The government will need to give more details on how vaccine certificates will work for those who cannot be vaccinated for medical reasons, says a computer systems engineer.
Yesterday, Prime Minister Jacinda Ardern announced that the Cabinet had accepted the use of vaccine certificates in Aotearoa, and that they would likely be a digital Covid-19 vaccination certificate containing a QR code.
The codes can be printed on paper and there will be an app available for venues to use to verify that the QR code is genuine.
The government aims to have vaccine certificates in use by next month.
Technologist Andrew Chen, a computer systems engineer and researcher at the University of Auckland, expected more details about the policy for people who cannot be vaccinated due to a medical condition and how to ensure that QR codes are not misused.
“From a technology perspective, the main benefit that we have had is that we have been able to see how this technology has been implemented abroad,” Chen said.
“We can learn from their experiences, and I would say that right now the European Union [standard] it’s been pretty solidly tested. “
He said New Zealand’s planned system is similar to the European Union standard, the EUDCC, with a QR code that a verification app will be able to scan.
“In that QR code there is encrypted information about the individual and their vaccination and / or test status.
“The way this has been done is that they will make sure that only legitimate people can generate the QR codes, and then only legitimate people will be able to crack the QR codes, which will help keep that private information a little bit more secure.
Chen said staff checking QR codes at venues shouldn’t have to deal with any information about the health conditions underlying a vaccination exemption.
“What we heard yesterday was that if you have a verification app for a site operator, then they will only see a vaccination status and a name, and that status could just be a green check or a red cross.
“One of the open questions at the moment is if someone who is not vaccinated for legitimate health reasons … if you scan their vaccination certificate, maybe a green check will appear to say that this person can enter.
“I think that’s an issue that the government will have to deal with from a political perspective and from a public health risk perspective.
“I don’t want the average retail worker to have to find out if this particular disease is a legitimate exemption from being vaccinated.
“The more we can abstract that just by showing a green tick or a red cross, the better it will protect those people’s privacy as well.”
There could be different levels of access in applying a verifier for staff registering people at a festival compared to those checking people at the border, Chen said.
“Those are some of the complicated things that could complicate things, but we will have to see what politics looks like in the coming weeks.”
‘Low’ piracy risk
While no technological system was 100 percent immune from cyberattacks, Chen said the systems were designed “as well as can be.”
The information in the certificates was supported by the Covid Immunization Registry, “which is the central source of truth about people’s vaccination status.”
If New Zealand’s vaccination certificate were in a format similar to that used in Europe, Chen said he would be “reasonably comfortable”, the risk of our information being hacked was relatively low.
“Most of the attacks that we can see probably require in-person interventions rather than relying on hacking.”
Covid-19 Response Minister Chris Hipkins said[https://wwwrnzconz/news/political/452993/national-party-leader-judith-collins-criticises-vaccine-certificates-and-mandatesthatthegovernmentisworkingtoensurethataverificationsystemmeansthatcertificatescannotbefalsified[https://wwwrnzconz/news/political/452993/national-party-leader-judith-collins-criticises-vaccine-certificates-and-mandatesthegovernmentwasworkingtomakesureaverificationsystemmeantcertificatescouldnotbeforged[https://wwwrnzconz/news/political/452993/national-party-leader-judith-collins-criticises-vaccine-certificates-and-mandatesqueelgobiernoestabatrabajandoparaasegurarsedequeunsistemadeverificaciónsignifiquequeloscertificadosnosepuedanfalsificar[https://wwwrnzconz/news/political/452993/national-party-leader-judith-collins-criticises-vaccine-certificates-and-mandatesthegovernmentwasworkingtomakesureaverificationsystemmeantcertificatescouldnotbeforged
“There will be a system in which those who are scanning people will be able to verify that the name in the QR code matches the name that is registered against the vaccine.” The certificate was “targeted at particular risk locations,” Hipkins said.
Misuse of QR codes
Other countries have experienced the problem of people using a QR code that is not their own, Chen said.
“The QR code will reveal your status and your name. In theory, what was supposed to happen abroad is that you are supposed to get another form of identification as well.
“So in New Zealand, that could be your driver’s license or passport that has your photo on it and then you would check that the person’s face matches the name on the identification that measures the name on the vaccination certificate.
“What we have seen abroad is that many places have just not bothered because it is too complicated, so it has not been applied as much.
“But they are living in a different context where having a small number of unvaccinated people attend a baseball game, maybe that’s okay given that they have more cases in the community, whereas here it is known that even one unvaccinated person Attending a big summer festival can present a significant risk.
“So I think we could be a bit more strict about it.”
Chen said clarity is also needed on when the use of certificates could be phased out, such as a high enough vaccination rate or a specific alert level.
“It is only in extraordinary circumstances, with the current public health crisis, that we can justify using certificates in this way.”