A consideration of the meaning of digital verifiable vaccination credentials

1. Creative Commons BY SA 4.0 John Phillips, Dec 2020
Over the coming
days, weeks and
months, a global
vaccination
program will start.
Never before in human history have
we had the capability and the need
to vaccinate the people of the world.

2. Creative Commons BY SA 4.0 John Phillips, Dec 2020
This is an overused quote, but for
once seems appropriate:
“this is not the end, it is not even the
beginning of the end, it is perhaps
the end of the beginning”
Churchill
COVID-19
vaccination may
become something
we have to learn to
live with rather
than being once
and done.

3. Creative Commons BY SA 4.0 John Phillips, Dec 2020
The need for trust
is paramount
We need trust in
● Vaccine science
● Vaccine approval
● Vaccine manufacture
● Vaccine distribution
● Supply Chain technology
● Medical Jurisdictions
● Medical Practitioners
Trust in the whole system is
essential to encourage vaccination.
And yet in many countries, trust in
institutions is in increasingly short
supply.

4. Creative Commons BY SA 4.0 John Phillips, Dec 2020
Trustworthy,
verifiable, vaccine
credentials will
enable economic
and social recovery
Our hypothesis:
Being able to prove that you have
had a vaccination will be one of the
critical enablers of getting the world
moving again.
SSI can provide trustworthy,
portable, privacy protecting,
vaccination credentials that can be
checked in real-time with low cost,
open-source based technology
accessible to all.

5. Creative Commons BY SA 4.0 John Phillips, Dec 2020
A verifiable
vaccination
credential provides
proof that
someone has been
vaccinated.
That is all it does
This is not an “immunity passport”.
The effect of receiving a specific vaccine
depends on how the vaccine performs.
Empirical evidence on performance
informs recommendations and policies.
Recommendations and policies should
change over time as more is learnt and
situations (and viruses) change.
The fact that someone was vaccinated
with a specific vaccine on a specific date
does not change.

6. Creative Commons BY SA 4.0 John Phillips, Dec 2020
How we interpret
and use such
“proofs” is an
important decision
for civil liberty,
privacy and our
global recovery.
Scientific experts are concerned that
recommendations and policies are based on
scientific evidence.
Privacy experts are concerned that we balance our
rights and liberties in our social response.
Economic experts are concerned that we need to
get economies functioning again.
Social experts are concerned that we need to
recover to a normal that we can all live with.
Our decisions need to balance these concerns.
This isn’t simple. Complex problems don’t have
simple solutions.

7. Creative Commons BY SA 4.0 John Phillips, Dec 2020
SSI enabled
Verifiable
Vaccination
Credentials provide
a simple, secure
building block
SSI is an open-source, open-standards
based approach supported by a global
community in active and increasing use
by private enterprise, not-for-profits and
governments around the world.
SSI provides a framework for digital trust.
Supporting privacy, agency, selective
disclosure and even “zero knowledge
proofs” SSI is a non-proprietary and
flexible framework.

8. Creative Commons BY SA 4.0 John Phillips, Dec 2020
1. Issuing a credential
2. Receiving a Credential
3. Verifying a Credential
There are three key
roles in any SSI
model

9. Creative Commons BY SA 4.0 John Phillips, Dec 2020
Issuer Holder Verifier On vaccination, the medical authority
issues a credential to the holder’s
digital wallet and later the holder can
then present the proof to verifiers
(an airline in this example) to show
that they’ve been vaccinated
Note that we’ve shown a paper certificate /
credential being issued too. We believe this
should remain normal practice.

10. Creative Commons BY SA 4.0 John Phillips, Dec 2020
Each credential is cryptographically
protected, signed by the issuing
organisation and addressed uniquely
to the recipient.
No forging, no “re-sale”, no change of
ownership is possible without issuer
involvement.
Issuers need to be established
trusted organisations: licensed
medical practices, health
organisations, governments.
Issuers
can ensure that
their credentials
can be trusted and
cannot be misused
or tampered with

11. Creative Commons BY SA 4.0 John Phillips, Dec 2020
SSI is designed to empower and
protect the individual.
It enables holders to prove that they
have a credential, to selectively
disclose parts of a credential, to use
more than one credential to provide
a proof, and to prove they have a
credential without sharing any data.
All this without having to connect the
verifier to the issuer, or to another
third party each of which is a privacy
eroding event.
Holders
can prove they
have been
vaccinated when
they want, with
who they want and
with minimal
disclosure

12. Creative Commons BY SA 4.0 John Phillips, Dec 2020
Four key checks
1. Who issued the credential?
2. Who was it issued to?
3. Has it been tampered with?
4. Has it been revoked
Importantly, what the verifier decides
having what do having verified the
credential based on its policies,
regulations and recommendations.
Verifiers
Can check the
validity of the
credential without
breaching privacy,
building trust and
reducing risk

13. Creative Commons BY SA 4.0 John Phillips, Dec 2020
Verifiable vaccine
credentials [digital
and paper] will
contain jurisdiction
specific elements
Example elements:
1. Type of vaccine
2. Manufacturer
3. Batch / vial number
4. Medical Institution and Person
5. Date/Time administered
6. Who it was administered to
7. Which dose [if a multi-dose vaccine]
Standardising a core set of attributes will
help support global interoperability but
SSI Credentials are by the nature
interoperable [can be read by any
compliant system]

14. Creative Commons BY SA 4.0 John Phillips, Dec 2020
Vaccine
administration is
[typically] the
responsibility of an
authorised
medical provider
At the “pointy” (injection) end,
medical regulators determine the
process for vaccine sourcing,
distribution, and allocation and
qualified medical practitioners
administer the vaccine.
Health regulations define rules on
medical procedures, data capture,
storage and distribution.
To be useful, any new system needs
align with and add additional value
to the existing models

15. Creative Commons BY SA 4.0 John Phillips, Dec 2020
Typically the patient is issued with a
paper confirmation of their
vaccination.
We expect paper to persist and
digital to be an “and”.
We believe you can and should also
be offered a digital credential that
you can use to prove that you’ve
been vaccinated to whoever you
choose, when you choose without
the issuer being involved, just like a
paper credential.

16. Creative Commons BY SA 4.0 John Phillips, Dec 2020
In most countries, patient and
medical procedure records are
added to the local administrator and
health regulator data systems.
In some jurisdictions, some of this
data will be available to the patient
through some form of online login.
Centrally stored and managed, this
data is not easily shareable or
verifiable and cannot be presented to
a third party as proof of vaccination
Local
Organisational
Records System
State/National
Health
Jurisdiction
Records System
[Possible] online
access through
health portal

17. Creative Commons BY SA 4.0 John Phillips, Dec 2020
An SSI verifiable
digital vaccination
credential has
benefits for people,
organisations, and
economies
1. Secure
2. Portable
3. Interoperable
4. Privacy Enhancing
5. Trustworthy
Verifiable vaccination credentials
will enable economies, people and
societies to get moving again.

18. Creative Commons BY SA 4.0 John Phillips, Dec 2020
What do you think?