Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1696591558004.pdf (Vanuatu)
Government of Vanuatu ICT Policy Framework Draft National ICT Policy Framework for For Consultation February 2021 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Table Of Contents ICT POLICY AND THE NATIONAL SUSTAINABLE DEVELOPMENT PLAN INTRODUCTION 1 1.1 1.2 RATIONALE FOR REVIEW 1.3 POLICY DIMENSIONS 1.4 CHALLENGES 1.5 COMMITMENT AND REVIEW 1.6 STRUCTURE OF THIS POLICY FRAMEWORK DOCUMENT 2 NATIONAL ICT VISION 3 SITUATIONAL ANALYSIS 4 FRAMEWORK GUIDELINES 4.1 GUIDELINES 4.2 CONSTITUTIONAL PRINCIPLES AND VALUES 4.3 LEGISLATIVE CONTEXT AND COMPLIANCE 4.4 PRIORITISATION OF NATIONAL INVESTMENTS 5 POLICY FRAMEWORK IN CONTEXT 5.1 EXISTING POLICY INSTRUMENTS UNIVERSAL ACCESS OPEN DATA DATA PROTECTION SOVEREIGNTY 5.2 POLICY OWNERSHIP REGULATORY OVERSIGHT RELEVANCE 6 ACCESS POLICIES 6.1 POLICY OBJECTIVES 6.2 OPEN ACCESS ARCHITECTURE RIGHTS OF WAY (WAY LEAVE) BROADCAST SIGNAL DISTRIBUTION COMPLEMENTARY INFRASTRUCTURE 6.3 DISASTER MANAGEMENT 6.4 INCLUSIVITY AND DIGITAL LITERACY INFRASTRUCTURE POLICIES 7 7.1 SHARING NATIONAL INFRASTRUCTURE 7.2 7.3 INFRASTRUCTURE PARTNERSHIPS FOR DEPLOYMENT AND SUSTAINABILITY GOVERNMENT FIBRE NETWORK INNOVATION AND IP TRAFFIC DEVELOPMENT MOBILE AND DIGITAL PAYMENTS DIGITAL IDENTITY, VERIFICATION AND VALIDATION LOCALISATION AND DOMAIN NAME POLICY LOCAL CONTENT 7.4 CRITICAL NATIONAL INFRASTRUCTURE Draft v0.95 – For Committee Review & Consultation Page 2 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft CNI RESILIENCE PROVISIONS GOVERNMENT DATA CENTRES DATA SOVEREIGNTY DISASTER-RESILIENT COMMUNICATIONS VANUATU INTERNET EXCHANGE 8 DATA POLICIES 8.1 POLICY OBJECTIVES 8.2 ACCESS TO INFORMATION 8.3 NATIONAL DATA MODEL 8.4 NATIONAL PROJECT DATA RESOURCE (NPDR) 9 SECURITY POLICIES 9.1 POLICY OBJECTIVES 9.2 CYBER SECURITY 9.3 RESPONSIBLE INTERNET USE 9.4 CHILD ONLINE PROTECTION 9.5 9.6 SECURITY OF CRITICAL NATIONAL INFRASTRUCTURE INTERNATIONAL
 COOPERATION NATIONAL DATA SECURITY SERVICE PROVIDER SECURITY OBLIGATIONS INFORMATION PRIVACY AND SECURITY 9.7 10 KNOWLEDGE ECONOMY AND INNOVATION POLICIES 10.1 POLICY OBJECTIVES 10.2 TRANSFORMATION OBJECTIVES FOR THE KNOWLEDGE ECONOMY KNOWLEDGE ECONOMY ECOSYSTEM HUMAN RESOURCE DEVELOPMENT 10.3 ELECTRONIC COMMERCE LEGAL REFORMS SUPPORTING E-COMMERCE DIGITAL PAYMENTS DIGITAL IDENTITY INTERMEDIARIES AND CONTRACT LAW IN DIGITAL TRANSACTIONS DIGITAL TRANSACTION RISK AND OPPORTUNITY 11 E-GOVERNMENT POLICIES 11.1 POLICY OBJECTIVES 11.2 E-GOVERNMENT SERVICE DELIVERY DIGITAL FIRST INVESTMENT EVALUATION AND PRIORITISATION 11.3 SMART ISLANDS INTERACTION AND COLLABORATION SERVICES CATALOGUE 11.4 OPEN ACCESS AND COMPETITIVENESS OPEN ACCESS OPEN COMPETITION 11.5 E-GOV TECHNOLOGY ARCHITECTURE AND STANDARDS OPEN STANDARDS REUSABLE CORE PROCESSES NATIONAL DATA MODEL Draft v0.95 – For Committee Review & Consultation Page 3 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft USER EXPERIENCE DESIGN GUIDELINES MINISTERIAL RESPONSIBILITIES 12 E-ENVIRONMENT POLICIES 12.1 POLICY OBJECTIVES 13 RADIO FREQUENCY SPECTRUM POLICIES 13.1 POLICY OBJECTIVES 13.2 5G SPECTRUM 14 COMPETITION POLICIES 14.1 POLICY OBJECTIVES 14.2 OPEN COMPETITION 14.3 NET NEUTRALITY – OPEN COMPETITION 15 CONSUMER PROTECTION POLICIES 15.1 POLICY OBJECTIVES 15.2 LEGISLATION AND REGULATION NET NEUTRALITY – RESPONSIBILITY OF CARRIERS NET NEUTRALITY – OWNERS AND USERS OF INTELLECTUAL PROPERTY NET NEUTRALITY – FRAMEWORK LEGISLATION CONSUMER PROTECTION LAW PROTECTION OF PERSONAL DATA PROTECTION OF THE CHILD INTERNATIONAL COOPERATION 15.3 15.4 CODES OF PRACTICE 15.5 CONTRACT TERMS – FRAMEWORK LEGISLATION 15.6 NO BARRIERS TO USE 16 EXTERNAL COLLABORATION POLICIES 16.1 POLICY OBJECTIVES 16.2 GLOBAL CITIZENSHIP 16.3 CONTRIBUTING TO THE INTERNATIONAL AGENDA 16.4 REGIONAL
 ICT CHAMPION 17 CONTENT AND APPLICATIONS DEVELOPMENT POLICIES 17.1 POLICY OBJECTIVES 17.2 BUY VERSUS BUILD PROTOTYPING CUSTOMISATION AND CONFIGURATION 17.3 RELEASE MANAGEMENT 17.4 WORKFLOW 17.5 SINGLE SIGN-ON 17.6 HIGH-LEVEL DESIGN GUIDELINES FOR ESERVICES AND WEB PRESENCE 17.7 OPEN DOCUMENT FORMAT 17.8 SOCIAL MEDIA 18 FULFILLMENT POLICIES 18.1 POLICY OBJECTIVES Draft v0.95 – For Committee Review & Consultation Page 4 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 18.2 POSTAL/COURIER OPERATIONS AND SERVICE OBLIGATIONS 18.3 ESTABLISHMENT OF A NATIONAL ADDRESS PROTOCOL (NAP) 18.4 REGULATORY OVERSIGHT 19 DEVICE POLICIES 19.1 POLICY OBJECTIVES 19.2 BRING YOUR OWN DEVICE 19.3 VIRTUALISATION AND THE GOVERNMENT CLOUD 19.4 API ECOSYSTEM 20 POLICY OWNERSHIP AND STAKEHOLDERS 20.1 MINISTERIAL RESPONSIBILITY 20.2 OFFICE OF THE GOVERNMENT CHIEF INFORMATION OFFICER (OGCIO) 20.3 BUSINESS STAKEHOLDERS 20.4 CIVIL SOCIETY STAKEHOLDERS 20.5 DEVELOPMENT PARTNERS 20.6 20.7 GOVERNMENT ORGANISATIONS ICT CAPACITY DEVELOPMENT, STANDARDS OWNERSHIP, AND PROFESSIONAL BODIES MINISTRIES AND AGENCIES OTHER GOVERNMENT ORGANISATIONS 20.8 REGULATORY PROVISIONS TELECOMMUNICATIONS AND RADIOCOMMUNICATIONS REGULATOR INFORMATION COMMISSIONER IDENTITY MANAGEMENT - PROPOSED E-COMMERCE AND FINANCIAL - PROPOSED INTERNATIONAL STAKEHOLDER ORGANISATIONS ASIA-PACIFIC NETWORK INFORMATION CENTRE (APNIC) WORLD-WIDE WEB CONSORTIUM (W3C) 20.9 21 MONITORING AND EVALUATION 21.1 POLICY OBJECTIVES 21.2 PROJECT METRICS 21.3 EXPANDED NSDP INDICATORS Draft v0.95 – For Committee Review & Consultation Page 5 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft APPENDIX A: TERMS AND ACRONYMS APPENDIX B: DRAFT STAKEHOLDER ENGAGEMENT AND CONSULTATION PROCESS APPENDIX C: UK
 HEALTH AND SOCIAL CARE DATA PRINCIPLES APPENDIX D: AGE-APPROPRIATE DESIGN – UK CODE OF PRACTICE APPENDIX E: ASPI ASSESSMENT OF E-GOVERNMENT CAPABILITIES APPENDIX F: FURTHER READING 102 105 106 108 110 112 Draft v0.95 – For Committee Review & Consultation Page 6 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Policy Recommendations Policy Recommendation 1 – Open Access Architecture ................................................................................ 22 Policy Recommendation 2 – Rights of Way ................................................................................................... 22 Policy Recommendation 3 – Disaster Preparedness and Management ......................................................... 23 Policy Recommendation 4 – Avoidance of Single Point of Failure in CNI Design ............................................ 23 Policy Recommendation 5 – Baseline Digital Inclusivity and Literacy Assessment ......................................... 25 Policy Recommendation 6 – Infrastructure Sharing ...................................................................................... 27 Policy Recommendation 7 – Infrastructure Development ............................................................................. 28 Policy Recommendation 8 – Infrastructure Deployment and Sustainability .................................................. 28 Policy Recommendation 9 – Partnership/Outsourcing of Government Operations ....................................... 29 Policy Recommendation 10 – IP Traffic Development & Monitoring ............................................................. 29 Policy Recommendation 11 – Promotion of Mobile and Digital Payment Architecture ................................. 30 Policy Recommendation 12 – Biometric Digital Identity ............................................................................... 31 Policy Recommendation 13 – Localisation and Domain Name
 ...................................................................... 31 Policy Recommendation 14 – Critical National Infrastructure - Designation ................................................. 32 Policy Recommendation 15 – Critical National Infrastructure - Security ....................................................... 33 Policy Recommendation 16 – Data Centre Virtualisation and Government Cloud ......................................... 34 Policy Recommendation 17 – Data Sovereignty ............................................................................................ 35 Policy Recommendation 18 – Disaster-Resilient Communications ................................................................ 35 Policy Recommendation 19 – Internet Exchange Points ............................................................................... 36 Policy Recommendation 20 – National Data Model ...................................................................................... 38 Policy Recommendation 21 – National Project Data Resource ...................................................................... 39 Policy Recommendation 22 – Responsible Internet Use Policy ..................................................................... 42 Policy Recommendation 23 – Consultation on Child Online Protection ........................................................ 42 Policy Recommendation 24 – International Cooperation Policy .................................................................... 43 Policy Recommendation 25 – National Information Security and CNI Policies .............................................. 44 Policy Recommendation 26 – Revisions to the Official Secrets Act ............................................................... 44 Policy Recommendation 27 – Information Privacy and Security Legislation .................................................. 46 Policy Recommendation 28 – Vanuatu Knowledge Economy and Innovation Partnership
 ............................ 48 Policy Recommendation 29 – Knowledge Economy Ecosystem .................................................................... 49 Policy Recommendation 30 – Public Awareness – ICT HR Initiatives ............................................................. 51 Policy Recommendation 31 – Digital Literacy in Education ........................................................................... 51 Policy Recommendation 32 – Government Innovation Partnership Fund ..................................................... 52 Policy Recommendation 33 – Framework Legislation for Reform ................................................................. 54 Policy Recommendation 34 – Digital Payment Regulations – VFSC ............................................................... 54 Policy Recommendation 35 – Digital Identity and Authentication ................................................................ 56 Policy Recommendation 36 – Intermediaries and Contract Law in Digital Transactions ................................ 56 Policy Recommendation 37 – Public Awareness – Digital Transactions ......................................................... 57 Policy Recommendation 38 – Digital-First By Default ................................................................................... 59 Policy Recommendation 39 – Mandatory ICT Investment Evaluation.
.......................................................... 59 Policy Recommendation 40 – Services Catalogue Development ................................................................... 61 Policy Recommendation 41 – Open Standards in Procurement .................................................................... 62 Policy Recommendation 42 – Open Standards in Technology ....................................................................... 63 Policy Recommendation 43 – Reusable Code and Processes ......................................................................... 63 Policy Recommendation 44 – Data Visualisation .......................................................................................... 63 Policy Recommendation 45 – e-Environment and Green ICT ........................................................................ 65 Policy Recommendation 46 – 5G Policy ........................................................................................................ 67 Policy Recommendation 47 – Promoting Competition .................................................................................. 69 Policy Recommendation 48 – Open and Fair Competition ............................................................................ 69 Policy Recommendation 49 – Net Neutrality (Competition) ......................................................................... 70 Policy Recommendation 50 – Carrier Responsibilities .................................................................................. 72 Policy Recommendation 51 – Social Media Education Policy ........................................................................ 73 Policy Recommendation 52 – Net Neutrality – Framework Legislation ......................................................... 74 Policy Recommendation 53 – GDPR Compliance .......................................................................................... 75 Policy Recommendation 54 – Contract Terms – Framework Legislation ........................................................ 76 Policy Recommendation 55 – Differently-Abled – No Barriers to Use ........................................................... 76 Draft v0.95 – For Committee Review & Consultation Page 7 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Policy Recommendation 56 – International ICT Agenda, Contribution and Compliance ................................ 78 Policy Recommendation 57 – Regional ICT Champion .................................................................................. 78 Policy Recommendation 58 – Prototyping .................................................................................................... 80 Policy Recommendation 58 – Release Management .................................................................................... 81 Policy Recommendation 58 – Workflow Management ................................................................................. 83 Policy Recommendation 58 – Social Media Policy – Individual Responsibilities ............................................ 86 Policy Recommendation 59 – National Address Protocol.............................................................................. 88 Policy Recommendation 60 – Regulation of Postal Services ......................................................................... 89 Policy Recommendation 61 – SaaS Application Usage .................................................................................. 91 Policy Recommendation 62 – Virtualisation ................................................................................................. 91 Policy Recommendation 63 – Cloud-First Solution Provisioning .................................................................... 92 Policy Recommendation 64 – API Framework .............................................................................................. 93 Policy Recommendation 65 – Executive Sponsorship ................................................................................... 94 Policy Recommendation 66 – Evolution of OGCIO ........................................................................................ 95 Policy Recommendation 67 – Project Metrics ............................................................................................ 100 Policy Recommendation 68 – Evolution of NSDP Pillar and Goal Indicators ................................................ 101 Figures Figure 1 - Policy Dimensions ......................................................................................................................... 10 Figure 2 - NSDP Vision .................................................................................................................................. 13 Figure 3 – Core Platform Scope – National ICT Policy Framework ................................................................. 17 Figure 3 – Responsible State Behaviour in Cyberspace ................................................................................. 77 Figure 4 – API Framework Controller Model ................................................................................................. 93 Figure 5 - Value-Add Data Journey ............................................................................................................... 99 Figure 6 - IAP2 Model For Public Participation ............................................................................................ 105 Disclaimer The findings, interpretations, and conclusions expressed in this draft policy document are entirely those of the author.
They have not been subject to stakeholder consultation and do not necessarily represent the views of the Government of Vanuatu, its affiliated organisations, or those of any individual or the organisations they may represent.

Where information is noted as being not available, this is despite all reasonable endeavours having been used to access information in the public domain for the preparation of the document.
Draft v0.95 – For Committee Review & Consultation Page 8 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 1 INTRODUCTION 1.1 1.

2.

ICT Policy and the National Sustainable Development Plan The National ICT Policy Framework, presented in draft for consultation in this document, is intrinsically linked with the Vanuatu National Sustainable Development Plan (NSDP) 2030.
This document should not be construed as being any form of “separate” ICT policy, instead the entire rationale of this document is to progress the efforts of the wider ICT sector (both public and private) and developments in technology toward achievement of NSDP outcomes.

Each section of this policy framework document sets out specific links to pillars, goals and national policy objectives for ease of reference.

1.2 Rationale For Review 3.

4.


The revised National ICT Policy Framework for Vanuatu, as set out in this consultation document arises from the necessity to refresh and update the existing national policy (prepared in 2013).

This precursor document was developed when ICT was far less pervasive in society as a whole, and in its use across Government in particular.
Since then, advances in technology and communication have transformed the ways in which citizens use ICT, their expectations in terms of services and how these can be delivered.

The increasing maturity of ICT convergence 1 means that the National ICT Policy Framework must address a wider range of subject matter than ever before.
The topics addressed by this Framework are concatenated into themes within which subsidiary (and complementary) policies will be formulated within four broad dimensions 1.3 Policy Dimensions 5.

The National ICT Policy Framework consists of a number of strategic objectives woven throughout this document that address four key policy dimensions as set out in the model below2.
1 Boundaries that previously existed between separate ICT services (computing technology, networks, media/content and business operations) have largely eroded.

2 The model is an adaptation of the Estonian X-Road implementation dimensions.

Draft v0.95 – For Committee Review & Consultation Page 9 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Figure 1 - Policy Dimensions 6.

7.

Organisation – shows the stakeholders and ownerships relevant to this strategy framework.
Executive sponsorship at the highest levels of Government is evident, with the Prime Minister having responsibility for the ICT portfolio, supported by the Office of the Government Chief Information Officer (OGCIO).

Legal – there are some significant challenges in terms of the legal framework for ICT, both current and future.
Although some useful work has been undertaken with the recent promulgation of a Cybercrime Bill, a great deal more remains to be done however in order that the nation has a robust and appropriate set of legal foundations upon which digital transaction and e-Government transformation policies can be built.

8.
Fiscal – at the strategic level of economic development, significant opportunities for policy enhancement exist, such as: a) future policies addressing economic development policy that focus on infrastructure for sustainable “knowledge enhancement” (rather than simply job-creation) to ensure that Vanuatu becomes a magnet for knowledge-based companies in the region; b) regulation3 and taxation regimes that promote information and knowledge trading at international levels, looking toward future knowledge-based economic development rather than traditional industries; and, c) market stimulation and development policies arising from new forms of collaboration4 and participation across national boundaries using electronic methods.
9.

Technical Architecture – Government has made progress in supporting the development of a nationwide ICT architecture, primarily with its established Universal Access Policy, overseen by the Telecommunications, Radiocommunications and 3 Initiatives being put forward by the World Intellectual Property Organisation (WIPO) in the harmonisation of copyright legislation for online media, materials and markets is a good example of this.
4 Several AU and WB programs now focus upon market development and international collaboration (rather than products) Draft v0.95 – For Committee Review & Consultation Page 10 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Broadcasting Regulator and deployment of fibre network connections to a large number of Government offices.
In the future, investment policies (probably supported by donors and using public-private partnership delivery methods) will focus upon expanding the scale, scope, and functionality of critical national infrastructure (CNI).

1.4 Challenges 10.

Tactically, the ability of Government to make and receive payments by electronic means is embryonic.
Further attention to the establishment of robust operational and regulatory policies and guidelines will be necessary to build customer/citizen confidence and to develop reliance on digital payment mechanisms.

Furthermore, financial and digital literacy levels are to be addressed, the inclusion of disadvantaged members of society will be an explicit aim of Government policies in this area.

11.

The key challenges facing policy makers are: a) it is difficult for Government to “go it alone”.
Stakeholders, especially businesses, employees, and citizens need to see benefits for policy initiatives to succeed.

Equally, Government has a significant influence on the national market for services and technology arising from its geographical coverage, process scope, financial resources and international relations.
Both of these perspectives must be suitably balanced for policies to be effective; b) recognition and reward systems may not sufficiently apportion the contributions of key individuals or organisations, as they are intrinsically linked to performance measures of current (traditional) economic models; and, c) standard metrics such as return on investment or return on capital employed are calculated using accounting methods, omitting indicators that recognise contributions to knowledge economy performance.
The implication of this is that investments in knowledge enhancing activities need strong advocates at senior levels to properly recognise these contributions.

12.

The inherent complexity and pace of evolution of ICT are both well-known and it is inevitable that Vanuatu may not always have sufficient resources or experience to address key strategy or policy issues without assistance from its partners, neighbours and friends.
Government will address these issues in two ways: a) by ensuring that Vanuatu has a voice in the variety of international fora where technical standards are set, ICT ethics are debated, or agreements are made; and, Draft v0.95 – For Committee Review & Consultation Page 11 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft b) explicitly seeking to learn from the experiences of others.
In particular, Government will actively look to harness examples of good ICT practices from other economies5 and adapt them to the specific local and regional context.

13.

In proposing these strategic framework directions and objectives, Government seeks to balance the obligations and strictures imposed by a relatively light-touch regulatory regime 6 with the compliance requirement costs (to public and private sector operations alike) in as pragmatic a manner as possible.

1.5 Commitment and Review 14.


Government is committed to a program of digital transformation, whereby increasing efficiencies and effectiveness of Government services will be promoted by harnessing digital delivery mechanisms wherever possible.

Access to these services will be provided in ways that align with how citizens, businesses, and other civil-society stakeholders wish to consume them.

15.

ICT policy in particular cannot remain static.


It will be subject to continuous changes as expectations and demands from users mature.

Design and use of e-government programs must therefore continue to evolve, with continuous reviews of technical, regulatory and societal relevance.

1.6 Structure of this Policy Framework Document 16.
The document starts with re-affirmation of the national vision for ICT, and how technology-enablement will support progress toward NSDP outcomes (Section 2) followed by a brief situational analysis (Section 3).

17.

A precis of the policy principles is provided at Section 4, followed by a summary of policy areas and the context addressed by this framework document at Section 5.

18.
18.

Policy framework areas are then expanded upon in a series of logically grouped themes set out in Sections 6 to 19 where specific policy recommendations are also made.

19.
19.

The document concludes with some commentary concerning policy ownership responsibilities and stakeholder consultation proposals (Section 20) along with proposed monitoring and evaluation arrangements (Section 21) 5 This document includes examples of good practice from Australia, Estonia, and the United Kingdom amongst others that are proposed for localisation and adoption.
6 Much legislative and regulatory work remains to be done, however in general Government recognises technology as an imperative, rather than a threat, and that it offers many opportunities where leading in key areas will sooner or later be transformed into more visible forms of national and societal benefits.

The overall approach to legislation and regulatory development will therefore be characterised as enabling and empowering rather than preventative or restraining wherever possible.
Draft v0.95 – For Committee Review & Consultation Page 12 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 2 NATIONAL ICT VISION 20.

The National ICT Policy Framework is formulated in direct support of the National Vision, as summarised in the National Sustainable Development Plan 2030 Figure 2 - NSDP Vision 21.

This framework summarises and contextualises a large range of more closely focussed policy interventions and implementations that will be made by Government.

22.
22.

The following sections provide a situational analysis summary of the “as-is” environment, set out the context of the range of ICT-related policies considered, and provide additional details of policy objectives and directions relevant to a broad range of ICT-related topics.

Draft v0.95 – For Committee Review & Consultation Page 13 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 3 SITUATIONAL ANALYSIS 23.
Policy documents routinely contain commentary upon the effect of technology upon the ways in which Government conducts its interactions, and how these interactions are being shaped by rapid developments in technological capabilities.
Aside from these challenges alone, this policy review is being prepared during a pandemic unprecedented in living memory, which is accelerating yet further the dramatic shifts in global economic conditions and how transactions in both public and private sectors are changing with advances in technology.

24.
24.

Among the side-effects of COVID disruptions are the fuelling of innovation and the uptake of e-enabled processes in all spheres of life, with some reports indicating that the equivalent of five-years’ worth of digital adoption could have been achieved within an eight-week period in mid-2020 alone 7 .

The pace of change poses real risks, exacerbating the existing vulnerabilities of disadvantaged citizens, leaving them even further behind.

25.
25.

Opportunities to be exploited via direct use of digital means are considered throughout this policy document.

There are also however some indirect opportunities which the Government may also choose to pursue, principally the “digital nomad” passport examples (from Estonia and Barbados in particular), whereby working visas are made easily available for entrepreneurs and skilled individuals in the technology sector.

Policy-setting in this regard is outside the scope of this document, however.

26.
Government will favour policies that focus upon working in collaboration with (and in some circumstances also enabling) established private sector operators, new entrants, and development partner organisations to address the following key questions: a) how the public sector can best adapt to the “new normal” in terms of digital development; b) determining pragmatic and sustainable steps that can be taken optimise engagement with disadvantaged sections of the community; and, c) promoting approaches that minimise any unintentional digital exclusion in the implementation of Government policies.
27.

Climate resilient domestic fibre-optic networks and other related infrastructure on Efate and Santo provide middle and last mile connectivity between the internet landing station on Efate and end users (primarily Government facilities).

28.
28.

[Working in this area – additional content to add arising from consultation and review work] 7 Source –Global Survey of consumer sentiment during the coronavirus crisis – McKinsey – October 2020 (accessed 4th November 2020) Draft v0.95 – For Committee Review & Consultation Page 14 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 4 FRAMEWORK GUIDELINES 4.1 Guidelines 29.
The Government holds the following guidelines to be essential in the determination of its National ICT Policy Framework that will be derived during the consultation process: a) support for the principles, values and fundamental rights of the individual as set out in the Constitution; b) compliance with existing statute, and alignment with the National Sustainable Development Plan (NSDP); c) ownership at the highest levels of Government, by the people and for the people of Vanuatu; d) relevance will be continuously maintained by on-going reviews of the National ICT policy; e) policy components will be overseen by appropriate regulatory bodies, with monitoring and evaluation responsibilities along with expanded powers to order compliance, remediation or redress; f) universal access to services, across the nation, and including all citizens is a national priority; g) open access to communications services, data and information will be promoted wherever possible; and, h) it is the Governments role to lead by example, to be ambitious, set stretch- targets, and provide an environment within which innovation can flourish.
4.2 Constitutional Principles And Values 30.

The National ICT Policy will at all times maintain and sustain the Constitution of the Republic of Vanuatu and in particular the “fundamental rights and freedoms of the individual without discrimination on the grounds of race, place of origin, religious or traditional beliefs, political opinions, language or sex” 8.

4.3 Legislative Context and Compliance 31.


As enabled by the Constitution, the Government of the Republic of Vanuatu enacts legislation (primary law) and in some cases provides additional regulations (secondary law) that are used to clarify rules, practices, procedures etc.

8 Constitution of the Republic of Vanuatu 1980 (as revised) Chapter 2 - Parts 1 (Fundamental Rights), and 2 (Fundamental Duties).
Draft v0.95 – For Committee Review & Consultation Page 15 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 32.

This policy document sets out what the Government wishes to achieve for society as a whole in respect of framework ICT provisions and safeguards.

It is linked closely with the NSDP and with other pre-existing policies.
Implementation of the policies put forward within this framework may also result in further primary or secondary legislation being proposed wherever appropriate.

33.

Significant legislative work needs to be undertaken, as noted by a separate, complementary, document that focuses on the detail of legal issues and where challenges arise in the regulation of ICT-enabled processes.

Extracts from this work9 are included within this document for reference.

4.4 Prioritisation of National Investments 34.


Vanuatu is not provided with limitless resources for investment into ICT-related areas.

There are many competing priorities for scarce capital and recurrent budget commitments across the full spectrum of public services that Government must deliver in accordance with its mandate and in alignment with the NSDP.

35.
35.

Government recognises that commitment of public funds and effort must only be made once holistic and realistic assessment of detailed investment cases has been made10.

9 Vanuatu Legislative Review for ICT Policy Issues v60 – August 2020.

10 See Section 11.2.2 Draft v0.95 – For Committee Review & Consultation Page 16 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 5 POLICY FRAMEWORK IN CONTEXT 36.
The policy framework sets out cogent and coherent architectural designs for a core operating ecosystem where resources, technology and processes are equitably distributed, interoperability is promoted, and collegiate approach to shared objectives can be realised.

37.

Figure 3 (below) summarises the scope of the core operating ecosystem, as addressed by this policy framework document.
Digital Signature • Certificate Authorities and authentication Critical National Infrastructure • Disaster resilience • Reliability and perfomance Digital Identity • Encrypted biometric data, with matching algorythms and API-based validation.
• KYC and identity authentication services on-demand Data Visualisation • National Data Model • Correlation, mapping and consistencye accrss GoV data assets • Tools and visualisations using AI, data User Tools & Software • Government email, • Application development standards and compliance • Service provisioning @gov.vu Interoperable Services eServices Catalogue • • Reliability and perfomance • API data exchange Virtualised Data Centre • minin and advanced tools.
GIS • Geospatial data, physical addressing, cartography and digital mapping Links applications layers to Ministry level Security • Policy and compliance monitoring for security of CNI, data assets, end-user credentials 2FAC authentication for eServce access.

• • CERTVU Networking Physical Hardware Figure 3 – Core Platform Scope – National ICT Policy Framework 38.
For some components of this proposed ecosystem, primary ownership of data, collection processes, reporting and management is appropriate (Ministry of Lands for geospatial data, and Finance for receipting and payments, for example).

OGCIO will identify the proposed ownership of key data entities and work with the Ministry/Agency responsible to ensure that interoperability, and access to data are maintained, duplications reduced as far as practicable, multiple definitions/formats avoided.

39.
39.

Ministries and Agencies may be required to collaborate to provide key elements of this ecosystem (Ministries of Internal Affairs, and Health, for example, in respect of biometric registration) and the OGCIO shall provide “internal consultancy” support to promote joint ownership and pragmatic solution outcomes at all times.

40.
40.

It is explicitly not the intention of this framework to be prescriptive, whether positively or negatively, in respect of ICT support provisions or software applications specific to individual sectors, Ministries or Agencies.

Draft v0.95 – For Committee Review & Consultation Page 17 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 41.
Ministries and Agencies will retain the management of ICT software tools, support, capacity development and data as appropriate to their mandate and in line with eService delivery responsibilities.

5.1 Existing Policy Instruments Universal Access 42.

A Universal Access Policy (UAP) has been established within the purview of the Telecommunications, Radiocommunications and Broadcasting Regulator (TRBR).

Part 4 of the Act11 sets out specific provisions.

43.
43.

UAP is presently understood to mean “geographically ubiquitous”, with access to telecommunication connectivity across the whole of Vanuatu being the key outcome sought, however Future statutory UAP provisions will be amended to include Quality of Service (QoS) metrics.

At the time of preparation of this policy document, consultations were underway managed by TRBR.

44.
44.

This policy objective will be expanded in its remit to address the inclusivity of services, to enable all citizens to participate, contribute and benefit from digital service delivery and e-Government.

Open Data 45.

As distinct from UAP (above), and wherever possible, regulatory intervention will be founded upon the principles of open access, whereby source data, research, analysis or interpretive findings are made available for distribution free of cost or other access barriers.

46.
46.

Clearly the dual provisions of personal data protection and the duty of care that Government has to safeguard the security of the nation cannot be overridden by open access.

47.

In all other cases however the default position of legislation and regulation should be to permit/support legitimate access to data (pre-analysis) and information (post the analysis process) in all areas where it cannot be disaggregated to identify individuals or impinge upon protections enshrined in the Constitution.
Data Protection 48.

Vanuatu does not presently enjoy a high-level of personal data protections nor is there a duty of care on the part of service providers to safeguard information that a person may regard as being personal or otherwise sensitive.

The European Union cites Vanuatu as one of the countries with whom data cannot be shared openly for this reason.
11 Established by the Telecommunications, Radiocommunications and Broadcasting Regulations Act (30 od 2009) – as amended to 2018 Draft v0.95 – For Committee Review & Consultation Page 18 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 49.

Government will therefore put forward reforms to its existing legal instruments12 that address these data issues and provide its citizens with protection that is as good as the best examples of international good-practice.
Furthermore, a regulatory body shall be constituted that will assume responsibility for standards, compliance and the safeguarding of data of all types13.

Sovereignty 50.

Vanuatu is committed to being a reliable international partner with undisputable integrity in the collection and sharing of data to support all manner of environmental, public health, education and economic information.

51.

Data about the nation of Vanuatu however belongs to the nation.
To ensure that all such data is accessible to citizens, businesses and Government, a central data repository will be provided by Government into which all data collected about the nation, its citizens, and activities must be contributed.

52.

For the avoidance of doubt, all Ministries and donors will be required to specifically reference central national storage of data, and access to any reports, findings, recommendations etc.

will be maintained by a national digital archivist.

5.2 Policy Ownership 53.


The Minister responsible for ICT shall own this policy and is charged with responsibility for on-going monitoring to ensure relevance, compliance and coherence.

54.

The Office of the Government CIO (OGCIO) shall act as the secretariat for all matters relating to this policy as well as providing requisite liaison between other legislative and regulatory bodies or initiatives as may be required.

Regulatory Oversight 55.


The Telecommunications, Radiocommunications and Broadcasting Regulator (TRBR) has already been established, with oversight provisions specific to certain ICT and technology components of Government policy (particularly Universal Access).

Part 4 of the Act14 sets out specific provisions in this regard.

56.
56.

Further regulatory oversight may be preferred (see also Section 20.8) as the primary means of exercising balanced and objective control of how specific thematic areas of National ICT policy are implemented and managed.

57.

It is probable that key policy themes may be supported by new regulatory provisions (Acts, bodies etc.).
These themes include: 12 Primarily the Right To Information Act (No.13 of 2016 – as amended) and the Electronic Transactions Act (Cap 263) 13 This may include GDPR-compliant legislation, and restrictions on the use of traffic-tracking and personal behaviour/marketing using cookies and other technologies without explicit user consent 14 Established by the Telecommunications, Radiocommunications and Broadcasting Regulations Act (30 od 2009) – as amended to 2018 Draft v0.95 – For Committee Review & Consultation Page 19 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft a) Fulfilment (postal/courier services, a national address protocol etc.
); b) Data Management (security of personal data, access to and sharing of data intra- and inter-country, data standards etc.

); and, c) provisions for the safety, security and interoperability of Digital Identity.

58.

Repurposing of some existing regulatory or oversight bodies may be necessary to include digital delivery mechanisms (such as electronic money, stored value devices/technologies etc.)

which could be addressed as part of the responsibilities of the Reserve Bank of Vanuatu, for example.
Relevance 59.

The National ICT Policy will be reviewed every 5 years (at maximum) and may be amended in whole or in part whenever necessary to embrace opportunities arising from specific developments in technology, consumer behaviour, communications, media/content or service delivery.

60.
60.

Alterations may also arise from recommendations made by Regulatory bodies, who are to be encouraged to participate in transparent and wide-ranging consultations when establishing guidelines, rules, or regulations within their purview.

Draft v0.95 – For Committee Review & Consultation Page 20 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 6 ACCESS POLICIES 6.1 Policy Objectives 61.
Policy Objectives for access to national ICT infrastructure are to: a) provide open infrastructure access to enhance service delivery to all stakeholders with special emphasis on governance, health and educational institutions, and marginalised sections of the population;; b) promote equitable sharing of natural sites, rights of way, physical infrastructure and co-location of ICT facilities by licensed operators based on technical and commercial considerations; c) include disaster management planning dimensions within all infrastructure deployments, to maintain access during adverse weather and natural disaster conditions as far as possible; and, d) promote inclusivity, access for all to the benefits of ICT usage, regardless of social background, ability, or location.
62.

These policies support NSDP objectives SOC 2.1, 4.5, 4.8, 4.9 as well as ENV 1.4, 2.1, and ECO 2.9.

63.

It should be noted that the Universal Access Policy of Government is set out in a separate policy document.

Regulatory oversight for this is provided by TRBR, as established by an Act15 of Parliament.
This National ICT Strategy Framework does not supplant these provisions: it is complementary in that enhances consideration of Government ICT services and citizen engagement that will be deployed over the access networks developed within the remit of the UAP policy.

6.2 Open Access Architecture16 64.

Broadband penetration across Vanuatu (particularly outside the main urban areas) is relatively low by international standards.
Promoting growth in this areas is an important part of national policy, applying equally to government, business, and citizen stakeholders.

65.

The objectives of an open access environment that is both sustainable and enforceable are to promote equal opportunity for technologies, services and stakeholders.
These policy proposals support the creation of a fair and competitive environment, particularly enabling service-based competition and open access to infrastructure 15 The Telecommunications and Radiocommunications Regulation Act (N0.

30 of 2009), as amended.


16 See also Open Data Policy (Section 5.1.2) Draft v0.95 – For Committee Review & Consultation Page 21 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft supported public investment and joint-venture arrangements with private sector organisations.

66.

The policy aims to balance open access requirements with a pragmatic understanding of investment priorities that are essential for last-mile connectivity.
Investors in last- mile connectivity and service provisions will be encouraged by means of risk/reward sharing models and on-going enhancement of the Universal Access Policy to align well with this National ICT Policy to provide balanced, realistic, and forward looking development guidelines.
Open Access Architecture On-going investment in national infrastructure will be a recurring theme of national ICT policy to keep pace with developments in technology and demand-side increases arising from the increased consumption of data by all parts of society.

A technology-neutral stance will be promoted by Government investment in key national core infrastructure components, and active participation in partnership/outsourcing initiatives will be the modus-operandi.
Policy Recommendation 1 – Open Access Architecture Rights Of Way (Way Leave) 67.

The approvals of rights-of-way and of land access to all service providers are essential for the development of national telecommunications infrastructure.

The Government will facilitate the recognition of ICT infrastructure as a utility, along with taking a primary role in all land-related negotiations and dispute resolutions.
Rights of Way In support of NSDP ECO 4.8 Government will use its best endeavours to facilitate access to sites that are component parts of the telecommunications infrastructure of the nation, and act to resolve land access issues or disputes.

Policy Recommendation 2 – Rights of Way Broadcast Signal Distribution 68.
Government will continue to control broadcast signal distribution services (licensed and regulated by TRBR) in line with demand, market growth, and the availability of the required radio frequency spectrum resources to ensure that the use of broadcasting infrastructure is maximised.

All licensed signal distributors will be required to provide services to licensees on an open access and non-discriminatory basis.

Complementary Infrastructure 69.


Shortcomings in the provision of complementary infrastructure have hampered provision of efficient and affordable ICT services in the country (particularly in terms of support infrastructure, such as reliable power and free access to key infrastructure sites).

Draft v0.95 – For Committee Review & Consultation Page 22 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 70.
Government will actively support development of infrastructure for the public good and strengthen mechanisms that ensure open access for all service suppliers and consumers.

6.3 Disaster Management Disaster Preparedness and Management Government will continue to enhance all aspects of disaster management using whatever ICT tools and provisions as they become available.
This will include, but not be limited to, seismic sensing, early warning data monitoring, multi-channel and multi-modal communications and others.

A National Emergency Telecommunications Plan will be developed, to inform and guide each aspect of the organisation and management of infrastructure and resources that are critical to reducing the humanitarian impact of natural disasters.
Specific inclusions will include the role of communications in the preparedness, response, and recovery from disasters, and ongoing measures to improve resilience.

Policy Recommendation 3 – Disaster Preparedness and Management 71.

Single points of failure will be identified and engineering solutions proposed to eliminate them.
Telcos shall have interim responsibility for providing disaster-resilient solutions as part of existing licencing provisions and new entrants into the Vanuatu ICT market that provide any form of infrastructure or related services will be required to have disaster resilient design approvals prior to deployment of any infrastructure as well as disaster recovery plans that are tested prior to certification for public use.

72.
72.

All components designated as forming part of Critical National Infrastructure17 (CNI) must have specific disaster management plans in place and in no circumstances will a single point of failure be countenanced in the design or implementation of any part of the CNI.

These will be reviewed annually by the National Disaster Management Office (NDMO) working in partnership with OGCIO and infrastructure owners (where applicable).

Remediation recommendations will be binding upon infrastructure owners.
Prohibition of Single Point of Failure In CNI Design Government will implement and monitor compliance with policies that minimises inherent risks from single points of failure across all components of Critical National Infrastructure.

Annual reviews will take place under the aegis of OGCIO and NDMO acting together.
Policy Recommendation 4 – Avoidance of Single Point of Failure in CNI Design 17 See definition and additional provisions at Section 7.4 Draft v0.95 – For Committee Review & Consultation Page 23 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 6.4 Inclusivity and Digital Literacy 73.

Access to the benefits of ICT usage will not be restricted based upon ability, location, or social factors.
Government will take active steps to increase levels of inclusion by: a) promoting digital literacy for the whole population equally; b) working with the differently-abled to understand specific access challenges according to the needs of individual groups; c) requiring e-Government applications to conform to accessibility guidelines (including mobile apps); 74.
An outreach program of digital skills and inclusivity training will be designed, with different age-ranges targeted, to provide opportunity to undertake improved digital courses based on national standards18.

This will set out the essential citizen skills and capabilities for development in life and work, divided into five categories: a) communicating digitally; b) handling information and content; c) transacting; d) problem solving; and, e) being safe and legal online.

75.
75.

Digital skill levels will be monitored and measured for the first time.

This essential baseline information will influence future policy direction and help understand the challenges facing Vanuatu in the future.
Three broad categories will be used, these are: a) Essential: citizens having the basic online skills and the confidence to access digital technology to live and work well; b) Intermediate: citizens/employees that have the right digital skills to enable businesses to thrive in Vanuatu; and c) Expert: skilled individuals that have the knowledge to enable them to drive digital innovation and be at the forefront of the economic development of Vanuatu.
18 These examples draw on the UK Essential Digital Skills Framework, as an indication of the policy objectives that will be refined to suit the Vanuatu context.
Draft v0.95 – For Committee Review & Consultation Page 24 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Digital Inclusivity and Literacy Assessment Government shall undertake a baseline digital inclusivity and literacy assessment – the results, when disaggregated into population groupings, will be used to measure improvements and inform detailed policy formulation in the near term.
Particular attention to access to digital services by the differently-abled will be included in the assessment work and specific policy initiatives designed to address inclusivity challenges including: • visual impairments (screen readers, braille embossers, braille displays, desktop magnifiers and software, large print and tactile keyboards) and navigation assistance; hearing telephone amplification equipment); (hearing aids, assistive listening devices, impairments • • wearable technology including personal emergency response systems; and; • accessibility software.
Policy Recommendation 5 – Baseline Digital Inclusivity and Literacy Assessment Draft v0.95 – For Committee Review & Consultation Page 25 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 7 INFRASTRUCTURE POLICIES 76.
Policy Objectives for national ICT infrastructure are to: a) develop an efficient, high capacity shared national ICT infrastructure to enhance service delivery to all stakeholders with special emphasis on governance, health and educational institutions; b) promote an integrated, converged, technology neutral and secure ICT infrastructure in partnership with private-sector operators to support delivery of e-Government services; c) strengthen innovation activities across the nation such as agricultural marketplaces19, tourism and manufacturing activities to increase the amount of internet traffic, particularly that arising from locally owned and developed content, across national ICT infrastructure; d) identify and manage a core disaster-resilient capability to support key transactional services for e-Government (“Critical National Infrastructure”) 77.
These policies support NSDP Economy Pillar (particularly ECO 1.7, 1.9, 2.4, 2.5, 2.9 and 3.3) 7.1 Sharing National Infrastructure 78.

79.

Sharing of physical network infrastructure between service providers is to be promoted wherever feasible.

Subsidies or other support mechanisms (particularly where these may be funded in whole or in part by Government) to promote UAP and QoS enhancements shall not be duplicated in the same geographical area.
Initially, sharing may be limited to physical components (land, power, structures etc.)

however technical/logical sharing of Radio Access networks (RAN) components such as antennae, backhaul and core networks will be promoted whenever possible, including MOCN and MORAN20 logical network architectures.

19 Supports NSDP objectives ECO 3.1, 3.3, 3.5 and 3.6 20 MORAN (Multi-Operator RAN) architecture shares all RAN components (power, access, site, towers etc.)

but keeps core networks separate.


MOCN (Multi-Operator Core Network) whereby two or more carriers share the same RAN.

Existing core networks could be kept separate.

MOCN is the most resource efficient solution as it gives carriers the opportunity to pool their respective spectrum allocations, resulting in improved trunking efficiency.
Draft v0.95 – For Committee Review & Consultation Page 26 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Physical Infrastructure Sharing The nation needs a viable, reliable, communications network and cannot afford to fund multiple redundant routes/access points except where necessary for resilience.

Sharing of physical infrastructure between service providers will be actively promoted, and incentives to share common technical/logical components will be developed.
Specifically, the Government will: • promote the sharing of public and private ICT facilities, land access, rights of way, access, and provision of power to ensure resiliency and redundancy in order to support disaster recovery plans; and ensure equitable access and sharing of natural sites, physical infrastructure and co- location of ICT facilities by licensed operators based on technical and commercial considerations.
• Policy Recommendation 6 – Infrastructure Sharing 7.2 Infrastructure Partnerships for Deployment and Sustainability 80.

Social and economic growth will become increasingly symbiotic with uptake of ICT- related services 21 .

These services (whether delivered by public or private sector operators) will in turn require appropriate infrastructure.
In the near-term, national policies must therefore focus upon promoting reliable, effective and affordable access to ICT services, forming a core, integrated, ICT eco-system.

81.

Government does not need to own all of the national end-to-end infrastructure, nor can it afford multiple (competing) infrastructures.

Partnership arrangements with other organisations are envisaged as part of an overall expansion of national ICT infrastructure.
TRBR will be responsible for approving a unified design of national infrastructure, consistent with open access principles, e- telecommunications Government deployment expectations as well as UAP and QoS requirements.

82.

Partnerships arrangements based upon risk/reward partnership models will be infrastructure and assume evaluated, whereby partner(s) will build/deploy performance risks in return for land, access, and operational licences provided by the Government.
Physical asset ownership shall remain with the Government in all cases where subsidiary financing (including by concession or access) has been provided by Government or donors.

21 In their 202 paper “The impact of digital technology usage on economic growth in Africa” the disaggregated analysis by Solomon and van Klyton of the types of ICT usage reveals that two indicators, social media and the importance of ICTs to government vision, are of particular significance for economic growth.
Draft v0.95 – For Committee Review & Consultation Page 27 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Infrastructure Development The Government will continue to promote expansion of ICT infrastructure and services with special attention to areas not presently well provided with access.
Partnership risk/reward sharing models will be developed to promote private-sector engagement with collaborative (rather than competing) infrastructure development that will address UAP and QoS objectives.

These will be regulated by TRBR.

In alignment with investment prioritisation and evaluation policies (See also Section 11.2.2) all partnership proposals will be evaluated using formal business case and knowledge economy contribution metrics.

Policy Recommendation 7 – Infrastructure Development 83.
The Government will increase its participation in deployment planning and support of ICT infrastructure, particularly where delivered by private sector partners in partnership arrangements.
Infrastructure Deployment and Sustainability The Government recognises that it has a key role to play in such arrangements, becoming a reliable and trusted partner that: • supports a fair and competitive environment through the enforcement of open access to ICT infrastructure; and, provides key infrastructure enabling components (energy, security, land, physical access etc.)

to support faster, safer and cheaper deployment and maintenance of ICT infrastructure.
• Policy Recommendation 8 – Infrastructure Deployment and Sustainability Government Fibre Network 84.

Government recognises that there is considerable potential for existing fibre infrastructure deployed in Luganville and in Port Vila to deliver additional benefits by serving a wider end-user population.

Presently these networks are owned by the Government, and it is proposed that maintenance and enhancement responsibilities be offered to the market in a partnership arrangement.

85.
85.

Ownership shall remain with Government, as these networks form part of the CNI (see Section 7.4) and especially the provision of dedicated, large capacity, and high- availability connections between the two core Government Data Centres (see Section 7.4.2).

86.

Operations, maintenance and enhancement of these CNI components shall be undertaken by a partnership operator in accordance with security provisions set out at Section 7.4.1.
Draft v0.95 – For Committee Review & Consultation Page 28 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Infrastructure Operations and Maintenance Government may outsource some of the business-as-usual operational responsibilities for its existing fibre networks and data centre links to third-party partnership operator(s) if there is a viable business case22 to do so.
Specific additional security measures shall apply to all outsourced components designated as being Critical National Infrastructure.

Policy Recommendation 9 – Partnership/Outsourcing of Government Operations 7.3 Innovation and IP Traffic Development 87.

Government strategy for the medium term is to focus upon e-enablement of all of the services it offers to citizens, businesses, and between all parts of Government.

This move online will have the intrinsic effect of driving IP traffic volumes upwards.
88.

Social and economic growth will increasingly be predicated upon uptake of ICT-related services23.

These services (whether delivered by public or private sector operators) will in turn require appropriate infrastructure.

In the near-term therefore, the National Policy Framework and related policies shall focus upon promoting reliable, effective and affordable access to ICT services, forming a core integrated ICT ecosystem.

89.
89.

Public-Private partnerships and similar risk/reward sharing models will be promoted, whereby partner(s) will build/deploy infrastructure and assume performance risks in return for land, access, and operational licences provided by the Government.

Physical asset ownership shall remain with the Government in all cases where subsidiary financing (including by concession) has been provided by Government.
IP Traffic Development The Government will continue to promote IP traffic growth with a general move to e- Government across all of its service delivery portfolio.

Partnership risk/reward sharing models will be developed to promote private-sector engagement with infrastructure development that will address UAP and QoS objectives.

Business case requirements for these will be evaluated by OGCIO and regulated operationally by TRBR.
Reporting of IP traffic supply and demand statistics will be required from all operators in the sector.

Policy Recommendation 10 – IP Traffic Development & Monitoring 22 See also Section 11.2.2 23 There are many studies which support links between various ICT metrics and increasing Gross Domestic Product (GDP).
A Gulf Cooperation Council study published in 2019 found a 1% increase in broadband usage resulted in a 2% increase in financial development, arising from a combination of factors including reduced effects of unemployment and inflation, as well as increases in money supply and GDP.

(See also Further Reading at Appendix D) Draft v0.95 – For Committee Review & Consultation Page 29 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Mobile and Digital Payments 90.
A key element of Government policy in the near term will be the promotion of digital and mobile money tools and techniques, particularly establishing the technical capability for accepting and receipting inbound mobile money payments24 for goods and services (whether by means of in-person visits and contactless payment devices or by remote usage of website and digital payment functionality).

91.
91.

The use of Instant Payment Notification (IPN) hubs has been piloted successfully across Africa to provide next generation “many-to-many” API linkages between pre- paid utility service providers and mobile money platforms.

Real-time API connectivity provides for instant notification and validation of payments and greatly simplifies the complex technical integrations between multiple service providers using a common brokerage architecture.
The single point of integration greatly reduces the complexity of this ecosystem.
Mobile and Digital Payments Infrastructure The Government will promote the use of mobile and digital payments wherever possible in national commercial activity (G2C, G2B and G2G) by: • developing a holistic set of common standards, infrastructure, financial management instructions and banking arrangements for all Government departments and agencies to be capable of accepting digital and mobile money payments for any goods, services, licence, fee or tax payment made to it; • make necessary changes to the Employment Act to legitimise and properly control • the use of digital payments for salary and personal emoluments; establish IPN and common national API functionality to promote pay-as-you-go (PAYG) services usage from any bank, digital, or mobile payment provider to any PAYG service provider.
Policy Recommendation 11 – Promotion of Mobile and Digital Payment Architecture Digital Identity, Verification and Validation 92.

Accreditation of users accessing online services will be a fundamental enabler to propel forward the use of mobile/digital payment methods and to enable digital Government service delivery.

93.

A primary unique national identity for all citizens is therefore proposed.
It will be based upon biometric identification of adults and take the form of both physical (ID Card) and digital versions (PKI-enabled digital signatures).

24 Outbound digital payments (such as for salary and other personal remuneration purposes) are presently not permissible under the Employment Act (Cap 160) as amended.

Notwithstanding this, direct deposit functionality is in common use, and the law needs to be amended as a matter of urgency to reflect this commercial reality.
See also the Vanuatu Legislative Review for ICT Policy Issues Draft v0.95 – For Committee Review & Consultation Page 30 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Digital Identity Government will establish a biometric registration program for all adults that will become the primary national identity for citizens: • • • a combination of fingerprints, iris scans, and photographic likenesses will be used; all adults over the age of 15 will be required to register; a primary data source, accessible only by secure API will be provided to enable 1) verification of individuals using PKI methods for e-government transactions, 2) as primary source ID for all other forms of national identification, such as voter registration, VNPF membership, passports, access to healthcare/education etc.
is available to commercial operators on the basis of need (such as know-you- customer requirements), via API and this may be provided on a fee-per-use basis.

• Policy Recommendation 12 – Biometric Digital Identity Localisation and Domain Name Policy 94.

Presently, international internet traffic originating in Vanuatu is mostly switched in Fiji, with banking transactions happening in Papua New Guinea (BSP), New Zealand (NBV) and Australia (ANZ).
The visible web-presence of Vanuatu as a nation is therefore somewhat obscured, furthermore this poses a risk from single points of failure in the CNI such that any disruption to international data connections could have serious impact upon domestic fixed-line and mobile telephony.

95.

Government will promote the use of .vu domain names, in-country switching and VIX caching 25 to promote visibility, optimise local web traffic and enhance disaster resilience of the CNI.
The .vu ISO 3166-1 country-code Top-Level Domain (ccTLD) for Vanuatu, along with subdomains will continue to be regulated by TRBR 26 with administration outsourced as required (presently www.vunic.vu).
Localisation and Domain Name Policy Government will: • mandate the use of .gov.vu, .com.vu, .org.vu, .edu.vu, .health.vu, .ngo.vu and other related naming conventions that identify clearly the ownership and source of web traffic; reinstate VIX and require ISPs and network operators to contribute to its upkeep and usage; and, require network operators to provide switching that is both disaster-resilient and avoids single-point-of failure in the CNI.
• • Policy Recommendation 13 – Localisation and Domain Name 25 See also Sections 7.4.4 and 7.4.5 26 Vanuatu Domain Name Management and Administration Regulation Order No 206 of 2016 Draft v0.95 – For Committee Review & Consultation Page 31 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Local Content 96.

In line with the localisation of domain name policies (above), local content with .vu suffix will be prioritised for VIX caching.
This will be of particular relevance to e- learning and digital health content (both potentially very large data volumes), for which VIX caching could be applied in order to reduce access times (latency) and costs for remote users.

7.4 Critical National Infrastructure 97.

Part 2 of the Cybercrime Bill (to be laid before Parliament in 2020) allocates responsibility for definition of “critical infrastructure” to the Minister responsible for ICT.

This policy framework enhances the definition to become CNI.
Critical National Infrastructure Government will designate components comprising its Critical National Infrastructure and set out mandatory security/access controls, physical and virtual architectures, active status monitoring, fault remediation times, and additional provisions for disaster resilience.

Policy Recommendation 14 – Critical National Infrastructure - Designation 98.
Designation of CNI components could well follow a similar path to that of the United Kingdom, where the definition includes “those critical elements of infrastructure (namely assets, facilities, systems, networks or processes and the essential workers that operate and facilitate them), the loss or compromise of which could result in: a) major detrimental impact on the availability, integrity or delivery of essential services – including those services whose integrity, if compromised, could result in significant loss of life or casualties – taking into account significant economic or social impacts; and/or b) significant impact on national security, national defence, or the functioning of the state.” 99.
As the custodians of this National ICT Policy Framework, and associated policies, OGCIO have a role to play in providing advice and assistance to those who have responsibility for designing and protecting these most crucial elements of CNI.

CNI Resilience Provisions 100.

Cybersecurity provisions for CNI will be provided primarily by CERTVU as is the case at present.

101.
Any organisation involved with operations or maintenance of any part of CNI will be required to include the following national security requirements: a) to actively assist the Government in times of national emergency; Draft v0.95 – For Committee Review & Consultation Page 32 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft b) to maintain such hardware 27, service level contracts and backup software applications/data as needed to ensure continued operation of services delivered over CNI for specified contingency events; c) to take reasonable measures to ensure that their networks are not used for any purposes other than those agreed by Government; d) to implement reasonable cybersecurity measures under the direction of CERTVU and other Government actors; e) to make relevant law-enforcement related information available to authorities when directed to do so pursuant to court orders (e.g., traffic data, call information records and interception); and, f) to comply with licence requirement(s) and seek prior approval from Government for any proposed “change of control” of the licensee, which will provide Government with the ability to screen foreign ownership.
Critical National Infrastructure - Security Specific requirements will be developed by OGCIO for all operators having responsibilities for components of CNI.

These will be mandatory inclusions in all contractual terms.

OGCIO and CERTVU will be responsible for on-going monitoring and performance evaluation of all contracts where CNI components are involved.

Policy Recommendation 15 – Critical National Infrastructure - Security Government Data Centres 102.
Government Data centres will be designated as CNI components and configured to provide for continuity of operations by protecting essential applications and data against loss that could arise from natural disasters, acts of terrorism, sabotage, and technical faults among others.
Government shall: a) develop and enhance its data centre provision in alignment with best-practice standards for purposes of ensuring quality of service under an open access, carrier neutral model; b) facilitate the development and enactment of legislation in support of data sovereignty, localisation, and centralisation to promote data protection and ease of access (ensuring that Ministries, Departments and Agencies share and optimize data centre infrastructure to improve the efficiency, effectiveness scalability and security of Government data assets); and, 27Recent experiences of NZ telcos holding critical spares inventory overseas, and subsequently being adversely affected by border closures and other pandemic-related problems must be avoided in the case of Vanuatu CNI.
Government will require appropriate levels of CNI backup hardware to be maintained in-country.

Draft v0.95 – For Committee Review & Consultation Page 33 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft c) ensure that data is processed fairly and lawfully in accordance with the rights of citizens and obtained only for specific, lawful purposes; 103.
Capacity and reliability of Government data centres will be enhanced in line with moves toward deployment of e-Government applications and plans to provide key identity management and authentication services more widely (including potentially to private-sector and citizens on a 24/7 basis).

104.
104.

Government data and applications hosted in these data centres will generally be fully virtualised by default, to provide scalable, secure, and high-availability services (this will include software defined and highly automated configurations in an active/active configuration to provide reliable Government cloud services alongside traditional on- premises infrastructure.
Data Centre Virtualisation Government will configure two main data centres (Luganville and Port Vila), with high- availability clustering, load balancing in active/active configuration and host applications for all line Ministries in highly virtualised environments Policy Recommendation 16 – Data Centre Virtualisation and Government Cloud 105.
It is essential that regular disaster-recovery (DR) testing is carried out on both data centres and the communication links between them to verify the resilience and preparedness of the CNI to withstand adverse events.

106.

Similarly, adequate spare capacity, particularly in terms of processing and especially load-balancing must be provided for both data centres to meet planned expansions for the next 3-5 years.
Draft v0.95 – For Committee Review & Consultation Page 34 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Data Sovereignty 107.

In the same manner that CNI will be designated, critical national data will similarly be identified as part of the national data model (Section 8.2).

Data Sovereignty Government will develop policies for data sovereignty that ensure essential national data assets critical to the operations of core Government processes remain in-country28.
For the avoidance of doubt: • • Vanuatu will retain data identified as sovereign to the nation within the boundaries of the nation; and, backup and/or DR copies may be maintained outside the country only where the chain of ownership can be proven, maintained, and bound to a single contract with a supplier.
The purpose of this restriction is to avoid Government cloud services being dependent upon multiple hosting, hardware, facilities and support arrangements which give rise to multiple points of failure over which the Government cannot exercise effective control.

Policy Recommendation 17 – Data Sovereignty Disaster-Resilient Communications 108.

Post-disaster re-establishment of communications is a critical first step and enables most of the subsequent remediation efforts.
Government will explore all possibilities for multi-channel and disaster resilient communications29, whether voice or data.

A range of technologies is envisaged, to avoid single point of failure, and to provide alternatives appropriate for large urban centres and remote island populations.

Disaster-Resilient Communications Government will continually evaluate and implement enhancements to its disaster- management communication options.
These will focus on disaster-preparedness (rather than business-as-usual) and include, but not be limited to, the existing telco-operated networks, subsea cable(s), HF/VHF radio with repeaters where necessary, and satellite- based voice/data traffic.

Policy Recommendation 18 – Disaster-Resilient Communications Vanuatu Internet Exchange 109.
The Government will re-implement the present Vanuatu Internet Exchange30 (VIX) as part of a revamped core network to reduce dependency on international internet 28 It is unlikely to be either feasible, or indeed desirable, to prevent some Government or other national data being stored in cloud-based environments where the precise location, storage operators, or facility owners may not be clearly identified.
This approach may suffice for some categories of information; the National Data Model must however identify which data items are critical operationally, and these must remain within-country as primary data sources.
29 See also Section 6.3 30 See complementary provisions at Sections 7.3.3 and 7.3.4 Draft v0.95 – For Committee Review & Consultation Page 35 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft traffic, promote service quality improvements, and act as a catalyst for local capacity development.

Furthermore, the use of third-party partnership arrangements with peers and other interested parties that seek to deploy additional IXP capacity will be encouraged (Google, Facebook etc.)
Internet Exchange Points The Government will re-energise and strengthen VIX.

All Government investments in applications, service delivery, and data dissemination of whatever nature, including third-party partnership operator(s) and donor-funded investments will be required to include provision for additional IXP capacity, along with inherent design architectures that optimise VIX usage and minimise international IP traffic requirements.
Policy Recommendation 19 – Internet Exchange Points Draft v0.95 – For Committee Review & Consultation Page 36 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 8 DATA POLICIES 110.

Public sector bodies are often more familiar with making decisions based on projections and forecasts rather than using insights derived from near-live data.
The ability to collect and analyse data will be critical in changing the paradigm of government departments looking backwards at what has happened in the past whilst trying to predict the future or acting upon out-of-date information.

Data is being created continuously by the actions of all citizens and businesses.

To ignore these extremely valuable sources of information that have the potential to support the future economic and digital growth of Vanuatu will no longer be tolerated.

111.
111.

Public sector data includes inter-alia facts, statistics, and other information that are capable of being communicated, analysed or processed via physical or electronic means (excluding any sensitive data managed by specific legislation (such as disaggregated personal data), intellectual property or details of international agreements.

8.1 Policy Objectives 112.
Government shall leverage the proposed national data centres and reporting frameworks to be established as part of the e-Government initiatives to coordinate and correlate its data assets: a) data and information owned by Government shall be made available to all on a free-of-charge basis as widely as possible consistent with privacy, personal data, or security constraints; b) a national data model will be developed to facilitate common terminology and correlation of data sets across all Government data and application assets; and, c) project and status reporting will be supported that informs progress against NSDP objectives by measuring a variety of “lead” and “lag” metrics31 linked to each.
113.

These policies support NSDP Economy Pillar (particularly ECO 1.7, 1.9, 2.4, 2.5 and 2.9) 8.2 Access to Information 114.

A National Data Model (NDM) will be developed that sets out data assets, ownership and re-usability across the whole of Government and the wider public-sector.
31 See also Section 21.3 for additional definitions and context of indicator metrics Draft v0.95 – For Committee Review & Consultation Page 37 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 8.3 National Data Model 115.

A National Data Model (NDM) will be developed that sets out data assets, ownership and re-usability across the whole of Government and the wider public-sector.

116.
116.

To facilitate the “digital-first” approach (Section 11.2.1) and support national data sovereignty requirements (Sections 7.4.3 and 9.6.1), all government/donor initiatives containing digital components must include commentary and explanations of how data will be owned, created, used, stored and what may be deleted, after how long.

117.
117.

The NDM will also establish a common vocabulary that reduces duplication and enables efficient information exchange across diverse public and private organizations, used to connect organisations and people who share common needs to exchange information.
Further, the NDM will establish guidelines for: a) Artificial Intelligence (AI) and Machine Learning (ML), and where they have roles to play in simplifying the process of discovering, cataloguing,, tagging, and creating semantic relationships between distributed data assets; b) data catalogues, that allow authorised users to perform “Google-like” semantic searches against metadata; and, c) establishing data lineage32 and in particular its role in data privacy and security compliance.
National Data Model Government will develop a national data model that sets out data ownership, content, lineage, provenance, and format, along with a common data vocabulary to promote uniform descriptions of data content, data exchange between applications, and cross- platform reporting.

• Access to data held in repositories of Government data will be managed by APIs (see Section 19.4).
• OGCIO will lead efforts to coordinate data descriptions and correlations between public sector entities and to leverage reporting/dissemination using the e- Government portal.

All public-sector initiatives with digital components must include specific provisions for alignment with the NDM as well as demonstrating compliance with the data management lifecycle.

• Policy Recommendation 20 – National Data Model 32 Data lineage includes data origin, what happens to it and where it moves over time.
Lineage gives visibility while greatly simplifying the ability to trace errors back to the root cause in a data analytics process and enables replaying specific portions or inputs of the data flow for debugging or regenerating lost output.

Data provenance refers to records of the inputs, entities, systems, and processes that influence data of interest, providing a historical record of the data and its origins.
The generated evidence supports forensic activities such as data-dependency analysis, error/compromise detection and recovery, auditing, and compliance analysis Draft v0.95 – For Committee Review & Consultation Page 38 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 118.
Specific restrictions to access (in the case of, for example, health, tax or sensitive Government information) will be established and controlled on the basis of need33 and in most cases will not require physical transmission.
Instead, an messaging schema similar to the e-GIF (UK) or X-Road (Estonia) models will be defined using a messaging schema34 to: a) set out detailed technical policies and specifications governing information flows across government and the public sector; and, b) address interconnectivity, data integration, e-services access and content management requirements.
8.4 National Project Data Resource (NPDR) Establishment of NPDR A NDPR will be established with the following characteristics and attributes: • access to data content of different types, geographies, subject, and sector classifications provided by a unified web resource that includes details of all Government initiatives, projects and reform proposals; available to all bone-fide stakeholders (particularly the beneficiary groups addressed by projects or proposals); all national initiatives, whether or not funded by external sources, will be required to make status and data contributions at least quarterly each year; regular assessments and status updates will be undertaken and the results available for stakeholder scrutiny.
• • • Policy Recommendation 21 – National Project Data Resource 119.

All proposals for new initiatives shall be included within the NDPR, along with summary details that show how proposals will contribute to the NDSP and development of the nation.

120.

The national open data model (above) will be the preferred data collection architecture.
Data may be contributed to NSDP and/or regional partner repositories (such as the Pacific Data Hub - https://www.pacificdata.org ) and in particular compatibility with catalogues, development indicators and statistical content35.

121.

NPDR and NSDP data safeguarding will include: a) personal data must never be presented in a way that identifies individuals; 33 See examples at Appendix C – derived from the national health and social care data policy of the United Kingdom.
34 eXtended Markup Language (XML), or similar 35 See also the Vanuatu National Statistics Office www.vnso.gov.vu for national indicators and Sustainable Development Goals (SDGs) Draft v0.95 – For Committee Review & Consultation Page 39 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft b) disaggregation is acceptable, but only to a point (Gender, Age ranges, islands, provinces, sectors etc.
), never to a level where personal data can be imputed; and, c) data that is commercially sensitive should not be presented in a way that gives advantage or disadvantage to any person, party, organisation or body.

Draft v0.95 – For Committee Review & Consultation Page 40 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 9 SECURITY POLICIES 9.1 Policy Objectives 122.
Government will adopt policies and strategies that support free, open, secure and resilient access to information by: a) assisting citizens to protect themselves and the rights of others in cyberspace; b) promoting awareness of good practice, responsible internet use, and providing educational resources for citizens; c) develop specific initiatives to protect vulnerable groups and emphasising the protection of children in cyberspace; d) active cooperation and participation in international and cross-border cybersecurity forums; e) ensuring that infrastructure, CNI, and data sources are managed in a robust and resilient manner; and, f) requiring all Government services and ICT usage to conform to principles of good data governance, classifying data appropriately, and managing data usage responsibly.
123.

These policies support NSDP Economy Pillar (particularly ECO 1.7, 1.9, 2.4, 2.5 and 2.9) 9.2 Cyber Security 124.

A separate policy document that addresses cyber security has been developed, the objectives from which have been included within the Cybercrime Bill to be laid before parliament in 2020.

9.3 Responsible Internet Use 125.


Government will lead a national effort to inform citizens and businesses of the risks and challenges of cyber-space, as well as the benefits from engaging with digital delivery channels.

All service providers will be required to contribute to these efforts (whether by means of separate but complementary initiatives, or by direct participation in Government-led initiatives).

126.

Coverage of these initiatives will be multi-dimensional.
Aside from general messages aimed at the whole nation, specific interventions will be focussed upon the differing needs of population groups such as young persons, the elderly, the differently-abled, systems administrators, data administrators, public servants, and sector specific interventions in finance, law-enforcement, health, education etc.
Draft v0.95 – For Committee Review & Consultation Page 41 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Responsible Internet Use A sector-based strategy will be applied to internet awareness initiatives, supported by service providers, civil society groups, donors, NGOs and other international bodies to raise awareness of internet risks, etiquette, and usage.

These initiatives may also dovetail with digital literacy/inclusion efforts.
All externally-supported initiatives provided by donors must include mandatory internet awareness, responsible use, and digital inclusion components in programme design.

Policy Recommendation 22 – Responsible Internet Use Policy 9.4 Child Online Protection 127.

Data sits at the heart of the digital services children use every day.

From the moment a young person opens an app, plays a game or loads a website, data begins to be gathered.
A very broad spectrum of data such as who uses these services, how, how often, where, and from what devices can then be harvested to persuade and influence young people in terms of the content they are encourages to engage with, tailor advertisements, and to spend more time using such services.

128.

For all the benefits the digital economy can offer children, it cannot be said that at present Vanuatu is currently creating a safe space for them to learn, explore and play.
Government will therefore follow the lead of the UK Information Commissioners Office in setting out a code of practice36 that has legal force and is based upon the United Nations Convention on the Rights of the Child (UNCRC) to recognise the special safeguards children need in all aspects of their life.

129.
129.

The UK code of practice is not intended as a technical standard, but as a set of technology-neutral design principles and practical privacy features to set benchmarks for the appropriate protection of children’s personal data.

Different services will require different technical solutions.
Child Online Protection Government will consult widely with social media platforms, telcos, media companies, news organisations, NGOs (particularly those with interests in children or parenting), academics and other interested parties to determine the applicability of a methods and approaches similar in concept to the provisions of the UK code of practice.

Appropriate national, regional and cultural amendments will be proposed wherever necessary prior to adoption of a Vanuatu version.
Policy Recommendation 23 – Consultation on Child Online Protection 36 See also Design Principles (Appendix D) and Further Reading (Appendix E) Draft v0.95 – For Committee Review & Consultation Page 42 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 9.5 International Cooperation 130.
Just as cybercrime is borderless, so must efforts be to reduce the impact, respond to changing threat types, the continuous evolution of countermeasures, and the sharing of the knowledge necessary to minimise its impact.

131.

Government is wholly committed to supporting such initiatives, and membership of international bodies is a key component of this work.

International Cooperation Government will continue to deepen and strengthen international cooperation in the fight against cybercrime.
OGCIO and CERTVU (in particular) will be active in maintaining international links.

Policy Recommendation 24 – International Cooperation Policy 9.6 Security of Critical National Infrastructure 132.

Additional security and access control measures will be developed for ICT components of CNI (see also Sections 7.4, 9.2, and 9.6.1) National Data Security 133.
A national security policy will be developed that ensures Government can maintain and develop public trust, that information will be properly handled, advise Ministers in confidence, and protect the many commercial and financial interests Government are responsible for.

134.

Government will consult the full range of policy, advice and guidance provided by CERTVU (Section 7.4), and other sources of good practice to shape operational requirements.
Specifically, the following principles will be followed: a) Government organisations shall be responsible for their own operational priorities, including how risks should be managed to support operations and service delivery; b) Permanent Secretaries/Heads of Department are accountable to Parliament for the data security of their organisations; and, c) an annual reporting process will ensure compliance and an appropriate level of commonality across Government.
Draft v0.95 – For Committee Review & Consultation Page 43 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft National Information Security and Critical National Infrastructure Policies Government organisations will identify data/information that form part of National Information and designate and technology/services forming part of Critical National Infrastructure.
Specific provisions in the respective policy documents will be established to manage risk appropriately by establishing risk-informed security controls that: • mitigate applicable threats; • • • are kept current and actively managed; protect against, detect and correct malicious behaviour; and, ensure that critical data, technology and services are resilient to disruptive challenges such as cyber-attacks and that Government has the means to recover from these.
Policy Recommendation 25 – National Information Security and CNI Policies 135.

Amongst general revisions to the Official Secrets Act (Cap 111) to include within its remit new concepts such as password security, digital identity and digital media, a revised classification policy for Government information may be put forward.

Three levels of confidentiality and security are proposed (Official, Secret and Top Secret) for which distinct security arrangements will be required.
Official information may be managed by means of standard security solutions common to large commercial organisations, however other levels may require additional safeguards and bespoke protections.
Official Secrets Act - Revisions General revisions to the Act are necessary to include specific ICT developments, provide for enhanced classification of Government information, and underpin in law the provisions of the National Information Security Policy and Critical National Infrastructure Policy Policy Recommendation 26 – Revisions to the Official Secrets Act Service Provider Security Obligations 136.
Service providers will not be responsible for content delivered as part of over-the-top (OTT) services to end users (customers).

137.

Service providers will be responsible for blocking access to, or removing content where instructed to do so by properly authorised notices, including directions of courts.

138.
Service providers engaging in any form of contractual arrangements with Government will be required to: a) to assist the Government in times of national emergency; b) maintain such hardware, service level contracts and backup software as needed to ensure continued operation of telecommunication services under specified contingencies; Draft v0.95 – For Committee Review & Consultation Page 44 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft c) to take reasonable measures to ensure that their networks are not used for illegal purposes; d) to implement reasonable cybersecurity measures; e) to make relevant law enforcement related information available to authorities when directed to do so pursuant to a court order (e.g., call information records and interception); and, f) seek the Government’s prior approval to a “change of control” of the partner organisation, which will provide the Government with the ability to screen foreign ownership.
9.7 Information Privacy and Security 139.

A GDPR37-like legislative environment is proposed that will require data controllers and data processors to put in place appropriate safeguards to ensure the privacy and security of all data relating to individuals.
The policy will include the use of technologies such as encryption of data (whether at-rest or during transmission), along with requirements for data processors to seek consent for collection/storage of personal data, disclosure without prior consent, restrict analysis of behavioural/traffic information, and reinforce restrictions on the use of such data for unsolicited, defamatory, or illegal purposes.

140.
140.

In case of a physical or technical incident, the data processor must be able to restore the availability of data in a timely manner so as to make it accessible again.
Furthermore, it will be the responsibility of the data processor to test, assess, and evaluate the effectiveness of the measures within their software applications taken to ensure the security of the data being processed (particularly important in a mobile- device environment where user data must be protected at all stages during the processing of data, including the data on individual user devices.

141.
Government will bring forward legislation that identifies the following: a) what constitutes personal, sensitive, or private information (including fingerprints, iris scans and other biometric indicators up to and including the human genome); b) restrictions upon the scope and use of passive information gathering tools (cookies and other such software), including particularly the ability for individuals to “opt-out” of tracking, marketing, or other similar functionality; c) what data can be collected about a person, along with any restrictions on use; 37 General Data Protection Regulations of the European Union (2016/679) set out the principles and safeguards for the management of personal data and are widely applicable outside the European Economic Area, including certain trading partner organisations/countries.
Draft v0.95 – For Committee Review & Consultation Page 45 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft d) the duty of care applicable to the collection, processing and storage of data; e) information requests that may be made by a natural person to determine what information is held pertaining to the individual, and by whom; f) how the wide-ranging provisions of the Right to Information Act (No.
13 of 2016) will be balanced with the rights and responsibilities of persons or bodies to safeguard personal or proprietary information along with responsibilities for reporting and managing breaches of data security; g) requirements for all organisations that collect or process data to notify customers about data breaches and their implications as soon as possible; h) promotion of early response to data security breaches (the key to preventing or minimising identity theft or other potential misuse of personal information); i) requirements for clear information that describes what is known about any breach or compromise of data integrity, including how it happened, what data was taken and (if possible) how information has been used; j) proof of action(s) taken to remedy breaches, and to prevent re-occurrence; k) how information is to be shared between public and private sector bodies that is crucial in order to contain the effect of data breaches, and to prevent propagation across different systems and data sets; and, l) the role of CERTVU38 and international bodies in containing data breaches and preventing reoccurrences.
access data held about them; restrict processing of personal data; Opt-Out Provisions for Personal Data and Usage Tracking Government will implement legislation similar in character and scope to the EU GDPR to mandate that any software application that collects or processes the data of Vanuatu citizens will be subject to stringent controls.
At minimum these will provide for the rights of individuals to: • • • move data between service providers (data portability); • • • At the same time, the opportunity to rework the Right to Information Act (No.13 of 2016) may also be taken (see separate Legal Review document39) object to and rectify data wherever necessary; be informed; and ensure data is erased when its purpose is completed.
Policy Recommendation 27 – Information Privacy and Security Legislation 38 Computer Emergency Response Team Vanuatu 39 Vanuatu Legislative Review for ICT Policy Issues Draft v0.95 – For Committee Review & Consultation Page 46 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 10 KNOWLEDGE ECONOMY AND INNOVATION POLICIES 142.
The European Bank for Reconstruction and Development (EBRD) defines a knowledge economy as an economy that is able to grow through innovation, A knowledge economy is also characterised by technological dynamism and includes sectors such as agribusiness and other service-sector providers not always necessarily associated with cutting edge innovation.

143.
Government recognises that it has a key role to play in: a) promoting a resilient, knowledge-based economy which recognises the importance of innovation and develops a national skill-base to prosper in the information age; b) stimulating the growth of e-Commerce across the nation, in G2G, G2B AND G2C areas; c) promoting a mixed economy, where entrepreneurial private-sector activities complement a public sector that is progressive and open to new ideas of how best to enhance delivery of essential services; and, d) developing partnerships.
A profitable private sector will not, on its own, generate large scale innovation.

In specific the areas where there are higher implementation risks and benefits the public sector has a role to play in supporting longer-term initiatives for the public good.

144.

Government shall value and grow both the formal and informal sectors of the knowledge economy so that no one is left behind.
Simply put, there are no quick or easy ways to create jobs and income earning opportunities for everyone; Government recognises that doing so will require prolonged and deliberate action, particularly in rural areas, where infrastructure and services have lagged the rest of the nation for a long time.

145.

Resource limitations require greater prioritisation of spending, within manageable levels, with citizen expectations for limited government resources to be put to the best possible use40.
10.1 Policy Objectives 146.
Government will: a) set development objectives for transformation, from grass-roots upward toward an inclusive national knowledge-economy that provides opportunity for urban, rural, formal and informal sectors alike; 40 See also Section 11.2.2 Draft v0.95 – For Committee Review & Consultation Page 47 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft b) promote communications environments; institutional frameworks, high-quality education, resilient infrastructure and equitable regulatory and financial c) catalyse and invest in close collaboration with others to build a thriving, inclusive research and innovation 41 ecosystem that connects discovery to prosperity and the public good; institutions, d) address specific gaps in the national innovation landscape, with a focus on intellectual property along with partnership policies that include higher investors, not-for-profit innovative businesses, education organisations and policy makers, as well as donor partners and civil society groups to encourage private sector investment in research and development by making Vanuatu an attractive environment for venture capital and private equity to enhance economic development.
147.

These policies support NSDP Economy Pillar (particularly ECO 1.7, 1.9, 2.4, 2.5 and 2.9) 10.2 Transformation Objectives for the Knowledge Economy Knowledge Economy Ecosystem 148.

Evolving a knowledge economy has important implications for Government policy makers as well as international agencies and institutions.

A broad-based consensus is essential, and Government therefore proposes the establishment of a knowledge economy and innovation partnership.
Vanuatu Knowledge Economy and Innovation Partnership (VKEIP) Government will convene a policy forum with cross-sectional representation of society, including in particular education, health, and technology as well as private sector, civil society , NGOs and donors with terms of reference specifically focussed upon promoting a holistic national approach to developing a knowledge economy and fostering innovation.
Policy Recommendation 28 – Vanuatu Knowledge Economy and Innovation Partnership 41 Innovation can be the adaption of globally available technology, processes and products (innovation by imitation), rather than pushing the frontiers of knowledge (innovation in the sense of invention).

Adaptation of externa ideas to the Vanuatu, Melanesian or Pacific context is equally valid, in this sense.
There is much to learn from agribusiness developments in Africa, for example, and how primary producers connect with wholesalers and consumers across extended supply chains.

This is not to say either that the focus of the economy as a whole will be solely upon high-technology initiatives – innovation is just as appropriate in services, processes, governance and organisational structures for delivery of benefits to the citizen.
Draft v0.95 – For Committee Review & Consultation Page 48 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 149.
Key features of the VKEIP terms of reference will include: a) traditional measures of economic success must be supplemented by new ones (Nova Scotia has developed “Knowledge Quotient” metrics for its economy, for example); b) developing an innovation framework addressing interactions between a diverse group of actors involved in the production, diffusion and use of new, and economically useful knowledge.
An effective framework will be required for a country to harness the potential offered by modern science and technology to its social and economic advantage; c) promoting coordination between stakeholders, and linkages between academia, industry, and government in particular (academic curricula and graduate skill sets must be aligned closely with the needs of the knowledge economy of the future, to fulfil critical national needs); d) working with stakeholders to determine how to promote an education and research ecosystem (universities, TVET institutions, sector-based research centres, national research and education network and schools), the business community at all levels (from start-up informal businesses to large and multi- (financial, national companies), and technology information, intellectual property, regulatory frameworks, incubation centres, science and technology parks, special economic zones, etc.
); and, infrastructure assets e) establishing conditions for this ecosystem to operate, dynamically and effectively in response to the needs of stakeholders (citizens, private sector and Government), with continuous improvement and lifelong-learning as embedded goals.

Knowledge Economy Ecosystem Government will embed knowledge-economy components into all of its projects, development and investment initiatives42.
Ministries, donor partners and aspiring third- party partnership operator(s) will all be required to include such components into every formal proposal for reform, investment or other development, demonstrating clearly how such proposals contribute to the knowledge economy and to public service efficiency and effectiveness.

Policy Recommendation 29 – Knowledge Economy Ecosystem Human Resource Development 150.
Transformation of the nations human capital resources will be an arduous, expensive and long-term commitment, which will demand the making of difficult choices in 42 See references to Investment Case development at Section 11.2.2 Draft v0.95 – For Committee Review & Consultation Page 49 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft balancing the importation of skills with realignment of educational and vocational training pipelines to meet the needs of national labour markets.
151.

In addition, there are new opportunities in applying ICT to enhance education, including curriculum development, teaching methodologies, simulation laboratories, life-long learning and distance education and for teaching of not only ICT, but of all subjects and specialisations that depend upon ICT-enablement.

If embraced appropriately and supported at all levels, these could transform the human capital of Vanuatu.

152.
152.

In common with many other countries, Vanuatu does not have sufficient breadth and depth of skilled and experienced ICT resources.

Furthermore, there are very considerable competitive pressures for human capital with the right skills in both regional and global marketplaces.

153.
Government objectives for ICT-related human resource development are to: a) increase the quantity and quality of ICT-related human capital across the nation; b) harness ICT to improve the quality of delivery of education and training in all areas including distance learning, as well as to enhance learning experiences themselves; c) expand and improve e-learning for adult-education, TVET, life-long learning, and both general and digital literacy programmes, notably for retraining and re-skilling of the existing workforce (making the use of ICT part of everyday life without excluding those that need skills development); d) provide new learning opportunities and ICT access for women and youth, the differently-abled and disadvantaged to address social inequalities; e) develop and deploy a nationwide core e-Education system that supports schools and higher education/training facilities across the country by interconnecting them with each other and with relevant knowledge centres; f) seek academic interest from global, regional and national sources to conduct research and development activities related to ICT in Vanuatu; g) promote private sector ICT developments and training programmes; and, h) create an environment that is conducive to short-term increase of national ICT capacity by integration of foreign skills (digital nomad and similar initiatives) as well as attracting returnees with ICT skills from the ni-Vanuatu diaspora.
Draft v0.95 – For Committee Review & Consultation Page 50 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft HR Development Initiatives Government develop a broad range of human resource development initiatives that will include: • establishment of ICT centres of excellence in schools and TVET institutions where specific ICT opportunities and possibilities can be trialled and evaluated; harness donor participation in capacity development and incubator initiatives that bridge the gap between education and work (including support for Yumiwork, Vlab and other similar initiatives) engage with the largest ICT corporate organisations worldwide to develop engagements that both assist Vanuatu and increase their corporate social responsibility footprint; and, seek specific technical assistance in developing future-focussed policies for key development areas such as the Internet of Things (IoT), big data, machine learning and other advanced topics where countries such as Vanuatu that provide exceptional innovation opportunities can develop an agile and responsive workforce for early- adopters in the space to grow.
• • • Policy Recommendation 30 – Public Awareness – ICT HR Initiatives 154.

In parallel with these initiatives, Government will actively promote digital literacy and open access for differently-abled citizens and special-interest groups to make e- Vanuatu as inclusive as possible.
Digital literacy will be promoted using each sector of education: a) by ensuring that the ECE and primary education are digitally-enabled; b) with secondary curriculum and teaching methods geared for the knowledge economy; c) tertiary education offering specialisation in priority areas to support the knowledge-economy; and, d) TVET and continuing adult education initiatives targeted at specific technical skill requirements as well as life-long learning for digital literacy in older citizens.
Digital Literacy in the Education System Government will work with curriculum designers and external partners in the education sector to promote digital literacy across all sub-sectors and age-groups.

Policies for ongoing monitoring of digital literacy levels will be established.

Policy Recommendation 31 – Digital Literacy in Education 155.
Analysis of ICT investment returns from UK government investment in science and innovation confirms that: a) social returns are significant – normally 2 or 3 times greater than financial benefits and persist long into the future.

Every pound spent delivers an Draft v0.95 – For Committee Review & Consultation Page 51 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft average social rate of return (i.e.
a return to wider society beyond direct investment benefit) of between 20% and 50% per year in perpetuity; b) investment in support of business-led innovation has generated a return to the economy of between 300% and 900% of additional value (Gross Value Added) for public money invested.

156.
156.

The policy of the Government of Vanuatu will be to promote investment in science and innovation locally, that will pay for itself many times over through expansion of capacity to exploit technologies developed elsewhere, direct economic growth, attracting business investment, and from improvements in living standards.

157.

Engagement with the private sector will also be developed, as experience43 indicates that innovation support increases corporate survival probability by around 3% over a decade.
Government Innovation Partnership Fund Government will establish a partnership fund to be accessible by consortia consisting of national companies, educational institutions and public-sector bodies acting in consort to seek out opportunities for deployment of ICT in support of national development and commercial opportunities.

Donor support will be sought to help attract the brightest and best human resources, ideas and capital.
Policy Recommendation 32 – Government Innovation Partnership Fund 10.3 Electronic Commerce 158.

In recognition of the critical role that e-Commerce 44 will play in economic development, its use shall be promoted in trade and investments as a means of integrating Vanuatu with the global economy.

Government will: a) support the development of e-Commerce by enhancing existing legislation45 to support digitally-enabled national and international trade.
These developments need to go far beyond existing initiatives in the management of 43 Innovation and the UK Knowledge Economy - https://www.gov.uk/government/speeches/innovation-and-the-uks-knowledge-economy (accessed November 2020) 44 The term “e-Commerce” is used throughout this document as a proxy for the more widely recognised term “e-Business”.
In Vanuatu, “e- Business” is conflated with a peculiar piece of legislation set up to promote the use of “cybersuites” – which are effectively free-trade zones regulated by the Vanuatu Financial Services Commission (VFSC) for offshore companies and crypto-currency trading, amongst other things.

See also Section 7.1.4 of the Vanuatu Legislation Review for ICT Policy Issues – September 2020.
45 A separate review of legal challenges, along with suggested actions can be found in the Vanuatu Legislation Review for ICT Policy Issues – September 2020.

The document puts forward revisions to existing statute and Bills (the National Payment Systems Bill, for example), some new Bills (particularly in the fields of data protection and digital identity, and a general focus upon the “framework” approach to legislation.

This latter point is a crucial one.


Instead of attempting to make existing law equivalent by mandating that an electronic document is the equivalent of a paper one, for example, or creating an entire new acquis of digital law that mirrors existing legislation, law should be drafted in future that avoids specifying processes.

Instead, the law should set out features that must be present, the parameters within which those features should operate, and specific outcomes that need to be achieved.
Section 3.3 Structure of a Potential Legal Framework covers this point in further detail.
Draft v0.95 – For Committee Review & Consultation Page 52 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft import and export processes46 and extend into widespread commercial, retail and citizen interactions; b) develop and regulate a secure electronic funds transfer and digital transaction payment system; c) consolidate multiple forms of identity verification into a unified national digital identity for each citizen, supported securely by biometric credentials.
Access controls for the purposes of authentication, accreditation, Know-Your- Customer (KYC) and other legitimate purposes will be provided by solely by means of API messaging/response; d) formalise the role of intermediaries within the scope of e-Commerce.

These may be financial (card and mobile payment providers), logistical (fulfilment services) or technical (website owners, telcos, ISPs etc.).
There must be robust and actionable recognition of the role(s) of intermediaries, as well as specific liabilities and exclusions at each stage of e-Commerce transactions (see Policy Recommendation 33 below); e) promote nationwide communications and information campaigns to raise public awareness of the opportunities (and safeguards required) of digital transactions.

Legal Reforms Supporting e-Commerce 159.


The Electronic Transactions Act (Cap 263) governs electronic transactions and related matters, including legal recognition of and requirements for electronic records, formation and validity of electronic contracts as well as other communication of electronic records, electronic signatures, encryption and data protection as well as obligations and liability of intermediaries and e-commerce service providers.

160.
160.

Although provisions are made for the registration of certification service providers at Section 20(2) of the Act, none have yet come forward for consideration or approval in the two decades since the Act received assent.

Furthermore, no regulations appear to have been issued to control the operation of Certification Authorities.

161.

The recent Legislative Review for ICT Policy Issues (q.v.)

sets out a considerable number of challenges with the existing body of statute.
Primarily, attempts to establish equivalence47 between existing processes and their digital replacements are not likely to succeed in the short or medium terms.

The Review argues instead that 46 Thus far, trade issues have almost exclusively focussed on import/export, along with the collection of fees, charges and tariffs.

A very small number of importers do make electronic payments prior to clearance of goods.
Broadening this e-Commerce model will require significant consolidation and refinement of the Vanuatu legal environment.

See detailed discussions in the Vanuatu Legislation Review for ICT Policy Issues – September 2020.

47 Equivalence (between digital and hard-copy documents) is so far the only attempt made in Vanuatu law to address considerations of the digital age.

Nowhere have equally important consideration of processes been addressed (contract offer, acceptance, consideration etc.
or even the basic signing, stamping, sealing, storing, filing, serving processes applicable to documents themselves) with the result that the legislation is largely either ineffective or incomplete.

Draft v0.95 – For Committee Review & Consultation Page 53 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft broad-brush “equivalence” should be replaced by Framework legislation, that avoids describing the implementation of processes.
Instead, this approach sets out features that must be present, the parameters within which those features should operate, and specific outcomes that need to be achieved.
Reform of e-Commerce Legal Framework Priority reforms to be addressed are: • implementation of the provisions of the Electronic Transactions Act (Cap 263) – particularly in respect of regulations to govern the responsibilities of Certification Authorities and service providers; framework legislation to govern e-Commerce transactions (offer, acceptance, consideration, ownership of goods/services, etc.
); the National Payment System (as proposed by a draft Bill under consideration by Parliament) will be regulated; and, digital identity, biometric data, and accreditation for all purposes where verification of the individual is required.
• • • Policy Recommendation 33 – Framework Legislation for Reform Digital Payments Digital Payment Regulations Government will expand the role of the Vanuatu Financial Services Commission to include provision of regulations for the financial and fiduciary aspects of digital payment methods, tools and processes applicable to all transactions48 that involve individuals or companies registered in Vanuatu.
Where issues that may impact national monetary policy49 are encountered, VFSC shall be advised by the Reserve Bank of Vanuatu.

Policy Recommendation 34 – Digital Payment Regulations – VFSC Digital Identity 162.

A system of digital identity will be put forward and adopted by Government.

This is an essential building-block for e-Government service delivery and defines how individuals are recognised online.

163.
163.

The benefits for citizens, businesses, and Government are substantial in terms of process cost reduction, accuracy and targeting of service delivery, and citizen confidence that their identity is secure, trusted, unique, and owned wholly by them.
It will eventually be used to access all e-Government services including democratic participation (voting), access to healthcare, education, and all other instances where 48 Many transactions between business and citizens in Vanuatu, undertaken using banks and mobile money providers registered in Vanuatu are presently conducted in offshore jurisdictions.

An effective onshore regulatory regime is essential for the maintenance of public trust.
49 Such as reductions in the amount of physical currency in circulation whenever digital payment methods become readily accepted.

Draft v0.95 – For Committee Review & Consultation Page 54 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft proof of identity is required (banking, establishing a company, healthcare, medical prescriptions, tax, travelling, provident fund etc.).

164.
164.

Digital identity will be supported by biometric data (fingerprints and iris scans) to authenticate and uniquely identify individuals in a safe, secure and reliable manner.

balancing individual privacy rights, cultural considerations, commercial needs and the interests of Vanuatu.

165.
The methods and processes by which digital and biometric identities are established will: a) place citizens firmly in control and ownership of their digital identity; b) enable citizens to participate in the digital economy and society more easily with confidence and choice; c) empower businesses to deliver innovative solutions based upon secure and reliable end-user accreditation and identity; d) improve productivity and ease of compliance at reduced cost/effort when requesting, attesting and validating identity or identity attributes; and e) better adapt to identity challenges in an increasingly fast-paced and ever- changing world.
166.

Uses for digital identity are not limited to individuals and governments, they have beneficial impacts across the whole economy and adoption is an innovation issue that needs public-sector investment on a national scale.

167.
167.

Investment in digital identity will be a national priority, to be delivered in a uniform national approach that encompasses all public sector identity-management requirements and extends further into Know-Your-Customer (KYC) requirements for financial-sector operations as well as all manner of commercial applications where identity verification is needed.

168.
168.

Removing silos of data by use of a common nationwide approach, led by the public sector, will support trusted operations and deliver significant cost efficiencies from data storage, interoperability and shared accreditation credentials.

An open protocol will also create deeper insights, delivering personalised customer experiences and help build trusted relationships.

169.
169.

Implementation will require support from the business community to help shape national digital transformation and enable wide acceptance of an open protocol for digital identity.
Draft v0.95 – For Committee Review & Consultation Page 55 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Digital Identity and Authentication Government will bring forward legislation to establish biometric identification of natural persons, and for a unique and authoritative method of proving the identification of individuals.
The following policy objectives will be included: • a secure central repository of encrypted data will be maintained by Government and overseen by a regulatory body established for the purpose; this data set will only be accessible where permitted by the regulator, and in no circumstances will data move out of this repository; biometric identification will be used to generate unique digital identity; access for identity verification in support of other purposes (voter registration, passport issuance, private-sector KYC requirements, and e-Government service delivery, for example) will be provided only by use of verified and secure APIs; and, the primary record of reference for all citizens and purposes shall be the biometric national identity.
• • • • Policy Recommendation 35 – Digital Identity and Authentication Intermediaries and Contract Law in Digital Transactions 170.

A recent legal review50 argues that the standard offer, consideration, and acceptance provisions in contract law presently have no equivalents in digital terms (nor do advertisements or invitations to treat).
Furthermore: a) provisions for consumer consent to the collection, use, safeguarding and storage of transaction data are inadequate; b) diverse legislation such as the Price Control Act (Cap 86) and the Value Added Tax Act (Cap 247), both of which are most prescriptive in terms of invoicing and signatures, will need to be revised if online transactions are to occur; and, c) issues arising from contract performance, repudiation of payment, and redress need careful consideration.
Framework Legislation for Digital Transactions Government will undertake to provide suitable parallel framework legislation as a matter of urgency to provide similar protections for online transactions as have been built up over years of experience of existing methods of transacting business between individuals, companies and Government.
Policy Recommendation 36 – Intermediaries and Contract Law in Digital Transactions 50 See Vanuatu Legislation Review for ICT Policy Issues – August 2020 Draft v0.95 – For Committee Review & Consultation Page 56 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Digital Transaction Risk and Opportunity 171.
Supporting infrastructure for the combination of technologies, policies and procedures, which will support digital signatures, encryption and other Public Key Infrastructure (PKI)-enabled transactions will be required, along with significant public education as to the risks and opportunities these present.
Public Awareness of Digital Transaction Risk and Opportunity Government will undertake a sustained nationwide public education initiative that engages civil society groups to raise awareness of how digital transactions work, the risks, opportunities and possibilities.

PKI, encryption, security, authentication and digital online safety will be key subjects in the education program in order to develop public confidence in a viable digital transaction ecosystem.
Policy Recommendation 37 – Public Awareness – Digital Transactions Draft v0.95 – For Committee Review & Consultation Page 57 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 11 E-GOVERNMENT POLICIES 172.

Government is under relentless demand-side pressure to achieve directly conflicting goals; providing more and better services, more quickly, for its citizens and at the same time reducing the costs of service provision.
Technology and the deployment of e- Government will be key factors in balancing these competing pressures.

11.1 Policy Objectives 173.
By applying ICT-enabled transformational change to the ways in which services are delivered, (a workable definition of e-Government), the objectives of this National ICT Policy are: a) efficient, effective, accessible, and transparent Government services that meet the needs of its citizens and stakeholders across the nation (Digital First) delivered at manageable cost; b) enhancing collaboration between Government agencies, businesses and citizens to improve the efficiency and effectiveness of resource utilisation (including continuous reduction of transaction costs and data exchange founded upon the national data model, see Section 8.2); c) promoting competitiveness and open access to information held by public- sector bodies by providing easy access, timely information and universal delivery of Government services supported by effective information security and appropriate protections for personal data; d) establishing a core e-Government framework of technologies, processes, user- interface design guidelines etc.
within which Ministries are individually responsible for their own service delivery priorities; and, e) building-in usability and accessibility for all stakeholders to participate in the information society of the future.

174.

These policies provide broad support across all aspects of the NSDP Society and Economy pillars.

11.2 e-Government Service Delivery Digital First 175.
Government intends to embed digital delivery of services at the heart of its strategy, to improve effectiveness and efficiency across all the services offered to citizens, businesses, and other stakeholders.

176.

Government shall adopt a “digital-first” policy, to place technology-enabled efficiencies and effectiveness at the heart of all its operations, present and future.
Whether donor-supported or not, all new initiatives proposed by Ministries or Draft v0.95 – For Committee Review & Consultation Page 58 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Agencies that have any form of digital component will need to show how digital service delivery means have been included within every investment proposal, and how these are integrated with the National ICT Policy.
Digital-First by default Government will promote the use of ICT in all of its operations with a “digital-first” approach.

This will be deployed incrementally, with any new initiatives required to include specific consideration of digital enablers, in parallel with process-reengineering of existing Government operations to embed digital methods in service delivery that have improvements to efficiency and effectiveness at their core.

Policy Recommendation 38 – Digital-First By Default 177.
Automation of Government functions in particular for priority sectors (Health, Education, Agriculture, Lands), and citizen service delivery across all other Ministerial portfolios will be the subject of sustained transformation and reform efforts made jointly with stakeholder involvement.

178.

Widespread use of ICT across all public sectors operations as well as partnership initiatives with the private sector will aim to increase both the productivity and competitiveness of the national economy.
Investment Evaluation and Prioritisation 179.

Government recognises that commitment of any public funds and effort must only be undertaken once a holistic and realistic assessment of detailed investment cases has been made.
There are many competing pressures upon public investment, and in order to compete effectively for allocation of scare resources, all ICT-related investments will be required to be accompanied by: a) detailed investment case considerations, (these will be mandatory for all projects with ICT components); and, b) demonstration of how compliance with this National ICT Policy Framework and any resultant policies is to be ensured by the investment/work/project as proposed.
Mandatory ICT Investment Evaluation Government will develop model investment case guidelines: • • these must be completed prior to the approval of any project with an ICT component; all investment cases will be reviewed by appropriate Government stakeholders (including OGCIO for all ICT-related investments) for compliance with guidelines as set out in this document along with resultant ICT policies; and, financial and knowledge-economy investment returns will be the primary comparators between projects, with preference given to those where projected benefits are the most likely to be achieved.
• Policy Recommendation 39 – Mandatory ICT Investment Evaluation.

Draft v0.95 – For Committee Review & Consultation Page 59 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Smart Islands 180.

The Smart Village51 concept as set out by the International Telecommunications Union (ITU) has some possibilities for adoption in Vanuatu now that the essential connectivity has been largely deployed, and once some baseline e-Government services are implemented.
Government proposes to set up some “Smart Island” pilots as rural digital hubs.

181.

Smart Islands will require the engagement of a broad range of across both public and private sectors to provide early-adopter lessons from the evolution of local digital economies that also improve the welfare of society as a whole.

These initiatives will be citizen-centric and become examples for subsequent nationwide and coordinated approaches in support of rural digital transformation.
11.3 Interaction and Collaboration 182.

Target constituencies for e-Gov service delivery are primarily specific groups and sectors within Vanuatu, and secondly, other international bodies (donors, NGOs, regional and international collaboration organisations).
In order of importance, the national priorities shall be: a) Government-to-Business (G2B) engagement, to promote economic growth by streamlining regulation, licencing, permissions, and procurement as well as fostering competition; b) Government-to-Citizen (G2C) interactions.

The focus of early attention shall encompass dissemination, clarity, and availability of information (push transactions).
Once the tools for digital authentication of individuals and digital payments are deployed, the scope of G2C interactions can broaden rapidly and deliver “digital first” online service-delivery objectives such as democratic participation, to health/education services and many more; and, collection, electronic payments, access revenue c) Government-to-Government (G2G) improvements to both efficiency and in the internal transactions will be key milestones effectiveness of transformation of service delivery to businesses and citizens.
183.

Clearly the nation and in particular digital services do not (and can not) operate in isolation from the wider internet, or from international obligations to which Vanuatu has committed.

184.

Sections 9.5,and 10.2, as well as Para.

154 address the interests of both internal and external stakeholders in this National ICT Policy.

51 See ITU.int Draft v0.95 – For Committee Review & Consultation Page 60 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Services Catalogue 185.
A key challenge in moving to e-Government as the primary mode of service delivery is understanding just how many services Government provides to the range of stakeholders.

Beyond this, the ownership of services, responsibility for ensuring delivery quality and accountability is distributed across Ministries And Agencies, most of whom do not have professional experience of e-Gov.

Defined standards for service delivery are not commonplace in Vanuatu (what does “good” look like?)
and there few defined boundaries or legal obligations for the quality and upkeep of these services.

a concise description of the service; Comprehensive Services Catalogue Government will develop a comprehensive catalogue of services that it provides.

Each service will be described in terms of the following: • • who can access it; • how it is delivered (by whom, how long it should take to deliver etc.
); • what costs/fees/charges are incurred by the consumer of the service; • who is responsible for delivery; • which organisation is accountable for service provisions; • what standards are associated with service delivery; and, • how delivery will be monitored for compliance and performance.

Having developed this catalogue, services will be evaluated for suitability for conversion to e-Gov delivery modality within the “Digital First” agenda.
The Services Catalogue will form the basis of the e-Government portal or “one-stop-shop” for stakeholder access to interact with Government.

All new services, or services included within any reform activities, shall be “digital first” by default, and all proposals for change shall be evaluated against efficiency and effectiveness targets set by Government.
Policy Recommendation 40 – Services Catalogue Development 186. it is highly likely that multiple service catalogue views may be required for different stakeholders.

Initially, a stakeholder version for citizens and consumers of services will be developed: it is essential that this is organised around outcomes rather than the organisational structure of Government (users should not require knowledge of Ministerial or Agency responsibilities in order to access services).

187.
187.

Over time, other catalogue views will be developed such as: a) performance/statistical reporting views for service owners and managers; b) services grouped by legislation or regulatory instrument; and, c) technical architecture perspectives used as input for development of future ICT policies.

Draft v0.95 – For Committee Review & Consultation Page 61 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 11.4 Open Access and Competitiveness Open Access 188.
Access in terms of geographical coverage is addressed by the UAP (see Section 6.2) and equality of opportunity by Section 6.4 (Digital Literacy and Inclusivity).

Open Competition 189.

Government exercises considerable influence in the local marketplace and will always set out and implement open standards using fair and transparent processes that avoid identification of particular brands or products in specifications or requirements52 as these could limit the usability of the technology.
Open Standards - Procurement Open standards will be used across Government for all technology procurement events; and: • will be designed give suppliers equality of access to government procurement events; • • include provisions for flexibility and change; and, support sustainable costs (whole-of-life costs will be the absolute benchmark for cost comparisons).

Standards will be selected using fair and transparent processes, published, and accessible to reduce digital exclusion.
Policy Recommendation 41 – Open Standards in Procurement 11.5 E-Gov Technology Architecture and Standards Open Standards 190.

Government will henceforward specify the use of open standards for software interoperability, data and document formats, unless there is a clear reason why this is not possible.
Technical specifications must offer equal access for all relevant economic operators to procurement events and must not create unjustifiable obstacles to the opening up of public data and operational processes.
Open Standards - Technology Government will develop open standards that must meet user needs and be: • free to access for users ; 52 Unless justified by the subject-matter of the procurement event, technical specifications should not refer to a specific make or source, or a particular process which characterises the products or services provided by a specific economic operator, or to trademarks, patents, types or a specific origin or production with the effect of favouring or eliminating certain undertakings or certain products.
There may be exceptional derogations granted however, these however must be adequately documented, approved by the relevant authority, and be accompanied by a statement to the effect that equivalent products or services are acceptable.
Draft v0.95 – For Committee Review & Consultation Page 62 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft • • • • set out clearly so that users and potential suppliers can easily understand and use them support API-based data interchange and security controls (in particular in facilitating the exchange data using the software of user’s choice); improve the availability, clarity, and consistency of data used in operation of e- Gov processes; and, improve interactions between all stakeholders (G2B, G2C and G2G).
Policy Recommendation 42 – Open Standards in Technology Reusable Core Processes 191.

Common software and process functionality will be reused across the Government technology asset base to reduce costs, streamline implementation, and improve interoperability.

Examples of standard API procedure calls that may evolve are payment gateway operations (checking card details, payment transaction completions etc.
), biometric verification and user credential checking, verification of digital certificates, and many others.
Reusable Core Processes Government will incrementally develop a library of reusable core processes (and code) to manage frequently used functionality: • • code libraries will generally be accessed via remote procedure or API calls; credentials for access must include source application, operator ID and device information; duplication of software functionality will be generally prohibited in favour of promoting reuse.

• Policy Recommendation 43 – Reusable Code and Processes National Data Model 192.
Data definitions for core elements will be defined in the NDM (see Section 8.2).

Both software acquisition and reusable core processes must be compliant with NDM data formats, content and accessibility.
Data Visualisation Government will promote the interpretation of data and creation of enhanced value by: • acquiring, processing, parsing and occasionally combining diverse datasets while creatively looking for opportunities to present data visually; developing and understanding data visualisation techniques and libraries (in particular in their applicability to policy and strategy challenges); and, building static and interactive data visualisations and novel ways of converting data into information.
• • Policy Recommendation 44 – Data Visualisation 193.

See also the data visualisation and value journey depicted in Figure 6 - Value-Add Data Journey (page 99) Draft v0.95 – For Committee Review & Consultation Page 63 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft User Experience Design Guidelines 194.

Guidelines for User Experience (UX) design will conform to the Web Accessibility Initiative (WAI) promulgated by the World-Wide Web Consortium (W3C) 195.
Three sets of reference standards are proposed for adoption as part of this National ICT Policy, they are: a) Web Content – the W3C guidelines are approved as ISO/IEC 40500:2012 and set out how to make web content more accessible to people with disabilities.

Web “content” generally refers to the information in a web page or web application, including: 1. natural information such as text, images, and sounds; and, 2. code or mark-up that defines structure, presentation, etc.
b) Authoring Tools – for use by users or support resources who generate and publish content (posting to forums, uploading images/videos etc./); and, c) User Agents – that address plugins and providers of (e.g.)

media content.

Ministerial Responsibilities 196.

Nothing in this National ICT Policy document removes or alters Ministerial accountability for selecting, provisioning, operating and maintaining technology specific to their operational requirements or in support of their mandated responsibilities.
197.

Integration of ICT will remain a priority for Sectoral Policies, particularly in education, health, productive sectors, transport (especially maritime), trade and attraction of foreign investment.

198.

In more general terms, Ministries will also be responsible for harnessing ICT to promote gender equality, social equity, democratic participation, preservation and promotion of local culture (including arts), and protection of the environment.
Draft v0.95 – For Committee Review & Consultation Page 64 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 12 E-ENVIRONMENT POLICIES 12.1 Policy Objectives 199.

Government will promote policies for the use of environmentally-friendly ICT products.

These will include: a) developing regulations for recycling and disposal of used ICT equipment, supported by an appropriate legal framework.
Monitoring/evaluation, and remedial provisions where necessary; b) development of modern broadcasting facilities deployed sensitively to minimise environmental impact and energy usage.
As a prerequisite for grant or renewal of licenses, applicants will be required henceforth to demonstrate proposals for reducing the effects of their broadcasting infrastructure on the environment; including provision of appropriate recycling/disposal facilities for waste that may contain toxic substances; c) whole-of-life environmental impact benchmarks, these will assess the production, operation (consumables, for instance) and disposal aspects of ICT equipment as well as the energy requirements for their daily use; d) incentivising adoption of best practices to encourage reduction of carbon footprint, efficient energy management, e-waste recycling, re-forestation and eco-rating of ICT products.
200.

These policies support NSDP Environment Pillar (particularly ENV 2.1, 2.2, 2.4, 4.6 and 5.6) e-Environment Policy Government will develop specific e-Environment guidelines for the acquisition, usage, and disposal of ICT equipment.

Policy Recommendation 45 – e-Environment and Green ICT Draft v0.95 – For Committee Review & Consultation Page 65 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 13 RADIO FREQUENCY SPECTRUM POLICIES 13.1 Policy Objectives 201.
Government will continue to license broadcast signal distribution services in accordance with: a) market growth; b) availability of the required radio frequency spectrum resources to maximise the use of broadcasting infrastructure c) provision of services by all licensed signal distributors to consumers on an open access and non-discriminatory basis.

202.

These policies support several NSDP Pillars (particularly ECO 2, 2.4, 2.8, 2.9, ENV 2.1, SOC 6.7, ) 203.
Additional licenses for other spectrum uses such as maritime communications, emergency services, aviation, short range devices, special categories (ground radars, etc.)

will continue to be maintained by TRBR and Government reaffirms its approval for TRBR Spectrum Management Principles53.

13.2 5G Spectrum 204.

Government recognises the emergence of fifth generation (5G) standards, that are designed for higher-capacity wireless services.
Although there are benefits to be gained from eventual deployment of 5G devices and access-points particularly in terms of reduced latency 54 and increased bandwith availability, it will not be Government policy to permit anything other than a small-scale and controlled test of 5G outside of urban centres in the medium term (for at least five years).

205.

The deployment of eGovernment services across the nation will be targeted at using 4G delivery technology (as a maximum).
There are few services available to subscribers now (or predicted within the next five years) that would be dependent upon 5G infrastructure.

Simply put, the priorities of Government are in ensuring universal access to 4G technology with significant improvements in quality-of-service levels before it will countenance additional investment in 5G technology (whether led by public or private sectors).
53 See https://www.trbr.vu/attachments/category/220/trr_spectrum_management_principles.pdf 54 Latency is a measure of the inherent delay in connecting to network(s) and delivering content demanded by devices Draft v0.95 – For Committee Review & Consultation Page 66 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 5G Policy Government will permit a limited number of small-scale non-urban trials of 5G technology.
Specific requirements for 5G testing are: • operators must seek and obtain TRBR approval prior to trial deployment of any 5G equipment; formal analysis of service levels, performance, and quality of service must be included in any trial; and, detailed assessments of potential impact upon the health of citizens, users, and flora and fauna must be conducted as part of any trial, the parameters of which must accord with the International Commission on Non-Ionising Radiation Protection (ICIRP) and/or the World Health Organisation (WHO) • • Policy Recommendation 46 – 5G Policy Draft v0.95 – For Committee Review & Consultation Page 67 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 14 COMPETITION POLICIES 14.1 Policy Objectives 206.
In conformance with policies related to the development of a knowledge economy and promotion of innovation (Section 10) the Government shall adopt a balanced approach to competition policy that: a) actively promotes competition in all its forms; i. in the ICT sector particularly, with its significant impact upon near and medium-term economic growth prospects, competition between service providers of all types shall be fostered; ii.
the policy shall reduce restrictions and remove opportunities for the undermining of competition in all their forms to maximise the positive impact that competition can have upon investment, innovation, and economic growth; iii.

where dominant national market players exercise monopolies or near-monopolies, appropriate regulatory controls shall be established to ensure transparency and (where necessary) price controls; and, iv.
where Government must make technology choices that are limited by supplier availability in the international marketplace over which regulatory controls cannot be effected, these shall be made in an open and transparent manner; b) is cognisant of the influence Government can have as a customer for, or promoter of, ICT initiatives across the whole spectrum of the economy.
This shall not preclude Government from investing in competing technologies or organisations, however; c) limits exclusivity or non-competition protections within strictly time-bound periods, and then only where no other options are available; and, d) promotes public-private partnerships wherever appropriate.

207.

These policies support the NSDP Economic Pillar (particularly ECO 2.4, 2.8, 3.3, 4.1, 4.5 and 4.9) 14.2 Open Competition 208.
Government recognises various aspects of its role in promoting the development of a knowledge economy, fostering innovation, and as a large-scale consumer of ICT services.

209.

These roles variously include “anchor tenant” for large infrastructure projects, provider of funding (in whole, in part, and sometimes in collaboration with international bodies) for early-stage transitions of innovation into mainstream usage, and other related partnership activities with stakeholders.
Draft v0.95 – For Committee Review & Consultation Page 68 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Promoting Competition The Government will promote open and fair competition in all its forms.

This will include, but not be limited to: • • open tender processes for public-sector procurement; and, avoidance of contract lock-in, exclusivity, or other forms of restrictive practices wherever possible.
Policy Recommendation 47 – Promoting Competition Open and Fair Competition The Government expects to take equity positions in third-party partnership operator arrangements (along with all manner of other ICT initiatives and innovations55).

As such, any exclusive arrangements entered into with any supplier, service provider or external organisation, may only be considered for a time-limited “concession” period and exclusivity must cease immediately thereafter.
Government will not be bound by any non- competition terms under any circumstances56.

Policy Recommendation 48 – Open and Fair Competition 210.

Government shall retain the option for participation in private sector initiatives, and equally shall make available possibilities for private-sector engagement in initiatives managed by the public sector (including other bodies in the wider public-sector such as VNPF etc.)

14.3 Net Neutrality – Open Competition 211.


Net neutrality is the principle that Internet Service Providers (ISPs) must treat all internet communications equally, without discriminating or charging differently for access irrespective of user, content, website, platform, application, traffic-type, type of equipment, source address, destination address, or method of communication.

212.
212.

Government is committed to an internet that is as open as possible from the perspective of free and fair competition between providers.

55 See Section XX (Competition) in particular) 56 For the avoidance of doubt, this may mean that the Government simultaneously holds stakes in competing ICT or infrastructure propositions or service-delivery organisations.

This is regarded as entirely normal.


Draft v0.95 – For Committee Review & Consultation Page 69 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Net-Neutrality – Open Competition Government policy will be effected that ensures all forms of service provision will be available equally from service providers, for the benefit of all stakeholders.
For the avoidance of doubt, policy and associated regulations will require that access shall be controlled solely by data consumption (data usage) on the part of ISPs and will specifically remove the ability for ISPs to block any form of content or service that does not otherwise contravene the laws of Vanuatu.

Policy Recommendation 49 – Net Neutrality (Competition) 213.
There are dimensions of the wider net neutrality debate, particularly around censorship, self-regulation and liability for content that are further addressed in Section 15, and in particular the liability of common carriers (Sections Error!

Reference s ource not found.

and 15.2.1) Draft v0.95 – For Committee Review & Consultation Page 70 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 15 CONSUMER PROTECTION POLICIES 214.
The scale and scope of digital services is very large and growing at an exponential rate across the globe.

Facilities in common usage now include online search, social networking, video-sharing platforms, cloud computing, internet messaging services, online operating systems, online marketplaces and advertising products, for example, all of which have potential for exploitation of the individual, and for which no globally- applicable standards and few legislative consumer protections presently exist.
15.1 Policy Objectives 215.

The Government shall: a) facilitate the protection of citizens and stakeholders by the development of relevant legislation and regulation.
In addition, a series of policy measures will be prioritised in order to establish that education of the individual and concepts of personal responsibility are adequately supported by regulatory mechanisms to protect cyber-space for its citizens; b) contribute to international cooperation initiatives57, and adopt cross-border regulatory frameworks to deal effectively with issues related to content and services that strengthen international cooperation and policy implementation for ICT-related consumer protection initiatives; c) promote the development of Codes of Practice by service providers, including telcos, ISPs, OTT content providers etc.
for the self-regulation of content, promotional activities and operation of services (including initial complaint handling and redress), and monitor compliance with consumer protection legislation; d) develop framework legislation and related procedures that embrace digital versions of contracts, terms, conditions, redress, risk management, etc; and, e) ensure that no artificial barriers to access, use, or applicability of ICT services or provisions exist for the differently-abled.

216.
216.

These policies support NSDP objectives SOC 2.1, 4.5, 4.8, 4.9 as well as ENV 1.4, 2.1, and ECO 2.9.

57 See also Section 16 Draft v0.95 – For Committee Review & Consultation Page 71 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 15.2 Legislation and Regulation Net Neutrality – Responsibility of Carriers 217.

Protection of citizens from cyber-threats arising from content is challenging.
There is significant divergence between legislation enacted (or proposed) in different legislatures around the globe, and as yet no clear indications can be determined as to the ultimate direction of rapidly evolving and extremely complex law58.

The obstacles to establishing equivalence59 and harnessing existing legislation are that at technical levels, broadcast, print and digital media and OTT services are substantively different.

Treating them as being equivalent is unlikely to prove successful60.
218.

Government inclines to the view that service providers involved in the delivery of content (be they Vanuatu Post, or ISPs who do not create intellectual property) should share the same legislative framework, in that they are wholly engaged in the transmission of material from a source to a destination.

219.
219.

A viable framework for “carrier” liability in these circumstances may be feasible within existing statute in Vanuatu, in that Courts may intervene to cease delivery in well- defined circumstances, using management, supervisory and reporting processes that are known and established61.

Carrier Responsibilities Government will establish framework law that treats “delivery only” ISP activities in a broadly similar manner to the ways in which physical delivery services are managed at present.
Developments in regulation of ISPs and technology service providers that take place in other jurisdictions will be closely monitored, with appropriate legislation being promulgated whenever appropriate.

Policy Recommendation 50 – Carrier Responsibilities 220.
Any future framework law in Vanuatu, perhaps proposed as a result of evolution of statute in other jurisdictions, will need to address clear delineation between responsibilities of “carriers”, and especially where these diverge from those of OTT and other “publishers” (creators, owners and disseminators of content)62.

58 The EU proposals as set out in the Digital Services Act are quite different from the US approach.

The EU aim to force service delivery platforms to police what is posted or sold online.
59 One of the key arguments that undermine the “equivalence” approach generally, and why framework legislation is the suggested option of the Vanuatu Legislative Review for ICT Policy Issues (q.v.)

60 An email is not equivalent to a letter merely by diktat.

There are material differences in transmission, storage, delivery, security and many other characteristics, usage, liability and trust, for example.
61 Indeed, the Cybercrime Bill (2019) adopts largely the same methods for requiring ISPs to proscribe delivery of content deemed objectionable as that which may be imposed upon postal services or broadcast media under pre-existing statute law.

62 Recent developments in agreements between Facebook and the Australian media sector are a case in point here, demarcating Facebook from being a publisher to a carrier.

This area is however both complex and rapidly developing.
On one hand Facebook being compelled to enter into commercial arrangements to host and/or deliver intellectual property of Australian publishing houses appears to position Draft v0.95 – For Committee Review & Consultation Page 72 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Net Neutrality – Owners and Users of Intellectual Property 221.
Much as there are a variety of differing perspectives concerning the responsibility and scope of the “duty of care” approach for carriers, (above) there are similar concerns surrounding service providers where distinctions between creators of intellectual property, monetisation of data assets, and publishing of third-party content become blurred.

222.
222.

Some examples illustrate the approach the Government proposes to take in respect of “intermediaries”63: a) it is not logical to hold a social media platform provider liable for opinions expressed by its users.
In this regard, the service provider is an “intermediary” and the conceptual desirability of permitting free-speech outweighs any imposition of censorship whether arising from vicarious liability or otherwise; b) contributors to social media (and by implication also all creators of content or intellectual property) must ultimately be liable for their actions; and, c) those who consume social media (or other) content do so at their own risk.
Social Media – Education Policy Government will lead by example and initiate a wide-ranging campaign with content targeted at specific sectoral groups (children, young adults, differently abled, leaders, the elderly etc.)

that highlights the challenges and pitfalls of using social media, while at the same time educating the population at large as to what constitutes responsible usage.

Policy Recommendation 51 – Social Media Education Policy 223.
Though the above may be adequate for most citizens and in most circumstances, there are inevitably instances where additional protections may be beneficial, particularly in respect of OTT services64: a) where providers 1) develop content themselves, 2) stream content from third- parties under licence agreements, or 3) where online advertisements are delivered by OTT providers using user-interest/behaviour data purchased by third-parties that target content-delivery to users, then OTT providers and third-party owners of IP (advertisement or core content) may become liable.
The creators of content must of course retain liability for the content itself, and Facebook as a carrier.

On the other hand, as a private company, Facebook can run whatever adverts it likes.

In this context it appears clear that Facebook now behaves a publisher, and moreover a publisher with an agenda.
Any notion that Facebook (or Twitter, or YouTube) are simple “carriers” or “platforms” seem to have been superseded, and instead they are more akin to being opinionated channels, alongside Fox News, Russia Today, the BBC or Al Jazeera.

63 Intermediaries are typically social media applications and organisations such as Facebook, Twitter, WhatsApp, Instagram, TikTok and others 64 OTT providers (Netflix, Amazon Prime Video, DisneyPlus, Apple TV+, iTunes etc.)
primarily support the delivery and monetisation of live and video-on-demand content.

Additional services including messaging, audio-streaming and VoIP are sometimes included.
Draft v0.95 – For Committee Review & Consultation Page 73 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft the OTT providers as distributors and in some cases editorial sponsors of such content; and, b) creation of intellectual property content will always attract liability when such content is “published” or provided for streaming/download.
Net Neutrality – Framework Legislation Net Neutrality – Framework Legislation Government will put forward framework legislation preserve freedom and openness of internet access across the nation by: • establishing the “user-first” perspective as a policy principle for the availability of internet access; confirming the liability of OTT providers and IP owners for the content they distribute and create, while at the same time limiting the liability of the ISP “carrier” in conformance with existing provisions for legal means of monitoring, removing and barring access to content where legally justified; limiting the shaping of traffic or other forms of prioritisation to traffic type (video, voice, data etc.)
and enforcing equal treatment between applications of the same type or function; outlawing individual prioritisation, throttling or blocking of websites (and especially “hidden” phenomena such as website sponsorship or payment for enhanced access); and, constraining the use of deep packet inspection and/or packet filtering solely for the purposes of reasonable and legitimate network management (prevention of spam, malware, DDOS attacks etc.).
• • • • Policy Recommendation 52 – Net Neutrality – Framework Legislation Consumer Protection Law 224.

Government will ensure that the protection for its citizens as enshrined in statute law will be available equally, whether transactions are conducted by existing means or using digital services of any kind (the approach to achieving this is expanded upon in Section 15.4 below).

Protection of Personal Data 225.


In many parts of the world, the use of internet activity tracking techniques (cookies and others) have become commonplace in the highly undesirable harvesting of personal data, without the knowledge or consent of a person that identifies behaviour, opinions, habits, or is otherwise sensitive.

226.
226.

The EU General Data Protection Regulations (GDPR) aim to provide improved privacy protection and control for EU citizens; they are designed to give individuals control of their personal data and to improve how businesses manage personal consumer data.

Similar legislation enacted in Vanuatu would have the dual benefits of compliance with EU provisions (reducing costs for application developers and strengthening trade) as well as promoting best practices in the local context.
Draft v0.95 – For Committee Review & Consultation Page 74 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Opt-Out Provisions for Personal Data and Usage Tracking Government will implement legislation similar in character and scope to GDPR to mandate that any organisation or software application that collects or processes the data of Vanuatu citizens will be subject to stringent controls.
At minimum these will provide for the rights of individuals to: • • • move their data between providers (data portability); • object to and rectify data wherever necessary; • be informed about the circumstances in which their personal data may be used; and, • ensure data is erased when no longer needed.

access their personal data; restrict processing of personal data by informed consent; Policy Recommendation 53 – GDPR Compliance Protection of the Child 227.
Specific additional provisions shall be made in Consumer Protection that address protection of children and young adults (see Section 9.4) 15.3 International Cooperation 228.

Government shall continue to contribute to international cooperation initiatives65, and adopt cross-border regulatory frameworks to deal effectively with issues related to content and services that strengthen international cooperation and policy implementation for initiatives.

Section 16.1 highlights policy initiatives in this area.
ICT-related consumer protection 15.4 Codes of Practice 229.

As part of the “light touch” approach to legislation and regulation (Section 1.5), Government shall promote the development of Codes of Practice by service providers, including telcos, ISPs, OTT content providers etc.

230.
230.

These must include, as a minimum, provisions for the self-regulation of content, promotional activities and operation of services (including initial complaint handling and redress) and provide transparent and open monitoring of compliance with consumer protection legislation and other ICT legislation.

15.5 Contract Terms – Framework Legislation 231.
Distinct from Net Neutrality (above), the body of statue law in Vanuatu is to be enhanced with law that provides for similar protections for contracts entered into using digital means as those that presently exist in established trading environments 65 See also Section 16 Draft v0.95 – For Committee Review & Consultation Page 75 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft (and where many centuries of established practice, case law, and trading experience exist).
Social Contract Terms – Framework Legislation Government shall develop framework legislation and related procedures that embrace digital versions of contracts, terms, conditions, ownership, title to goods, risk management, and redress.

Policy Recommendation 54 – Contract Terms – Framework Legislation 15.6 No Barriers to Use 232.
It is important for inclusivity and engagement of the nation with the e-Government and digital agendas that no artificial barriers to access, use, or applicability of ICT services or provisions exist for the differently-abled.

No Barriers to Use Government shall ensure that the differently-abled shall have access to the full range of its e-Government services as well as promoting barrier-free access to all other digital services available in Vanuatu.
Policy development fora shall be structured to include representatives from civil society, and special interest groups representing as wide a spectrum of differently-abled, gender specific, or age-related user interests as possible.

Policy Recommendation 55 – Differently-Abled – No Barriers to Use Draft v0.95 – For Committee Review & Consultation Page 76 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 16 EXTERNAL COLLABORATION POLICIES 16.1 Policy Objectives 233.
Government will continue and enhance cooperation with international and regional bodies, particularly those that operate in the e-Government and ICT spaces generally by: a) Being a good global citizen – particularly in terms of cyber-security, and the ICT aspects relating to countering both money laundering and the financing of terrorism; b) continuing to make the voice of Vanuatu heard in international policy-setting fora wherever ICT-related debates take place; and, c) developing into the roles of regional champion of good ICT governance, advanced use of digital tools, and becoming the partner and destination of choice for the multi-national dialogue events in the ICT space.
16.2 Global Citizenship Figure 4 – Responsible State Behaviour in Cyberspace66 66 Image Courtesy of APNIC Draft v0.95 – For Committee Review & Consultation Page 77 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 16.3 Contributing to the International Agenda 234.

As a “good international citizen”, Vanuatu will continue to participate actively in international fora and ensure that its voice is heard whenever collaborative policies in the ICT space are debated.
International Cooperation Government will continue and enhance cooperation with international and regional bodies that operate in the e-Government and ICT space by: • maintaining compliance with the UN model for responsible state behaviour in cyberspace (this will form the baseline framework for all ICT-related international collaboration); exercise every opportunity to make the voice of Vanuatu heard in policy-making and ICT standards development worldwide; and, • • monitoring key developments in the legislative and regulatory control of information society issues, particularly around net neutrality, censorship, carrier liability, personal data protection and the rights of the child for applicability in the national context.
Policy Recommendation 56 – International ICT Agenda, Contribution and Compliance 16.4 Regional ICT Champion 235.

Vanuatu will take all necessary steps to promote best practice in regional ICT usage, with both Melanesian and other regional neighbours.
Regional ICT Champion Government will promote Vanuatu as a regional champion of good ICT governance and innovative usage of e-Government tools and techniques, in particular: • • • setting and maintaining high standards of ICT governance, usage, and sustainability across the whole public sector; focussing upon development of national ICT capacity at all stages of the education system, achieving the best possible levels of digital inclusivity and being an enthusiastic partner for regional ICT initiatives (such as the Pacific Open Data partnership – www.pacificdata.org); and, sharing data and learning with regional and international organisations to help our neighbours, contribute to disaster resilience, and improve economic collaboration.
Policy Recommendation 57 – Regional ICT Champion Draft v0.95 – For Committee Review & Consultation Page 78 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 17 CONTENT AND APPLICATIONS DEVELOPMENT POLICIES 17.1 Policy Objectives 236.

It is the intention of this National ICT Policy Framework neither to mandate nor proscribe any particular product, tool or technology, though a key policy objective is to streamline the variety of platforms tools, technologies and methods in use.

237.
Government seeks to: a) harness the skills and experience of Suppliers to put forward solution delivery methods and technologies that are appropriate for the local environment and contribute demonstrably to efficiency and effectiveness in delivery of services to its stakeholders; b) benefit from periodic upgrades and in technology and concomitant performance/delivery/sustainability capacities by acquiring solutions that utilise the best available technology to meet business requirements and those that offer timely substitution of equal or better technology at same or less cost over the lifecycle of any project; and, innovations c) share in any benefits that can be realised by active management of licence costs, rightsizing requirements, or other cost reductions when they may become available.
17.2 Buy versus Build 238.

In line with the Governments open-source strategy, application software acquisition shall routinely specify design-and-build requirements.

It may be that potential Suppliers may recommend a hybrid solution of bespoke development and commercial off-the-shelf (COTS) solutions that are optimised and optimal in separate functional areas.

A solution comprising bespoke application development for biometric registration, integrated with (e.g.)
a proprietary solution for report delivery and document management would be a good example of this.

239.

Suppliers will always be required to manage all aspects of integration between the components of any solution they may propose.

They must do so in ways which demonstrate clear adherence to these guidelines.

Prototyping 240.
Prototyping 240.

Active use of prototypes will be required, to assist in developing user-understanding of how application(s) and business processes may subsequently behave in production, and to promote rapid validation of solution designs.

The key objectives of this approach and its benefits to Government are in the use of realistic (simulated) data content so that users may try-out functionality of specific interest rather than having to interpret and evaluate designs based solely upon descriptions.
Draft v0.95 – For Committee Review & Consultation Page 79 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 241.

Prototyping is regarded as valuable a method of understanding of how changes to business process (always preferable) may result in avoidance of significant customisation (generally to be minimised).
It is likely that prototyping methods will prove useful for end users to refine business requirements or describe additional ones that emerge during the implementation lifecycle.

242.

This approach must be no mere random act of design, it shall be planned, executed and managed effectively for each implementation project or programme.

Workshop sessions conducted using structured tasks/scenarios created in advance that are managed by subject-matter and application experts will be mandatory.
Prototyping When contemplating business process change or the acquisition of application software, Government shall favour the prototyping method of design verification: • business process change should be considered always as a precursor to software customisation clear demonstrations of functionality, application behaviour, and data outcomes will be mandatory; and, structured evaluation using test, scenarios and test data will be used for comparison.
• • Policy Recommendation 58 – Prototyping Customisation and Configuration 243.

Definitions: a) Configuration: achieved by using the inherent flexibility of software applications where, by entering data into a system (or using tools specifically provided for the purpose), the behaviour or features of the application are changed.
Examples of this include populating a data table of suppliers (which allows users to choose from a drop-down list box) or adding local language field labels and setting default language display options.

b) Customisation: where applications are modified to meet business requirements, by means of a software feature that requires additional code implementation, change control, and on-going and/or some form of maintenance.

244.
244.

Government understands the difference between configuration and customisation to is essential and expected.

be primarily related to complexity.

Configuration Customisation is to be avoided wherever possible; the first mitigation measure should be to seek modifications to business processes rather than software.
Where this is not possible, an impact assessment, including specifically a whole-of-life ownership cost estimate that includes implementation, documentation, testing, maintenance and upgrade costs must be prepared for evaluation.

All potential customisations must be evaluated and approved by Government prior to the commencement of any development work.
Draft v0.95 – For Committee Review & Consultation Page 80 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 17.3 Release Management 245.

Suppliers must suggest processes that manage how changes will be developed and unit tested to form “Builds”, once approved, these shall then be propagated into staging environment(s) for additional testing.

“Releases” may comprise of one or more “Builds”.


These builds and releases are the component parts of version control and management disciplines.

246.

The importance of a robust Release Management methodology (and one that is implemented diligently) cannot be overstated.

In enterprise-wide applications there may be many hundreds of physical components, and virtual component numbers will be in the thousands, all of which must operate together seamlessly.

247.
247.

Tracking environments and provisioning all manner of application instances for development, test, production, training, reporting etc.
will require structured methods, approvals and reliable audit proof (Regression testing) will depends upon re-running of prior tests against known control samples of both data and application code, which is to be undertaken in advance of each Release being approved for production) Release Management A suitable methodology will be developed and owned by OGCIO that: • enables controlled release of new application software and alterations to existing software components between multiple different technical environments for testing and verification purposes before moves to production; encompass all components of the application stack; defines the periodicity of patch applications, including regression tests prior to release; considers environment-specific configuration files that may need to be propagated to client access devices; has provision for accelerated (or emergency) changes that could be necessary to effect urgent service recovery tasks as a result of critical “stop” events; and, be integrated with national ICT support and security infrastructure.
• • • • • Policy Recommendation 59 – Release Management 17.4 Workflow 248.

Multiple approvals and processes with a high degree of inter-departmental or inter- Ministerial involvement are commonplace.

In order to manage these effectively, logical flow of process steps that notify users of status, next actions, tasks awaiting completion, exception conditions and successful completion will be required.
249. Business process workflow management will be an essential part of how users will interact with the business applications, and cross-platform integration between different solutions may be required.

Draft v0.95 – For Committee Review & Consultation Page 81 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 250.
When acquiring application software, Government will require Suppliers to demonstrate Service-Oriented Architecture (SoA) compliance and a viable interoperability environment using an Enterprise Service Bus (ESB) approach that provides commodity services in addition to adoption, translation and routing of client requests to appropriate answering services.

251.
251.

Government will require the ability to create and modify workflow Rules and Routings by means of graphical design tools that incorporate event or state triggers, manual process initiation, conditional branching, “to-do” list management, time-based escalation, monetary approval thresholds, as well as notifications via email or SMS.

Specifically: a) workflow configuration must be achievable by means of a diagram-based graphical designer alone.
Potential software suppliers should include detailed descriptions and examples of viable solutions to show how this will be achieved meeting business functional requirements, or where data validation for input forms might require more complex processing.
b) Roles, Rules and Routings must be managed by use of application configuration methods rather than requiring customisation; c) Workflow must always be Role-based (explicitly not by means of named users) and embed as standard the security profile constraints of each user sign-on; d) Roles, authority limits, and relationships between Roles will need to be maintained by tools provided within the operating environment.
If at some future juncture a Government Human Resources application is implemented, these user attributes may be derived from a suitable organisation chart or position-management structures.

e) Approval levels linked to business rules, with appropriate escalation must be provided.

It is expected that these will be implemented in procurement, purchasing or payment work streams and others linked directly to monetary values.
Other possibilities for streamlining workflow approvals can be envisaged however, which could form part of future business processes such as management of user access accounts, release of financial information into the public domain, and other report-generation tasks for example.

f) Where actions are assigned to users by workflow processes, these should generate prompts to those responsible for completing them.
This is best achieved by generating entries into “to-do” lists that provide meaningful descriptions of the action(s) required, due dates, and links that take the use to the appropriate part of the relevant application in order to complete each such task.

g) Suitable notifications to originators of each workflow task should be provided in the case of completion, deferral, rejection, tasks approaching due dates, overdue tasks, out-of-office notifications and escalations.
Draft v0.95 – For Committee Review & Consultation Page 82 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft h) User worklists should be monitored and suitable provision for statistics and reporting provided, including monitoring of response/approval cycle times for performance management purposes Workflow Management A workflow management environment will be established that operates across Government software assets Policy Recommendation 60 – Workflow Management 17.5 Single Sign-On 252.
Government shall require the ability for users to access all of the applications and resources assigned to them, by signing in once only using a single user account.

253.

Multiple authentications will generally be avoided in order that users do not have to manage multiple sets of account names and passwords, access privileges can be automatically provisioned or constrained based upon their group membership, and employee status.

254.
254.

Multiple-factor authentication is to be actively promoted including, for example, the use of limited-use access codes delivered to mobile devices registered to user accounts 255.

It is recognised that many devices available in the marketplace have integral biometric authentication capability.

For the avoidance of doubt, biometric authentication must be supported by a password to create a “physical attribute and knowledge” dual- factor authentication pair.
17.6 High-Level Design Guidelines for eServices and Web Presence 256.
The following design, implementation and maintenance guidelines shall be adopted whenever Government eServices delivery components are to be provided with a central portal, or web presence established for other purposes: a) consistent branding (look and feel) with standard presentation across Ministries, Agencies and other Government institutions based upon a common shared style guide67; b) detailed research is an essential precursor for website design and digital service delivery methods.
The user need neither know nor care what organisational structures are responsible for service delivery, different ways of 67 Consistent in this context does not also mean wholly static.

As stakeholder use and needs evolve, so should web design standards and styles in order to meet new requirements.
Draft v0.95 – For Committee Review & Consultation Page 83 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft access to eServices must be provided (such as by outcome, not Ministry), that are based on proven (not assumed) user needs and preferences; c) analytical data shall guide website design and modification.

Design, monitoring and improvement of websites by harnessing usage data is essential.
Whether users access eServices or information from smartphones, personal computers or shared computers, the single government website should be designed to accommodate these options; d) Keep things simple.

A small number of well-known access portals (ideally only one) gives the user confidence68 that Government information and eServices are centrally available, reliable, and well managed; and, e) at all costs, web content needs to be current, reliable, accurate and relevant.
This will require dedicated resources to improve/refresh content, keep site navigation simple and intuitive, and respond to changing user needs.

17.7 Open Document Format 257.

The Open Document Format (ODF) standard works on most operating systems for desktops, laptops, mobile phones and tablets.
Government will adopt ODF 1.2 because it: a) is an open standard that allows suppliers to create interoperable office productivity solutions; b) facilitates security checks to help prevent common cyber-attack scenarios; c) can lower IT costs as ODF is either low cost or free to use; d) allows Government and citizens, businesses, and other organisations to share documents easily using most common word-processing applications; e) is compatible with a wide range of software including assistive technology; f) can add digital signatures to a document; and, g) has powerful and generic metadata functionality for document classification.
17.8 Social Media 258.

Social Media is constantly changing the way in which individuals connect.

It provides new ways of starting and building relationships, and engaging in discussion with 68 This also means removing duplication, especially old or obsolete sites.
There are circumstances however where some organisations (typically Regulators, SOEs, or particularly large/complex organisations (the Ministry of Health, for example) are contenders for separate web presence outside of the main Government portal.

By making the parameters for such choices clear from the outset, much difficulty of interpretation can be avoided.
Draft v0.95 – For Committee Review & Consultation Page 84 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft individuals irrespective of geography, role, or background.

Government will put forward a policy for how its employees use and interact across all social media platforms (the draft below builds upon that used by General Motors, a useful starting point for its clarity, conciseness, and statement of responsibilities).

259.
259.

Vanuatu Government Social Media Policy will be created in order to protect the reputation of Government, facilitate compliance with applicable law and regulations, and empower public servants to be advocates of Government.

A selection of draft policy content is presented below, to which all public servants would be required to adhere: a) Be honest when disclosing your identity.
If you post about Government or public sector issues then disclose that you work for or with Government by using the hashtag #IWorkForVanGov or #IWorkWithVanGov to your post.

Once you make the choice to acknowledge your affiliation with Government in the social space, any of your online activity may be associated with your employment, potentially impacting your professional reputation or the reputation of Government.
Be sure anything you post online about Government, its policies, products or services is accurate.

b) Only approved spokespeople can speak on behalf of Government.

Even after you have identified yourself as working for Government, be clear that the views and opinions you have expressed are your own.
If you think an official Government response may be required for something you see on social media, contact the Government Social Media Team at socialmedia@gov.vu Content that is shared through the Government web pages or by approved spokespeople has been reviewed by the appropriate internal parties, and is available for employees to share.

All required disclosures for this content, including #IWorkForVanGov, have been prepopulated.
Government needs to properly track and report product problems, do not try and resolve other people’s service problems yourself online.

Instead refer them to the Social Media Care Team at socialmedia@gov.vu c) Do not make recommendations for co-workers or suppliers on LinkedIn Government does not to write professional recommendations or endorsements.

This guidance extends to digital platforms such as LinkedIn.

employees allow d) Keep confidential information to yourself.
You should never reveal non-public Government information on social media.

Treat all confidential information classified information or secrets of Government, and of our partners and suppliers, as strictly confidential.

e) New social media channels require approval.


You should not open Government social media channels without first getting approval from the Draft v0.95 – For Committee Review & Consultation Page 85 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Social Media Centre of Expertise.

For additional information about the new channel request process, contact socialmedia@gov.vu f) Use good judgement about what and how you share.
Keep in mind that your posts can potentially tarnish reputations or infringe on the rights of someone else.

Once information is placed on the internet it is often there forever and cannot successfully or easily be removed.

Do not post information or rumours about Government that you suspect or know may be false.

g) Treat others with respect.

Customers, citizens, colleagues, supervisors, suppliers, competitors and others may have access to your posts.
Offensive or inappropriate remarks are as out-of-place online as they are offline.

Use the same set of standards as you do in the physical workplace.

h) Private things are not private.

Comments and things that you publish can often be seen or found by others, despite privacy settings.

Consider everything you post online as potentially discoverable by anyone.

i) Familiarise yourself with the full Social Media Policy and the Leadership Code (where appropriate).
If you are a public servant, employee, or agent of Government, even indirectly (consultants, independent contractors, political advisors, or temporary workers), it is your responsibility to be familiar with these Policies in their entirety.

Social Media Policy – Individual Responsibilities The Government will adopt a set of social media guidelines for use by all public servants that emphasises fairness, openness, individual responsibility, and respect.
Policy Recommendation 61 – Social Media Policy – Individual Responsibilities Draft v0.95 – For Committee Review & Consultation Page 86 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 18 FULFILLMENT POLICIES 18.1 Policy Objectives 260.

Government policy is that effective postal and courier services which meet commercial and social needs of Vanuatu are important to both competitiveness and social cohesion.

261.
261.

A well-functioning and universal delivery (fulfilment) service is a key building block for e-Government in particular, and e-Commerce generally.

262.

These policies support the NSDP Economic Pillar (particularly ECO 2.7, 2.8, 3.1, 3.6, 4.1, 4.2, 4.9) 18.2 Postal/Courier Operations and Service Obligations 263.

Vanuatu Post presently offers collection and delivery from some 60 or so locations across the nation.
These will need to be expanded, and a common system of addressing provided for both Vanuatu Post and private courier services to be able to deliver letters and parcels widely across the nation in a manner that is predictable, reliable, and at reasonable cost.

264.
264.

Government recognises that all citizens have a right to access basic postal services and will ensure that Vanuatu has a vibrant and efficient postal sector across physical, electronic and financial platforms in order to increase the contribution of the sector to the national economy.

This will be achieved by ensuring that postal operators provide affordable, equitable and efficient universal service, among other measures.

265.
265.

Take-up of e-Commerce facilities (whether provided by public or private sector sources) will depend upon speedy and reliable fulfilment mechanisms for the delivery of goods and services.

266.

A revised Universal Service Obligation (USO) is proposed, whereby a postal services operator is granted the concession to charge fixed fees69 for the collection, transport, and delivery of letters, packages and parcels from point to point nationwide.
Other reserved services (Universal Postal Union obligations of Vanuatu70, philatelic products, for example) may be grated to the USO operator and all of these USO concessions/obligations will be monitored by a regulator (see Section 18.4) 69 Modifications to fixed fees, or delivery time obligations, may be agreed by a regulatory body (see Section 18.4) as appropriate for locations that are particularly remote, or difficult to access.
70 Vanuatu acceded to the UPU (a specialised agency of the UN) in July 1982 Draft v0.95 – For Committee Review & Consultation Page 87 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 18.3 Establishment Of A National Address Protocol (NAP) 267.

A unified addressing system across the nation is an essential component of the strategic development of e-Government, completing the fulfilment infrastructure for all manner of e-Commerce transactions.

268.
268.

The NAP shall cover all islands, towns and villages, and incorporate links with Geographic Information System (GIS) to provide identifiable locations in digital format for residential and commercial buildings relevant to all citizens, residents and businesses.

269.
269.

The NAP shall be developed along with a national address template matching International Standard Certificate (S42) of the Universal Postal Union (UPU)71, digital geographical technical standards owned by (ISO/TC 211), and separately ISO 19160 (specifically for addressing).

National Address Protocol • The Government will lead the design stages of the NAP, and implementation will become the responsibility of a regulator (see below).
The NAP will be compatible with ISO/TC211 and ISO 19160, with a national address template aligned with UPU S42.

• Policy Recommendation 62 – National Address Protocol 18.4 Regulatory Oversight 270.

The establishment of suitable regulatory oversight for the postal services industry in general, and the Universal Service Obligation (USO) in particular, is proposed.
The primary responsibilities of the regulator will be to: a) establish minimum service requirements for the universal postal service, the setting of carriage rates, along with monitoring, evaluation, and potential remediation of service levels; b) ensure fair competition between public and private sector operators the parties involved in the postal services industry across the nation (noting that some postal services will be reserved monopoly activities under the USO); c) safeguard the provision of high-quality, and affordable universal service; d) promote the growth of a competitive and innovative postal services industry; e) develop regulatory guidelines for operators that promote long-term benefits for society, stakeholders and customers; 71 Vanuatu acceded to the UPU in July 1982 Draft v0.95 – For Committee Review & Consultation Page 88 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft f) maintain the national address protocol, making search and maintenance facilities available to all by digital means; g) maintain high level of consumer confidence in service delivery by the postal services industry; h) ensure the security of postal service industry generally, including postal articles, the postal network, and staff; and, i) periodic review of the USO, its scope (including exclusive and non-exclusive service requirements), pricing, and general applicability to prevailing or anticipated market conditions.
Postal Services Regulation Fulfilment of e-Commerce and e-Government services will demand fast, accurate and reliable postal services, which may attract new entrants to the market.

A regulatory framework for these services will be established to ensure open and fair competition with the universal service obligations provided by a single organisation.

The regulatory body will incorporate representation from citizens.
Policy Recommendation 63 – Regulation of Postal Services Draft v0.95 – For Committee Review & Consultation Page 89 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 19 DEVICE POLICIES 271.

Government policy shall be wholly device-agnostic, without favouring any device over others.

The key example in this regard is the use of mobile devices, where there shall be no preference at a national policy level for Android, iOS or other device types, for example.
Instead Government will focus upon the usability, skill-base development, and process value-add to be achieved by as broad a use of ICT devices as possible.

272.

Furthermore, the devices available at the outset of this policy journey are of course going to be subject to rapid change, with new device types, such as biometrics, wearables, nano-devices, Internet of Things (IoT) and others becoming available during the policy lifecycle.

19.1 Policy Objectives 273.


Government shall adopt general policies in terms of ICT devices that are broad and inclusive in nature.
Specific objectives include: a) Bring-Your-Own-Device (BYOD) will be essential in all e-Gov services-delivery designs; b) server-side virtualisation and software-defined data centre (SDDC) or similar non-proprietary solutions for all components of CNI and Government cloud (applications and data sources); and, c) in principle, data will be stored once and accessed /shared using controlled API access.

19.2 Bring Your Own Device 274.


The existing policy that predisposes type-approval prior to importation of goods (as presently managed by TRBR) will continue to apply for any equipment to be imported into Vanuatu.

275.

The ability for BYOD access to all Government eServices is essential.
Suitable access controls and authentication shall be provided to shield NCI from unauthorised access, and BYOD device usage within .gov.vu and related domains shall be closely controlled by network administrators on a case-by-case basis.

276.

The use of third-party SaaS tools within the public sector to promote collaboration, productivity and project management capabilities is likely to increase in parallel with increasing digital skills and the sophistication of partnership working with third- parties .
277.

SaaS tools are not without risk however, and as the data used will in most circumstances be hosted outside of Vanuatu this implies internet transit and opens up the possibilities of interception or misuse.

Draft v0.95 – For Committee Review & Consultation Page 90 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft SaaS Application Usage Government will establish mandatory usage guidelines wherever SaaS software is to be used across the public sector.
These will include: • good practices in the setting-up of user accounts, BYOD device access credentials, password management, and payment modalities; the responsibility of individual users to use SaaS tools safely, and to protect data assets; reminding users that existing operational constraints and usage policies must be adhered to.
These shall include the Leadership Code, Social Media Code (Section 17.8) and applicable laws, particularly those relating to data protection, records management, and freedom of information; responsible usage, security of data (particularly personal data) and passwords; and, a service-orientated architecture (SOA) that aligns with the move to e-Gov service delivery and national data resource requirements.
• • • • Policy Recommendation 64 – SaaS Application Usage 19.3 Virtualisation and the Government Cloud 278.

Government policy will promote data centres, CNI, core networks, and the consolidation of software assets in a highly virtualised environment.

Any proposed solutions will balance the need to be open, accessible and usable against cyber- security threats and the need to handle sensitive information with care.
Virtualisation Government will bring forward detailed proposals for virtualisation that will include: • software-defined data centre (SDDC) concepts will be used as server-side standards, to manage all data centre resources and achieve both resilience and economies of scale by pooling, abstraction and automation of services; for desktops It will mandate the reuse of proven, common application solutions and policies; resilience of CNI; and, a service-orientated architecture (SOA) that aligns with the move to e-Gov service delivery and national data resource requirements.
• • • Policy Recommendation 65 – Virtualisation 279.

When procuring new services or renewing existing arrangements, all public sector organisations must consider and fully evaluate potential Government cloud 72 solutions that comply with data sovereignty (Section 7.4.3), NDM (Section 8.2) and security (9.6.1) requirements first before considering other options.
This policy will be 72 The term “cloud” is used in conformance with the United States National Institute of Standards and Technology (NIST) definition, with one of the cloud’s primary characteristics being an on-demand, self-service model.

Consumers of cloud services should be able to unilaterally provision computing capabilities, (server time and network storage etc.
), as required without technical interventions from service providers https://www.nist.gov/news-events/news/2011/10/final-version-nist-cloud-computing-definition-published Draft v0.95 – For Committee Review & Consultation Page 91 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft mandatory for central government and strongly recommended for other public sector bodies.
Cloud-First Solution Provisioning Acquisition, renewal or transfer of software applications in the public sector shall be subject to a “cloud-first” policy requirement73.

OGCIO will set out minimum operating standards for cloud solutions (accessibility, security, data management etc.

), and assist public sector organisations in ensuring that the quality and effectiveness of the Government cloud solutions are actively monitored.
Value-for-money assessments, including whole-of-life costs will also be included in the evaluation: • public sector bodies remain free to choose an alternative to the cloud but will need to demonstrate that it offers better value for money; and, initial deployments are to be encouraged across the public sector for standard Software-as-a service, enterprise, and back-office ICT support.

• Policy Recommendation 66 – Cloud-First Solution Provisioning 19.4 API Ecosystem 280.
Government aims to make as many as possible of its services available in digital form so that these can be consumed by applications running on client mobile devices and desktops.

The use of HTTP endpoints is currently the usual method for achieving this, whereby applications make HTTP requests to these endpoints and data is returned in a variety of formats.

depending on the endpoint (XML, JSON, etc.)

281.


The client applications that consume such services can be implemented as standalone for a mobile device or tablet, as browser-based HTML, or as other types of code that can make a request to an HTTP endpoint and receive data in response.

All these however share the same significant issues with security and compatibility, amongst many other challenges as applications change, mature, or are replaced.

282.
282.

To address these accessibility and security concerns, an API ecosystem will be developed as part of CNI, to manage all requests to/from/between on-premise government software applications and hosted applications (usually in a Government Cloud environment, accessible to third-parties – the core of e-Government services provisions).

APIs will have a key role to play in securing these services.
73 In this context “cloud-first” means the Government cloud rather than public, community, hybrid or private deployment models.

There are circumstances where the other deployment models are appropriate, although benefits for the public sector are primarily to be found in embracing a Government cloud infrastructure.
Draft v0.95 – For Committee Review & Consultation Page 92 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft API Framework APIs serve a large variety of use cases from internal Government applications across the digital government ecosystem, whether from on-premise legacy applications in the Government data centre or hosted in a Government cloud.
Government will: • • only provide data to other applications in response to requests routed via secure APIs strictly control the design, security, publishing, and access credentials for API usage; and, • monitor and analyse all API traffic for compliance, security, and performance.
Policy Recommendation 67 – API Framework API Framework Controller Figure 5 – API Framework Controller Model Draft v0.95 – For Committee Review & Consultation Page 93 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 20 POLICY OWNERSHIP AND STAKEHOLDERS 20.1 Ministerial Responsibility 283.
The Minister responsible for ICT is the Prime Minister who generally acts on the advice of the organisation charged with providing advice and guidance, the Office of the Government Chief Information Officer (OGCIO).

Executive Sponsorship Direct Prime-Ministerial sponsorship and responsibility for the national ICT agenda is extremely advantageous, and as ICT extends into all aspects of national policy this structure should remain.
The highly effective support to the PM as provided by the Director General of the Prime Minister’s Office and the OGCIO policy unit is also reaffirmed as the primary advisory mechanism for Government ICT matters.

Policy Recommendation 68 – Executive Sponsorship 20.2 Office of the Government Chief Information Officer (OGCIO) 284.

OGCIO acts as the Secretariat for all matters relating to Government ICT and national ICT policy formulation, adoption, monitoring and reporting.
It is presently comprised of the following units: a) a Network unit that provides network management & maintenance services for the Government Broadband Network (GBN); b) Transmission Unit, that manages and maintains the Government Broadband Network (GBN) and VIX hardware; c) a Helpdesk, provided as a decentralised service for Government Ministries and Departments, covering application and communication issues; d) Information Services Unit that provides application and database management facilities for e-Gov servers and storage infrastructure, along with security administration and application development; e) a policy and compliance unit that formulates national ICT policies, regulations and ICT standards as well as initiating legislative developments and promoting new initiatives in ICT usage at national and community levels.
Draft v0.95 – For Committee Review & Consultation Page 94 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft • • Evolution of OGCIO The infrastructure operational roles of OGCIO will in future be transferred into partnership arrangements.
The OGCIO of the future shall focus more clearly upon policy- making and internal-consultancy in areas such as: • enhanced national policy and strategy consultations), particularly for upcoming e-Government initiatives; compliance and regulatory oversight of partnership arrangements; advisory support for regulatory bodies on all aspects of national ICT policy and technical issues; legislative and regulatory development proposals; coordinating national standards along with specification, deployment and outreach of e-Government initiatives across the nation; and, promoting national data convergence, benefits realisation and supporting line Ministries with business analysis and integration capacity.
(including stakeholder implementation, formulation • • • Policy Recommendation 69 – Evolution of OGCIO 285.

The network, transmission, and helpdesk functions of OGCIO will be transferred into commercial partnership arrangements under which future NCI and Government connectivity will be delivered.

These do not involve public policy matters and do not need to be delivered by the public service, whose core competency is in the areas of public policy, strategic planning, compliance and regulatory oversight.
20.3 Business Stakeholders 286.

Private-sector organisations of all types and sizes are stakeholders in this National ICT Policy Framework, as it will form the core of commercial transactions, identity verification, digital identity, electronic transactions for the foreseeable future.

All manner of interactions with and between Government, businesses and citizens will be maintained and transformed by Government moves to digital service delivery methods.

20.4 Civil Society Stakeholders 287.


Vanuatu Society For Disabled People (VDPA), is an umbrella organization for 22 local Disabled Persons Organisations (DPOs) The National Coalition (which also includes the Vanuatu Society for People with Disabilities and Transparency International Vanuatu) aims to leverage their expertise and engage with mainstream civil society actors through the Vanuatu Civil Society Disability Network.

288.
288.

Representation of citizen, gender, religious and youth groups including: • Care International • DVAT • Malvatumaori Council Of Chiefs • National Council Of Women (NCW) • Vanuatu Association of Non-Governmental Organisations (VANGO) • Vanuatu Council Of Churches (VCC) Draft v0.95 – For Committee Review & Consultation Page 95 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft • Vanuatu National Youth Council (VNYC) • Youth Challenge 289.
Media Organisations • Vanuatu Broadcasting and Television Corporation (VBTC) • Media Association of Vanuatu 20.5 Development Partners 290.

The Governments of Australia, China, the European Union, France, India, Japan, Korea, New Zealand, and the United Kingdom.

291.

Multilateral organisations including the Asian Development Bank, the United Nations (multiple Agencies) and the World Bank.
20.6 ICT Capacity Development, Standards Ownership, and Professional Bodies • National University of Vanuatu • University of the South Pacific (USP) • Vanuatu Institute of Technology (VIT) • Asia Pacific Network Information Centre (APNIC) • Asia Pacific Telecommunity (APT) • Asia Pacific Top Level Domain Association (APTLD) • Australian Communications and Media Authority (ACMA) • International Corporation for assigned names and Numbers (ICANN) • International Telecommunications Union (ITU) • Pacific ICT Regulatory Resource Centre (PIRRC) • Pacific Islands Telecommunications Association (PITA) • The Pacific Islands Chapter of the Internet Society (PICISOC) • Utilities Regulatory Authority (URA) • Vanuatu Internet Governance Forum (VANIGF) • Vanuatu IT Users Society 20.7 Government Organisations Ministries and Agencies 292.
All Ministries, Agencies, and State-Owned Enterprises (SoEs) will be required to develop (or modify) eService delivery policies in line with this National ICT Policy Framework.

For organisations operating wholly within the public sector, OGCI will offer advice and guidance on how best to integrate sector or operationally specific ICT polices.

Draft v0.95 – For Committee Review & Consultation Page 96 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 293.
Sub-national government organisations, particularly provincial administrations will be encouraged to engage with the consultation and review process to determine how best to leverage the opportunities provided by this policy framework.

294.
294.

SoEs and other private-sector organisations may be offered the opportunity to take advantage of facilities, functionality or infrastructure envisaged by this Policy Framework, however eServices delivered shall attract fees levied in order to defray both operating and development costs as well as to avoid creation of commercial advantage.

Other Government Organisations 295.


Computer Emergency Response Team – Vanuatu (CERTVU) will remain as the central cyber security information and incident response hub for Vanuatu.

The objectives of the team are to promote awareness of cybersecurity at all levels across the nation, build resilience, and to act as primary response and defence mechanism for malicious incidents penetrating Vanuatu internet and IP communications networks 296.
The role of the Vanuatu Intellectual Property Office (VIPO) is unchanged by this Policy Framework in the safeguarding of intellectual property relating to trademarks, patents, designs, copyrights and trade secrets.

20.8 Regulatory Provisions Telecommunications and Radiocommunications Regulator 297.

No changes to the scope, mandate or activities of TRBR is envisaged as a result of adoption of this policy framework.

Information Commissioner 298.


Possible re-evaluation of the provisions of the Right to Information Act (No.

13 of 2016) and scope of data protection regulatory oversight to be undertaken in conjunction with policy consultation and review particularly apropos data access monitoring (see Section 5.1.3), an Age-Appropriate Code of Practice, and provisions of GDPR or similar legislation envisaged by Sections 15.2.5 and 15.2.6 Identity Management - Proposed 299.
Possible new regulatory responsibilities – to be elaborated up on post consultation and review E-Commerce and Financial - Proposed 300.

VFSC and Reserve Bank – possible new regulatory responsibilities to be elaborated up on post consultation and review Draft v0.95 – For Committee Review & Consultation Page 97 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 20.9 International Stakeholder Organisations Asia-Pacific Network Information Centre (APNIC) 301.
Internet addresses are a shared public resource.

Effective management and fair access to these resources is vital to the ongoing health of the Internet.

APNIC registers the right to use those resources according to policies set by the community members who use them 302.
APNIC is responsible for maintaining the public APNIC Whois Database and managing reverse DNS zone delegations., it performs these activities as part of its commitment to a global, open, stable and secure Internet that serves the entire Asia Pacific region.

World-Wide Web Consortium (W3C) 303.

The Web Accessibility Initiative (WAI) that is championed by W3C will form the core of Government web application design standards to ensure the broadest possible outreach to differently abled citizens.
Draft v0.95 – For Committee Review & Consultation Page 98 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 21 MONITORING AND EVALUATION 304.

Vanuatu, along with many other developing countries, has monitoring and evaluation (M&E) systems that are primarily centralised, often donor-specified as a component of funded interventions, and with priority given to the information needs of central financial management and planning agencies.
The direct consequences of which are that evaluation is not used as often as it might be to inform ongoing operational project management.

305.

In order to address the opportunity to improve project management and outcome monitoring, a more distributed model for monitoring and evaluation will be adopted, that specifically includes project beneficiaries in the analysis.
The objective of M&E reform shall be to enhance both donors and Government focus, as well as to increase beneficiary engagement with the design, implementation, and use of evaluations.

Figure 6 - Value-Add Data Journey 306.
Vanuatu has some separate bodies of data, usually held in disparate applications and locations – as Figure 6 (above) illustrates, the journey from data to wisdom involves some key steps: a) Information is data analysed for meaning, and interpreted in context; b) Knowledge, is the understanding of interrelationships between information; c) Insight is understanding how knowledge has impact; and, d) Wisdom comes from using information, knowledge and insight to predict outcomes and make better decisions.

307.
307.

M&E aims to improve the volume, quality and relevance of all aspects of the journey toward wisdom.

Data only leads to Information, and onward to Knowledge, Insight and eventually Wisdom if it is open to challenge, to debate, consultation and reasoned interpretation.

Draft v0.95 – For Committee Review & Consultation Page 99 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft 21.1 Policy Objectives 308.
It is the intention of Government that ICT projects shall be the standard-bearers for a new approach to M&E where success is measured ultimately by customer satisfaction.

309.
Government will: a) establish a standard set of metrics to describe status, progress, and in-year customer/stakeholder satisfaction, against which annual and assessments will be made and published; b) create a national data project resource accessible to all stakeholders that provides a common shared view of the status of its project initiatives; c) complement the high-level national objectives (as set out in the NSDP) with operational “lead” and “lag” metrics in sufficient detail to demonstrate progress against NSDP objectives as well as expected outcomes; d) at the proposal stage, require all project and reform initiatives to be evaluated against both project metrics and NSDP objectives as a precursor to approval.
21.2 Project Metrics 310.
Project-based and operational metrics will be collected and collated for all Government initiatives and hosted as part of the national data set (Section 8.2) within the national data centres (Section 7.4.2) Project Metrics A standard set of project metrics will be derived, that set out both operational and strategic goals, such as: • • • • • how proposed projects aim to contribute to NSDP objectives; status of compliance and regulatory oversight; completion, expenditure and resource usage; customer/stakeholder satisfaction measures; and, lessons learned summary assessments.
Policy Recommendation 70 – Project Metrics 311.

Reporting and status updates will be provided as part of the e-Government information and services portal.

21.3 Expanded NSDP Indicators 312.

To complement the high-level national objectives (as set out in the NSDP), additional indicators may be desirable.
with “lead” and “lag” metrics in sufficient detail to demonstrate operational progress against NSDP objectives and expected outcomes, including: Draft v0.95 – For Committee Review & Consultation Page 100 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft a) “lead” indicators, primarily input-related, that provide forward-looking benchmarks that, if met, will result in achievement of target outcomes; and, b) “lag” indicators which are ex-post metrics that demonstrate achievement of outcomes.
They are relatively easy to measure but more difficult to change.

313.

The strategic indicators within the NSDP are arguably too few in number and could usefully be augmented with lead and lag metrics for each category, as well as benefitting from more frequent assessment.
Too large a time interval between assessments is undesirable, and availability of both data and analytical tools within the NDR should lead to improvements in transparency that arise from continuous M&E possibilities, along with open access to indicator status (website publication) and source data.
NSDP Indicators Government will put forward proposals for revising the indicators associated with NSDP Pillars and Goals, with revisions including: • enhanced and re-baselined goal indicators that include appropriate lead and lag metrics for each; a second-tier of contributory indicators that are more tactical in nature but contribute to measuring and monitoring process toward the main strategic Pillar goals; publish raw data and status of all indicators on a single website, with appropriate access controls; and, increase the frequency of formal M&E events, with results also published.
• • • Policy Recommendation 71 – Evolution of NSDP Pillar and Goal Indicators 314.

A similarly transparent, and multi-faceted approach to reporting all manner of compliance, policy and strategy objectives would also be very useful in demonstrating (e.g.)

compliance with UN State Behaviour in Cyberspace guidelines (see Section 16.1) and many other similar objectives.
Draft v0.95 – For Committee Review & Consultation Page 101 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft APPENDIX A: TERMS AND ACRONYMS AI AIC API APNIC ASPI ccTLD CNI Artificial Intelligence Asia Internet Coalition – an industry association that promotes the understanding and resolution of Internet policy issues in the Asia Pacific region.
Applications Programming Interface Asia-Pacific Network Information Centre, the Regional Internet Registry for the Asia-Pacific Region (of which Vanuatu is a member) Australian Strategic Policy Institute Country-Code Top Level Domain (the ISO national country code for Vanuatu “.vu” expressed in terms of internet domains) Critical National Infrastructure Constitution The Constitution Of The Republic Of Vanuatu DFAT DR e-GIF EBRD EIDAS G2B G2C G2G Department of Foreign Affairs and Trade (an Australian government body) Disaster Recovery e-Government Interoperability Framework (the UK model for data exchange between public sector bodies) European Bank for Reconstruction and Development Electronic Identification, Authentication And Trust Services Government-to-Business.
Typically such transactions are focussed at business start-ups (promoting economic growth), taxation, licencing and procurement.

Government-to-Citizen.

Key interactions between Government and all of its citizens as consumers and beneficiaries of all manner of services (education, health, democratic participation etc.).

For the most part these will rely upon accreditation of the citizen to access specific services.

Government-to-Government.


Transactions and interactions between Government bodies, made essentially in support of national objectives and with business and citizen stakeholders in mind.
Improvements to both efficiency and effectiveness of internal transactions will be key milestones in the transformation of service delivery to businesses and citizens Draft v0.95 – For Committee Review & Consultation Page 102 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft GDP GSMA IAP2 ICIRP IEC ILO IP IPN ISO ISP KYC MFAT ML MOCN MORAN MVNO NDM NDMO NDPR NIST OTT PAYG Gross Domestic Product The GSM Association – owners of the technical standards for 900 MHz spectrum band for mobile communications International Association for Public Participation International Commission on Non-Ionising Radiation Protection International Electrotechnical Commission – an international organisation that prepares and publishes international standards for all electrical, electronic and related technologies International Labour Organisation (a United Nations agency whose mandate is to advance social and economic justice through the setting of international labour standards).
Internet Protocol, Commonly an “address” for individual devices connected to a computer network in much the same way as a house address may identify physical buildings.
Instant Payment Notification International Standards Organisation Internet Service Provider Know Your Customer, reference to due-diligence processes of financial and other service providers Ministry of Foreign Affairs and Trade (a New Zealand government body) Machine Learning Multi-Operator Core Network Multi-Operator Radio Access Network Mobile Virtual Network Operator National Data Model National Disaster Management Office National Project Data Resource National Institute of Standards and Technology (a US Government body) Over The Top (streaming media services offered directly to consumers via the internet) Pay-As-You-Go subscription model for services usage Draft v0.95 – For Committee Review & Consultation Page 103 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft PIV PKI PPP RAN SaaS SDDC SDG SOA SOE UPU USO VFSC VIX VPN W3C WAI WB WHO XML Personal Identity Verification Public Key Infrastructure - a set of roles, policies, hardware, software and procedures to manage the creation, distribution, use, storage and revocation of digital certificates and public-key encryption Public-Private Partnership Radio Access Network Software as a Service Software Defined Data Centre Sustainable Development Goals (a set of 17 indicators adopted by all UN member states in 2015 as a shared blueprint for peace, prosperity, people and the planet) Service-Orientated Architecture State-Owned Enterprise Universal Postal Union (A specialised UN Agency) Universal Service Obligation Vanuatu Financial Services Commission Vanuatu Internet Exchange Virtual Private Network World-Wide Web Consortium – an international community of member organisations, staff and the public who work together to develop web standards (see www.w3.org) Web Accessibility Initiative (of the W3C) World Bank World Health Organisation eXtended Markup Language (a set of rules put forward by W3C for the encoding of documents in a format that is both human-readable and machine-readable) Draft v0.95 – For Committee Review & Consultation Page 104 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft APPENDIX B: DRAFT STAKEHOLDER ENGAGEMENT AND CONSULTATION PROCESS 1.
A stakeholder engagement model, similar to that set out below, produced by the International Association for Public Participation (IAP2) will be put forward with the explicit aim of engaging the widest possible range of stakeholders in the on-going policy debate relating to all things ICT.

Figure 7 - IAP2 Model For Public Participation 2.

3.

The National ICT Policy itself will comprise many other subsidiary initiatives, policies, decisions, laws, regulations etc.
It follows therefore that stakeholder engagement will be similarly varied in nature, with no one unitary approach that will be uniformly appropriate.

Similarly, a multi-channel consultation and information model will need to be developed, that enables stakeholders at all levels of ICT literacy to participate and comment upon policy proposals.

Emphasis will need to be placed upon clarity and effectiveness of communications that do not disbar participation by presumption of technical ICT competence.
ICT policy issues are wide-ranging and will affect all levels of society, it is crucial therefore that as broad a range of opinions and inputs is garnered.

Draft v0.95 – For Committee Review & Consultation Page 105 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft APPENDIX C: UK HEALTH AND SOCIAL CARE DATA PRINCIPLES Good information sharing is essential for providing safe and effective care.
There are also important uses of information for purposes other than individual care, which contribute to the overall delivery of health and social care or serve wider public interests.

These principles apply to the use of confidential information within health and social care organisations and when such information is shared with other organisations and between individuals, both for individual care and for other purposes.
The principles are intended to apply to all data collected for the provision of health and social care services where patients and service users can be identified and would expect that it will be kept private.

This may include for instance, details about symptoms, diagnosis, treatment, names and addresses.

In some instances, the principles should also be applied to the processing of staff information.
They are primarily intended to guide organisations and their staff, but it should be remembered that patients, service users and/or their representatives should be included as active partners in the use of confidential information.

Where a novel and/or difficult judgment or decision is required, it is advisable to involve a Data Guardian.
(https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment _data/file/942217/Eight_Caldicott_Principles_08.12.20.pdf - accessed in November 2020) Principle 1: Justify the purpose(s) for using confidential information Every proposed use or transfer of confidential information should be clearly defined, scrutinised and documented, with continuing uses regularly reviewed by an appropriate guardian.
Principle 2: Use confidential information only when it is necessary Confidential information should not be included unless it is necessary for the specified purpose(s) for which the information is used or accessed.

The need to identify individuals should be considered at each stage of satisfying the purpose(s) and alternatives used where possible.
Principle 3: Use the minimum necessary confidential information Where use of confidential information is considered to be necessary, each item of information must be justified so that only the minimum amount of confidential information is included as necessary for a given function.
Principle 4: Access to confidential information should be on a strict need-to-know basis Draft v0.95 – For Committee Review & Consultation Page 106 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Only those who need access to confidential information should have access to it, and then only to the items that they need to see.

This may mean introducing access controls or splitting information flows where one flow is used for several purposes.
Principle 5: Everyone with access to confidential information should be aware of their responsibilities Action should be taken to ensure that all those handling confidential information understand their responsibilities and obligations to respect the confidentiality of patient and service users.

Principle 6: Comply with the law Every use of confidential information must be lawful.
All those handling confidential information are responsible for ensuring that their use of and access to that information complies with legal requirements set out in statute and under the common law.
Principle 7: The duty to share information for individual care is as important as the duty to protect patient confidentiality Health and social care professionals should have the confidence to share confidential information in the best interests of patients and service users within the framework set out by these principles.

They should be supported by the policies of their employers, regulators and professional bodies.
Principle 8: Inform patients and service users about how their confidential information is used A range of steps should be taken to ensure no surprises for patients and service users, so they can have clear expectations about how and why their confidential information is used, and what choices they have about this.

These steps will vary depending on the use: as a minimum, this should include providing accessible, relevant and appropriate information - in some cases, greater engagement will be required.
Draft v0.95 – For Committee Review & Consultation Page 107 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft APPENDIX D: AGE-APPROPRIATE DESIGN – UK CODE OF PRACTICE This code came into force on 2 September 2020, with a 12 month transition period.

Organisations should conform by 2 September 2021.


The standards are: • Best interests of the child: The best interests of the child should be a primary consideration when you design and develop online services likely to be accessed by a child.

• Data protection impact assessments: Undertake a DPIA to assess and mitigate risks to the rights and freedoms of children who are likely to access your service, which arise from your data processing.
Take into account differing ages, capacities and development needs and ensure that your DPIA builds in compliance with this code.

• Age appropriate application: Take a risk-based approach to recognising the age of individual users and ensure you effectively apply the standards in this code to child users.
Either establish age with a level of certainty that is appropriate to the risks to the rights and freedoms of children that arise from your data processing or apply the standards in this code to all your users instead.

• Transparency: The privacy information you provide to users, and other published terms, policies and community standards, must be concise, prominent and in clear language suited to the age of the child.
Provide additional specific ‘bite-sized’ explanations about how you use personal data at the point that use is activated.

• Detrimental use of data: Do not use children’s personal data in ways that have been shown to be detrimental to their wellbeing, or that go against industry codes of practice, other regulatory provisions or Government advice.
• Policies and community standards: Uphold your own published terms, policies and community standards (including but not limited to privacy policies, age restriction, behaviour rules and content policies).

• Default settings: Settings must be ‘high privacy’ by default (unless you can demonstrate a compelling reason for a different default setting, taking account of the best interests of the child).
• Data minimisation: Collect and retain only the minimum amount of personal data you need to provide the elements of your service in which a child is actively and knowingly engaged.

Give children separate choices over which elements they wish to activate.

• Data sharing: Do not disclose children’s data unless you can demonstrate a compelling reason to do so, taking account of the best interests of the child.
• Geolocation: Switch geolocation options off by default (unless you can demonstrate a compelling reason for geolocation to be switched on by default, taking account of the best interests of the child).

Provide an obvious sign for children when location tracking is active.

Options which make a child’s location visible to others must default back to ‘off’ at the end of each session.

• Parental controls: If you provide parental controls, give the child age appropriate information about this.
If your online service allows a parent or carer to monitor their child’s online activity or track their location, provide an obvious sign to the child when they are being monitored.
Draft v0.95 – For Committee Review & Consultation Page 108 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft • Profiling: Switch options which use profiling ‘off’ by default (unless you can demonstrate a compelling reason for profiling to be on by default, taking account of the best interests of the child).
Only allow profiling if you have appropriate measures in place to protect the child from any harmful effects (in particular, being fed content that is detrimental to their health or wellbeing).

• Nudge techniques: Do not use nudge techniques to lead or encourage children to provide unnecessary personal data or weaken or turn off their privacy protections.

• Connected toys and devices: If you provide a connected toy or device ensure you include effective tools to enable conformance to this code.
• Online tools: Provide prominent and accessible tools to help children exercise their data protection rights and report concerns.
Draft v0.95 – For Committee Review & Consultation Page 109 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft APPENDIX E: ASPI ASSESSMENT OF E-GOVERNMENT CAPABILITIES Implementing e-government and digital government capabilities in the Pacific (Hoegeveen – February 202) Conclusion 1: Establish a national coordinating body or committee for ICT A precondition for the successful and sustainable implementation of e-government capabilities is for each Pacific island state to establish a well-functioning, competent and mandated national coordinating body.
Management of ICT and digitisation issues is directly connected to change management in public administration and should therefore be coordinated by a central coordinating body or committee.

Outcomes from this project have shown that all states currently face major challenges in establishing efective whole-of-government coordination for ICTs and the development of e- government capabilities.
Conclusion 2: Develop an integrated e-government architecture Building an e-government capability is an extensive and costly task.

Therefore, it’s essential to establish a set of reusable components that all government department systems can use.

Such reusable components should not only save money, but also increase eficiency and service quality.
The main enablers of an integrated e-government architecture are: interoperability of systems and a secure data exchange • digital services available to citizens (users) • • an NDID system and a trust infrastructure • • a management system for metadata of government systems • a government network • a government cloud-based data storage.

foundational digitised registries As this report shows, most countries possess most of those enablers.
To build and integrate the enablers and avoid interoperability issues later, it’s important to develop a clear e- government architecture.

That architecture should include agreed principles (for instance, on privacy and security) and a system design that integrates the enablers.

Some of the enablers, such as the NDID and the foundational registries, could also be designed and operated as part of a regional arrangement.
Conclusion 3: Ensure the quality of data in basic registries Another key component of an e-government system is authentic data sources (that is, registries).

The data collected and stored in the registries is the outcome of business processes of the relevant agencies.
Draft v0.95 – For Committee Review & Consultation Page 110 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft Moving from paper-based to digital processes provides an opportunity to optimise business processes and compare diferent data sources.

It’s important that arrangements for data- sharing between government departments are in place to avoid duplication and the mismatching of records.
The primary focus in digitising registries in Pacific island states should be to develop and ensure the quality of data in foundational registries, such as registries for births, deaths and marriages, businesses and land entitlements.

An established good practice is to assign unique numeric identifiers to citizens, businesses, real estate, land parcels and other relevant objects.
This allows administrators to identify people or objects in diferent databases across multiple transactions, such as in education, health care, taxation, justice and finance.

It also helps to assure public servants that they are dealing with the same person or object in all life events.

Conclusion 4: Develop secure data exchanges and integrate cybersecurity Citizen-centric and service-oriented information systems require information systems to be linked into an integrated logical whole.
This requires government departments and their information systems to be interoperable.

In other words, they must be able to work together.

A secure data exchange is another priority in developing an e-government capability in the region.

Information from national databases must be accessible in real time, and that requires secure and controlled data exchanges.

Considerations of cybersecurity should be included from the beginning.
This report shows that, to date, that hasn’t been the case, and most e-government schemes lack a reliable cybersecurity approach.

Conclusion 5: Implement a solid digital identity scheme An NDID is the final cornerstone of an e-government system.

It allows citizens to carry out secure electronic transactions and take full advantage of available e-government services.

NDID schemes need to be secure and protective of privacy, while relying on a proper and high-quality basic registry (see Conclusion 3).
Draft v0.95 – For Committee Review & Consultation Page 111 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft APPENDIX F: FURTHER READING • Essential Digital Skills Framework (GOV.UK) • https://assets.publishing.service.gov.uk/government/uploads/system/uploads/atta chment_data/file/738922/Essential_digital_skills_framework.pdf ICT for Development in the Pacific Islands, ASPI, https://s3-ap-southeast- 2.amazonaws.com/ad-aspi/2020- 02/ICT%20for%20development%20in%20the%20Pacific%20islands.pdf?x_oS.r8OVV fTlxxgNHI58k_VL45KC83H • Digital identity in New Zealand – see https://www.realme.govt.nz and https://digitalidentity.nz • Financial Action Task Force – 2018 Mutual Evaluation Of Vanuatu, Asia-Pacific Group On Money Laundering, Http://Www.Fatf- Gafi.Org/Media/Fatf/Documents/Reports/Fur/APG-3rd-Follow-Up%20Report- Vanuatu-2018.Pdf • Health Data Safeguarding – A Consultation paper on the UK Caldicott Principles for data guardianship https://assets.publishing.service.gov.uk/government/uploads/system/uploads/atta chment_data/file/941865/NDG_CP_and_CG_consultation_response_FINAL_08.12.2 0.pdf • South Pacific Computer Law: Promoting E-Commerce In Vanuatu And Fighting • • Cyber-Crime In Tonga, Blythe, Stephen E, Https://Www.Usp.Ac.Fj/Index.Php?Id=13316&Type=98 Instant Payment Notification Hub architecture for mobile payments , GSMA https://www.gsma.com/mobilefordevelopment/wp- content/uploads/2020/04/Mobile-for-Development-Utilities-The-GSMA-Instant- Payment-Notification-IPN-Hub-Impact-and-insights-from-inception-to-industry- transition.pdf Impact of ICT on Financial Development – Empirical Evidence from Gulf Cooperation Council countries (2019) https://journals.sagepub.com/doi/full/10.1177/1847979019870670 • The Key Differences Between Data And Information: Https://Www.Guru99.Com/Difference-Information-Data.Html • Technology And Law, White & Case, Https://Www.Whitecase.Com/Publications/Insight/Law-Technology-Risks-And- Opportunities-Tectonic-Forces-Work • Customs Online Payment, Https://Customsinlandrevenue.Gov.Vu/Index.Php/En/News/322-Vanuatu-Becomes- The-First-Pacific-Country-To-Implement-Customs-Online-Payment • Smart Regulation for OTT Growth – Asia Internet Coalition • https://www.aicasia.org/wp-content/uploads/2015/10/AIC-White-Paper-on- OTT_Final2.pdf Innovation and the UK Knowledge Economy https://www.gov.uk/government/speeches/innovation-and-the-uks-knowledge- economy • Definition of Cloud Services, United States National Institute of Standards and Technology (NIST) https://www.nist.gov/news-events/news/2011/10/final-version- nist-cloud-computing-definition-published Draft v0.95 – For Committee Review & Consultation Page 112 of 113 Vanuatu National ICT Policy Framework – Pre-Consultation – Draft • Age-Appropriate Design Code, United Kingdom Information Commissioners Office https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection- themes/age-appropriate-design-a-code-of-practice-for-online-services/ • The impact of digital technology usage on economic growth in Africa, Solomon and van Klyton https://www.sciencedirect.com/science/article/pii/S0957178720300989 This study analyses the impact of the use of digital technology on economic growth for 39 African countries from 2012 to 2016.
This analysis applies a system GMM estimator to understand the extent to which the usage of digital technology facilitates growth using a measure of digitalisation from the Networked Readiness Index.

Unlike previous research, it distinguishes between the impact of individual, business, and government ICT usage on growth and shows that only individual usage has a positive impact.
Furthermore, a disaggregated analysis of the types of usage reveals that two indicators, social media and the importance of ICTs to government vision, are significant for growth.

Draft v0.95 – For Committee Review & Consultation Page 113 of 113