A privacy-preserving COVID-19 immunity pass.
Covi-ID is a South African startup that offers a privacy-focused, free and open-source COVID-19 immunity pass for everyone using blockchain technology.
As we’ve seen, governments around the world are resorting to drastic measures in order to curb the spread of the virus and jump-start their economies. From tracking contacts of infected patients through contact and geo-location tracing to immunity passes, novel technologies are at the forefront of our fight against COVID-19. Although we’ve made great progress, many of the tools employed become infeasible without compromising the user’s privacy.
What is Covi-ID?
Covi-ID is a privacy-preserving COVID-19 immunity pass. The idea is that no one should be subjected to restrictions due to COVID-19 longer than necessary.
We have built a platform that allows users to receive their health status from medical professionals using a method called Self-Sovereign Identity (SSI). The core principle of SSI is that users should be in control of their personal information. This means that you, the user, and not a private company or the government should control how your most sensitive and personal data is used.
An example of leaked sensitive information is the Ashley Madison data breach, which occurred in July 2015, where hackers stole almost 60 gigabytes of user data. This data included the user’s real names, credit card details, and home addresses. Since the users had no real control of their data, many were publicly shamed. Even worse was the hack of US government databases and subsequent release of personal information for 1,400 government and military personnel.
In a public health crisis, privacy is put to the test. User data about who has obtained immunity, who has contracted the virus, and who was in contact with this person, is extremely valuable. Collecting and analyzing this data is crucial for effective policymaking, which aims to contain the virus and jumpstart our economy. We started Covi-ID to show that these important public health objectives can be achieved without sacrificing privacy.
Our platform has three components:
1. An app for citizens
Anyone and everyone will be able to register for an account on our website. Once you register, you will receive a dedicated QR code which will represent your identity account.
If you have a smartphone, you’ll be able to store this QR code on your device. If you don’t have a smartphone, you will be able to print out the QR code and store it somewhere safe. We’ve paired this QR code with a user’s selfie; this ensures that the verifier will be able to recognise when someone else uses your unique QR code.
In both cases, users keep full control of their information. You can choose which company to share it with and for how long. Covi-ID will never access your information, rent it out, or sell it to anyone.
2. An app for businesses and organisations
We believe that once the lockdown ends, businesses will need to create additional layers of security to decrease the chance of further outbreaks due to infected customers. To help with this, Covi-ID will be introducing an app for these businesses.
A supermarket, taxi, bank, or school, can download our business app for free. Using this app, they will be able to scan your QR code and verify your COVID-19 status. To protect your privacy, this app uses the green-amber-red colour scheme to indicate your status.
- Green status means that the user has either recovered from COVID-19 or recently tested negative. Once a vaccine is available, vaccinated users will be issued a green status.
- Amber status means that this user has not recently been tested and did not yet contract the virus. If you have an amber status, a business may implement precautionary restrictions. For example, Pick ‘n Pay may say only 30 people with an amber status are allowed in their store at a specific point in time.
- Red status means the user is infected and should self-isolate.
3. Connection to medical professionals
Medical professionals are the only individuals who should be trusted with your personal health information. As a user, the Covi-ID app will enable you to connect with your medical professional of choice and ask them to verify that your status is indeed true. It is important to note that businesses and Covi-ID will not have access to any of this information. Upon scanning your QR code, the only information you divulge is your name and COVID-19 health status.
What makes us different from other platforms?
The dominant business model of software companies is to harvest as much user data as possible and then monetize this data as they see fit. Think about Facebook, Google, or Amazon, and the giant heaps of data they collect about every single user. Individually, each data point might not be very valuable, but the collection of data turns these “siren servers”, as Jaron Lannier calls them, into billion-dollar companies. Instead of creating an open system like the internet, these companies create walled gardens where they control as much of the data, innovation, and ecosystem as possible.
We break out of this outdated business model of centralizing data, by putting users in charge of their data. And we’re bold enough to say, what we do is more similar to the development of the internet than Facebook.
In essence, we are defining the standards for the exchange of sensitive data, starting very narrowly with a user’s COVID-19 status. We provide you with the ability to fully control your data using decentralised technology. All code and documentation will be made freely available to the public. We believe in complete transparency, ensuring the end-user is kept in the loop every step of the way.
Using an everyday use case, it is currently not possible for taxi drivers to take as many passengers as they usually would due to public health concerns and restrictions placed by the government. Not only are taxi drivers losing revenue but commuters can not move as quickly and freely as they usually would.
How we plan to keep the system open and transparent
The identity accounts that we offer through the web app are called custodial wallets in SSI language. What this means is that we will be acting as custodians for the users’ data. Data custodians are like guardians, but for your data. Knowing this, you might then say we, Covi-ID, have an unfair advantage since we will be one of the first ‘data custodians’ in South Africa.
Importantly, though, we not only allow other organizations to provide the same identity accounts, we actively encourage them to do so by making our software freely available as a white label solution to anyone who is interested in being a data custodian. This ability for other custodians to enter the system and for users to freely move their data from one custodian to the other will result in competition between data custodians from which users will benefit.
Once we have released the custodial wallet and verifier app code, we will move towards building a fully-fledged SSI wallet for smartphone users. But again, once we have built it, we will also make it available as open source.
Who we are
Covi-ID was started by a group of South African academics, students, entrepreneurs, and privacy activists. In total there are 20 co-founders who are working to make Covi-ID a reality. We also have a community of about 128 members, which has highly motivated volunteers who are helping us on this journey.
How can you help?
We are always looking for people that share our vision and wish to contribute to our mission. We currently have eight workstreams:
WS-1: General Administration
WS-2: Product
WS-3: Fundraising / Networking
WS-4: Government Relations
WS-5: Marketing / Socials / Community
WS-6: Research
WS-7: Agent-Based Modelling
WS-8: Finances
If you are interested in joining us, please send an email to info@coviid.me or contact us through our social media channels.
Special thanks to Co-Pierre Georg, Kungela Mzuku & Charl Everts who co-authored the article.
