Europe: extending the digital COVID certificate

The European Union (EU) is preparing to extend the digital COVID certificate by a year, until June 2023, however there are concerns that the certificate is vulnerable to cybercrime and abuse.  Meanwhile the EU has certified the Thailand Digital Health Pass, Mor Prompt vaccination records, to allow residents in Thailand to travel to over 60 countries/territories that are part of the EU Digital COVID Certificate System. It is the second ASEAN country to join the system after Singapore.

Vaccine passports, crucial to managing the pandemic, have led to a rapid advance in digital health technology, and the EU views the Digital COVID Certificate (EUDCC) as a success. Adopted by 27 EU states and 19 other countries, there are however concerns about the technology.  On 31 March, the EU will publish a report on the technology’s regulation.

EUDCC uses barcodes in the certificates that are not encrypted, making them vulnerable to cybercrime and abuse.   The EU’s certificate deploys cryptographic key pairs – random characters in no particular order – to digitally sign users’ data to later prove the data is authentic. The regional certifying authority signs the certificate with a private key. To verify that data, the barcode readers in airlines and restaurants use a public key, one that is in the public domain.

One solution would be to develop temporary keys that would activate when a person presented their credentials. But in the meantime, an infrastructure to manage the necessary key pairs is absent.

Certain requirements of the EUDCC made it harder to protect — the fact that it must operate offline ruled out solutions relying on secure servers. Digital identity experts are working on a technology that would use blockchain, but this is still at too early a stage for implementation in the COVID certificates.

Meanwhile, EU has certified the Thailand Digital Health Pass, also called Mor Prompt vaccination records. The approval allows Thai travellers to use the certificate recorded on the system and show their health and vaccination records of Covid-19 before travelling to countries/territories under the EU Digital COVID Certificate System.

The Thailand Digital Health Pass will display:

• Basic information for identity verification: Full name, National 13-digit ID number, age, nationality, and passport number (if any).
• Personal information relating to the Covid-19 Coronavirus: Covid-19 vaccination record valid for 180 days from the date of receiving the latest shot, Covid-19 testing result using RT-PCR or ATK tests (only by the EU-approved brand) valid within 7 days from the date of the last test, the Covid-19 recovery data valid for 180 days from the date of diagnosis. It will be displayed in a QR Code form with a digital signature of the person to prevent document forgery.