COVID-19 Vaccination Passports Explored: Security and Privacy Considerations

Author: Gustavo Neves is the Governance, Risk, and Compliance Service Line Manager for EMEA

The concept of a digital health passport is getting closer and closer to becoming a reality. This COVID-19 vaccine certificate could function as a sort of passport if a country requires it. The potential benefits for tourism and the overall global economy are obvious. The concept of having a vaccine being required for travel is not new. The International Certificate of Vaccination is used primarily to ensure immunization against yellow fever. It is mandatory when traveling to certain countries that present a special danger of catching the disease.

The passport or certificate that is coming will be unlike the International Vaccination Certificate, it will be based on technology and not on paper. This represents potential benefits, but also potential challenges for privacy and data security. Considering that it will include information on the health of the data subject, the data will require special protection and increased care. Even with special care, there are still possible increased dangers to citizens’ rights, freedoms, and guarantees in the event of a data breach.

It is therefore important to analyze the risk potential associated with:

1. Data leaks, which pose a danger to the data subject
2. Failures in the integrity of certificate issuing and verification processes

The fact that it is a digital certificate obliges us to consider the impact of having a central database of sensitive information. If this information is exploited, it represents a breache of massive volumes of data. For example, some recent information leaks from social media databases affected hundreds of thousands or millions of data subjects. Data leaks could lead to real danger, plus identity theft, targeted social engineering attacks, extortion attempts, and other harmful actions. These concerns will certainly be on the list of priorities of those responsible for implementing the new health certificate system.

There are already some concrete approaches proposed by different entities. At the European Union level, the Digital Green Certificate is announced, which aims to ensure one of three things:

1. The carrier was vaccinated against COVID-19
2. The carrier did a recent test that had a negative result for COVID-19
3. The carrier recovered from the COVID-19 recently

The Digital Green Certificate provides an example of how the COVID passport could work securely. The certificate must present a QR code. The authenticity of which will be guaranteed by a qualified digital signature of the issuing entity, which makes its forgery much more difficult than in traditional passports. The certificate must also contain personal identification data that allows the QR code to be associated with its holder. Allowing this verification control to compare this data with an identification document.

It should be noted that the QR code verification only proves the authenticity and validity of the associated digital signature. Only this information will pass through the network gateway and not the personal data of the holder. The issuing entities at the level of each Member State are responsible for the databases with information relating to citizens.

Since the certificate will be based on a mobile application, it is important to ensure information security if the carrier loses the mobile device or the device is hacked. Mobile technology offers interesting possibilities, such as the secure enclave feature of Apple smartphones, which is hardware-specific and provides increased protection to the integrity of cryptographic operations, even when the device is compromised. The Android operating system and others have similar solutions based on smart wallets.

Promising innovations like blockchain could be used to make vaccine passports more secure and efficient. The International Air Transport Association (IATA) Travel Pass is based on blockchain technology, which means that there is no central database of information, potentially exploitable by attackers. This type of technology has been primarily associated with the protection of cryptocurrencies. This application in health data is already being enhanced in the protection of medical diagnostic records and aids in mobile applications. Another example of this is the E-HCert application, which uses the VeChain Thor blockchain.

Finally, a note on future steps. It is a cybersecurity best practice in software development to promote standardized implementation approaches that are built on open protocols and technologies in all components of the process. This ranges from certificate generation, through local and central storage, and down to verification and communication. As the need for certification mechanisms such as these becomes pressing at global level, it is crucial to assure a consistent and thorough level of protection in all initiatives. Having a secure and consistent system brings about more confidence in digital systems of health certifications.

Did you enjoy this blog article? Comment below with your feedback.