The most anticipated app in recent memory is the upcoming Covid Vaccination passport app which it seems will be called My Vaccine Pass. That’s the app we’ll need to download on our smartphone in order to access any semblance of regular life in the coming year.
Want to eat out, go to a rock concert or a movie? Expect someone will be standing at the doorway with a QR verifier to verify your vaccination status.
However the Ministry of Health has constantly changed the date around when we can expect it and has also been opaque around some of the tech behind it.
I reached out to the MOH to delve down into when, what and how this vital piece of tech, which will govern our lives for the foreseeable future, will work.
The answers were enlightening.
Expect the app by the end of the month – and it will be similar to the vaccination apps in use overseas and use a QR code.
It turns out that once certificates are available, there will be an 0800 number and face to face option for those who can’t verify their identity using passport, drivers licences, RealMe or other acceptable forms of id.
As expected the Covid Tracer app which is anonymous – will be kept separate; doing otherwise would breach both Google and Apple’s privacy rules – but the Covid Tracer app will have a button that takes users to the My Covid Record website – which is live now.
Third party app verifiers – for example a vaccine certificate could be merged into an event ticket to save time on entry – will also be governed by upcoming legislation to ensure privacy – no one at a venue or any Government organisation will be able to access the data about vaccination certificates used at any venue you enter.
While the responses allay many privacy concerns it’s also clear that the government is busy preparing legislation to support the app and that it is still working through some of the security and privacy aspects.
I sent a list of 23 questions to MOH and received a response from the Ministry of Health Group Manager, National Digital Services, Michael Dreyer.
Rather than answer the questions submitted individually the response was a single page which answered some questions but didn’t address others.
Among the questions left hanging were – Will the app also have info re Covid tests and any exemption status? How does someone ensure the person with the app on their phone is who they say they are – will xtra id be required at the point of entry? Will RealMe and My Health services be upgraded in anticipation of the app? Will the app use a digital ledger or a blockchain? How will the app work with people who have been vaccinated overseas? What sort of publicity/information campaign is planned to accompany the launch? And – Has the app been tested in real world conditions?
Update 5-11-21: The technical info has just been released on Github by the MOH.
“The release of the specifications today, ahead of vaccination passes being required or available, means business and the public can understand how this technology is going to work. It is important for businesses to check out the approach being taken and start considering how best to make this a part of how they operate,” said Michael Dreyer, Group Manager National Digital Services.
The MOH has appointed NZ tech company MATTR to construct its vaccination passes for use domestically and internationally.
On its website MATTR claims it provides “the building blocks to solve and remove the historical challenges of digital security, privacy and data verification, opening up a new world of trust.”
MATTR will be the main provider of the technology that underpins the Ministry’s My Vaccine Pass and will develop and support the Ministry’s Verifier App for businesses to confirm a person’s vaccine status.
“We have been talking to events companies, tourism operators, and other businesses to understand their requirements for verification. The Ministry’s Verifier App can be used for in-person verification, however if companies would like to introduce more sophisticated capabilities, such as integration into existing digital journeys or pre-verification processes, then the technical specification provides enough details for them to do so.”
“It was important for the Ministry to work with a New Zealand tech company that understood the need for the public to have a secure digital record of their vaccine status,” said Michael Dreyer.
With the code now publicly available businesses can incorporate the verifier process into their existing software if they wish.
The specification and other documentation will be available from – github.com/minhealthnz/nzcovidpass-spec and the MOH says that MATTR and other tech companies can be engaged separately to provide additional verification tools and capabilities.
Below is Dreyer’s original response in full.
“Vaccination certificates will be available mid-late November and will contain a unique QR Code. These can either be printed or saved digitally on a smartphone.
New Zealanders who create a My Health Account will be able to access their vaccination certificate for use in New Zealand using My COVID Record.
Currently, one of six identification options (New Zealand driver’s license, New Zealand passport, New Zealand birth certificate, New Zealand citizenship certificate, Australian birth certificate, and Australian passport) or a RealMe account must be used to set up a My Health Account, which can be used to access My Covid Record. The six options provided are those that we can use securely to validate and trust proof of identity.
RealMe is an option, if it is already previously verified, or if the consumer lives in a location where people are able to go to get a verified account.
Once certificates are available, the Ministry will be providing assisted channels (0800 number and face to face) to ensure those in New Zealand who are fully vaccinated but don’t have one of the accepted forms of identification can still get their vaccination certificate.
The vaccination certificates are created from data held in the Covid Immunisation Register that records New Zealander’s COVID-19 vaccinations.
The vaccination certificate system has been designed to keep people’s details private. When they present their vaccination certificate at a venue, no details will be stored by the official Ministry of Health Verifier App. No one at a venue or any Government organisation will be able to access the data about vaccination certificates used at the venue.
We are looking at legislative protections to prevent third-party verifier apps from collecting this information.
There is a button on the Covid Tracer App that takes you to the My Covid Record website.
It’s important to maintain the anonymous nature of the COVID Tracer App. Adding vaccination certificates would require adding stronger identity checks and verification into COVID Tracer to prove who’s using the app in order to show their certificate. This would likely compromise the strong privacy stance the app has at present.
In addition, Google and Apple have advised that it’s not possible to include “vaccination certificates” in an app that provides COVID-19 exposure notifications because it breaches their privacy policies.
The verifier app will be able to be used without an internet connection. Vaccination proof is securely coded into the QR code.
More details about the security and privacy standards used with the certificates will be released in the coming weeks.
The Ministry follows rigorous data security practices, including regular independent security assessments, to ensure New Zealanders’ vaccination records are secure and private.
Any legislation needed to support the app is currently being worked through.
We have worked with local partners to develop the My Covid Record website and the My Vaccine Pass that will be used domestically, as well as the International Vaccine certificates.
More information on technical developments is expected to be released soon and we will keep you informed.”
Ministry of Health Group Manager, National Digital Services, Michael Dreyer.
