D2.2 TRUST AND CONFIDENCE ON THE INTERNET This factor reviews the level of user trust and confidence in the use of online services in general, and e-government and e-commerce services in particular. Maturity Stage: Formative to Established Overall, the participating stakeholders accepted that a limited proportion of Internet users critically assess what they see or receive online or consider that they have the ability to use the Internet and protect themselves online. Moreover, a limited proportion of users trust in the secure use of the Internet based on indicators of website legitimacy. Operators of Internet infrastructure are developing measures to promote trust in online services but have yet to implement them. As mentioned above Internet users in Iceland trust in the security of the Internet without basing that trust on website legitimacy. Their trust is too often an overly confident “blind” trust. People like the convenience of online services and either do not understand what secure browsing is, for instance, or they do not fully understand the risks that are associated with insecure Internet provision. Users do not necessarily lock their PCs and usually behave online much like they act in their everyday life, which is shaped by a general sense of trust that is characteristic of the Icelandic culture. Participants noted that identity theft is not considered a problem for the majority of users. According to the General Penal Code No. 19/1940 (see D4.1) identify theft is not criminalised unless it is used for unlawful purpose and practises. E-government services have been firmly established in Iceland. The Government continues to increase e-service provision and tax declarations are already being submitted electronically. The government, along with other stakeholders and users, recognise the need for the application of security measures to establish trust in these services. However, participants noted that users trust in e-government services ‘’by default’’ as they do in other government services. The implementation of the EU General Data Protection Regulation (GDPR) and the NIS Directive will ensure security and data protection provisions for e-governance services. Thus, user trust in e-services is also expected to be strengthened among users. Electronic certificates for authentication and two-factor authentication for document signing are being promoted and utilized broadly within the public sector. E-commerce services are fully established by multiple stakeholders. Security solutions are updated and reliable payment systems have been made available. A growing proportion of users trust in the secure use of e-commerce services and the private sector promotes use of e-commerce services and trust in these services. Participants claimed that, generally, onlinebanking and other commercial services from local suppliers are being used; but that foreign services, such as Amazon, are used and trusted more. 33 | Cybersecurity Capacity Review Iceland, 2017