• Security for e-business is overlooked; it comes as an afterthought or is perceived purely as a technical issue.

• It is essential that the government plays an effective role in security.

• Government must put out more effort to meet the expectations of business and customer stakeholders.

The role of government in E-business security

The literature on e-business adoption appears to consider a wide range of stakeholders [6–9]. However, a comprehensive review reported in [8] reveals that in practice researchers are likely to focus on just a few stakeholders, predominantly customers. Hence, they stress the importance of paying more attention to stakeholders such as regulators, suppliers, and investors.

Clearly, government is also an important stakeholder, and a number of studies have explored its role in the context of developed countries. An early paper by Julta et al. [10] investigates the effect of governmental legislation concerning electronic signatures to promote the use of electronic communications on building the public’s confidence in electronic transactions. Van Baal [11] examines the government’s role in devising measures for supporting small and medium-sized enterprises that could stimulate e-business in the trade sector. Roberts and Toleman [4] discuss how governments could improve regulations and compliance effectiveness in order to promote more secure services. A more recent study in the developing world by [3] investigates the effect of support provided by national government institutions and commercial infrastructure on e-business outcomes in Latin America and Sub-Saharan Africa. The findings reveal the need for ICT policies specific to the needs of e-business.

In Jordan there is a paucity of studies involving the role of government in building a secure and trustworthy e-business environment. Abu-Samaha and Abdel Samad [12] studied the reasons why most organizations and individuals in Jordan refrain from using the Internet to exchange products and services or funds online. They concluded that the primary reasons are lack of an advanced and secure technical infrastructure, low volume of Internet users, and limited use of digitized payment methods in Jordanian society (like credit cards). Obeidat and Abu-Shanab [13] identified different categories of barriers to adopting electronic government services among business organizations in Jordan; these were: strategic, technological, organizational, policy, legal, and human factors. Interestingly, the findings of these studies, particularly the latter, concur with our own finding based on empirical work [5]. Similarly Alsmadi [14] has identified many security threats in several Jordanian e-government portals that provide e-services to citizens and businesses. Clearly these weaknesses and problems hinder the expansion of e-government services in Jordan to becoming fully active in e-business in terms of G2C (Government to Consumer) and G2B (Government to Business).

Despite these limitations, through the past decade the Jordanian government has been working hard to increase the country’s electronic readiness to benefit from today’s information society and has recognized the potential benefits that ICT diffusion and e-business adoption can bring to the country. Indeed, Jordan was one of the first countries in the region to pass a special law for online transactions [15]. In 2007 the government policy for ICT called for more efforts to encourage local companies to offer e-services, especially e-commerce services [16]. In response to this policy, the Ministry of Information and Communications Technology (MoICT), in cooperation with other governmental bodies and stakeholders, introduced the National e-Commerce Strategy for 2008 to 2012 in order to provide the necessary framework for implementing those recommendations [17].

Since our research focuses on security relating to e-business adoption strategy, we aim to explore how and to what extent security is addressed in the Electronic Transactions Law [15] and in the government’s National e-Commerce Strategy. In the following subsection, we provide a detailed overview of [15] and the National e-Commerce Strategy.

Overview of the Electronic Transaction Law (ETL): Law No. 85 of 2001

Al-Omari and Al-Omari [18] point out that Jordan was one of the first countries in the region to recognize the importance of legislation that facilitates e-business transactions and pass a special law for online transactions. This temporary law is called Electronic Transactions Law (ETL) No. 85 and represents the single legal reference that can be applied to e-business transactions [15]. Instead of amending existing legislation to recognize online transactions, this law was introduced to be applicable to any transactions that involve electronic processing, transmitting, and storing of data. The law attempts to regulate a number of aspects of e-business such as: electronic contracts, records, messages, and signatures. It also provides a set of articles related to electronic transfer of funds and authenticity of electronic documents. It therefore represents a first effort toward prevention of certain sorts of cybercrime. However, ETL does not provide comprehensive legislation that can ensure the security and trustworthiness of the online environment.

According to article (3) of the ETL, the law was introduced to enable electronic means of conducting online transactions for both governmental and commercial sectors. ETL consists of 7 chapters and 41 articles that cover four areas relevant to secure e-business: electronic documents, including records, contracts and messages; electronic transfer of funds; electronic signatures and digital certificates; and penalties for some kinds of online abuse.

First, regarding the use of electronic documents, the law acknowledges the legal power of different forms of electronic documents and considers them acceptable sources of evidence that cannot be denied just because they are conducted by electronic means. Indeed, according to article (7/a) of ETL “the electronic records, contracts, messages, and signatures shall be considered to produce the same legal consequences resulting from the written documents and signatures in accordance with the provisions of the Laws in force in terms of being binding to the parties concerned or in terms of fitness thereof as an evidential weight.” Similarly, article (8/a) of the law sets the conditions for considering an electronic record to have the same legal effect as its original form. These conditions mainly concern availability, accessibility, and integrity of the data contained in the digital record as well as identification of the originator.

Second, at the core of e-business is the notion of electronic transfer of funds. ETL stipulates a number of provisions for facilitating e-payment. For instance, article (25) recognizes electronic transfer of funds as an acceptable payment method. Only two general conditions are set on financial institutes providing e-payment services: they must comply with other relevant laws of banking as per the Central Bank of Jordan, as well as regulations and instructions that the Central Bank issues to regulate e-payment in the country; and they must ensure the security of the services provided to clients and maintain banking confidentiality.

Third, the law defines “electronic signature” as the only mechanism which provides security and acceptability of the “electronic record,” which the ETL defines as “a record, contract or data message generated, sent, received or stored by electronic means.” It stipulates that the electronic record is valid and deemed secure from a legal point of view only if it is signed by a secure electronic signature generated during the validity period of its digital certificate, which needs to be obtained from an accredited certificates authority. This implies the existence of a Public Key Infrastructure (PKI) for implementing this law.

Finally, in terms of secure e-business, some means is required to prevent related abuse. The ETL stipulates provisions related to some cybercrimes which mainly focus on illegal use of digital certificates. Both imprisonment and fines have been introduced as penalties for illegal online acts such as the creation of security certificates for fraudulent purposes. Penalties have also been introduced for organizations involved in the process of securing electronic records. For instance article (37) stipulates that “any entity engaged in the practice of securing documents which submits false information in a registration application, or discloses confidential information of any of its clients, or violates the regulations and instructions issued pursuant to this Law documents shall be subject to a fine of no less than (5000) five thousand dinars.” In article (38) the law goes further, introducing punishment for any act considered a crime committed by electronic means.

Overview of the National E-commerce Strategy

The National e-Commerce Strategy represents the governmental plan for developing e-commerce in Jordan. The strategy defines e-commerce as “transactions between consumers and businesses or between businesses associated with the development or trade of goods and services over telecommunications or broadcast network,” which implies that this strategy is intended to cover all e-business modes, including business to customer, business to business, and internal business automation. The strategy was drawn up based on a SWOT analysis (of Strengths, Weaknesses, Opportunities, and Threats) carried out between July and October 2007 to assess the current state of e-business in the country. The strategy’s vision, goals, and objectives have been set with the intention of making Jordan “a leading e-commerce centre in the region through the exploitation of its information technology capacity and the creativity of its people” [17]. Five major factors were identified as reasons why e-commerce had not taken off in Jordan:

To overcome these impediments a set of enablers and their associated actions were identified. These are shown in Table 8.1.

In the next section we assess to what extent these government initiatives, namely, the Electronic Transaction Law and the National e-Commerce Strategy, meet the requirements for e-business security. We show that they have a number of limitations that make them inadequate to provide the required legal setup.

Analysing ETL in relation to E-business security

The Electronic Transaction Law (ETL) is clearly an important step toward increasing the adoption of e-business in the Jordan because it provides a suitable legal framework for such activities. However, our analysis reveals that several issues related to e-business as well as security are not addressed in this law. These limitations render the current legal situation inadequate for providing a secure e-business environment.

One major drawback we identified is that the law is not mandatory; therefore, it is applicable only if participating parties agree to apply it. Indeed, article (5/a) states: “unless a provision in this Law states otherwise, the provisions of this Law shall apply to the transactions on which the parties thereto agree to implement the transactions thereof through electronic means.” Similarly, article (5/b) requires a new agreement between the parties for every new transaction. According to Al-Ibraheem and Tahat [19], this is because ETL uses as its model the United Nations Commission on International Trade Law (UNCITRAL [20]), which requires explicit consent from the parties that are going to perform transactions by electronic means. While this provides some sort of flexibility for the parties transacting online, it also means that the law might never be implemented, hence failing to regulate e-business.

A further factor making a large part of this law ineffective is the lack of regulations and instructions on how to implement and enforce some of its provisions. For instance, the validity of an electronic signature is linked, under this law, to the validity of the digital certificate, which needs to be issued by a competent and licensed certificate authority. According to article (40/b) the Cabinet will issue the necessary regulations for implementing the provision related to “the procedure for issuing security certificates, the authority competent to do such and the application fees.” As another example, article (29), relates to the security of electronic transfer of funds. It specifies that the Central Bank of Jordan is responsible for maintaining and ensuring the safety of the banking environment in Jordan. Unfortunately, as of this writing, regulations to support both of these articles have still not been issued [21].

This lack of supportive regulations concerning the security of online transactions hinders the establishment of a secure e-business infrastructure and increases the legal uncertainty for both businesses and citizens. Furthermore, the absence of these regulations makes it impossible to establish even a basic security infrastructure. In the contrary, many developed countries such as the UK, the United States, and most of the European Union states have established a set of directives and regulations for digital signatures and certificates authorities that support the adoption of online transactions in those parts of the world [22].

ETL is also very limited with regard to cybercrime, mainly addressing the illegal use of digital certificates. It introduces a penalty of up to one year’s imprisonment for any illegal act conducted online. However, the law does not distinguish among the many forms of cybercrime, which differ in terms of type, intention, and severity. Under the current law there is no difference between a simple computer penetration targeting any machine over the Internet, which can be committed by an individual, and an organized denial of service attack targeting large e-business portals. Considering the nature and diversity of cybercrime, these provisions fail to recognize the wide range of real risks associated with e-business environments and fail to deal with each type of these crimes according to its nature and impact.

The Jordanian constitution appears to respects citizens’ privacy in the physical world; however, there is no equivalent treatment for online privacy. For instance, Internet cafés, which are very popular in the country, are requested by law to collect personal data from the Internet users and must disclose this data if the government so requests: “In March 2008, Jordan began increasing restrictions on the country’s Internet cafés. Under the pretext of maintaining security, Internet cafés were installed with cameras to monitor users, and Internet café owners were required to register the IP number of the café, the users’ personal data, the time of use and the data of Web sites explored” (see [23] p. 3).

According to the Economic and Social Commission for Western Asia (ESCWA) [24,25], lack of data protection laws and absence of disclosure control mechanisms are the major cause of privacy problems in many countries, including Jordan: “While most advanced countries have devised laws that protect privacy and data, all ESCWA member countries still lack standards and regulations to protect personal privacy and data, with the exception of general laws that are applied in certain cases” ([24] p. 38).

Furthermore, the absence of laws and regulations to protect the rights of customers engaging in e-business transactions represents a serious obstacle to building customer trust in this form of transaction. Consumer protection includes many issues such as product liability, privacy rights, fraud and misrepresentation [24]. Unfortunately, these issues are not covered under the current legal framework, which contributes to the legal uncertainty of the e-business environment. The authors of [19] point out the obvious absence of legislation that covers standards, procedures, techniques, infrastructures, and security guidelines for e-business that the commercial sector should follow in order to ensure security.

We therefore conclude that the current legal framework is inadequate to provide a secure e-business environment. It has failed to address several fundamental issues: enforcement, supportive regulations for establishing security infrastructure, cybercrimes, privacy, and online customer protection. Moreover, from our empirical research [5] we know that these issues are of significant concern for a wide range of stakeholders. Addressing these issues is essential for providing the comprehensive legal framework required for today’s complex e-business environment.

Analyzing security within the National E-commerce Strategy

The government’s strategy to develop e-business covers a wide range of areas, including legislation, local ICT industry, infrastructure, and financial services, and its actions target a wide range of stakeholders, including customers and service providers as well as government departments. It appears that all of these stakeholders’ requirements could be fulfilled. However, some important questions remain: How and to what extent is security addressed by the National e-Commerce Strategy? Is it comprehensive enough to fulfill the requirements? Here we explore these questions.

Clearly, there has been an attempt to address two barriers to the lack of confidence in e-business: the absence of an adequate legal framework and the absence of security awareness among potential online users. The government’s National e-Commerce Strategy incorporates two action plans to address these two limitations. The inadequate legal framework especially relates to customer protection and the security of e-transactions; as we have discussed, the Electronic Transaction Law (ETL) is not able to ensure sufficient online security. One of the government’s action plans was to amend the current ETL to cover issues such as confidentiality of e-transactions, spamming prevention, dispute resolution, and effective enforcement measures. Moreover, the action plan included promulgating three new laws: a cyber crime law, a consumer protection law, and a law to establish credit bureau facilities in Jordan. The second action plan, intended to leverage security for e-business, focused on increasing security awareness among potential online companies, including publishing security guidelines for online companies. The target was to have 90 percent of online merchants conforming to these guidelines two years from the issuing date. Unfortunately that date was left unspecified!

The government’s National e-Commerce Strategy with its proposed action plan is clearly a significant step in assuring e-business security and eliminating the relevant stakeholders’ concerns. It has addressed some important issues, especially in relation to legislation that promotes a secure online environment. However, the strategy still has a number of interrelated deficiencies, which can be observed at the strategic,governance, and action levels of the strategy. We now discuss these deficiencies and their possible implications.

Looking at the strategy’s goals and objectives, it appears that securing the e-business environment was perceived not as a strategic goal but as an obstacle that could simply be removed by offering security guidelines to online companies and passing a certificate authority law and other relevant laws and regulations. This limited understanding of the role of security and its implications could be the reason that the strategy does not take a comprehensive and systematic approach to addressing wider security issues. Not having security as a strategic goal can increase the chance that it will be overlooked in many areas associated with the implementation of the strategy. We illustrate with three notable examples.

At the infrastructure level, the government seems to want to invest heavily in providing citizens with physical ICT infrastructures without paying much attention to how to secure these infrastructures, which are required by e-business adopters. For instance, the strategy emphasizes the availability and affordability of e-payment systems, broadband, and wireless services, but does not require service providers, such as ISPs and telecommunication companies, to secure these services. This means that security could be overlooked in these critical infrastructures. The ICT infrastructure section of the action plan states that MoICT, in collaboration with telecommunication operators and local ISPs, would ensure the availability of the ICT infrastructure necessary for e-business services; unfortunately, none of the actions relates to the security of ICT infrastructure.

In the second and fourth goals of the strategy, the government aims to make Jordan a regional leader for IT services and a strong competitor in the digital economy. Yet security is not integrated into the process of achieving these goals and unfortunately is not considered as a competitive advantage. Therefore, we think that these goals are unlikely to be achieved, since security of IT services is an important factor for companies who want to provide their customers with a high quality, reliable service. This lack of security could lead to Jordan being excluded from the benefits of such opportunities, thereby negatively impacting its strategic goals. Moreover, even though the government owns this strategy, the absence of a governance framework for information security shows that the government does not want to take responsibility toward ensuring security. Indeed the strategy clearly states that “as an implementer of e-commerce strategy, however, Government’s roles and responsibilities are limited. This strategy lays down objectives for Government to meet in areas such as the law associated with e-commerce, taxation and customs. Government can facilitate, promote, propose, recommend and sometimes fund, but seldom command or require action by the private sector.”

The action plan PLURAL? associated with the National e-Commerce Strategy includes many actions to raise e-business awareness in different sectors and among a wide range of stakeholders. However, in practice these actions focus only on the benefits of e-business; none of them emphasizes the need to build information security awareness especially among stakeholders such as customers, judges, lawyers, and government officials. This limited focus on raising security awareness in the business community means that it is failing to fulfill the government own ICT policy which states: “Government requires that users (both residential and small business) be supported by the provision of advice on the safe use of the Internet and the protection of children, in order to promote consumer confidence in the use of ICT, while avoiding risks and protecting human rights. This function should be led by the MoICT and should include participation by other relevant public and private stakeholders” [16]. As a consequence, it has not been possible to build citizens’ security awareness, which could increase their levels of confidence and equip them with skills for protecting their online security, thereby elevating their trust in e-business. Our empirical work [5] strongly suggests that all stakeholders need to be involved and therefore the strategy needs to recognize the importance of information security awareness at different levels of society for cultivating a security culture, which, we propose, would contribute to enhancing the security of e-business.

Discussion

The analysis of our study revealed that the Jordan government’s limited view of security has impacted its plans and initiatives to promote an attractive e-business climate. The first government attempt to address security was through the Electronic Transaction Law (ETL). Our analysis revealed that EFL is, however, inadequate to provide a secure e-business environment, since it fails to address several security issues that are concerns of a wide range of stakeholders. These issues include online privacy and data protection, online customer protection, and security of e-business infrastructure. Besides, the lack of supportive rules and regulations to implement and enforce some provisions in ETL, especially the ones relating to establishing certificate authorities, render a large part of ETL inactive and therefore unable to fulfill its goal.

The National e-Commerce Strategy, introduced seven years later, represents acknowledgment by the government that the existing legal framework was hindering the adoption of e-business in the country and its attempt to correct this situation through actions to reform the current legal setup to better facilitate e-business. These actions include promulgating three new laws: a cyber crime law, a consumer protection law, and a law to establish credit bureau facilities in Jordan. Nevertheless, the strategy fails to perceive security outside the legal dimension. While the government has acknowledged the relation between security and citizens’ trust in e-business, its proposed action plan does not go beyond providing security guidelines to online companies, and the legal role predominates.

Our analysis suggests that security was not viewed as an essential part of the strategy or as a competitive advantage. This has had two major implications. First, security has been overlooked in many areas at the implementation level of the strategy. This is notable in the action plan which covered areas such as stakeholders’ awareness and ICT infrastructure but lacked any plan to address associated security aspects. Second, there is no national security governance framework to establish a set of roles and responsibilities that the government and other relevant stakeholders need to exercise to ensure security of the e-business environment. In such a situation, it is difficult to know who is in charge of what, and security is left to the judgment of the individual parties involved in e-business.

This analysis highlights the absence of an effective governmental role with respect to government’s responsibility to regulate the digital environment to protect both businesses and customers. Accordingly, we recommend that the government should contribute in building awareness of security issues at both organizational and individual levels. For instance, our study found that the lack of a government monitoring role has two implications. On the business side, nobody checks whether or not private companies are capable from a security point of view of doing business online, which can impact negatively on a business’s perceived responsibility toward security. On the other hand, lack of monitoring increases customers’ feelings of distrust in the electronic environment, especially in the absence of a legal setup to protect online customers [26].