Issuu

VACCINATION CERTIFICATES AND IMMUNITY PASSPORTS HEALTH STATUS PROOF – WHITE PAPER No.1

HEALTH STATUS PROOF | WHITE PAPER No.1

‘

Many things have been changed by COVID. Health Status Identity was created by it

’

Published by Reconnaissance International Ltd 1B The Beacon, Beaufront Park, Anick Road, Hexham, Northumberland, NE46 4TU, UK Tel: +44 (0) 1932 785 680 Email: publications@recon-intl.com Website: securedocumentnews.com © Reconnaissance International Ltd 2021

Although all the information contained herein is obtained from sources believed to be reliable, we accept no legal liability of any kind for the publication’s contents or for any omissions, errors and their consequences. No part of this publication may be reproduced, stored in a retrieval system or translated in any form or by any means – electronic, mechanical, photocopying, recording or otherwise – without the prior permission of the publishers.

Reconnaissance International Ltd acknowledges products, services and company names referred to in this publication, some of which are trade names, service marks or registered trade marks.

HEALTH STATUS PROOF | WHITE PAPER No.1

Introduction Francis Tuffy – Consultant Editor

Not since the events of 11 September 2001, in the US, when at least two of the hijackers fraudulently gained identity documents, has the role of identity and the documents we use to assert it come under such scrutiny. The difference now, as we consider how we can revive economies, is that we are considering changes to the attributes we link to our identity – our health status – not to prevent intentional damage, but to make sure that people going about their lawful business do not put others at increased risk of harm. Like everyone else, I have followed the recent news stories in the media that have covered the political, the moral, the legal and the economic arguments for and against the introduction of vaccination certificates and immunity passports. As editor of ID & Secure Document News™, and of this White Paper, I believe that a key element to the debate has been missing – how might these proofs of health status work in a secure, flexible and costeffective way? To help answer these questions I have assembled a range of views from the people and organisations that are already producing secure, flexible and cost-effective certificates and passports. As vaccination numbers increase and calls for the introduction of health status passports gain momentum, ID & Secure Document News will continue to provide a voice of technical feasibility to the debate. With this in mind, the next White Paper in this series is scheduled to coincide with what is billed as the first real test of any health status passport scheme – the summer holiday season in Europe.

Our Sponsors Amongst the editorials and technical features from industry observers, three key industry actors in the ID and secure document business, Idemia, Thales and Veridos, have contributed sponsored articles, for which I am grateful. Their inputs have been invaluable in adding a real-world dimension to the White Paper and collectively they form a solid investigation of what is achievable.

HEALTH STATUS PROOF | WHITE PAPER No.1

‘

Vaccination Certificates and Immunity Passports are the defining development for the ID and secure document industry for 2021… and beyond

’

HEALTH STATUS PROOF | WHITE PAPER No.1

Contents 1 Introduction 4 Vaccination Certificates and Immunity Status Passports – Urgent and Important

6 Effects of the COVID-19 Period on

ID Verification and Secure Document Technologies

8 Vaccination Certificates are Going to

Need Standards and Infrastructures – So it’s Just as Well They Already Exist

10 Passports Were Never Imagined for Mass Commercial Transport – or Pandemics

12 Guidance for Implementing Health Pass Solutions – the Future of Digital Travel

14 Immunity Status Passports –

Watering the Green Shoots of Recovery

16 National Health Passes: Short-Term Fix or Long-Term Legacy?

18 Trust is Key as WHO Tests Digital Vaccination Certificates

HEALTH STATUS PROOF | WHITE PAPER No.1

Vaccination Certificates and Immunity Status Passports – Urgent and Important By Francis Tuffy – Consultant Editor

In the coming months, operators of international travel, work, education, hospitality and health will be faced with this ‘loaded gun in a crowded restaurant’ question: how can I know whether allowing an individual into my country, place of work, school, venue or hospital might raise the probability of virus transmission? We already have a requirement of entry for each of these scenarios based on proving that you have a negative result from a recent COVID test, and we are well advanced on adding immunity status to the criteria for entry in some cases. The starting assumption for this White Paper is not whether some kind of immunity status passport is ethically or politically expedient, rather it is that standardisation and interoperability (the long-hand for ‘passport’) is inevitable to navigate the thousands of bilateral arrangements that are already emerging between border controls and travellers, airlines and passengers, employers and employees, educators and students, venue managers and guests, and medical professionals and visitors. The second principle for the White Paper is that security should be built in now and not bolted on later. It seems probable that, when you apply for an immunity status passport, you will have to present evidence of health status linked to your identity, in the same way that when you currently apply for a (travel) passport you have to provide documentary evidence of citizenship linked to your identity. The evidence of health status currently in circulation comes from being vaccinated and (or) tested for COVID (virus and antibodies). In most cases, documents recording these events are records with little or no security against fraud. If we don’t build security into vaccination certificates and test results now, we face the far more costly prospect, in time and money, of bolting it on later. If the first assumption proves correct, then the second principle falls under the remit of the ID and secure document industry. That is why this collection of editorials, invited commentaries and sponsored articles is both urgent and important. These developments come at a time when the ID and secure document industry is itself undergoing rapid change. Secure documents linked to an identity (for instance, birth/marriage/death certificates, ID, passport, driving licence) that for decades have been issued on paper have, over the past few years, migrated to digital formats. An example of this is the driving licence which, for many years, was a paper based secure document. Some years ago, it transitioned to a wallet sized plastic document but still contained the same information including name, date of birth and categories of driving entitlement. Several US states have now adopted a mobile driving licence format which essentially puts that same information into a digital format. In the event of a traffic infringement the officer can access that information online to determine the entitlement of the driver. This transformation from paper and plastic to a digital format is regarded as a physical to digital transformation.

HEALTH STATUS PROOF | WHITE PAPER No.1

‘

Allowing an individual into a country, place of work, school, venue or hospital might raise the probability of virus transmission

’

Pass

But a new breed of documents, linked to the identity of an individual, is now making inroads into the physical to digital transformation. In Pakistan, for example, UNICEF has been running a mobile birth registration programme since 2016; to date around 1 million unregistered Pakistani children have been registered virtually – providing the same legal rights as the physical registration process but without issuing physical documents or their digital equivalents. This distinction between physical to digital and virtual-from-start is important not just because it captures a period of transition within the ID and secure document industry, but because it is what is happening now as we consider adopting vaccine certificates and immunity status passports. Currently, COVID vaccinations and tests are being carried out on a massive scale – with each event supposedly documented in some form of certificate. In reality, these documents can best be described as a record as they are seldom certified by a competent authority and do not securely link the result to an individual’s identity.

Most of these records have been issued on paper with little regard for security and in a variety of different formats. Through standardisation and then interoperability, these documents will transition first to a digital representation of the information and ultimately, for some use cases, into a virtual state with no traceability to a physical document. But while it is enticing to imagine travellers passing seamlessly through the highly controlled environments of Charles de Gaulle or O’Hare airports, with only a mobile app to navigate their route through ticketing and security, the reality is that a successful immunity status passport will have to be universal… working for all citizens in all settings. Progress towards the inevitable formulation of an immunity status passport will not be linear as new variants of the virus are discovered, vaccination numbers make faltering progress and the balance between economic recovery and public health concerns swings one way and then the other. This White Paper is the first in a succession of explorations of the role of the ID and secure document industry in helping roll out vaccination certificates and, ultimately, immunity status passports. The hope is, that out of this series of White Papers an Industry Roadmap will emerge – charting the urgent and important course from short term requirements to long term strategies.

VID-19

CO name…date of birth…test result…date of vaccination…type of ate Certific vaccine…name…date of birth…test result…date of vaccination…type of vaccine…name…date of birth…test result…date of vaccination…type of vaccine…name…date of birth…test result…date of vaccination…type of vaccine…name…date of birth…test result…date of

01010101000101010100001011111010 10010101010111001010010101010101 01011010010101010100101010101001 00101001111010101011101010000101

name…date of birth…test result…date of vaccination…type of vaccine…name…date of birth…test result…date of vaccination…type of vaccine…name…date of birth…test result…date of vaccination… type of vaccine…name…date of birth…test result…date of vaccina

COVID-19 Certificate

01010 101000101 01010000101 11110101001 01010101110 01010010101 01010101011 01001010101 01001010101 01001001010 01111010101 01110101 000

Pass

HEALTH STATUS PROOF | WHITE PAPER No.1

Effects of the COVID-19 Period on ID Verification and Secure Document Technologies Translated and adapted from the original by Achim Hildebrandt, former Head of Passports and ID Cards, Federal Ministry of the Interior – Germany.

For an industry to have a sustainable future it must address a need in society and provide a practical solution to a problem. In 2021, the emerging problem for which ID and secure documents have a significant role to play is in providing proof-of-immunity status systems that will increase the mobility of citizens and allow a safe lifting of lockdown measures. There is a debate currently waging between governments, institutions and corporations around the practicalities and morality of so-called ‘immunity passports’. Israel will be the first country to issue a ‘green passport’ to residents who have received the COVID-19 vaccine. The passport will lift some restrictions, including mandatory quarantine following exposure to an infected person, and offer access to cultural events and restaurants, according to Israel's Ministry of Health. For some, there is an ethical question to be answered about whether it is unfair to allow vaccinated people to have additional rights and mobility over un-vaccinated people. But when judged against the strategies to ease lockdown restrictions the question is framed differently, as people who have been vaccinated pose a lower risk to public health than those that are unvaccinated. The discussion will soon reach the top EU leaders in Brussels, where it is recognised that having proof of a negative COVID-19 test result is already allowing travel privileges versus those that cannot demonstrate a negative test result. What is clear is that if the certification of a vaccination is to have real relevance for societal mobility, questions about the reliability and security of the document and the data it contains are inevitably on the agenda. If the vaccination information is important for public health policy then it must be protected. Then the connection between health information and the person must be secured. And it is here that the ID security industry has enough experience and practical, quickly deployable and manageable solutions to be of use. Some of the solutions under consideration will undoubtably be digital, as they can be implemented more quickly than conventional physical solutions. But, in the long run, conventional solutions may be more practical for both the issuing side and the controlling side as additional reading and testing devices are then not absolutely necessary. Control would be possible by visual inspection.

HEALTH STATUS PROOF | WHITE PAPER No.1

It is also conceivable that should countries issue general vaccination cards, then the sensitive information about the vaccination could be protected by means of high-quality laminating film.

payment transactions are increasing significantly. Retail and other traditional businesses are increasingly transacting online. It is unlikely that there will be a reversal here. The cash industry will have to think about that.

There are proven solutions in the ID document area. For example, we are talking about holographic kinematic solutions such as those reliably used in the EU ID document area. The development of these solutions will demand decisions by the time a significant number of vaccinations have been administered.

In the field of ID documents, there could be a larger approach to eDocuments than previously thought, in the form of an eSolution as access to databases. The idea is not new, it is just being adopted on a larger scale (the time is ripe as never before). The EU visa has long been under discussion for such a solution. This means that the topic of using existing database systems and linking them will get a new boost.

This also applies to whether solutions are left to the market or whether government framework decisions are taken. Will the EU take on the matter (the holiday countries like Greece will signal their interest here) or the UN via ICAO? Or will individual states – in order to be able to quickly shape the benefits for starting up life as normal, move forward with national solutions – such as in the case of Israel. The decision on harmonisation may be left to a later day. But there is little doubt is that society has become more accepting of digital solutions during the period of COVID-19. Cashless

All in all, the experience of COVID-19 accelerated application of IT and eSolutions has shown what is possible and what is practicable. But the real trend in 2021 will not come from IT and digital experts. Rather, it will reflect that the issues of identity and how it relates to public health have moved firmly into the middle of society, politics and, above all, the thinking and experience of citizens.

HEALTH STATUS PROOF | WHITE PAPER No.1

Vaccination Certificates are Going to Need Standards and Infrastructures – So it’s Just as Well They Already Exist By Marc-Julian Siewert, COO of Veridos

The ongoing pandemic has created a need for a COVID-19 vaccination certificate that enables everyday activities such as visiting relatives in nursing homes or attending concerts, or even international travel, to accelerate without the risk of further spreading the virus. Whichever system of standardised certification is finally adopted by governments, under guidance from competent authorities, the issuers, citizens, and verification personnel that utilise the system must trust the solution and find it easy to use. Only then can the widespread adoption of such a certificate be accomplished. In developing the VeriGO® TrueSeal platform solution, Veridos, a provider of integrated identity solutions, has listed five key points it sees as crucial in maintaining trust, security and convenience: 1. Keeping data to a minimum: A secure vaccination certificate must minimise the data included about an individual, using only biographical information based on the specifications of the World Health Organisation (WHO), the European Commission or other standardisation boards such as the ICAO. Issuers should ensure that certificates are internationally comparable without storing any unnecessary information. 2. Inclusive formats: Availability of vaccination certificates must be accessible to all citizens regardless of their access to technology, meaning citizens should have the option of a digital or physical hard-copy certificate. 3. Remote verification: Equally as essential is a secure, contactless remote verification process. Through the use of smartphones or tablets as verification devices, certifications can be verified offline and at a safe distance, using technology already widely available. 4. Using (existing) public key infrastructures (PKI): In order to streamline deployment and maintain security standards, governments should definitely consider putting existing PKIs to use in the creation of the certificates. Exchanging the CSCA certificates bilaterally or via the ICAO PKD will make international operability quick and easy to implement. 5. Implementing a nationwide, standardised solution: Whether at vaccination and testing centres or at local doctors’ offices, care should be taken to avoid any additional administrative burden on healthcare workers. While IT systems may vary between certification issuing sites, the integration of a single solution will create consistency and efficiency across the board.

HEALTH STATUS PROOF | WHITE PAPER No.1

VeriGO® TrueSeal’s approach is to ensure exactly that. Working with Visible Digital Seals – a secure 2D barcode which are already used for travel visas – it is usable by all citizens in all situations, since the ongoing pandemic means that proof of this kind will become a regular requirement in everyday settings. VeriGO®

TrueSeal's Visible Digital Seal contains cryptographically secured central data to document the vaccination and identify the certificate holder – displaying only the data that is absolutely necessary to satisfy the relevant standards. Which data is seen as necessary to certify a vaccination will be defined by governments or international institutions such as, for example, the EU or the WHO. It would offer the opportunity to provide a vaccination certificate that is usable by all citizens, offering the interoperability of a digital solution while having the flexibility to be used by citizens who prefer a paper certificate. Veridos, like all actors in the ID and secure document industry, is under no illusions about the complexity of achieving universal vaccination certification. Many aspects need to be considered and different approaches weighed.

‘

It would offer the opportunity to provide a vaccination certificate that is usable by all citizens

’

However, Veridos has solutions in place using a similar technology set-up (eg. for birth certificates) and as VeriGO® TrueSeal is based on existing infrastructure it can be implemented relatively quickly.

About Veridos

Veridos is a world-leading provider of integrated identity solutions. Governments and public authorities in more than 100 countries trust the company’s uniquely comprehensive product portfolio. The company creates end-to-end solutions and services perfectly tailored to meet every government identity need. These range from paper to security printing, electrical chip components, enrolment, identity management systems, personalization and issuance, mobile ID solutions, and border control solutions including eGates. Governments can acquire best-in-class passports, ID cards, driver’s licenses, and more, or even the facilities to manufacture their own. Learn more about Veridos at www.veridos.com.

HEALTH STATUS PROOF | WHITE PAPER No.1

Passports Were Never Imagined for Mass Commercial Transport – or Pandemics By Editorial Team

King Henry V of England is credited by many as having issued the first passports, in the modern sense, by a 1414 Act of Parliament. Initially, they were a ‘gentleman’s agreement’ between the courts of sometimes hostile countries that were intended to allow foreign travellers passage in and out of the kingdom for the purpose of trade and negotiations. The passport still has the role of a protected passage travel document, requesting sovereign countries to ‘allow the bearer to pass freely without let or hindrance’ – in the words of the UK passport. But with the advent of widespread migration in response to wars, famines and economic privations, governments started to look to passports as a means of security and identification to help manage the influx of people. Passports became a requirement for international travel immediately after World War I, and a move towards the standardisation of the modern passport was made in 1920, through the League of Nations. In 1947, this was placed under the remit of the International Civil Aviation Organisation (ICAO), which continues to set passport standards to this day. With the introduction of biometric technology in Malaysia in 1998, passports have now become increasingly secure, while also able to provide more information about their holders through the use of an embedded electronic chip. Today, there are more than 100 states and non-state entities issuing ePassports, and over 490 million ePassports in circulation. So, what started as a privilege reserved for a tiny minority of society now facilitates the explosion in affordable international travel which has resulted in air passenger volumes increasing year-on-year since 1990, with two notable exceptions . The first of these was a fall of 19% in October 2001 (after the 9/11 attacks) and then in March 2020 when volumes (by revenue passenger kilometres) fell by 53%. The reason for this truly incredible drop in international travel is clear – COVID-19 and other respiratory tract infections do not respect borders. In the early days of the spread of the virus, governments seemed powerless to identify who was travelling into their country from affected areas. The inability to identify and isolate these travellers allowed the virus to spread rapidly across the globe through a series of ‘imported cases’.

10 HEALTH STATUS PROOF | WHITE PAPER No.1

And now as we look to reopen borders and stimulate international travel, we can see that despite the progress made in automating border management since 9/11, the processes are still, mostly, transacted using paper-based documentation as a security backstop. At a time of a travel-assisted infection crisis, when information about the recent travel history and health status of the traveller is as important as confirming their identity, travel documents (and the International Certificate of Vaccination or Prophylaxis – the tattered yellow booklet that holds the handwritten and stamped record of the traveller’s vaccinations) seem powerless against highly infectious viruses that have a long incubation period and can be transmitted by asymptomatic carriers. Despite all of the benefits of paper-based documentation, and their digital equivalents, one thing they are not is dynamic. Passports and health status documents, even with remote validation for additions and amendments, cannot be updated securely and quickly enough to keep pace with a rapidly moving crisis situation. And so, inevitably, the move is towards a virtual system of travel documentation. Even before the coronavirus pandemic, the International Air Transport Association (IATA) was at work on a paperless passport. Its project, One ID, would mean the passenger providing biometric information in advance that would allow them to check in, board and pass through immigration on arrival without anyone asking them for any documentation. Additionally, IATA’s ‘Travel Pass Initiative’, which is being trialled by Singapore Airlines on flights between Jakarta, Kuala Lumpur, and Singapore, informs passengers of what tests, vaccines and other measures they require prior to travel.

Similarly, ICAO could not have imagined the pandemic, but it was already working with various industry actors to prepare the future of digital travel credentials (DTC). A DTC is intended to substitute a conventional passport temporarily or permanently with a digital representation of the traveller’s identity, which can in turn be validated using the travel document issuing authority’s public key infrastructure. There is a growing consensus that we are moving toward adoption of some kind of Immunity Passport. In Europe, the move is spearheaded by countries that rely on tourism for a significant percentage of GDP but will be equally welcomed by the holiday makers who wish to travel to those countries for their vacations. But it’s not just the search for sun and fun that is driving this movement; Denmark and Sweden are planning their own form of COVID passport to help boost mobility and trade, and Hungary and Poland also have some form of digital immunity documentation in the works. The reality is that the paper-based passport, that was never imagined as a tool to contain viruses, is going to have to undergo some radical changes. The passport of the future – be it on paper, smartphone or cloud – will have to do more than assert our identity and nationality; it will also carry updatable and verifiable personally identifiable information about our health status. This is a massive shift in the way we view travel documents and will undoubtedly raise justifiable concerns about privacy and inclusion.

Allow the bearer to pass freely t without le ce or hindran

HEALTH STATUS PROOF | WHITE PAPER No.1

Guidance for Implementing Health Pass Solutions – the Future of Digital Travel By Pavlina Navratilova, Market Manager, National Identity and Healthcare, IDEMIA The COVID-19 pandemic has created substantial global disruption. Governments, travel and technology industries, among others, have mobilised to find urgent solutions to resume international travel and safely reopen borders. As a result, various health passport solutions*, named ‘Health Passes’, have been developed to quickly address the need to prove the health status of travellers when crossing borders. What are the main challenges that existing solutions are trying to solve? The industry is searching for an interoperable solution that can be issued securely while preserving privacy and ensuring data protection. These key pillars are the foundations of our trusted identity frameworks. However, careful consideration is required when implementing these standards, to ensure that they are adapted in line with current health needs.

Global interoperability ensured by international standards Global standard-setting bodies, such as the World Health Organization (WHO) and International Civil Aviation Organization (ICAO), have been developing a global framework to specify minimum security and interoperability requirements for health certificates.

ICAO, along with its 193 member states and key stakeholder international organizations, is using a coordinated approach to establish baseline standards in many areas relating to civil aviation. It has founded the travel document specifications, and currently, is finalising technical specifications for health certificates so that the aviation sector can be restarted via its Council of Aviation Recovery Task Force (CART).

Mobile App

12 HEALTH STATUS PROOF | WHITE PAPER No.1

As a result, the ICAO Visible Digital Seal (VDS), an internationally recognized standard of a 2D bar code, has been updated to meet the current requirements of the health certificates for travel related purposes. The VDS is signed according to the Country Signing Certification Authority (CSCA) principle that is used for signing ePassports. Therefore, the secure exchange of public keys can be done using the existing Public Key Infrastructure (PKI). This ensures the integrity of the seal, and simplifies the verification process.

Governments, the trusted actors for issuing health certificates Since the beginning of the year, the discussion around the adoption of a Health Pass has given rise to numerous debates between international political decision makers. At the European level, the discussion was first initiated by a letter from the Greek government to the European Commission in January 2021, calling for a coordinated EUwide approach. Consequently, the European Commission has announced that it will release a legislative proposal for a Digital Green Certificate on March 17, 2021. Due to the production of counterfeit health certificates being on the rise, the establishment of a trusted Health Pass is a key step toward regaining the confidence of governments. Governments, as trusted actors, are in the best position to guarantee the authenticity of the health certificates. They can also leverage the existing PKI for the issuance of the ICAO Visible Digital Seal. This issuance can be adapted to the specific needs of each country while complying with international standards. In practice, the traveller receives

Digital Format

Physical Format

a health certificate in the form of a VDS generated by the government, after taking a test or receiving a vaccination in one of the government-certified laboratories.

A secure health wallet for all health certificates

Various health certificates can be issued to verify the traveller's health status, and should be recognized as legitimate for health confirmation. Health Pass solutions enable individuals to securely store all types of certificates, from PCR tests to proof of immunity or vaccinations. It is only by doing so that we can guarantee the solution will not discriminate against individuals who, for various reasons, have not been vaccinated.

Citizens, the sole holders of their medical data

There is no compromise when it comes to the protection of personal data. With a privacy by design approach, a traveller's personal health information is safe at all times, allowing the user to be the sole holder of their health data.

Inclusion and convenience for all

With the accelerated use of digital technologies in our daily lives, the first introduction of the ICAO Digital Travel Credential, a digitised passport dematerialised in a smartphone, brings an entirely new user experience while travelling. In the future, this digital passport will enable the integration of the Health Pass. It will also create an all-in-one solution issued directly by governments, ensuring the highest level of trust. This entirely digitised travel experience, and simplification of having multiple credentials in your smartphone, brings convenience. In addition, we are all familiar with the stress of having to remember to take all documents while preparing to travel abroad. However, we should keep in mind that convenience is a point of view. The Health Pass must include all citizens, regardless of their level of technical ability. This will prevent discrimination of those who are not capable of, or willing to, use digital solutions.

With this in mind, a multi-form solution will need to be available. From paper to a smartphone app, these solutions allow the health status verification of all travellers. By doing so, the health certificate can either be sent to a Health Pass mobile app, or received in pdf format by email that can then be printed, or sent by post as a sticker for the visa page in a passport.

A simple verification process

Seamless integration of the Health Pass into the existing process of the passenger journey is key. For that, border control agencies as well as airlines and airport operators need to upgrade their process with the verification of the Health Pass. This should be done in the most efficient manner, to facilitate passenger flows and avoid queues at different stages of the passenger journey. To enable this, upon check-in, border control or boarding, the traveller matches their face biometrics against their passport photo (with their consent) and presents their Health Pass for verification. The VDS is verified and its travel document information contained is checked against the travel document that the traveller presents. This verifies the authenticity of the health test result and its allocation to the passenger. The solution needs to be accessible both online and offline, which is essential for simple and quick verification by as many people as necessary.

Conclusion

The current pandemic has shown that health security is as important as public security. If revival of the global economy is imperative, we must all join forces to gain the trust of travellers and ensure the safe reopening of borders. Governments play a key role in securing public trust and industry leaders are ready to accompany them in developing technologies that combine safety and ease of use. Digital technologies are the right response to the health crisis – let’s prove it with the Health Pass. *Health passports solutions (Health Passes) include various health certificates such as PCR tests, Immunity tests, proof of vaccination and other health-related proofs.

About IDEMIA

IDEMIA, the global leader in Augmented Identity, provides a trusted environment enabling citizens and consumers alike to perform their daily critical activities (such as pay, connect and travel), in the physical as well as digital space. Securing our identity has become mission critical in the world we live in today. We stand for an identity that ensures privacy and trust for international clients and governments.

HEALTH STATUS PROOF | WHITE PAPER No.1

Immunity Status Passports – Watering the Green Shoots of Recovery By Editorial Team

The idea of immunity status passports has been debated amongst governments since the start of the pandemic. Against warnings from critics of potential discriminatory, non-inclusive and anti-privacy practices, two countries are forging ahead with plans for their roll out. This has been followed more recently by the European Union. Like many countries around the world, Denmark is desperate to reopen the parts of its economy frozen by the pandemic. The kingdom of under 6 million people has become one of the most efficient vaccination distributors in Europe and aims to have offered its whole population a jab by June 2021. As early as July 2020, Denmark was offering its citizens a service to apply for a COVID PCR-test through the country’s national health website which, if the test came back negative, meant they could download a document certificating the result. At the beginning of February 2021, Denmark’s government said it was joining forces with businesses to develop a digital passport that would show whether the holder has been vaccinated against COVID-19, in an effort to facilitate and revive travel. Danish Finance Minister Morten Boedskov told a news conference that ‘in three, four months, a digital corona passport will be ready for use in, for example, business travel’. ‘It will be the extra passport that you will be able to have on your mobile phone that documents that you have been vaccinated,’ Boedskov said. ‘We can be among the first in the world to have it and can show it to the rest of the world.’ Unlike tourist destination countries such as Greece and Spain that are running immunity status pilots, the objective is not to attract foreign holiday makers this summer. The move to add immunity status to the personally identifiable information on Denmark's planned passport would be rolled out first to business travellers, eager to rekindle the commerce with foreign markets that accounts for a third of its GDP. Once the business sector is up and running, the hope is that Denmark's hospitality and mass entertainment sectors can then adopt the COVID passport. Boedskov said it was ‘absolutely crucial for us to be able to restart Danish society so that companies can get back on track. Many Danish companies are global companies with the whole world as a market.’ As a first step, citizens in Denmark will be able to check a Danish health website for official confirmation of whether they have been vaccinated. As one of the world's most digitised countries, Denmark is ideally placed to become a testing ground for this new approach, drawing on public and private collaboration.

14 HEALTH STATUS PROOF | WHITE PAPER No.1

Israel loses no time

Israel has been offering COVID vaccinations to all over-16s since the beginning of February 2021. In a population of roughly 9 million this is no mean feat, and the country has lost no time in using its successful vaccination programme to underpin a return to more normal life. From the beginning of March 2021, gyms, theatres, hotels, concert venues, and synagogues registered under the ‘green passport’ programme have been able to operate and only green passport holders will be allowed to enter these premises. To qualify for a green passport a citizen will have to have been vaccinated or have recovered from COVID. ‘We are giving a huge line to vaccinators,’ Health Minister Yuli Edelstein said during a recent briefing. ‘This is the first step back to an almost normal life.’ Edelstein added that soon there will be places of work that will have to require their staff be vaccinated or else undergo a COVID test every 48 hours. The green passport is granted to those who are a week past the second coronavirus vaccination, or to the around 740,000 people recovered from the virus who currently are not eligible for the vaccine. Rona Kaiser, Vice President of Information Technologies for the Health Ministry, explained that the passport can be downloaded via the trafficlight smartphone application, the Health Ministry’s traffic-light website, or via the ministry call centre. To access the green passport, you have to submit personally identifiable information including (travel) passport number and date of birth. CO CertVID-1 ific 9 ate

9 -1 te VID ica COertif C

s Pa

trade ofﬁces

European Commission proposals

On 17 March, Ursula von der Leyen, President of the European Commission, introduced draft legislation proposing a Digital Green Certificate (DGC) to facilitate safe free movement inside the EU during the pandemic. The DGC will serve as an assurance that a person has been vaccinated against COVID, received a negative test result, or recovered from COVID. The certificate will, in effect, comprise three distinct certificates: Vaccination certificates – stating brand of the vaccine used, date and place of inoculation and number of doses administered. Negative test certificates (either a NAAT/RT-PCR test or a rapid antigen test). Self-tests will be excluded for the time being. Medical certificates for people who have recovered from COVID-19 in the last 180 days. According to a statement from the Commission, the DGC will be free of charge, bilingual, interoperable, secure, non-discriminatory, and available in digital and physical format via QR codes.

‘If we do nothing, if we sit and wait, nothing will happen,’ he said, ‘If you start when COVID has left society, it will be too late. With this project we're very positive we will have a summer of joy, of football, of music. So better get started sooner, now, to plan.’

9 -1 te VID ica COertif C

Pass

gyms

The Israel green passport will be valid for six months, from one week after the second dose.

These three examples add further validity to this White Paper’s starting assumptions that some kind of immunity status passport is inevitable and that security should be built in from the start; sentiments strongly echoed by Lars Ramme Nielsen of Denmark's Chamber of Commerce.

Pass

COVID Certific-19 ate

If you apply on the ministry’s website, you will be issued with a printable green passport certificate that includes a scannable secure QR code with a digital signature. When you arrive at a store or other place of business, you will be asked to present your green passport. The printout can be presented for scanning, or the app can be opened, and the digital confirmation presented. You will also be asked to present your ID card.

carehome places of worship HEALTH STATUS PROOF | WHITE PAPER No.1

National Health Passes: ShortTerm Fix or Long-Term Legacy? By Kristel Teyras, Market Owner – Digital Identity Services, Thales

As vaccination programmes gather momentum, attention is turning towards restoring individual freedoms and reviving economies. In realising these ambitions, so-called health passes (aka vaccine passports or certificates) are seen by many governments as a potentially powerful asset. To date, much of the focus has been on enabling international travel. Inevitably, establishing the global standards necessary for success here will take time. However, schemes that provide citizens with trusted proof of their vaccinated status, quarantine compliance, and the results of PCR or antibody tests, can play a valuable role within national boundaries. While governments await international harmonisation, health passes deployed at the domestic level offer a means of reopening – or keeping open – a wide array of businesses, venues and events, without putting public health at undue risk. And the good news for governments is that a successful roll-out is more straightforward than it might initially appear. Certainly, there are significant challenges. To make a worthwhile impact, deployment needs to be swift. At the same time, schemes must provide absolute trust in the authenticity of any information shared by the pass holder. Verifying documentation needs to be quick and easy, and accessible to a wide range of businesses and organisations. As with any personal medical data, maintaining privacy and security is paramount. Leveraging the near ubiquity of the smartphone is an obvious response. But when it comes to developing apps to support COVID-related programmes, the record of governments to date has been mixed. In several cases, purpose-designed apps have fallen short of expectations in terms of protecting privacy and securing trust. To be fair and effective, any

solution must also recognise that not everyone carries a smartphone. What’s more, some who do are unwilling to share personal data via a mobile device. In fact, there’s no need to reinvent the wheel. All the necessary bricks are already supporting the latest generation of digital identity programmes. Thales is at the forefront of many of these initiatives, embracing not only smartphone-enabled solutions, but also the secure paper-based methodologies that are essential for any truly inclusive deployment. Health passes, just like digital identity programmes, will invariably require a chain of trust to be built between issuing authorities, digital identity holders and the organisations that verify these credentials. For the mobile channel, a Digital Identity Wallet should stand at the heart of the ecosystem, providing a secure, fully interoperable and standards-based environment for encrypted credentials within the holder’s smartphone. Ideally suited to the demands of health passes, in contrast to a standalone app, it delivers an extra layer of protection for the information contained within it. A virtual wallet also ensures that credentials are inextricably linked to the holder’s identity. To be universally accepted, health passes must provide reassurance they have been issued by the legitimate authority and presented by the genuine holder. Thales’ own Digital Identity Wallet, for example, is supported by a secure and interoperable platform, and incorporates the modularity necessary to extend to forthcoming standardised international health passports. Beyond that, it will also facilitate broader digital transformation initiatives. Crucially, the wallet can interface securely with a broad array of different health systems, guaranteeing the aforementioned chain of trust and

PCR Test ...

ING

SCA

...

ING

SCA

CHECKED

16 HEALTH STATUS PROOF | WHITE PAPER No.1

secure issue of a digitalised version of the health pass, proof of vaccination and/or test results to the authenticated individual’s Digital ID Wallet. It also enables lifecycle management of these digital documents. In the current context, this is particularly significant. Understanding of the virus, and the on-going efficacy of vaccines, is evolving continuously; to maintain trust, passes must remain current. Health passes will be checked by a wide array of stakeholders. A fast, accessible and intuitive verification process is therefore crucial to maximising adoption and compliance. It will also be essential for avoiding delays, particularly at mass spectator events. Once again, to ensure relevance, scheme rules will need to be updated overthe-air. Thales’ proposal is built on standards defined by international standardisation bodies including ISO – International Organisation for Standardisation – and ICAO – International Civil Aviation Organisation. Thales’ certified mobile security technologies ensure that all the relevant vaccination, test, antibody or quarantine data is securely processed and stored. Whenever proof of this information is needed, users simply authenticate to open their mobile wallet, select the information they want to share, and generate a QR code to invite third party verifiers to engage with the wallet using ISO 18013-5 compliant mechanisms. Once consent is given, data is shared via Bluetooth Low Energy, Wi-Fi Aware or NFC. To optimise privacy, only the information required needs to be shared by the holder.

About Thales

Thales is a global high technology leader investing in digital and ‘deep tech’ innovations to build a future we can all trust, which is vital to the development of our societies. Businesses and governments rely on Thales to bring trust to the billions of digital interactions they have with people thanks to our identity management and data protection technologies.

For citizens unable or unwilling to use a smartphone, QR codes can be distributed via a PDF as an ICAO Visible Digital Seal. Trust is ensured by embedding ID document information within the code. Verification is performed in exactly the same way as the mobile version, with the citizen presenting a physical document such as a passport or ID card to prove they are the genuine holder of the printed code.

More than 30,000 organisations already Test the rely on Thales solutions PCR to verify identities of people and things, grant access to digital services, analyse vast quantities of information and encrypt data. Thales commits to protect people’s identity and citizens’ rights with secure, sustainable and usercentric solutions. CHECKED

...

ING

SCA

As well as addressing all the technical considerations, governments also need to undertake a rigorous cost-benefit analysis. Will the returns on a domestic health pass justify the investment? In contrast to a proprietary app, developed exclusively to support a vaccination programme, a Digital ID Wallet is a truly future-proof solution. Above and beyond the requirements of the health pass, it provides a standards-based platform for on-going digitisation programmes, including any future, internationally harmonised vaccine passport. In addition to reigniting economic growth, and offering welcome relief to lockdown-weary citizens, health passes therefore represent a unique opportunity for governments to create a positive legacy that prevails long after the immediate challenges of the pandemic have passed. NN

... ING

SCA

AIRPORT Vaccination certificate G...

IN NN

SCA

...

ING

...

SCA

VACCINATED

HEALTH STATUS PROOF | WHITE PAPER No.1

Trust is Key as WHO Tests Digital Vaccination Certificates By Editorial Team

The small digital-savvy Baltic state of Estonia is working alongside the World Health Organization (WHO) on a pilot project to test how globally recognised electronic vaccine certificates might work. So far, they’ve found its the trust, not the technology, that is lacking. As various countries pursue their own digital vaccination certification, the WHO has so far not recommended vaccine passports for travel. Although that could change, depending on the results of the program with Estonia. WHO and Estonia recently agreed to collaborate on developing a digitally enhanced International Certificate of Vaccination, a ‘smart yellow card’ to help strengthen the effectiveness of the COVAX initiative, established to speed development and equitable access to COVID vaccines. The agreement signed between His Excellency Jüri Ratas, Prime Minister of Estonia, and Dr Tedros Adhanom Ghebreyesus, WHO Director General, on 5 October 2020 covers working together across a range of digital health projects and innovations in addition to the vaccination card. These include a global framework for health data interoperability, and guidelines for national ePrescription and eDispensing systems, as well as the European Roadmap for the Digitalisation of National Health Systems.

Punching above its eWeight

Estonia, a eurozone member of 1.3 million people, is known as a tech trailblazer and innovation testing ground, with Estonians helping to pioneer the likes of Skype, eVoting, and delivery robots. The country has more than two decades' experience implementing various digital elements in society and, as a nation, has experimented widely with eDemocracy and has digital health records for its citizens. Crucially, Estonia has experience with the safe sharing of records across borders. Since 2018, Estonia and Finland have shared medical records, allowing individuals to pick up prescriptions across borders or inform medical staff of their history if necessary. The ground-breaking data share, which now includes Portugal and Croatia among others, provided a dry run for Estonia to tackle the similar, but far larger, project of digital vaccination certificates.

18 HEALTH STATUS PROOF | WHITE PAPER No.1

WHO can you trust?

Anett Numa, an expert on digital transitions at the eEstonia Briefing Centre, says that trust, both between participating nations and between individuals and institutions organising the vaccine passport, is key. The vaccine passport would rely on each individual country's input, explains Numa. Each participating nation would provide a list of healthcare providers or vaccine distributors, which are nationally authorised to issue vaccine certificates. Marten Kaevats, an adviser to the Estonian government on technology, said the primary issue for the project so far is to ensure that anyone checking the certificate can ‘trust the source’.

A mixture of paper and digital

The agreement between the WHO and Estonia is to explore the possibility of a ‘smart yellow card’ – a digital version of an existing paper system to prove yellow fever vaccination. The

existing yellow card is already a type of 'medical passport' that is recognised internationally and may be required for entry to certain countries where there are increased health risks for travellers. Vaccination records are important because they help us to remember what vaccinations have been received and when booster injections are required. The difference now is that innovations in health technology mean digital vaccine certificates can be offered. Realistically, there will be a period of transition from paper to digital and perhaps ultimately to a virtual system that doesn’t refer back to a physical vaccination document. Kaevats, who also advises the WHO on digital health issues, said it would be ‘impossible’ to create a global digital ID in the coming months and that a mix of paper and electronic certificates was more likely. He said the main focus at the moment was on elaborating global standards to develop ‘a single common solution for checking the existence of healthcare providers’.

HEALTH STATUS PROOF | WHITE PAPER No.1

‘

Without secure test and vaccination certificates there can be no trust in immunity passports. Build security in from the start – or you’ll have to bolt it on later

’

VACCINATION CERTIFICATES AND IMMUNITY PASSPORTS HEALTH STATUS PROOF – WHITE PAPER No.1

Publisher: Reconnaissance International Ltd Editor: Francis Tuffy francis@recon-intl.com Contributors: Achim Hildebrandt, Pavlina Navratilova, Marc-Julian Siewert, Kristel Teyras. The editorial team welcomes your news, contributions and comments. Please send these to publications@recon-intl.com 1B The Beacon, Beaufront Park, Anick Road, Hexham, Northumberland, NE46 4TU, UK Tel: +44 (0)1932 785 680 www.securedocumentnews.com

No part of this publication may be reproduced, stored in a system or translated in any form or by any means – electronic, mechanical, photocopying, recording or otherwise – without the prior permission of the publishers. While every effort has been made to check the information given in this publication, the publishers cannot accept any responsibility for any loss or damage arising out of, or caused by the use of, such information. Opinions expressed in ID & Secure Document News are those of the individual authors and not necessarily those of the publisher. COPYRIGHT 2021. ALL RIGHTS RESERVED

Interactive elements

HEALTH STATUS PROOF | WHITE PAPER No.1