Belgium launches digital health pass with Zetes trust services

Belgium has launched its Digital COVID Certificate (DCC), with digital trust services provided by ZetesConfidens, Zetes’ digital transaction security business unit.

The EU DCC was approved earlier in June, and is already in use by several countries within the bloc. ZetesConfidens provides the digital signatures embedded in QR codes to ensure the authenticity of the presented data, through its public key infrastructure (PKI). The PKI setup was completed in less than a week, according to the announcement, enabling acceptance of Belgium’s DCC on the European gateway for EU Member States to exchange trust information.

“We are very happy to be involved in this project, which confirms our role as a key partner for the Belgian authorities for all their ID schemes,” says Zetes People ID Senior VP Ronny Depoortere. “The ZetesConfidens business unit was created in 2018 and its QTSP status has allowed it to deliver qualified trust services for both the Belgian eID and the Belgian epassport, two documents which are also being produced by Zetes. We are looking forward to assisting any other EU country that is still in the process of completing its DCC solution or external countries that are willing to comply with the EU requirements. Our DCC offering ranges from QR code issuing, over trust services and a Digital Health Pass application, to a verification solution.”

Airline implementations

Air Canada has partnered with Amadeus to develop its digital health pass solution through its airline app, Simple Flying reports.

The solution is being trialed on flights from Frankfurt to Toronto and Montreal, with travelers provided a link to submit their COVID-19 test document through a QR code when checking in. Travelers must have been tested at one of two Centogene test centers, one of which is in Frankfurt Airport. Because Canada does not accept antigen tests, passengers must purchase PCR tests.

Emirates has expanded its IATA Travel Pass pilot to 10 cities, and is planning to expand it to operation for all routes in the weeks ahead, according to Emirates News Agency.

Customers on Emirates flying between Dubai and any of London, Barcelona, Madrid, Istanbul, New York JFK, Moscow, Frankfurt, Charles De Gaulle, and Amsterdam can use the IATA Travel Pass to share health status such as vaccination proof or PCR test results.

Emirates also plans to integrate the Alhosn app, the United Arab Emirates’ Ministry of Health and Prevention’s official COVID-19 testing channel, with its check-in system in July.

Yoti Director of Travel Gavin Watts writes in Travel Weekly that the company’s work with Virgin Atlantic, in which flight crew use the company’s biometric app to share their test results with the authorities of the country’s the travel to, shows the possibilities enabled by digital identity technology.

Extending that technology to allow people to share their status ahead of time will be necessary to re-introduce self-service airport processes, Watts says. That means providing an API service to allow airlines to check status without holding personal medical information, however, which in turns means standards for the data must be set.

India, Vietnam playing catch-up

CoWin Head V.S. Sharma says India’s digital COVID-19 vaccination certificate is now aligned with the World Health Organization’s Fast Healthcare Interoperability Resources standard, but tells Mint “it has all become a bilateral issue.”

“One country tells another that I will accept your certificate and you accept mine. We will have to work on this with various countries, but this is as good as it gets,” he says.

Sharma advises Indians to use their passport number as their identity proof document, after which it can be included on the certificate. He also notes numerous vaccinations have been delivered without registration, however.

While the country awaits bilateral agreements, the CoWin API keys are being shared with 34 entities, including digital payment provider Paytm, Air Asia, and state governments.

Vietnam is about to launch a trial for its digital health pass, writes Saigon Online.

The country is preparing to reopen tourism in areas where its COVID-19 outbreak is considered under control. The Ministry of Health is working with a provincial government to implement the guidelines for a trial of its COVID vaccine passport.

EFF sees potential flaws in California system

The Electronic Frontier Foundation (EFF) takes a measured look at the ‘Digital COVID-19 Vaccine Record’ issued by California as part of its reopening plan.

The group approves of the state’s restraint in not setting up infrastructure to make vaccine status-proofing into a surveillance system, and does not object to the status record in principle.

The QR code provided, however, the use of the SMART Health Cards framework based on W3C Verifiable Credentials, is not itself encrypted, and provides all of the user information that would be stored on a physical record to the party scanning it. This, EFF argues, makes them a potential tracking threat, if the data is aggregated.

The QR codes are tied to the bearer’s phone number or email address, but California has also not put extensive security or anti-forgery measures in place, and relies on the authenticating party checking the public key of the signed data is from a real health authority.

EFF is also worried about vaccination records becoming ‘digital vaccine bouncers.’

Article Topics

Amadeus  |  biometrics  |  credentials  |  digital identity  |  health passes  |  IATA Travel Pass  |  identity management  |  identity verification  |  mobile app  |  PKI  |  Qualified Trust Service Provider (QTSP)  |  verifiable credentials  |  Yoti  |  Zetes