form D) may be issued for cumulation purposes, in accordance with paragraph 2 of Article 30 of the ATIGA, the Partial Cumulation box should be ticked ( ). 16. DE MINIMIS: If a good that does not undergo the required change in tariff classification does not exceed ten percent (10%) of the FOB value, in accordance with Article 33 of the ATIGA, the De Minimis box should be ticked ( )

29 Appendix D: Summary of Questionnaire Response on Education Grants Topic Electronic Service: Education Grants Description: Online service procedure to obtain student grants for higher education and provide education certificate. Risk Assessment and Level of Assurance: From the above table, the responder justified that LoA 3 should be adopted. Regarding the identity proofing and verifications, there is no such electronic service available in the responder s country. However, the responder suggested that if such e-service is available, the following basic requirements should be in place, including: - Personal Information (ID Card, Probe of current address, contact information, etc) - Emergency contact person. - Financial Information (upon the need of agency) For the authentication mechanism, the responder suggested below techniques: - Login: Username/Password - Confirm and notify by phone number

30 Appendix E: Workshop Photo Gallery Intra-ASEAN Secure Transactions Implementation Workshop Intra-ASEAN Secure Transactions Implementation Workshop Intra-ASEAN Secure Transactions Implementation Workshop Intra-ASEAN Secure Transactions Implementation Workshop Intra-ASEAN Secure Transactions Implementation Workshop

31 Intra-ASEAN Secure Transactions Implementation Workshop Intra-ASEAN Secure Transactions Implementation Workshop Intra-ASEAN Secure Transactions Implementation Workshop Intra-ASEAN Secure Transactions Implementation Workshop