The International Air Transport Association (IATA) has unveiled key design elements of its digital health pass. IATA Travel Pass is a mobile app to help travellers easily and securely manage their travel in line with any government requirements for COVID-19 testing or vaccine information.
“Testing is the immediate solution to safely re-open borders and re-connect people. And eventually this is likely to transition to vaccination requirements,” said Alexandre de Juniac, IATA’s Director General and CEO. “In either case, a secure system to manage COVID-19 testing or vaccination information is critical. The IATA Travel Pass is a solution that both travellers and governments can trust. And it is being built with data security, convenience and verification as top priorities.”
IATA has emphasised these priorities with three critical design elements. The first one is putting travellers in control of their personal information for top-level data security and data privacy.
The IATA Travel Pass stores encrypted data including verified test or vaccination results on the passenger’s mobile device. Travellers can control what information is shared from their phone with airlines and authorities.
IATA has also stated that no central database or data repository is storing the information, ensuring the highest standards for data privacy. IATA Travel Pass is also built on the highest standards of data protection laws, including General Data Protection Regulation (EU GDPR).
The second priority is using global standards recognised by governments to ensure verified identity and test/vaccine information.
A government-issued ePassport is used to verify the identity of the user. It also serves to create a digital representation of the user’s passport to allow the information to be sent electronically in a secured way that is linked to their verified identity.
Currently, the main vaccination requirement for entry into some countries is for yellow fever. Under the International Health Regulations, this is managed by the ‘yellow card’ or International Certificate of Vaccination and Prophylaxis. The World Health Organization (WHO) is developing digital standards that will make these vastly more secure and will dramatically reduce fraud. When ready, the IATA Travel Pass will be able to accommodate such new global standards.
IATA also highlights that until a COVID-19 vaccine is widely available to the general public, the priority is on COVID-19 testing.
The third design element allows the IATA Travel Pass to be integrated into contactless travel processes. The IATA Travel Pass digital identity management module uses the principles of One ID. For the passenger, this means that the IATA Travel Pass will also unlock the potential for convenient contactless travel processes from check-in to boarding.
The process that a passenger would take to securely identify themselves in the IATA Travel Pass uses government issued ePassports to create a digital travel credential as per the standards developed through ICAO. The process has six steps:
- Download the free IATA Travel Pass to their smart phone and login;
- Take a selfie with the smart phone;
- Complete a liveness test as instructed by the phone – i.e., move their head, close their eyes in front of the camera as instructed;
- Scan the data on the two lines at the bottom of the passport photo page with their smart phones and scan the data-chip on the passport as prompted by the phone;
- The IATA Travel Pass then matches the photo with the passport data (which contains a digital biometric photo of the passport holder) to verify that (1) the passport belongs to the person in front of the phone and (2) that the passport is genuine and has not been tampered with;
- The verified digital travel credential is then stored on the passenger’s phone and can be used as their ‘digital passport/ID’.
The IATA Travel Pass is scheduled for release early in the first quarter of 2021 for Android and for iPhone. For iPhone it will use the “Secure Enclave” features of Apple devices and a similar security encryption technology for Android.
