Adrian and e-commerce: understand the technology, then develop the policies

I wrote this article for Lawyer’s Weekly magazine some years ago. It’s presented here for its historical interest, in particular how prescient are interview subject Adrian McCullagh’s predictions regarding the future of e-commerce viewed in the cool light of hindsight.

As national director of e-commerce for Gadens Lawyers, Adrian McCullagh has played a prominent role in developing Australia’s e-commerce legislation. He was a member of the Federal Attorney General’s Electronic Commerce Group which reported on the proposed e-commerce framework for the Australian business sector, was also involved in the National Public Key Infrastructure Working Group and currently serves on the Standards Australia Technical Committee IT 12/4/1, which develops national technical standards for e-commerce practice and implementation. In short, if it’s to do with law and e-commerce, McCullagh’s your man.

Adrian’s work embraces not only implementation of effective e-commerce strategies for national and international business but also advising industry groups and business sectors on e-commerce and related IT issues. Laywers Weekly caught up with him at the Gadens Brisbane offices for an insight into how a former computer science student became an e-commerce law specialist and the importance of online business in today’s rapidly evolving e-marketplace.

From programmer to lawyer

It is perhaps not surprising that Adrian initially chose computers as a career focus, given that his family had a strong IT background; his uncle introduced one of the very first mainframe computers into Australia, for the Commonwealth Government treasury back in the late 1950s.

“My uncle worked for ICT – later to become ICL – out of England. Once, when I was still growing up, I was tossing up what I should do for a living and my uncle said, ‘You’ve got to get into computers’! Adrian explains. “This was back in 1972 or 73. So I did a computer science degree at the then Queensland Institute of Technology and did my project on artificial intelligence – I wrote a backgammon game where you played backgammon with a computer.

“It was pretty rudimentary, a fairly naïve approach – it was a ‘probabilistic’ approach, not the ‘decision-tree’ approach that is being used now. I then worked for the Queensland University as a systems programmer at the medical school and I was also a medical statistician at one time, working in medical epidemiology. The Medical School was negotiating a contract for a new system and I was assisting. I wasn’t particularly impressed with the attorneys we were using. I actually lost a bit of confidence in them because they were asking the most rudimentary questions about the technology and I realised I knew more about it than they did. So this led me to thinking that maybe there would be an opening in the world for an IT lawyer, which back in 1981 was a fairly unusual proposition.”

Adrian quit his job and went back to QUT, supporting himself by part-time lecturing and tutoring in computer science while studying full-time law. He remembers the time fondly: “It was quite an interesting concept, because I would be in the situation of administering an exam as a lecturer and then I would have to rush off and sit for one as a student!”

Four years later, armed with an honours degree in law, Adrian commenced his articles at what is now Corrs Chambers Westgarths. After a few years he moved to a small law firm and later became a partner, “but that didn’t quite work out so eight years ago I came to Gadens.”

At Gadens he started as a senior associate. “Four years ago, long before e-commerce really took off, I commenced the very first PhD in e-commerce issues in law in Australia and one of the first in the world.” The emphasis of the work deals with the incorporation of trust strategies in digital signature regimes for e-commerce.

“What this translates to in simpler terms,” he explains, “is that my research is looking at what we mean by trust. It may be only a five-letter word but it’s actually a very complex concept, in that it involves legal, sociological and technological issues.

“What do we mean by trust from these perspectives – especially considering that certain cultures are more trusting than others? Where does the law fit to support the e-commerce framework, which itself is going to build upon social trust and technological trust?”

In his research, Adrian has looked at the European directive on digital signatures, Singapore, Hong Kong and Malaysian digital-signature law, the UK Electronic Communications Act and the various electronic/digital signature Acts in North America, trying to work out what is meant by trust in this complex legal context.

“There is a myriad of approaches to dealing with digital/e-signatures, and these are really going to underpin the entire methodology of doing business in the future,” he explains. “Have the legislators understood the nature of trust, and if so, how have they incorporated those trust strategies into the legislation? That’s the basis of my thesis.”

Understanding the technological limitations

Adrian’s IT background formed the impetus for his appointment as national director of e-commerce for Gadens, which he describes as “a natural progression, really. I had the background and the honours law degree, and because I was doing the PhD I had done all this research and writing on the subject anyway, so when Gadens were looking around for someone to fill the position, they said ‘you’re it!’” Another important position Adrian holds is his role as the sole lawyer on the Standards Australia Technical Committee IT 12/4/1. “The committee is developing technical standards for public key infrastructure,” he explains. “Basically we’re concerned about the infrastructure upon which digital signatures are going to be very much dependent. What the standards deal with are what types of algorithms will be acceptable, what types of certificates will be required, the registration procedures and certification that authorities need to comply with. Really it’s setting the technological framework for public key infrastructure so we can implement digital-signature mechanisms. I’ve been involved in that for three years.”

Returning to the subject of his PhD, Adrian emphasises that the marriage between technology and law is an effort on his part to show where the two disciplines intersect and are interdependent.

“What I’m really trying to show is that in order to understand where the law fits into e-commerce, you need to understand the limitations of the technology. Then you can develop appropriate policies to support where it doesn’t cover these or at least take a procedural approach so you can be aware of the limitations; this should be the role of government, in that one of government’s regulatory analysis roles is to support commerce and society in understanding what the procedures are, what the limitations, are conducting risk analyses and so on.”

Double difficulty for government regulation

Adrian emphasises that conducting this research has led to a continual development in his approach to the issues.

“When I started the PhD it was more of an information gathering exercise, but I think now as I’ve developed greater skills through doing the research it’s become more trying to determine, through talking to the techno people, exactly where the technological and legal limitations are. We need to determine where the law should step in and conversely where it should step out.”

He points out that in this regard, self-regulatory mechanisms are very important – and sees a two-fold difficulty for the government.

“The first difficulty is that governments by their sheer nature are not in a position to react quickly. This is because governments do not alone make laws – parliament makes laws. And in parliament you of necessity have a government and an opposition and before you can pass laws you need to conduct a lot of debate. And some laws become very contentious – for example, those concerning content regulation of the internet. This has taken a lot of to-ing and fro-ing regarding what the final shape of the law is going to be. In this regard the workings of the Internet Industry Association of Australia and its executive director Peter Coroneos have been absolutely tremendous in being able to move the agenda along a very rational approach.”

Adrian says one of the new regulatory approaches starting to be adopted by government is the establishment of commissions of authority such as the ACCC, ASIC and APRA. This approach is not unique to Australia but is being used in many jurisdictions so as to keep pace with the ever-changing nature of society and commerce.

“A commission of authority will regulate and propagate rules associated with that particular industry or issue and, unlike government, these groups can react very quickly. That’s firstly because they’re less bogged down in bureaucracy (although some would disagree!) and secondly because, usually when they go into research or investigation of a particular area they can hire experts in that fields so as to get a better understanding of the emerging industry or approach.

“Therefore they can be not necessarily proactive but at least less reactive, because they can react quickly. A clear example is the role of ASIC (Australian Securities and Investments Commission). They dealt with the continued use of putting prospectuses on the internet by releasing policy statements on the subject. Now, there were no specific laws regarding this, and if parliament had had to deal with it there would have been a great time lag, but ASIC by its nature as commission of authority was able to introduce policy statement 107 and other mechanisms to regulate the publishing of prospectuses in a far quicker time frame.”

And the second difficulty with governments? Adrian explains: “Most do not have close associations with other governments across the world because of their limited time frame – they get voted in, get voted out, and can’t really build up relationships because that takes time. The commissions on the other hand, once established, are much more permanent and can therefore build long-term relationships with other authorities in other jurisdictions.

“The whole framework of dealing with e-commerce is such that down the line I would not be surprised either if one of the regulatory authorities is given the role of regulating e-commerce or it becomes such a pervasive form of doing business that the government actually sets up an e-commerce commission.”

Importance of government lobbying

“The difficulty of e-commerce is that it actually transgresses multiple regulatory authorities,” Adrian adds. “If you are dealing with electronic cash or payments systems, for example, you fall within the regulatory ambit of the Reserve Bank because they have control of the Payment Systems Regulations Act. If you’re dealing with prudential aspects, life insurance, etc you fall within APRA’s ambit. If you’re dealing with consumer issues you fall within the ACCC. How you balance whether one authority should have full control over it or not is something which really the government has yet to address. You might get certain situations arising whereby an event covers both organisations, in which case you would have two regulatory authorities investigating the same event which would obviously be a waste of resources. So you have to find the balance.”

Adrian points out that in this regard the role of the IIA and similar organisations is very important. As he explains, “Since around the early 1990s, political parties in this country have not developed their policies internally – unfortunately in Australia I don’t know of any departments of government at universities that have investigated this trend or done any in-depth research in this area. But in the US, university research has been done and it’s been noted that up till the mid 1970s, political parties used to develop their own policies internally. From the 1970s on there was the rise of lobby groups and they would develop particular agendas, present them to governments and try to persuade them to say ‘this is the way we think it should roll out’. Then the political parties would do their own private polling to identify whether the political environment was for or against this particular issue. This is now occurring in Australia. The role of the IIA and other organisations is very influential in providing guidance for government to say this is the way it should go. Some of the larger banking and mining organisations have been using this mechanism as a form of lobbying advancement for some time.”

Influence of the internet

Like many in the legal profession, Adrian’s way of conducting business has been dramatically influenced by the rise of the internet. In fact, in his position as an e-commerce lawyer, the medium determines the whole nature of his work. As he puts it: “If I was, say, a construction lawyer, I would mainly be concerned with the issues here in Queensland from the point of view of how they affect my clients and my business. But being an e-commerce attorney I have to be aware of what’s occurring in Europe, Southeast Asia and the US – a clear example of this is that I actually start work at 5.30 every morning because I liaise with lawyers in New York, LA, Chicago, London, Brussels and Southeast Asia. In order to make sure we can make the same timeframes, you need to be flexible in this regard. You need to be aware of what’s occurring throughout the world.”

“Recently a French court has said to a very large portal that they are breaching French law because they are promoting the sale of Nazi paraphernalia. This raises all kinds of cross-jurisdictional issues. Where is it going to end? It raises the issue of what impact the laws have on my clients who are promoting goods from Australia. Are they in actual fact offending any other jurisdictions’ laws, and how do we structure their websites to minimise liability? You need to now cast your net far wider. I in fact need to know, at least in part, French law.

“In the final analysis, the internet is forcing us not necessarily to get law degrees for other jurisdictions but at least to be aware of the issues associated with those jurisdictions. It creates a greater burden upon lawyers.”

The e-business future

Perhaps the web-like cross-jurisdictional paths of the e-business world could be eliminated by worldwide unity, like the one-world-governments favoured in utopian novels. Adrian shrugs this off as unlikely, but comments, “Well, then again, who would have thought that the European Commission would become the European Community would become the European Parliament, and who could have foreseen the creation of the single currency Euro?

“What I do think is that the US dollar will survive, the Euro will survive and there may be one or two others.

“Depending on how influential China becomes in Southeast Asia, the Chinese currency will be the third, and I also think there will be a universal currency which will be some sort of e-payment mechanism. In choosing the Chinese currency I am not necessarily discounting either the Indian rupee or the Russian ruble, but their economies I think are not strong enough to withstand the power of those other three currencies. So I don’t think the Aussie dollar will survive … I think we will actually become a US dollar country … so there will be a great currency change.

“As for laws, I think you will find that there will be a greater emphasis (and we’re seeing this now) on the UN to produce more uniform laws such that countries can pick them up more easily and so that there is a uniform approach across many jurisdictions. That is certainly the position with laws on e-commerce, the UNCITRAL (UN-based) position on e-commerce. The UN involvement in international trade laws will increase and its role will be to make sure there’s uniformity.”


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s