Introduction

COVID-19 vaccination efforts are well and truly underway across the world. In addition to those in Europe and North America, vaccination campaigns are gathering pace across China, India, Russia, and the Middle East, though lagging in many other, mostly poor, countries. As more start scaling up their own programs and the number of vaccinated people increases over the coming year, a COVID Vaccine Certificate (CVC) is likely to become an important tool to help monitor and manage the rollout of vaccinations and get national economies back on track. Such a credential will also be needed to facilitate the safe movement of people across countries, including to rejuvenate the tourism industry, which is important for many developing countries.

Since a vaccination certificate is a form of functional ID, with one component consisting of data related to the vaccination—such as date, vaccine, place of vaccination, and other relevant information—and the other the identity of the holder, it may be useful to consider some lessons learned from the rollout of identification (ID) systems across the world.

One thing is clear: the CVC will be a formidable challenge, not only to international cooperation, but because it will need to be implemented in the course of mass vaccination campaigns across countries with very different health management systems and ID systems and with a constantly evolving situation.

Background

In the early phase of the pandemic, some countries floated the idea of “immunity passports” for people who had recovered from COVID-19, but with divergence in scientific and public health opinion, none of the proposals has actually been implemented. In contrast, the CVC would indicate vaccination status along the lines of the paper-based International Certificate of Vaccination or Prophylaxis, the so-called Yellow Card, but it would need to incorporate digital technology to increase its level of trust. The Yellow Card embodies little protection against alteration or forgery or that the holder is the person indicated on the card.

There are by now several major initiatives to develop COVID-19 vaccination tracking systems. These include the collaborative effort by the WHO and Estonia to develop a “smart Yellow Card” to help strengthen the effectiveness of the COVAX initiative and the DIVOC platform under development in India to help achieve its ambitious vaccine rollout plan. Both of these systems extend beyond the goal of facilitating international travel to help countries manage the vaccine rollout through a period with large uncertainties, especially as COVID-19 strains continue to evolve and propagate across the world. The CommonPass is yet another initiative, supported by the World Economic Forum.

RELATED EXPERTS

Alan Gelb

Senior Fellow

Anit Mukherjee

Policy Fellow

There are still questions on the efficacy of a CVC in the face of uncertainty over the effectiveness of vaccines. The January 15 meeting of the WHO’s Emergency Committee on COVID-19 did not recommend requiring proof of vaccination or immunity for international travel at that time, noting still-limited vaccine availability as well as the unknowns of the pandemic. Others have expressed serious reservations about such tracking systems, that they threaten privacy and expand the remit of already excessive ID systems. However, especially with the expansion of vaccination and the number of different vaccines, the emergence of new strains of the coronavirus, and the dynamic nature of the pandemic—which will possibly require revaccinations as the new strains evolve—it is not a matter of if—but when—a CVC will be a prerequisite for essential activities, especially cross-border travel. To be fit for purpose, such a credential would need to be trusted and able to serve as an on-demand proof of vaccination for both international travel and domestic purposes—anytime and anywhere.

 In the absence of a globally accepted credential for COVID-19 vaccination, countries are already introducing such systems. Denmark has announced plans to issue COVID-19 passports that can be printed from the unified Danish eHealth Portal. Israel plans to issue a “green passport” to those who have been vaccinated, which will grant them access to restaurants and cultural events and exempt them from quarantine rules or getting a virus test before travel. Indeed, Greece and Israel have already agreed to recognize each other’s green passports. In India, everyone who has been vaccinated will get a QR code-based electronic certificate on their smartphone, with the option to download a paper copy. Estonia stated that it would allow in travelers who show proof of vaccination, which have to include including information saying when the vaccine was made, which vaccine was used, the issuer of the vaccine, and the vaccine batch number. Other countries may follow suit, leading to a fragmented system of verification of COVID-19 vaccination status that will be both costly and inefficient.

In all these countries, individuals need to provide proof of identification to register through a dedicated portal, enabling the government to track vaccine rollout and its efficacy over time. This raises questions of data collection, management, and protection, and how countries confront the tradeoffs between public health on the one hand and protection of privacy on the other. It is important, therefore, to agree on global standards for its form and functionality, to build consensus among countries and global health organizations, and to prevent duplication of effort and fragmentation of systems that will be difficult to harmonize in the future.

Ongoing discussions recognize many of the issues around the introduction of the CVC. It will need to be based on a set of principles and standards to ensure that it is globally accepted as proof of vaccination. The WHO has initiated the Smart Vaccination Certificate consortium to focus on defining specifications and standards for a digital vaccination certificate with the dual purpose of (a) facilitating monitoring of national COVID-19 vaccination programs, and (b) supporting its cross-border use. It is an important step recognizing the need for such a credential but achieving a consensus on the actual design and implementation will not be an easy task.

The CVC from the ID Perspective

The importance of inclusion. There has already been concern about the inequity in COVID-19 vaccination across rich and poor countries, communities, and people. Given this reality, a digital CVC should be inclusive in its design and governance and ensure that it does not widen the digital divide. The draft principles set out by the WHO Consortium include a number of essential points:

• Everyone has the right to obtain and hold a smart vaccination certificate

• The smart vaccination certificate should not be increasing health inequities or increasing the digital divide

• Every smart vaccination certificate should be recognized and verifiable by any trusted authorities

• Minimum data collected and appropriately shared—only data required for the purposes of vaccinations should be required

• There is no “one size fits all” or “one solution to rule them all.” Given how diverse our world is, this effort focuses on ensuring that each smart vaccination certificate solution is able to meet the public health needs of each WHO member state as well as the needs of individuals around the world

The draft principles are not unlike some of those expressed in the Principles on Identification for Sustainable Development, which have now been endorsed by some 25 organizations. These too stress universal access, robustness, trust and data minimalization, and recognize that there will continue to be great variation across country systems. The challenge will be how to achieve these objectives, as well as some other essential ones.

One is speed and ease of registration; the process of certification should not obstruct, or slow down, the pace of vaccination, particularly in countries with less advanced digital infrastructure. Issuance will need to be very rapid, including in poor and remote communities, and in the context of decentralized vaccination centers to bring treatment close to people. Finally, the scope and method of verification need to be specified, both within countries and globally. These approaches can draw on the remarkable expansion of digital IDs that has taken place across the developing world during the last two decades.

Registration and identity proofing. Pre-registration can be a powerful step towards easing the problem of identity proofing at the point of treatment. The remarkable success of digital application processes for COVID-19 relief programs launched by countries such as Pakistan, Namibia, Togo, South Africa, and others suggests that electronic pre-registration through some combination of websites, apps, WhatsApp, and SMS can be accessible to many people. Indeed, in these cases they have generated numbers of applications that are far larger than the eligible populations, as many people hoping to receive cash grants registered more than once. Managing this problem has required the inclusion of unique ID numbers, typically the national identification number, as part of the application process.

Nevertheless, some people, usually from the poorest and most excluded groups, will not be able to access digital application processes. Others may not have a national number; the World Bank’s ID4D database suggests that about one billion people do not have foundational ID. Half of these are children whose births have not been registered. Many national ID systems do not enroll young people until they are 16-18 years old, an important demographic group for vaccination. Registration therefore faces ID gaps; even in Namibia, a country notable for its sustained efforts to strengthen its civil registry, estimates suggest that over 10 percent of births are not registered. Despite the very high adult penetration of Aadhaar (98 percent), India accepts a range of alternative credentials to pre-register for vaccinations.

Tracking the provision of healthcare to some communities without official ID may require custom solutions; in Bangladesh, for example, one program uses biometrics to identify mothers for pre- and post-natal care delivered by mobile health workers.  This can help to ensure continuity of treatment, that a person receives both first and second shots, but may not necessarily tie in to any wider ID system. While it is highly desirable to ensure that the ID systems used to identify people being vaccinated are interoperable (among other benefits, this would prevent individuals from being given multiple vaccination courses while vaccines are still in short supply), this may not always be possible for all groups in all countries.

Vaccination drives do not offer the right opportunity to fix the foundational ID system; countries will need to use what they have to do the best that they can. This should not be a problem for those, such as Peru, with very high levels of birth registration and ID coverage, where the national ID is required for virtually all interactions with government programs and services. But in many others, programs should not insist on a high level of identity assurance for every vaccination.

Issuance of the CVC. The issuance of a secure ID credential often proceeds in two stages, with people first enrolling and then needing to return to pick up a card. This slows the process, and sometimes has resulted in large numbers of cards accumulating in distribution centers as they fail to return. The CVC needs to be available after vaccination with no return to the clinic or other administrative center. Some rapid large-scale voter ID programs have solved this problem by printing and issuing voter cards on the spot, but this requires specialized technology on a large scale. Tanzania’s 2015 voter registration, for example, engaged thousands of specialized printers to produce 24 million voter cards on the spot. The logistics and costs of such an operation rule it out for a mass vaccination program.

The alternative is to issue a simple paper certificate at exit, together with a QR code based electronic certificate issued via a smartphone, as in India, or otherwise downloadable from the vaccination program website citing a control number for the paper card or other relevant data such as name, date and location of vaccination. This would provide a secure credential similar to the masked Aadhaar card issued by the Unique Identification Authority of India, with name and date of birth but not necessarily including a photo or (part of) an ID number. These could be optional, depending on country policies. The card would include relevant information relating to the vaccination but no other personal information.

Verification of the CVC and identity of the holder. One of the main advances in the area of identity management has been the formalization of Levels of Identity Assurance. These address the long-recognized principle that lower levels of assurance are adequate for many transactions or interactions and that there can be tradeoffs between the rigor of assurance processes and the costs and time incurred by participants. Even credentials with high levels of security are often used as a “badge”, checked by a quick look without follow-up to verify the credential (such as checking every security feature built into a driver’s license) and to ensure (for example, through a digital biometric check) that the person presenting it is the designated holder. Not all features of a secure system will be used every time, but it is still important to have the secure elements in place to use as needed and to prevent the undermining of the system.

How will the CVC be used to certify vaccination status, both within countries and for international travel? Bearing in mind that it includes a digitally signed QR code with the biographic and vaccination data, it would be possible through a scan, initiated anywhere is the world, to verify that the card is genuine and that the information on the face has not been altered. Local verification capacity is essential, since it is not realistic to propose that the credential be always verifiable against a central registry. If needed, however, a card could be checked remotely against a registry by entering the holder’s biographic data and vaccination details.

This still leaves the question of identity-proofing the holder in different use cases. Will people be required to present a CVC to board domestic flights and trains? To attend sporting events? To go shopping? Will individual establishments be able to set their own access requirements? Each country will, no doubt, develop its own rules and processes, and evolve these according to the situation. International travel is a different matter, since broad agreement and common standards will be needed if the CVC is to become an effective tool to facilitate mobility. One important step would be to negotiate the inclusion of CVC data into the Advanced Passenger Information System for air travel.

Identity proofing, paradoxically, might be simpler for international travel than for many domestic applications. International travelers are already required to have a valid passport (or its equivalent) whose issuance has involved extensive identity-proofing of the holder. The function of the CVC is not to help identify the traveler; it is simply to link the vaccination information to the “foundational” identity set out on the passport. While a common matching number, such as a national ID number on both credentials, would be ideal, for this purpose, it is probably enough to require a matching name and date of birth. Although there are some 45,000 John Smiths in the US, the number born on the same day is typically one or two, and rarely more than four. The probability that the passport holder is presenting a genuine card issued to another person is therefore very low.

This, of course, increases the importance of accurately recording and reporting name and date of birth at the time of vaccination, which can itself be a challenge in some contexts. But it strikes a balance between easy access and requiring a direct link to the passport, such as a national identity number common to both, that many people in developing countries will not be able to produce, and also helps to protect privacy by limiting the proliferation of the national ID number.

Conclusion

Although there are still debates around the utility of the CVC, some such system of vaccination certification appears to be inevitable, whether for the current COVID-19 pandemic or against the possibility of similar events in the future. Low-cost, high-access approaches are essential, if the process is not to widen the digital and affordability divide between rich and poor countries and rich and poor people. Appropriate technology can help to achieve this goal, balancing Level of Assurance against Level of Security, and helping to achieve greater functionality with better privacy safeguards.