Federal vs State

[wabzqem]

National Cabinet stated that:

All jurisdictions agreed to integrate an individuals’ record of COVID-19 immunisation history into state and territory check-in apps.

While this may provide a short-term good user-experience, it depends on work being duplicated by every state, and all of them getting security, privacy and tech problems right - and solving for offline experiences. It's possible (but unlikely) that each state will come up with a system where integrated check-in could look like:

• User scans the venue's QR code
• App displays signed previously fetched QR-code that has been signed by a health authority
• Venue uses verifier app to verify
• User is checked-in to venue as it currently works

But even this does not answer the question: what do people living on borders and state-travellers show? Or even people without a smart phone? If the answer to this is "they fall back to the medicare provided PDF/wallet/IHS/app" then we're in a no better position than when we started.

Does anyone have ideas about how this could actually work for state travellers, or if there's a good reason for states and territories to be implementing this themselves?

[alexmackey]

Agreed it seems silly for each state to be implementing this themselves but I wondered if this has something to do with:

1. Verification of the individual
2. The policies & strategies of each state vary considerably (but probably shouldn't for this)

I dont know how the EU system works (beyond the high level info on the site) but i'm assuming the signed QR code is paired with the other ID such as drivers license (I think this is run individually be the states) to avoid folks sharing the same QR code.

There's obviously other approaches to addressing this however :)

Also surely using the EU system would be beneficial when travel opens up for both inside Australia and when Australians travel to EU destinations.

[wabzqem]

With the EU system, the vaccine, test and recovery information is all captured within the QR-code itself. This isn't great for privacy, but it does allow different countries to have different rules, and means all of it is included in verification. It has to be used in combination with Photo ID.

[alexmackey]

I think it makes sense to hold that info especially as we're not sure how long vaccines etc will be effective for etc. I'm not sure how you'd prove a certificate belongs to a specific individual without either:
Some biometric thing unique to an individual like a finger print
Pairing with other info like drivers license (like above)
Vaccine card with photo id & no other info issued & validated by trusted authority

Was thinking that some bars and clubs in Victoria (and I assume else-where) have a system where customers have to present their drivers license for entrance which is then scanned. I wonder if there is an intention to build upon this for crowded/high-risk environments and with something already used?

[alexmackey]

This probably belongs in another discussion around the privacy aspects of the vax cert but was thinking you really dont want name visible (at least to the general public).

It seems likely that vax certs will be widely rolled out to a lot of places from workplaces to shopping malls to bars and clubs to more and i'd guess validated by various folks and automated solutions.

Does a random security guard/person charged with validating these really need to know your name? Probably not - they just need to know if cert is valid & whilst most folks will be fine there will always be some stalkers etc

[wabzqem]

An issue with offline (e.g. paper form) verification is that it's vulnerable to replay style attacks, so really needs to be used in combination with a name or identification.

The EU QR codes actually contain quite a bit of information - covid test result, recovery and vaccine info. Presumably because the government may only issue signed QR codes to people who are fully vaccinated, we might be able to get away with name + "this person meets requirements" and no other information. This might not work for travel however, where different countries may have different rules on number of shots, recognition of vaccine types etc, so it's required that all that information is encoded in there. EU has strict privacy regulations around personal data which helps.