Ok, you’ve been vaccinated but all you got was a tiny “record card” noting the date it was given, the Pfizer batch number and date.
I’ve already lost mine – but at the moment that’s really the only physical representation we have of being vaccinated.
Clearly, as New Zealand gets a greater percentage of the population vaccinated, a trusted digital vaccination passport will be integral to us resuming anything like normal life.
The passport will likely be required for activities like travelling, concerts, indoor dining, attending the gym, museums and going to movies – (the government has been at pains to point out that it will not be required for supermarkets or essential health services.)
Passports like this are common in the UK, the EU, Israel, China and Russia.
Last month, in what seemed a rather rushed announcement as Auckland came out of level 4 restrictions, the government officially spoke of the upcoming release of a vaccine passport.
The passport will be in the form of an app that will have a QR code that a verifier app will be able to scan. It will be available to download in late November.
The app is being managed by Ministry of Health officials who are working with private providers to develop it and will be a separate app to the Covid-tracer app.
Many of you might ask – why can’t proof of vaccination and testing be folded into the existing Covid-tracer app?
Danu Abeysuriya, CTO at RUSH Digital – the company that developed that app tells me that – while it is technically possible, and on the face of it might make a lot of sense – the optics of mixing the built-in anonymity of the tracer app with that of id verification would be a barrier to widespread acceptance.
“The pillar of that product has been its privacy-preserving ability; the entire design of the product down to the software source code, which is open sourced and independently verified for security and privacy, was to ensure that users could keep all of their recorded data on their own device without ever identifying who they are. It’s the promise we made to society and NZ COVID Tracer App users.
“Now, think about the use case of a vaccine passport – I have to be able to store my vaccine record in a way that definitely identifies me. Even if we were to design the software to have the ability to anonymously store some data and not others, it’s much harder to communicate to people. The NZ COVID Tracer App communication has been really consistent; it’s privacy preserving, does not identify who you are, all your data stays on the phone, etc. If we change that communication to say it can identify you in this instance, for this reason and not in others, it could lead to a lot of confusion.”
Indeed that confusion is happening now in Victoria where the vaccine passport has been entwined with their QR code check-in system, meaning that the State has a database of where everybody is all the time on the off chance that tracers needed to contact them, which has led to a lot of user resistance.
Is RealMe enough?
If the pandemic has swept aside debates about whether digital identities are necessary or not there’s still a way to go in legislating how governments introduce and use them.
The tech side of the vaccination passport app, from what little information has been released so far, doesn’t seem to be that different from others in use around the world.
What we are a little behind on is an accepted digital id system and getting kiwis comfortable in signing up for one.
What the government has come up with is a system where users download digital vaccination and Covid-19 test certificates via the government’s RealMe service – which is run by the Internal Affairs (DIA) or, alternatively, sign up for a My Health account which is run by MOH – and no, you can’t use your Facebook account to log in although My Health says it will support Google, Apple and Microsoft accounts in the future.
That first step of confirming your digital identity will be new to some and will test the robustness of the RealMe service which was set up over two decades ago.
The service hasn’t really gained widespread traction, has had little investment put into it and has since been surpassed technically by other private digital id services that many readers will have experienced when signing up for digital services that require id verification, such as investment apps like Sharesies or Hatch which can verify your id using a smartphone and a driver’s licence in a matter of minutes.
Still, at present, it’s RealMe or nothing if you want to interact digitally with government departments.
That, in turn, has brought up concerns by some in the sector around the government being both regulator and competitor – (DIA has released a statement saying it will take steps to separate these functions in upcoming legislation.)
Similarly – whether Internal Affairs and MOH will open up the process of vaccine verification to private providers of digital verification is still being discussed.
On the face of it letting private players into this space would seem a logical step as it would allow those who are resistant to anything government-led to use a government approved, but not government run, provider to verify their identity, while giving others the option of staying with the government run RealMe or My Health.
James A Brown of APLYid told RNZ’s Morning Report this week that private providers offer a more streamlined and user-friendly experience and that – “we would certainly encourage providers like APLYid and others to be part of that much wider ecosystem.”
And odds are that will come to pass, as the government has been working on a modern digital identity legislation since 2018, recognising that the current legislation is outdated and fragmented.
There’s also a fundamental risk in a single centralised database holding this information rather than a more distributed one.
Indeed it’s likely that the Digital Identity Services Trust Framework Bill currently before parliament will address many of these vaccination passport issues.
Among them is the possibility of opening up biometric data held by DIA to private providers.
Digital Economy and Communications Minister David Clark signalled a loosening of restrictions in the space in a speech in May and promised that the new legislation would address concerns the business community had over interoperability, innovation and collaboration on digital identity services – “kiwis who need to share information about themselves can do so on their terms, with peace of mind about the security of said information.”
The good news is that the whole vaccination passport issue might hurry along a raft of in-process government digital innovations that will open up our online identity ecosystem, increase data portability and make post-lockdown digital life a whole lot easier.
Merry, early, Christmas.
