Panel says QR codes and public key list make health passes strong

Some national health and vaccine certificates are almost comically outdated and open to fraud, according to participants in a discussion about what needs to change to instill trust in new documents.

The answer comes down to QR codes printed on physical documents or, preferably, embedded in digital ID documents carrying health and vaccine certification, they agreed.

The codes may be the simplest practical measure to quickly move people across borders. No global and few regional standards exist for what a digital health pass should look like or what information it should contain.

Ultimately, some standard will be needed to return travel and trade to pre-pandemic levels of trust and safety. The new wrinkle is accomplishing that while minimizing exposure of travelers’ personal information.

The panel was part of many related conversations ahead of the sixth Border Management and Identity Conference in December, convened by APSCA. Organizers are focusing on efficiency boosts during the pandemic for cross-border movement of people and goods.

No one speaking at the event expressed confidence that nations will pull together to both safeguard travel and minimize communicable-disease outbreaks. More than one reference to ambitions for progress by “the next pandemic” was made.

A tattered yellow health document displayed by panelist Claudia Schwendimann of the Austrian State Printing House showed the fallibility of many such so-called proofs of vaccinations.

The passport number it carried had long expired. And it was taped to hold it together and had little or no way of proving anything.

There are health documents circulating for communicable diseases but not for COVID, so information is just written in.

Schwendimann also showed a digital document with a two-kilobyte QR code that had basic biometric data including a small, moderate-contrast and -detail photo of her.

The rest of the information was typeset, but, she said, a second code could hold the rest of the information, making language differences less problematic and potentially speeding transit through crowded hubs.

There is progress underway now, however. Infrastructure is very slowly coming together. The International Civil Aviation Organization last month published a master list of public keys for digital health passes.

A public key is the basis of a health pass system’s ability to be trusted. Anyone can verify the authenticity of digital documents — in this case, documents attesting to COVID vaccination and recovery status.

Without the individual being checked having to surrender much in the way of private data, airport security, gate personnel, border guards, retailers and event organizers can be more confident they are not facing a disease threat.

And even as the threat of COVID shrinks a bit — and nations continue to dither on a trustable health status regime — the threat of fraudulent health certificates is increasing.

There are fraudulent QR codes helping people to travel when and where they would like to, but spotting the fake has been as easy as following the code back to its source.

That is changing, said Janne Meijer, immigration liaison officer for the Netherlands embassy in Bangkok, Thailand.

Meijer, also a member of the International Organization for Migration, said she is communicating with an official from South American nation about a fraudulent QR code — not one on a health document yet — that led to a spoofed site.

Article Topics

APSCA  |  biometrics  |  border management  |  digital ID  |  document verification  |  fraud prevention  |  health passes  |  identity document  |  standards  |  travel and tourism