Self-Sovereign Identity in the age of a global pandemic
COVID-19 is an unprecedented pandemic that has put society in a state of emergency almost everywhere in the world.
Because the virus has an incubation period of about 14 days, and many people are asymptomatic, it has been very difficult to contain the infection. The most drastic solution has therefore been to reduce contact with other people through social distancing and quarantine. The main objective of this decision has been to flatten the infection curve in order to win valuable time to organize a strategy to maintain the pandemic and limit the number of complicated cases.
The provision of tests and materials and the decrease in hospitalizations is allowing governments to focus on easing lockdown. In order to implement it, however, it is necessary to be able to keep the number of infections under control, and essential to have more and better data on how many people are infected, how many have been infected and have antibodies, and how many have not.
This is where easing lockdown strategies come in. On one hand, improving the information available by doing massive tests, both serological (to detect antibodies) and PCR (to detect the presence of the virus); and on the other hand, communicating and sharing this information, which allows us to quickly know who has been in contact with the virus and whether it is necessary to proceed to a selective quarantine.
Contact tracing to fight virus spread
Contact tracing is nothing new. In all countries, contact tracing protocols responses are triggered in case of infectious diseases. These protocols (as explained by Louis Gutierrez, executive director of the Massachusetts Health Connector at the imPACT conference a few days ago) are executed manually: the patient contacts the health centre, the centre asks a series of questions, and together they try to make a list of who the person has been in contact within the last 48 hours. This process is manual and therefore absolutely impossible to scale. Now, given the high number of infections, there is an opportunity to address the problem through automatic contact tracing.
To this end, as summarized by the DP3T (an initiative of several European universities), solutions are being proposed that address the problem in different ways through designs that attempt to minimize data recovery. There are two approaches: the first, centralized, in which user interaction networks are built centrally on servers; and the second, decentralized, in which contact data is stored only on people's devices and in case of infection a list is created (on a server) where the identifiers (ephemeral and not attributable) of those infected are published.
In this line, the European Commission published last Thursday a toolbox (Mobile applications to support contact tracing in the EU's fight against COVID-19, Common EU Toolbox for Member States), with a list of recommendations for developing contact-tracing applications (must be voluntarily, approved by the national health authority, preserve privacy - personal data is securely encrypted - and dismantled as soon as it is no longer needed). It is worth noting that the European Parliament on April 17th gave their support to the decentralized approach, pointing out by an overwhelming majority "that [...] the generated data are not to be stored in centralised databases, which are prone to potential risk of abuse and loss of trust and may endanger uptake throughout the Union” and demanding "that all storage of data be decentralised”. This approach was also backed by a joint declaration by several scientists and researchers around the world.
Immunity passport
In addition, and in order to ease conditions of the lockdown, some authorities are considering facilitating the verification of who is immune through the use of a type of electronic passport containing digital credentials.
When performing the serological tests, laboratories or health centres could not only give the results to the patients on paper, but in a digital format, to facilitate verification if necessary by the competent authorities.
It is important to note that this is highly sensitive personal data, and it is also important to consider that any technological solution used should be compatible and scalable with existing information systems.
Covid Credentials Initiative, a community-driven initiative
For this reason, several companies, currently working on the development of technologies that respect privacy and the protection of personal data, are joining forces and knowledge to provide a joint response to this challenge, through the Covid Credentials initiative (CCI, https://covidcreds.com). Specifically, several working groups have been created with the aim of defining and prioritizing the set of verifiable credentials most useful for COVID-19's response.
Here are the first use cases being worked on:
- Creating and maintaining a local network of trust: The use case focuses on the question of "what is needed locally to issue reliable credentials (COVID-19 and others)". It is expected that in the coming months and years a large number of credentials will be issued that will be relevant in COVID-19 related contexts. Since such credentials provide privileges, such as physical or digital access, there is a risk that unreliable credentials will provide illegitimate privileges.
- Proof of immunity by exposure and vaccine: To measurably reduce the likelihood that employees returning to work will be carriers of COVID-19.
Similarly, the DIF (Decentralized Identity Foundation) of which we are also a member, is evaluating the creation of a working group to host the initiative in order to ensure that all the results of the collaborations are protected by the appropriate legal framework and that they remain free, open-source and widely usable.
Here be dragons
At the moment, the approach taken to solve the problem is mainly technical. Bringing together the best practices and the experience of professionals to provide a coordinated and consensual solution from the sector.
Despite the good intentions of the initiative and the unquestionable benefits the use of an immunity certificate can bring, some ethical questions arise with it. As this article argues ”many people will be resentful if others were able to return to work and make money because they had an immunity passport”.
Other difficulties could also end up pushing away the idea of an immune passport in the short term. As noted in this other article, “we still know very little about what human immunity to the disease looks like, how long it lasts, whether an immune response prevents reinfection, and whether you might still be contagious even after symptoms have dissipated and you’ve developed IgG antibodies. Immune responses vary greatly between patients, and we still don’t know why. Genetics could play a role”.
Join the initiative!
This is why the CCI is calling on the scientific and health communities to join the initiative so that they can contribute from their experience to validate the approach being given to each of the use cases, thus minimising the technical and ethical risks.
You can join the Covid Credentials Initiative through its website at https://covidcreds.com.
Image by fernando zhiminaicela from Pixabay