SIGHTS UNSEEN.

For traditional companies and Internet startups alike, e-business is uncharted territory. That means that new opportunities to improve operations and reach customers abound. But it also means that there are new challenges and new dangers to face. Murky legal issues. Increased vulnerability to hackers. Complicated and conflicting regulations. The specter of information being abused for commerce and power. Before setting out on the e-business journey, executives need to be ready to meet the pitfalls of today, and the lurking, unseen perils of tomorrow. Forewarned is forearmed, and by taking a realistic, thorough view of the challenges to come, CEOs can not only create the e-business, but protect and nurture it, and thrive in a fast-changing, exciting, and sometimes frightening world.

Think way, way back to the mid-1990s, when companies started offering goods over the Internet. At the time, a lot of consumers were worried about security and, especially, having their confidential credit card information stolen as it moved over the network. Today, an observer might conclude that such fears have more or less evaporated, with millions of people going on-line to spend billions of dollars.

That observer would be wrong. Concerns about security and privacy are still very prevalent, and a great many people worry about keeping personal information safe from abuse by criminals, companies, and even governments. Indeed, 64 percent of on-line consumers are "unlikely to trust a Web site," according to a Jupiter Communications report.

The success of America Online is evidence of that concern, says Mark Templeton, chief executive of Citrix Systems, a Fort Lauderdale, FL-based software firm. Just a few years ago, many pundits thought that the growth of an open and free Web would be the end of proprietary on-line services such as AOL, Templeton explained at the University of Virginia e-summit. But AOL has thrived. "I think that what makes AOL work to a large degree is that it's a safe place to go. It's like going on a tour. Why do so many people sign up for a tour to London, rather than just get on an airplane and go to London? It's because [they know it is] a safe, secure kind of agenda. 'Someone's going to take me through, show me what I should see and not see, keep me out of bad areas.'"

For companies, however, such comforts are hard to find. E-business is a brave new world, and it involves many unknown perils and as yet unseen challenges--starting with privacy and security, which are serious issues for businesses as well as consumers. That's because collecting and storing information about customers--their tastes, where they go, what they buy--is the lifeblood of on-line business, the key to target marketing, customization, and personalization. However, those activities also mean that a tremendous and growing amount of information about customers is being kept in corporate databases. And if a company can't keep its data safe, customers will quickly go elsewhere. In many cases, "elsewhere" might not only mean another vendor, but court. In 1998, a U.S. jury awarded an identity-theft victim $50,000 in actual damages and $4.47 million in punitive damages. The reason was that the defending credit-reporting agency had "failed to follow procedures to maximize accuracy" and thereby "willfully defam ed the defendant," according to a report by PricewaterhouseCoopers.

There's a good chance that security and privacy issues will receive more attention in the coming years, simply because they will become relevant to more people. "The Internet right now is optional, and someone might say, 'Well, you don't have to use it--there's no gun to your head,'" says Larry Ponemon, a PricewarerhouseCoopers partner. "But I predict that in five or 10 years, it will be the only way to operate. So if you don't have security and privacy and those ethical issues at the front, then you're looking at some very serious problems."

Companies can rake steps to help avoid such problems. Security and privacy technologies such as encryption, digital signatures, and biometric identification systems are evolving rapidly. But nothing is perfect, says Ponemon. "The level of security that's required to have 99 percent reliability in a systemic sense just doesn't exist. And the reason why it doesn't exist is a random event called 'smart people.' There's always someone in the world who is inventing a better virus or is a better hacker. That's the source of the problem. You can't model it. You can't program it away. You can't do any of those good things that you can do in a kind of a steady-state situation."

The human variable is not always malicious, Ponemon continues. "The biggest privacy vulnerabilities that we see--and we see them over and over again--are not evil people. They are people who just didn't know." People make mistakes and save or use customer information when they shouldn't, he explains. For example, his company worked with a software firm that gave customers the chance to "opt out" of having their full registration information used in a marketing database. Yet, about half the registrations that had opted out were being entered into the system by people who were just doing things wrong. Even having a clear privacy policy in place doesn't always help, Ponemon adds, "We still have organizations that are big, and they can't control what is done on a daily basis within that organization. It's a big risk."

What can a company do? One thing, experts say, is to educate customers about privacy policies and let them know about the level of security risk in using a site. "You never betray that customer trust," Yahoo! CEO Tim Koogle told the Virginia e-summit. His company makes it a point to tell customers when they are giving Yahoo! information. "You remind them of that. You say what's going to be done with it and what will never be done with it. You give them the ability to choose to not give you the information, and then you never break the trust."

"There are lots of neat things you can do if [customers] are willing to turn over that information," added CNET CEO Halsey Minor. The key is to "identify up front that you're going to be extracting this kind of information, and make sure that you extract only that information."

HIDDEN DANGERS AHEAD

Privacy and security have been very much in the spotlight in recent months, but there are a number of other looming perils and problems to watch out for on the road to e-business--things that may only get more troublesome over time.

To begin with, CEOs need to consider the increased complexity of doing e-business across borders. E-business is global by nature, which means companies will find themselves facing a variety of business practices, laws, customs, and regulations. And they will not only be dealing with differing conditions from nation to nation, as multinationals do today, but with the conditions of many nations at the same time, due to the fact that the Internet allows them to reach many places simultaneously.

For example, in the European Union, the consumer-protection laws of each individual country remain in place, with transactions falling under the law of the country in which the consumer resides, says Karel De Baere, who heads up e-business efforts in Europe for PricewaterhouseCoopers. "So theoretically, anybody who wants to do e-business in the business-to-consumer space in Europe would be confronted with 15 different consumer-protection laws that it needs to satisfy. Or, in the advertising domain, you can't advertise pharmaceutical drugs in certain European tries, or there are restraints in terms of what you can do. Some places don't allow comparative advertising. So it's a complicated environment, and even if you try to act as ethically as possible, complying with all these different rules can be difficult."

Another complication of working across borders is the need to contend with a patchwork of tax regulations--especially value-added taxes VAT) and sales taxes. "For American companies, dealing with the whole indirect taxation question is probably going to generate a much more complex problem than privacy issues," says De Baere. With European VAT rules, for example, "a book downloaded through the Internet could qualify as a service--and again, depending on the country, different rules apply. It seems trivial on the surface, but filling out the matrix of all the possible combinations is not a trivial thing."

On another front, e-businesses will also find themselves having to break new--and often thorny--legal ground. This is largely uncharted territory, after all, and legal questions will arise around topics such as protecting information-based products, establishing alliances, guarding the integrity of brands, and ensuring the enforceability of transactions. Also, existing laws are often ill-suited to the world of e-business, which only complicates the picture, says De Baere. For example, when customers in many European countries buy products via a distance sale, such as through the mail or on-line, they have a legal refusal period of anywhere from five to 14 days--and the seller is not supposed to invoice the customer until that period is over. For a company selling downloadable software over the Internet, that presents a real dilemma. Technically, that seller should not invoice up front, as the software is downloaded, but if the company waits a week or two to bill the customer, it runs the very real risk of h aving its product copied or used, and ultimately returned without payment.

Finally, from a macro viewpoint, e-business and the Internet are changing the context in which business is conducted--that is, changing society itself. And it may not all be for the good. Although some 500 million people are expected to be connected to the Internet in 2003, that is still less than 10 percent of the total world population. In short, if things continue on their current course, a great many people are not going to be able to use one of the world's most vital tools for prosperity. "Eleven percent of children in the inner city have access on an ongoing basis to the Internet. That's ridiculously low, and that's going to be a have/have-not kind of issue," Jeffrey C. Walker, managing partner of Chase Capital Partners, told Virginia's e-summit. "Are we going to help bring the have-nots into the system? Can we bring in this global community?" Humanitarian concerns aside, those kinds of disparities in access could contribute to increased uncertainties in business, such as instability in overseas market s and attempts by governments to exercise more control over the Internet.

BUILDING THE E-BUSINESS FOUNDATION

Overall, there are no simple solutions to these problems. Privacy, security, taxation, regulation--they all require vigilance. Companies will need to monitor the situation constantly, keep auditing and examining systems and policies, and move carefully in working across organizational and national boundaries. And they will need to get involved in efforts to help government and education cope with the social and political issues that will affect the future of e-business.

Planning and foresight that looks beyond new revenues and customer service, and incorporates the full range of e-business issues, will be key. Executives will have to think about nor only creating a new business model, but about how to sustain and protect that model in a fluid and sometimes threatening environment. Doing so will, admittedly, require the kind of organizational self-discipline that can be hard to muster in a world where the need to move and act is paramount.

Indeed, most global companies still lack an effective e-business strategy, the META Group says. The Stamford, CT-based consulting firm found that 65 percent of the companies it surveyed spend less than $1 million a year on business initiatives. By comparison, the report says, such companies were routinely spending $100 million to $400 million on ERP systems. "E-business has not yet become part of a larger corporate culture and strategy," says Kirk Reiss, senior vice president of META Group Consulting. "The low dollar investment in e-business is indicative of stopgap measures and patch-up thinking--a 'metoo' strategy where companies are doing e-business because they see that other companies are."

Similarly, the GartnerGroup, a Stamford, CT-based research firm, predicts a coming era of "e-business disillusionment" in the next few years, with 75 percent of e-business projects failing to deliver on their promises. The company reports: "Such failures will not be because transformation to 'e' is wrong, but because the business model, strategies, and implementation will have failed."'

"You have to approach the e-business domain in a holistic way. That's probably the single biggest message," says PricewaterhouseCoopers' De Baere. "Looking at e-business as a sheer technology issue alone won't work. Looking at it from a purely tax and legal perspective is not going to work either. A strategy perspective, a process-Improvement perspective, a skill perspective--none of those alone will work. You need the holistic view, which really means getting the strategy right and organizing yourself in terms of capabilities and skills and the organizational model you adopt, reviewing and reengineering processes--all of it."

"Like anything that's incredibly new and exciting, there are always two sides to the story," Citrix Systems' Templeton concluded at the summit. "I'd just challenge everyone to not respond to the hype of it, but to respond to the potential and the real content of it all. It's real easy to pour massive amounts of resources into something that seems cool without doing the proper sort of gut check, analysis check, etc. We all have to keep our wits about us. As wonderful as it all is and as fast as it's moving, we do have to make sure were keeping our feet on the ground."

PAYING THE PRICE

Companies that conduct Internet e-commerce are 57 percent more likely to experience a proprietary information leak and 24 percent more likely to be hit by hackers than companies that don't do business on-line. The average security breach results in a $256,000 loss.

SOURCE: ICSA/INFORMATION SECURITY SURVEY

TAKING ACTION

To address privacy issues, e-businesses should:

Educate consumers about privacy.

Build trust by promoting and highlighting privacy efforts.

"Over-comply" with regulation.

Support the creation of a standard approach to privacy.

Get involved in shaping/limiting government regulation.

SOURCE: JUPITER COMMUNICATIONS

THINK LOCAL, STAY LOCAL

Less than half of surveyed on-line companies make a profit on each shipped package, and 85 percent are unable to fill international orders--largely because their systems can't deal accurately with international addresses or price total international delivery costs.

SOURCE: FORRESTER, RESEARCH

U BERTRAM ELLIS

By 2003, U.S. higher education institutions will spend almost $5 billion on information technology-related products and services, a reflection of the changing needs of college students and the shifting missions of colleges and universities, according to International Data Corp. research. But that only addresses one aspect of education in an on-line world, according to U. Bertram Ellis, chairman and CEO of Atlanta-based iXL Enterprises, which helps companies take advantage of technology. "My biggest concern vis-a-vis the speed and pace and change that the Internet is creating is how it affects public education. I'm not worried about the colleges being able to adapt; I'm worried about primary and secondary schools. I'm worried about their embracing the change that the Internet requires and the speed it requires."

THOMAS C POWER

Broadband technologies will bring more services to consumers, but "even five years out, it's predicted that as many as 50 percent of people will still be using the old dial-up connection to get to the Internet," says Thomas C. Power, senior legal adviser at the U.S. Federal Communications Commission. "The goal that I think we're all shooting for is high-speed Internet access to the home, and the question is how best to get there." In general, he adds, Internet technologies are raising a number of new challenges for regulators. "I think we have to fight the urge to treat everything new the way we've treated everything old. You don't just slap the old regulations on the new technology."

MICHAEL MCQUAR

Many Internet executives point out that government regulation of the industry would be problematic, to say the least. "There's no de facto governing body that can enforce anything in what we call the Internet community--the infrastructure providers and the users of the Internet," says Michael McQuary, president and COO of MindSpring Enterprises, an Atlanta-based Internet access provider. "The Internet community has a good moral compass and does take action quickly where it can. I think you will see that as more and more people get involved in the Internet, it truly is one of the most democratic vehicles and mediums, and the community can act quickly against things that it doesn't think are in the overall best interest and the common good."

The Technology Disconnect 

WHEN IT COMES TO THE PERILS AND PITFALLS OF E-BUSINESS, SOME ARE DISTANT AND UNKNOWN, AND SOME ARE CLOSE AT HAND--AND AT THE POINT WHERE THE OLD MEETS THE NEW.

"It's important to realize that e-business is not a substitute for good business practices," says PricewaterhouseCoopers' Chris Everett. "If your back-office systems aren't connected, just bringing up a Web site to get more customers is not going to be a successful strategy." What that often leads to is a kind of disconnect, where customers order on-line in minutes and then wind up waiting weeks for the order to be filled and shipped by traditional systems and processes. "I always say that your back-office systems are like a cake and the e-business-related systems are the icing," Everett says. "You need to have both, with good processes and procedures and systems in the back office tied into the Web technology."

A lot of companies have yet to make that connection. PricewaterhouseCoopers surveys show that only 25 percent of corporate Web sites are connected to customer databases, and only 7 percent of companies have their front-end Web sites linked to their back-office systems. That means 93 percent of them are rekeying information, faxing documents, and building electronic patchwork bridges to fill orders.

So far, companies have been able to keep up, except for some glitches around peak holiday shopping periods. But many will hit the wall in the near future, experts say. As more sales move to the Internet, Forrester Research notes that expanding product selection and the need to move large volumes of parcels--along with rising customer expectations about fast delivery-will add up to "order fulfillment chaos." Forrester adds: "Firms chat fail to attack order fulfillment with the same vigor as on-line selling will experience customer defection, funding attrition, and distribution nightmares."

Coming Soon: A Worldwide Web

Over the years, e-business has been something of a U.S. phenomenon, but that is changing rapidly. In the next three years, says International Data Corp., non-U.S. Internet commerce will account for 46 percent of worldwide e-commerce spending. And Europe will be leading that shift, with e-commerce there growing at a compound annual growth rate of 138 percent over the same period.

E-business is about to take off in Europe, agrees Karel De Baere, who heads up PricewarerhouseCoopers' European business efforts. He cites several factors, including high Internet penetration in several Scandinavian countries and the recent upsurge in the number of on-line users in Europe in general. In addition, he says, Europeans might not be as culturally opposed to on-line business as U.S. press accounts have suggested. "E-business-related turnover in France in 1997 was bigger than the total e-business-related turnover generated in the United Stares, through the French Minitel system;" he says. The Minitel system is a nationwide on-line service that has been in place for years.

Especially significant is the widespread use of mobile phones across Europe, combined with the emergence of a standard technology for linking mobile phones to the Internet. "Mobile phones have a very significant and distinct advantage over traditional Internet connections," says De Baere. "They enable you to get in touch with somebody all the time, and you can localize content for users because you know where they are."

The exploding growth of the Internet in Europe and around the globe clearly presents major opportunities for e-businesses, says De Baere. But, he cautions, executives should remember that it can also mean increased risk and complexity in terms of legal issues, taxes, and business practices. "Companies should be prepared to adjust their content in various ways, including language and even a cultural perspective," he says.