Passport to freedom? Not just yet

Article originally published by Geert Peeters, ZetesConfidens' Head of Innovation on his LinkedIn profile.

Designed to keep populations safe, Covid certificates do not show 100% impermeability to fraud. How can we improve them to ensure they really do protect us?

The world is reopening. In spite of the continuing Covid-19 pandemic, venues, events and travel are starting to welcome people again, as we try to return to some sort of normality. To do this as safely as possible, vaccination and testing are vital – and, of course, proof of these is equally important. But what sort of proof can we provide? And how much trust should we place in that proof?

Back to normal life, with caution

In most regions, national health departments are doing all they can to create the conditions where large groups of people can start to gather again – in theatres, sports stadiums, bars, restaurants and more. Governments are also keen to promote free movement across borders, especially those whose countries rely heavily on tourism. And they need to do these things in a responsible way, helping everyone involved to stay safe and comfortable.

Protection through documentation?

With the virus still spreading infection, the only defence currently is to ensure that the people entering venues and using public transport have been vaccinated, tested negative or recovered from Covid-19. So individuals need some means of proving this, which in many countries is a Covid certificate – a paper or digital record of vaccinations, test results or recovery status.

Some governments are enforcing the use of these documents to access events, venues and enabling citizens to travel, and more are likely to follow. But before we can have confidence in these as a method for protecting society against Covid-19, there are several problems to address.

First, many kinds of Covid PCR tests are easy to falsify. For example, since the introduction of the Covid PCR tests in Belgium earlier this year, numerous allegations of forgery have been made. Between April and June 2021 alone, 576 people were caught at the Brussels airport trying to use a falsified PCR test to travel abroad. Europol also warns of an increase in false negative Covid-19 test certificates, which criminals are selling to travellers who want to enter certain countries. And this is a global problem, with hundreds of thousands of fraud reports across the world. A direct and secure link with the official medical data source is therefore essential for the generation of a valid Covid certificate.

Then, even if the medical data is genuine, how can we be sure it belongs to the person presenting the certificate? How do we establish a link between a Covid certificate and the bearer’s true identity? The document contains information such as name and date of birth, but anyone who looks the right age and gender could use it to enter all kinds of venues.. And do venues such as bars, restaurants, theatres and museums – that are trying their best to get their businesses back on their feet – have the time and resources to check every customer’s passport or identity card alongside their health certificate?

A photographic solution

Some countries have already resolved this flaw by including a passport or identity-card number on the Covid certificate. However, not all governments issue such an ID card and you can’t expect citizens to ask for a passport to be able to get a Covid certificate. Another possibility to avoid the circulation of forged certificates is to make sure the information contained in the machine readable zone (usually a QR code) is signed by the issuing country through the use of cryptography. This is one of the mandatory characteristics of the Digital Covid Certificate as imposed by the European Union on its member states since July 1st. Nonetheless, even with these additional precautions the most important element of any secure document is still missing: a photograph of the bearer.

If the certificate were to include a photograph, it would provide a much faster, easier and more secure way for venues to verify the health status of their customers. There would be no need to present a passport or identity card with the certificate, and anyone checking it would be able to see, straight away, that the bearer was who they said they were. In other words, we would have a direct link between the health claims and the person’s identity.

Most importantly, including a photograph, even to a digital document, significantly raises the threshold for forgery attempts. So as well as making it quicker and easier to verify large numbers of Covid certificates, this addition would reduce fraud dramatically. Which is why, at Zetes, we’ve been developing a solution for a health certificate that puts in one place (paper document, digital document or app) all the information needed to confirm a person’s health status and true identity.

Let’s give Covid certificates the security they deserve

We’ve seen the growing need for people and businesses to get back to something like a pre-pandemic way of life. But, as identity specialists, we know that most current Covid certificates, being susceptible to fraud, will not help them do this safely. The only way is to build in the security we already have in most of our passports, driving licences and identity cards. In other words, to add a photograph.