Too much innovation, not enough labs: digital health pass details debated by ID4Africa

The threat of further exclusion of Africa from the international community due to the COVID-19 pandemic could easily be exacerbated by digital health pass systems, particularly if they are not well designed. Attendees of the conclusion to ID4Africa’s three-part livecast series on digital health passes heard a lively, and at time contentious debate about how to establish and maintain trust in the veracity of health status claims.

Even if a person is able to prove a test result, getting one that is recognized could be a challenge, because while Africa has more than 400 labs audited by the WHO in 27 countries, only 78 in 12 countries were accredited to ISO standards. This shortfall in accredited lab capacity must be addressed if Africans are going to be able to meet mandates to provide test results within 72, or even 48 hours of their time of departure on an international flight.

“If we fail to do this, it is inevitable that the use of COVID credentials will lead to the isolation of the African continent, which would have a major negative impact on the development agenda,” Atick says.

As was pointed out during the presentation, however, a tiny fraction of Africa’s population travels by air each year, so for most people the practical concerns around digital health passes are bound to be significantly different from those of many North Americans or Europeans.

Part 3, ‘COVID Passes: Harmonization, Standardization & Differentiation’ featured Gary Parrish of HD Barcode, Adriaan Kruger of nuvoteQ, Chris Justice of BLOK BioScience and Rafi Kaminer of Pangea on the CEO Roundtable. Geert Peters of Zetes and Pavlina Navratilova of Idemia described how the EU Green Pass works, and the solutions their companies are building for it.

Atick shared a framework for a chain of trust with the CEO panel, which discussed each element in some detail. The framework is based on a consideration of vaccination as a vital event, like birth or marriage. As such, the chain has four parts, consisting of the event itself, registration, credentialing, and the use of the credential. At each stage, harmonization, standardization and differentiation of the solutions on offer was considered.

Discussing the possibility of registering the fact of an individual’s vaccination or testing, Kruger and Justice said it presents a good opportunity for standardization throughout the continent without all the complexities of standardizing a whole electronic health record. There was some consensus that a strong civil registry can help people get vaccinated, but in its absence, Kaminer urged countries to begin registration campaigns for vaccination based on any kind of established ID.

This raised the question of whether vaccination could be carried out with the individual providing only a name and date of birth, as suggested by the WHO, with verification be showing an ID after the fact.

For Blok, Justice says no centralized ID database is necessary, just some kind of ID to bind within the application, such as ID capture and selfie biometrics.

In a poll of attendees, only 39 percent consider name and date of birth adequate information for people to provide on vaccination.

As Stephen Wilson would note soon after, health care providers were not prominent in the discussion, and he argued against the requirement for anyone to have digital ID to be vaccinated.

If digital identity data must be managed as part of the vaccination process, however, where does it go? Whether a central registry is needed was discussed, but the need for a local registry of some kind emerged as one of the few points of agreement. This must somehow feed a service gateway for attestation, notarization, and certification, which enables the generation of trusted credentials.

Practical for WHO?

As the discussion reached the fourth stage of the framework, use, a succession of community voices joined the conversation.

Integrated Biometrics CEO Steve Thies noted the mobility of many people across borders, particularly in Africa, and proposed the use of biometrics to address the limitations of centralized national databases.

Karl Steinacker asked why a passport, together with a limited and controlled local lab registry, could not suffice to provide the necessary information.

Harm Jan Arendshorst of uqudo spoke up in support of the Good Health Pass initiative as the way to achieve global interoperability, and urged a more complete ecosystem view of the pandemic control landscape.

“Instead of having a minimum and at the same time maximum dataset, what is important to understand is that there needs to be a more fine-grained level of privacy filter,” he said. “And for that, you need a global trust framework.”

The details of the requirement for a registry were discussed, with Wilson noting that a registry is normal, but said support for a digital identity record requirement for vaccination “is coming from the technology side of the house.”

The World Health Organization refers to “norms” in its guidance on the subject, he pointed out, which allows the question of what identity data is needed and where to be contextualized.

Atick essentially agreed on this point, saying that he wants the identity community to move away from innovation at every stage of the train, and innovate only at the pass level. The rest, he says, can be basic and not innovative, which could stifle interoperability. Atick further suggests that identity is introduced into the chain for the convenience aspect.

Kaminer objected that the Ministry of Health needs more than a name and date of birth to fulfill its obligations to vaccinated people, such as to inform people if they should seek medical attention due to a bad vaccine batch. “If they need to get ahold of you, they will not put it in the newspaper,” he said.

Ultimately, a ‘ground truth’ must exist somewhere which can be attested to. A solution like the IATA Health Pass can then integrate that attestation to provide authorization, based on the criteria of the particular use.

De-coupling vaccine registration from pass and credential generation will create better standardization, Atick concludes.

Africa and the offline authentication challenge

While APIs or a PKI system, either ICAO’s or something generated through bilateral agreements, may be practical for authenticating digital health passes in many parts of the world, Kruger points out that even beyond devices, online QR digital health passes are not realistic in Africa, as they depend on a range of factors including the user having an app store account, and internet access at the point of verification.

HD Barcodes’ solution can encode more than 700 KB of information, and can therefore include a facial image or a biometric template. Given the prevalence of QR codes in digital health passes, which cannot encode biometrics, the question of how an inexpensive paper credential can be issued that provides strong binding to the bearer came up frequently throughout the three-part event.

Majorities of just over 60 percent said it is ethical to ask for COVID vaccination proof for employment, and just under 60 percent said the same for university attendance. Further, 33 percent said digital health passes will be used permanently and only for international travel, 33 percent said they will be used permanently for travel, employment and socializing, and 35 percent said they will disappear in a couple of years as pandemic dies out, highlighting the need to define what use case is under discussion in order to determine appropriate standards or norms.

Mitchell DeYoung of Spenn, Ilja Hofmann of OVD Kinegram, Hilda Karashani of Muhlbauer and Rob Lubeck of BurstIQ gave a series of presentations on ‘enabling innovative technologies.’ Those range from Spenn’s extension of its financial inclusion platform and BurstIQ’s holistic digital health platform to Muhlbauer’s app and OVD Kinegram’s physical health status cards.

The discussion raised further issues such as the difficulty of attestation for self-testing, and the potential for subsidized smartphone distribution to enable greater inclusion of Africans.

The inescapable and overarching takeaway from the three-part event is that as Africa is being left behind in COVID-19 vaccine supply, greater effort and awareness are needed to prevent the world’s richest countries from deciding on a global framework for digital health passes and international travel that billions of people cannot possibly participate in.

Article Topics

Africa  |  biometrics  |  credentials  |  digital identity  |  health passes  |  ID4Africa  |  identity verification  |  mobile app  |  travel documents