The Millennium Bug Alert

Note to national committees and chambers of commerce
15 May 1998

How ICC can help, particularly through its worldwide chamber network

On 8 April 1998, the Bank for International Settlements (BIS) hosted a Round Table on the millennium bug problem which may arise when we reach the Year 2000. The conference was sponsored by the Basle Committee on Banking Supervision (Basle Committee), the Committee on Payment and Settlement Systems (CPSS), the International Association of Insurance Supervisors (IAIS) and the International Organization of Securities Commissions (IOSCO). Maria Livanos Cattaui, Secretary General of the International Chamber of Commerce (ICC), participated at the invitation of Andrew Crockett, General Manager of the BIS to help ensure the success of the meeting and to bring a delegation of ICC experts nominated by national committees. The limited invitation meeting was attended by more than 200 senior executives (from 52 countries) representing a variety of public and private sector organizations from around the world.

The sponsors of the event recognized the seriousness of the challenges posed by the century date change in IT applications, and in particular the potentially severe consequences in financial markets associated with a lack of Year 2000 readiness. The discussions at the conference focused on the identification of the necessary initiatives to ensure that financial market participants and the interconnected infrastructures can continue to function without major disruptions during the transition to the new millennium.

ICC was called upon to mobilize its members and spread awareness of the problem and the sharing of information to solve the issues concerned.

We are convinced that the member chambers of ICC are the best way to mobilize tens of thousands of companies including SMEs (small to medium-sized enterprises) facing this problem. We are aware that many chambers have already taken action and started large-scale awareness and assistance programmes. One way chambers might help smaller enterprises is with the availability of experts; given the fierce competition for skilled resources to examine the lines of computer code, chambers might contract with local consultants, to sub-contract them in turn to local SMEs.

If chambers of commerce wish to hold conferences and/or workshops, the ICC secretariat stands ready to assist in creating quality programmes with internationally recognized speakers. It might also interest your members to know that the ICC International Court of Arbitration is fully prepared to handle disputes arising from damage caused by the Year 2000 problem more rapidly and at a lower cost than litigation.

If you have information or knowledge of special experts you would like to share, or if you have any questions, please contact Christopher Lewis or Christiaan van der Valk at ICC headquarters (by Email on Click here to send a mail or Click here to send a mail or by fax on +33 1 49 53 28 59).

Defining the problem and its scope

1. What causes the problem?

Years ago when there was a high premium on saving space in programming, a convention was developed according to which programmers only used two digits instead of four for the year in the date field. For instance, the date field would read 19XX with the last two digits being variables. For many years, everyone assumed that by the advent of the Year 2000 more competent systems would be in place to replace the older ones. However, many important and crucial systems have not been replaced. Consequently, these systems will face grave functional disturbances when the new millennium arrives.

2. What will it affect?

Aside from computers and their programmes, one of the problems lies with embedded microchips. These chips are more prevalent than most people realize. They are in traffic lights, hospital machinery, cars, aircraft, water treatment plants, fax machines, televisions. The list seems to be endless. Dealing with embedded microchips seems to be the 'overlooked' aspect of the Year 2000 problem.

3. What will happen?

The potential problems that will arise when the date field encounters the end of the 1900s include:

• the microchip no longer understands its code and simply ceases to work, rendering the equipment unusable;
• the microchip could continue to function, processing errors as it does not understand the code.

Needless to say, either option would cause huge problems in the daily operations of organizations.

4. Peter de Jager is considered to be among the world's leaders in raising awareness of the Year 2000 computer crisis. He is the author of "Doomsday 2000", an article which appeared in Computer World on 6 September 1993. During his keynote address, he stressed three simple points:

• the computer systems on which we depend are broken
• they must be fixed by the start of the year 2000
• we are not good at delivering systems on time.

These three simple statements add up to a crisis. In addition, the conversion to the euro drains resources away from addressing the Year 2000 problem. Mr de Jager is very concerned that some firms feel that they must first devote resources to the euro, and then turn attention to the Year 2000. Without commenting on the unde rlying political implications, he even suggests pushing back the implementation date of the euro. The year 2000 is a real deadline that is advancing at the rate of 60 seconds per minute.

5. Andrew Kyte, Research Director of the Gartner Group, noted that the problems facing information systems and embedded chips are distinctly different, yet carry the same label. He distinguished information systems which principally affect enterprises in the information/knowledge/service sectors, from the embedded systems which principally affect enterprises in manufacturing. The problems resulting from information systems can be compared to a storm while those arising from embedded systems are a hurricane.

The Gartner Group has estimated the total cost for addressing the Year 2000 date changee will be between US$300 to US$600 billion within the global market (0.7 probability).

6. It is obvious that no individual IT user, individual institution, sector, market or country is immune to the difficult issues presented by the Year 2000 problem. Even if an institution has verified and tested all its internally developed systems and applications, it will be affected by:

• the state of readiness of its vendors and third-party service providers;
• the public utilities upon which it relies, particularly the telecommunications and electricity suppliers;
• the infrastructures that it relies upon for its trading, payment and external information needs; and
• the counterparties and customers upon which its business viability rests.

Moreover, the globalization of financial and economic activity and the widespread use of information and telecommunications technology have created various international interconnections and global interdependencies which add greatly to the complexity of the challenge.

Steps to effectively deal with Millennium Bug and contingency planning

Essentially, everyone agrees that the steps any organization must take to become millennium compliant are as follows

• recognize and accept the problem
• determine the extent of the problem
• prioritize system functions which must be corrected
• plan and commit the resources, develop contingency plans
• make the changes
• test the results
• become millennium compliant!

Andrew Kyte, notes that cost estimations in step four are nearly always several times less than the final sum reached at step seven. This why we constantly see businesses making upward revisions of their Y2K spending.

Many Year 2000 experts agree that the applications affected by the date change-over cannot all be fixed in time. There are simply not enough resources to prepare every system. Therefo re, it is necessary to prioritize: mission-critical programmes must receive immediate attention. Less crucial applications should be addressed only after all the mission-critical applications are functional.

Time is short, and deadlines for each step are tight. Optimally, organizations should already have finished the examination of the thousands or millions of lines of code and have entered the testing phase. However, many organizations have not even identified the problem, much less finished fixing code.

The necessity of a contingency plan was evoked as a means to cope with a potentially disruptive business climate. In designing a contingency strategy, Martha Bennett, Vice President, Research, Europe, Giga Information Group, outlined important questions organizations must ask themselves:

• Who do you depend on?
• Who depends on you?
• Who may put you at risk?
• Who may sue you if you are putting them at risk?

Finally, there was a consensus that the most important aspect of the changeover is the testing of the applications. It is only through comprehensive testing that all of the programming wrinkles can be ironed out. Without proper tests, there can be no assurance that mission-critical applications will be ready on time. Testing is time-consuming, labour intensive and expensive, but it is a need that cannot be overlooked or underestimated.

Given the degree of interconnection between market participants and the fact that internal remedial programmes and testing efforts will require continuous reassessment and adaptation, organizations should maintain an open dialogue with their customers, counterparties and creditors so that all interested participants are able to make informed business decisions. Furthermore, it is essential that organizations consider the likely effects of the century date change on their customers and counterparties when evaluating future business transactions with these entities.

Insurance Issues

The insurance industry has been familiar with the millennium problem for quite some time and has been dealing with it. John Thompson, Chairman of the Executive Committee of the International Association of the Insurance Supervisors (IAIS), explained that insurance policies are date-sensitive products, sometimes reaching decades into the future. Examples of insurance data include: birth date, policy effective date, expiry date, inception date, renewal date, claim occurrence date, claim reported date, claim payments date. Therefore, years ago errors were detected resulting from inputting dates beyond the year 2000. Although the problem is familiar, the industry is not sufficiently prepared and must go through the same steps as all other sectors.

From a policy standpoint, the industry has made it quite clear that it will deny claims arising from the date change. The clock striking midnight at the start of 1 January 2000 is predictable and is not an insurable event. According to the Association of British Insurers, "The purpose of insurance is to provide you with protection against events which are fortuitous - that is, unexpected. Insurance policies are NOT designed to deal with even ts which are entirely foreseeable, like the millennium." The progression of time is both known and unavoidable, therefore, uninsurable. The denial of claims will necessarily lead to litigation, arbitration and other alternative dispute policy mechanisms.

As an overview of the different types of insurance exposure, the Chairman of the IAIS Executive and Technical Committees warns, "Year 2000 could result in higher than anticipated claims on insurance policies. For example:

• Professional liability exposure: for technology producers, designers,consultants, etc. who may be sued for errors, omissions or failure to complete contracts.

• Directors and officers exposure: for managers and directors failing to take adequate measures to address the problem.

• Loss of profit exposure: for policies written on an 'all risks' form, or from material losses caused indirectly by a year 2000 failure - e.g., fire due to computer breakdown/malfunction, fire causes loss of inventory, etc.

• Liability exposure: third-party losses because the insured's computers or products contain an embedded computer chip that is not Year 2000 compliant.

• Property damage exposure: fire or water damage caused by failure of peripheral computer-based services (alarm systems, elevators, sprinkler systems, etc.)

• Marine or aviation exposure: from non-compliant guidance or traffic control systems.

• Automobile Exposure: from non-compliant traffic or street lighting systems."

Dispute Resolution

Given the extent of the potential difficulties arising from the date change, resort to litigation and other dispute resolution procedures seems inevitable.

Already two full years before the new millennium, the first case was filed in Michigan alleging damage arising from delays resulting from rejected credit cards with post year 2000 expiration dates. Several other cases have followed. It seems clear that we can expect a considerable amount of legal action.

Guy Morton, Partner, Freshfields, listed a variety of legal concerns:

• direct loss from non-compliance by the firm or by others (e.g. payment or delivery failures)
• customer claims for failure to provide contract services
• third party claims for alleged disruption/ interference
• regulatory sanctions for non-compliance
• personal exposure of officers
• insolvency risk
• audit problems

As an alternative to the high costs of litigating these issues, the BIS Round Table participants were eager to know what the ICC's I nternational Court of Arbitration has done to prepare for the millennium disputes. ICC Secretary General Maria Livanos Cattaui outlined ICC's five-pronged approach to handling arbitration cases, which could reduce the costs of the above estimates:

• the Court is setting up a Y2K Advisory Dispute Resolution Panel that would advise parties which method of dispute resolution (if any) would be the most appropriate given the nature of their dispute;
• ICC Arbitration under the 1998 Rules of Arbitration;
• ICC's Fast-track arbitration under the 1998 rules if all parties request it;
• Centre for Expertise for use prior to any formal dispute resolution mechanism;
• ICC Rules for Optional Conciliation which can also be applied to mediation.

By providing these five options, ICC offers parties a variety of speedy, low cost methods of resolving their disputes. Having these mechanisms allows firms to devote resources to combating the problem rather than litigating it. In fact, several organizations have argued that all possible efforts should be made to remove legal impediments to the sharing of critical information on Year 2000 readiness. This would allow people to share information without regard to future legal liability based on admissions.

The need to involve management

Every senior political and business executive should have realized by now that these issues pose a critical management challenge. The implications for the ability of businesses to continue operating through the transition to the new millennium are potentially severe.

The many challenges include:

• the need to address resource constraints
• the need to share information on readiness (not withstanding legal issues)
• the coordination of testing schemes within and across markets
• the heightened disclosure of vital information
• the development of market conventions to deal with transaction failures
• contingency planning for infrastructure problems.

Many people at the BIS Round Table pointed to the Securities Industry Association (SIA) as an example of how an organization should deal with the problem. Early on, the SIA Board concluded that there was a problem and took all necessary steps to get its members prepared.

Discussions at the Round Table confirmed that the Year 2000 challenge continues to require the unwavering attention of senior executives throughout the world. Organizations need to ensure that appropriate programmes have been established to address all the various readiness issues that can be expected to affect their business. The resource constraints (financial, human and technological) and the amount of time needed to remedy and test internal systems are compounded by the need to evaluate readiness and arrange for testing with counterparties and customers, payment, clearance and settlement system s, as well as various trading and information systems.

Indeed, as outlined above, officers and managers might be held negligent for not developing a detailed Year 2000 plan. With the cover of their officers' insurance policy in a state of legal ambiguity, they must take action to prevent personal liability. Recently, even regulatory bodies have been forcing companies to disclose their preparatory steps as a positive obligation.

Private & Public Sector Coordination

The private sector, both in a domestic context and internationally, is committed to move ahead on a variety of fronts. Initiatives include the further development of mechanisms to share information relating to Year 2000 issues; an effort to establish minimum best practices for programmes designed to achieve readiness; and the support of rigorous internal and external testing. Although competitive pressures may arise from the markets' assessment of the readiness of individual firms, there is likely to be scope for organizations, individually or through industry associations, to cooperate to ensure that the time remaining before the new millennium is used to the mutual benefit of all.

ICC is committed to facilitating private-sector initiatives. ICC has discussed the development of increased coordination with other international organizations such as Organization for Economic Co-operation and Development (OECD), World Information Technologies Services Association (WITSA), Information Technology Association of America (ITAA) and the Global 2000 Coordinating Group. ICC, as the only global non-sectoral business organization, will also raise the need for global action with a large number of associated private-sector organizations in the fields of transport, telecommunications, IT, and manufacturing, as well with as chambers of commerce worldwide.

The discussions at the Round Table emphasized that, while only the private sector can solve Year 2000 problems, public-sector coordination is necessary to facilitate domestic and global activities. Such coordination is particularly helpful in designing external testing programmes; improving information sharing among market participants, their vendors and service providers; fostering increased disclosure by financial and non-financial corporations of their Year 2000 readiness and testing results; establishing market conventions and procedures for dealing with potential contingencies; and reinforcing the role of oversight bodies such as supervisors and auditors.

Where appropriate, further joint action will be taken to promote the Year 2000 readiness of the global financial industry. The sponsors of the BIS Round Table will cooperate with regional efforts to organize regional seminars on the Year 2000 problem in order to enhance worldwide awareness of the seriousness of the situation and to induce appropriate action.

During the Round Table, Maria Cattaui and Harris Miller, President of WITSA and ITAA, announced their intention to cooperate in holding conferences and seminars devoted to raising awareness of the Year 2000 problem and to sharing best practices in preparing for the date change.

BIS Round Table sponsors' recommendations

Awareness of the seriousness and scope of the problem varies considerably across markets and institutions worldwide. It is imperative that all market participants, especially financial market supervisors, work to ensure that Year 2000 preparations receive the maximum senior management attention and priority, including at the board of directors level. In particular, market participants from regions that have not yet vigorously tackled the problem should consider the need to invest significant resources in the short time that remains.

Assessing Year 2000 readiness is the most critical and complex issue facing the financial industry. Because widespread testing has not yet begun, the extent of the problems and the amount of remediation work that remains are unclear. Market participants should explore ways to enhance the transparency of testing results.

It is critical that financial market supervisors around the world implement programmes that enable them to assess the Year 2000 readiness of the organizations and market infrastructures that they supervise. Further, it is important for supervisors to ensure that the risks related to the century date change are identified, properly communicated among market participants and appropriately managed in their jurisdiction.

The highest possible priority should be given to Year 2000 preparations by telecommunications and electricity providers in each national jurisdiction. Failure of these organizations to prepare adequately and share information on their plans to promote effective testing could lead to serious disruptions in the world's financial markets.

In order to achieve a greater degree of market transparency, the sponsors believe that the sharing of critical information on Year 2000 readiness by all market participants is essential. The private sector might develop standard questionnaires and frameworks for Year 2000 disclosure as these have the potential to provide clear means for measuring progress.

Financial industry conventions and dispute resolution procedures should be developed to address the possibility of transaction failures. Additionally, contingency measures should be considered for the potential failure of key parts of the financial market infrastructure. Further, it is recognized that national payment systems need to coordinate testing schedules in order to provide opportunities for end-to-end testing on a domestic and international basis. The Round Table sponsors welcome and support the initiatives taken by various industry groupings in this respect.