Report
Identity Review | Global Tech Think Tank
Keep up with the digital identity landscape.
Table of Contents
- Privacy-Preserving Credentials
- Global Government Response
- Technology Solutions for Immunity Credentials
- Global List of Health Verification Initiatives
With the COVID-19 pandemic ushering sweeping changes, governments, public health officials and corporations are searching for long-term solutions to opening up the country. With an increasing incentive by policymakers to open up doors again for economic development, the uncertain transition towards normalcy has brought into question the use of “immunity credentials,” a form of identification to help mark people who have been infected with COVID-19, and now recovered and developed antibodies to the disease.
Immunity credentials can allow those who are not COVID-positive to return to daily in-person routines, travel or going back to work, providing evidence that they are low-risk of transmitting the COVID-19 virus. This could be accomplished through a national digital identification system that monitors and tracks the health status of its citizens. The details of how digital immunity credentials would be implemented are still up in the air, but may include important features such as the ability to share results remotely, interoperability across systems, proof of authenticity and the potential for individuals to have full ownership over their health data.
Contact tracing has also been utilized to find and follow up with people who have been in close contact with someone who has tested positive for COVID-19. By tracing the trail of those exposed and getting them into quarantine, it can slow the spread of COVID-19.
Many digital identity companies are moving forward to create solutions that serve to find the fine balance between national health, security and ethical privacy. This report gives a breakdown of on-going initiatives for immunity credentials. Here we feature innovative players in the identity space that are building solutions to address health credentials, including providers such as Onfido, Civic, Evernym and 1Kosmos.
Privacy-Preserving Credentials
The COVID Credentials Initiative (CCI) recently launched as a global community of technology providers and health organizations, collaborating on solutions to address the spread of COVID-19. With over a hundred organizations from around the world, the initiative includes key identity players such as Evernym, uPort and Microsoft. The group’s mission is to deploy privacy-preserving verifiable credential projects using W3C digital credentials standards.
“It can be used, the parts that are relevant, for any particular local project that’s actually producing credentials, anything where there’s issuers and holders and verifiers of a specific population, or trust community is the term they use, that will be using it,” said Drummond Reed, Chief Trust Officer at Evernym. “And that relationship is with local projects that reach out to or intersect with CCI and can take advantage of the different CCI workstreams as they need to.”
This alliance contains four work streams that focus on different aspects and issues of verifiable credentials: use cases, rules and governance, tools and technology and communications. The tools and technology workstream has produced the first version of a governance framework for COVID credentials that can be compatible with the CII initiative.
“This isn’t your average self organization effort. We’re doing something here that can save lives. That can help ideally with the global economic recovery from what may be the deepest economic trough we hit in our lifetime,” said Reed in a Zoom meeting for the COVID Credentials Initiative.
Global Government Response
Throughout the pandemic, governments have accelerated the integration of new technologies to track and warn its citizens of exposure to COVID-19. For example, the Singaporean government launched one of the first privacy-preserving contact tracing initiatives called TraceTogether, an application developed by the Government Technology Agency (GovTech) in collaboration with the Ministry of Health (MOH).
The app is designed to supplement current contact tracing efforts by exchanging short-distance Bluetooth signals between phones to detect other TraceTogether users in close proximity. The identities of those users aren’t shared, but if a user tests positive, other users who have passed in close proximity will be notified.However, despite this capability, users who test positive must voluntarily provide the Bluetooth data.
The United Arab Emirates (UAE) aims to reduce COVID-19 transmission through the newly-launched UAE Pass app, which enables citizens to access all government services online. Developed in collaboration with Smart Dubai, Telecommunications Regulatory Authority and Abu Dhabi Digital Authority, the UAE Pass allows smartphone verification of a user and enables them to sign documents digitally.
“This step confirms the ministry’s commitment to ensure the continuity and flexibility of all government services in light of the directives of the smart government to reduce the spread of COVID-19,” said Hessa Essa Buhumaid, UAE’s Minister of Community Development.
The South Korea Ministry of Land, Infrastructure and Transport also announced that as of March 20th, airline passengers may use digital identity through a government app for plane boarding on domestic flights, allowing airplane passengers the option to board facilitated by mobile driver licenses. This move minimizes the need for contact during the travel process, minimizing the spread of COVID-19.
Technology Solutions for Immunity Credentials
Aside from these public partnerships, corporations have also gone out of their own way to create their own responses to the worldwide pandemic. The demand to enter the market for immunity credentials is at an all time high that is driving some firms to push their product out, creating a wide variety of offerings.
Recently, Apple and Google announced a joint effort to release an Exposure Notification system that claimed to implement privacy-preserving contact tracing using Bluetooth technology. Although appearing to trace exposure and location, Dr. Cavoukian had the opportunity to review the technical specifications of their system, sharing her approval: “They’re doing a good job of protecting privacy.”
For other companies, blockchain-based technologies offer a solution for immunity credentials which could protect personally identifiable information (PII). For example, Civic recently announced proof-of-health verification for companies called Health Key, which is accessible through Civic Wallet. Using this technology, users are in control of who they give medical records to and how they share it. This allows users to generate cryptographic proofs that allow them to prove bits of information about revealing everything about the underlying identity with that information.
“The beauty of user-controlled information is you can use zero-knowledge proofs to effectively control what happens with the usage of the data. As an example, a zero-knowledge proof would be—if I had a COVID-19 vaccination as you walk into a building and you could tell the machine that you had the vaccination but not give any information about yourself,” said Vinny Lingham, CEO and co-founder of Civic. “And using a series of cryptographic proofs, the machine can reasonably assume to a high degree of certainty that you have had the vaccine and you are cleared to enter, but not take your personal information with that transaction.”
Onfido is also developing “immunity passports” using its identity model. Through it, credential providers are able to verify any relevant information about an individual or organization and issue verifiable credentials to that person, allowing individuals to hold multiple digital credentials on their phone and accept or reject requests to share information with institutions. The applicability of this model is already being developed for public use; in May, Sidehide partnered with Onfido to prove immunity for hotel booking in hopes of making it safe for people to travel again.
Digital ID card maker Pangea is pushing a biometric smartcard for COVID-19 immunity to support the airline and tourism industries, while IDnow and the British government are in the talks of issuing immunity credentials using IDnow’s video identification and document recognition software. DrNote.com is also offering a COVID-19 immunity passport to the US market after its initial launch in the European market.
However, for some digital identity providers, anonymity is the core focus. 1Kosmos, a provider of biometric identity solutions, is one example of this.
“When I look at contact tracing apps, the way I look at it is different. I think it’s got nothing to do with privacy,” says Nicholas Roquefort-Villeneuve, Director of Kosmos at 1Kosmos. “It’s all about anonymity, where you are anonymizing who is stating whether they are positive or negative, and then you’re going to base all your life’s decisions on the fact that somebody who you don’t even know or are aware of has said or not said the truth.”
1Kosmos’s platform allows individuals to verify the authenticity of the credential provided, citing that verifiable credentials hold the true value because it is issued by an entity that has the authority to issue that credential. And as long as the credential can be verified in real time, individuals have an immutable record that can validate the authenticity of that credential that is issued. In addition, it should be based on the fact that the user consents to it due to the large amount of personally identifiable information (PII) associated with it, not public.
However, unlike other long-lasting credentials like driver licenses and college diplomas, immunity credentials may become invalid in time due to the possibility of infection and transmission; this opens the door for creating a platform that allows organizations to ensure that the user has renewed his or her own credential and has been updated, helping to prevent unauthorized access to a system or building.
“The way we are looking at this platform is not about pushing an app out there for the entire population to just download and use and state who they are. It’s for a specific demographic,” said Rohan Pinto, Chief Technology Officer and Founder of 1Kosmos. “So, what we’re trying to look at in these three sectors is to abide by certain compliance regulations that they need to comply with in order to enable getting back to work—one good example is, if you want to travel, if you want to fly, or if you want to enter a country anymore, you need to ensure that the person who’s coming into your country is COVID-clear.”
With 1Kosmos’s solution, when individuals go back to work, it will be as simple as scanning a QR code and then authenticating, giving explicit consent to send the results using their live ID so that they’re controlling every portion of the process to show that they have that result and they are COVID-19-clear.
A similar application of this can be used for getting a ticket online for airfare, and then again at the airport based on a timestamp. This allows flyers to do this process in steps if they are required to be clear as of 24 or 48 hours prior to travel, ensuring that they are clear at the point of purchasing the ticket as well as when entering the airport.
Global List of Health Verification and Tracing Initiatives (By Country):
ABOUT THE WRITER
Kevin Lu is a press and content strategist at Identity Review, where he writes about the intersection between media, tech ethics and social innovation. His work focuses on the data economy and its potential for creating social change in our world.
Contact Kevin Lu at kevin@identityreview.com.
Do you have information to share with Identity Review? Email us at press@identityreview.com.
