COVID-19 Immunity Certificates are becoming a reality....

Rajesh Soundararajan
Apr 22, 2020
5 min read

....Why is it important to do it the right way

COVID-19 Immunity Certificates are becoming a reality. What next?

This is the second week running, we are writing about the COVID-19 immunity certificates. We wrote on this topic last week - ‘Digital Vaccine Certificates or Immunity Passports’ - How to make them tamper proof and easily verifiable across borders?. At that point in time, we only saw a few countries exploring the options on this subject. Within a short span of one week, many countries have already made it mandatory for various purposes. In fact, things are moving so fast that we are prompted to blog about this subject again, to share how secure QR code is the most efficient and effective way to address immunity certificates.

That discussion of immunity certificates is trending and gaining traction - let’s look at the news flow. Chile will be the first in the World to have Covid-19 Immunity Cards. Tourists to India’s popular beach destination GOA, would need to carry a COVID-19 certificate. Elsewhere in India’s Kerala, the expatriates who return to their motherland would need to carry a ‘COVID-19 free’ certificate.

As we had said in the earlier blog post

If the consensus moves towards having immunity certificates then we are going to have tens and thousands if not millions of certificates issued by approved agencies. These ‘documents’ will need to be verified by third-party government and non-government agencies for various purposes. It could be travel, school admissions, immigration, entry into restricted areas or designated areas and so on.

We believe that we continue to see massive adoption of immunity certificates as a solution to manage this and any future pandemics - across nations, within nations, within states and within districts - while trying to maintain economic activity and a semblance of normal life.

Such a massive adoption without standardisation opens up possibilities for fraud and tampered documents that would defeat the very purpose of the certificate. Unlike other tampered certificates that possibly have a limited impact due to a smaller scale, any scam around immunity certificates has the potential to be massively disruptive, with the lives of people at stake. It can really hamper the effort of the authorities in balancing the demands of public health and economic activity. There are likely to be ‘factory-labs’ that will give these travellers, expats or tourists and even common citizens, an ‘alternate’ method of getting ‘genuine’ certificates.

Therein lies the crux of the matter. Immunity certificates may be in one location but may be used by a completely different entity at a location which is geographically away, and administratively in all probability disconnected from the issuing regime/location. Hence the need for easy and decentralised verification.

Under these circumstances, where it is not a closed loop verification, the issuer would have a responsibility of issuing certificates or immunity cards that are verifiable beyond the close network of the issuer. It is only logical and rational that a minimum amount of security needs to be put in place where the verifier, usually a third party or a different entity would be able to authenticate the immunity certificate.

What it essentially means is that the issuing entity would usually need to look at options which are quick, easily executable, and affordable across borders. With the distinct possibility of tampering, solutions like holograms or other kinds of watermarks would not work or would be difficult to keep track of and verify. The other alternatives like RFID, hyperledger or blockchain and artificial intelligence become far too complicated to set up, operate and execute in a short span of time. This is where existing but cutting-edge solutions like secure QR codes come in.

Secure QR code solutions use smartphone QR code scanning apps (apart from web validation mechanisms) which are familiar to users and yet embed high level of security into the standard QR code. The issuer is able to generate tens and thousands of non tamperable secure QR Codes which can be printed physically on a card or a certificate as the case maybe. These secure QR codes can also be embedded on electronic documents which can be carried and stored on phones as an image or as PDF or similar.

This mechanism of Secure QR code works well for verification across borders without compromising the security of the document.

Complex technologies may also work but we believe in this solution as it can be far simpler, quickly actionable, leveraging on currently existing commercial technology with minimal set-up requirements. It ticks the boxes of being universally verifiable without compromising individual privacy and without the need for any database dependencies.

To summarize : Secure QR code provides an easy and foolproof way to create and verify authentic health and immunity certificates

Once again - This is how it works in 3 simple steps

The issuing entity carries out the tests and issues the health certificate just as before but with an embedded secure QR code that stores the details on the ‘certificate’ itself. This certificate can be in an electronic or a physical format.
These secure codes are digitally signed by the private key of the issuer to make sure that they can only be generated by authorized entities and are tamper-proof.
The QR code on the certificate is scanned by an App which carries the corresponding public key to validate the information and present it to the verifier.

The image below shows how this can be done.