May 17, 2021

LANKASIGN: Unlocking the Next Level of Sri Lanka’s Digital Transformation

Can you briefly take us through Sri Lanka’s digital transformation journey since the pandemic outbreak in 2020?

Channa de Silva: The drastic change in the environment requires new approaches and solutions, imperatives that must be embraced by all sections of the economy to survive and to stay relevant.

The outbreak of the pandemic saw people and institutions grappling to keep up with day-to-day activities. One of the key challenges observed was in the areas of transacting for goods and services in what can be called an increasingly contactless world.

Although the relevant authorities have pushed for Sri Lanka to move towards a cashless economy, it was during the initial outbreak of COVID-19 that people actively looked at using the digital payment infrastructure that is in place.

Across the world, including Sri Lanka, the digital modes of communications including payments are continuing to boom, thanks to the introduction of new technologies coupled with other developments to encourage the emergence of innovative ways of doing things, which in turn creates new business opportunities.

Even before the crisis hit, Sri Lanka had the necessary framework to embark on the digital journey. The ability of consumers to make an immediate transition from manual to electronic transactions provides clear evidence that a strong foundation had already been laid.

Jayantha Fernando: The Sri Lankan Electronic Transactions Act provides the enabling legal framework to transform every form of physical activity that is carried out, into the digital medium -except for certain classes of instruments where notarization is needed, which are excluded from the ambit of the said Electronic Transactions Legislation. I believe and can firmly say that we have sufficient legal grounds to embrace this transition.

For instance, the Colombo Stock Exchange (CSE) going completely digital is an example of efforts being stepped up to ensure the available technology is used to its fullest potential, leaving no room for any inefficiencies to creep in. The upgraded digital experience of the CSE allows digital onboarding of customers, identity verification via digital means through the Department of Registration of Persons and allows market participants to engage in the capital market with no hindrance. As part of this reform process, several rule amendments made to the CDS Rules, Stockbroker rules and Listing rules under the digital transformation initiative, led by a joint SEC/ CSE digitization Committee. The new initiative was launched in September 2020.

Can you tell us about the Electronic Transaction Act?

Jayantha Fernando: Paving the way towards digital transformation in the private sector and Government transactions is the Electronic Transactions Act, which is based on the standards established by United Nations Commission on International Trade Law (UNCITRAL), Model Law on Electronic Commerce (1996) and the UN Electronic Communications Convention (2005). The latter is the only international treaty on Digital Transactions. Sri Lanka became the first country in South Asia to adopt this convention. Based on the initiatives taken by ICTA from 2006, and since we took part in the drafting phase of the UN Electronic Communications Convention, it became easier for Sri Lanka to adopt this global standard.

The Electronic Transactions Act No. 19 of 2006 (ETA) was established to fulfil several objectives; to facilitate domestic and international electronic commerce by eliminating legal barriers and establishing legal certainty; to encourage the use of reliable forms of electronic commerce; to facilitate electronic filing of applications, petitions, plaints, answers, written submissions or any other document in any Courts; to facilitate electronic filing of documents with the government and to promote efficient delivery of government services using reliable forms of electronic communications, and to promote public confidence in the authenticity, integrity and reliability of data messages and electronic communications.

The Act has ensured that electronic communication and digital documents are officially and legally accepted as a proper means of communication. It applies to all business and commercial transactions that are electronic, other than wills, testamentary dispositions, powers-of-attorney, sale, or conveyance of immovable property, etc, which are excluded by Section 23 of the ETA. The amendments introduced through Act No. 25 of 2017 made this legislation fully in line with the UN Electronic Communication Convention (UN ECC), which was a further boost for cross-border digital transactions.

How important was it to enable digital signatures?

Channa de Silva: Making the digital journey even more convenient to embark on is the ability to use digital signatures. Digital signatures essentially work by proving that a digital message or document was not modified, intentionally or unintentionally, from the time it was signed. This is done by generating a unique hash of the message or document and encrypting it using the sender’s private key. In addition, the sender cannot deny the communication was originated by him if a digital signature is affixed, thus, providing non-repudiation.

In this context, Sri Lanka has been successful in terms of enabling cross border transactions as well, since the root key from the island nation became recognized globally from the beginning of last year after its launch on 14th February 2020.

In May 2009, Sri Lanka saw the launch of the first sectoral Certification Service Provider (CSP) under the brand name LankaSign under the ETA. This was established by LankaPay, through a joint initiative taken by the Central Bank of Sri Lanka (CBSL) and ICTA, with technical support from Sri Lanka CERT.

In the first phase, digital certificates were provided to banks for use in financial transaction clearing systems, such as SLIPS and CITS.

What was ICTA’s role in enabling Digital Signatures?

Jayantha Fernando: In addition to providing leadership to the drafting of the Legal Framework, manifested in the Electronic Transactions Legislation, ICTA took the lead in supporting both the Government and private sector stakeholders in the adoption of this Legislation from 2006 onwards. Sri Lanka now has the legal framework to facilitate the legal acceptance of digital or e-signatures. The ETA (Section 7) gives digital signatures the same legal validity as traditional hand-written signatures, and Section 7 along with the definition of “Electronic Signatures” was amended in 2017 in order to bring it in line with International standards.

With regards to verifying the validity of digital signatures, what is required is a valid certificate from the signatory and the complete issuer chain of certificates up to the root certificate. In addition, the signatory’s public key, issuer Certificate Status Protocol (CSP) certificates and their Certificate Revocation List (CRL) are also required. The digital signature root hierarchy is administered and governed by a National Certification Authority (NCA) Task Force, functioning under the ETA. ICTA took the lead to establish this NCA Task Force and also took the lead to establish the required infrastructure for the NCA at the initial stage, which was managed by Sri Lanka CERT from 2011 onwards, as part of its Cyber Security national initiatives. With the establishment of CERT as a separate Legal entity under the Ministry, NCA functions were transferred to Sri Lanka CERT by an order published in the Gazette in October 2019. The NCA Task Force continues to manage and administer the NCA functions under the ETA.

With Work-from-Home being a part of the new normal post-Covid, is Sri Lanka capitalising enough on the available technology such as Lanka Sign?

Channa de Silva: While most enterprises have been focusing on their digital transformation the last few years, many are still utilizing processes that have manual, physical, or faceto-face components and document signing is probably the best example of this.

Digital signatures help in the current context since there is a reluctance at the moment to work on-premise due to the outbreak of the pandemic. A digital signature is the electronic equivalent of a handwritten signature. A digital certificate issued from a trusted party would have a higher degree of validity attached to them, which ensures integrity to the transactions. Now that we have the infrastructure in place, the government and businesses large and small should seriously consider the option of using digitally signed documents for more secure and faster transactions.

However, due to lack of awareness, most private organizations are somewhat reluctant to use digital certificates or digital signatures on their day-to-day basis although the benefits are immense. Companies should embrace digital signatures from a trusted source since they are convenient, versatile, binding, and secure.

Jayantha Fernando: This again is a business choice. Customers opting for digital signatures under the ETA have several options across various categories. The law lets trading parties decide the category of electronic signatures they would like to use. One important feature of the Act is that we have kept the law technology-neutral so that it can adapt to developments in technology.

Under the existing law, any method that helps to identify a person clearly and to indicate that person’s intention concerning an electronic communication would fall within the framework of an electronic signature and depending on the type of transaction, the parties can use various methods.

So basically, customers and businesses have choices, and they must pick what is suitable for them. My suggestion is to make that choice wisely and use a secure method that ensures the integrity of transactions and guarantees they are not tampered with. Digital signatures certainly achieve these objectives and there are no legal barriers to use them.

A complete transformation from paper to digital transactions, be it in the government or private sector, is the need of the hour. As measures are taken to identify and verify the identity of a person, protecting that in the digital world is imperative. We have been examining this area and as part of the Digital Strategy of the Government priority is given by ICTA to complete the Data Protection Bill. I Chair the drafting committee responsible for this and drafted the legislation that went through several public consultation processes, and received policy level approval from the Secretary, Ministry of Technology Mr Jayantha De Silva. The Data Protection bill has been further refined and revised over the last 2-3 months, based on the Observations of the Ministry of Justice, Attorney General, CBSL and others, and will be published as a Bill and enacted as legislation in the next few months. The Ministry of Technology, established in November 2020, has the mandate to fast track the initiative and set up the institutional framework for its implementation.