It’s looking like Covid will be with us for a long time. As the virus mutates faster than we can ever conceivably vaccinate the planet the likelihood increases that we’ll be living with some form of restrictions for a while. How should we deal with it? I won’t answer that more specifically than “test lots of things in a scientific manner across the world, and copy what works in a way that’s best for society”. A bit of a wash-out answer, though probably beats the last twelve months’ approach.
One (of the many) things to consider will be identifying to society those at risk (of hurt/vector-of-contagion/something) from those not at risk. Whether this should be done at all is another philosophical question – we have done for a long time with Yellow Fever – but how to do it should be easy. Digital certificates.
The Chinese use phone apps, or Borg-implants or something, and similar has been suggested in the West. These have the benefit of flexibility: they could include all sorts of goodies like visible displays and Big Brother being able to track you. Strangely this might discourage some use. Having to install government-written software on phones mightn’t always be popular.
A digital certificate is just a number in a certain format. It contains some info, and is cryptographically ‘signed’ by a trusted body. Cryptography and signing just mean it was put through a mathematical sum. We use them all the time at the moment. All encrypted websites – anything with ‘https://’ and a padlock in the address bar, i.e. most of them – use them. If you look at the certificate details you’ll see all the contained data: what websites can use it, their contact details, when it’s valid for, who signed it, where you can check it, what it can be used for (web, email encryption, signing other certificates, etc); it can even contain pictures.
Certificates work in a hierarchy: there’s a ‘Certificate Authority’ at the top which signs certificates for websites. Each website requests its cert of a CA. There’s a bunch of major commercial CAs which have some data built into your web browser, so when you go to a website your browser can tell immediately if the cert is genuine. You can have a CA sign a sub-CA, so a top-level CA could authorise a company’s own Certificate Authority to issue certificates for its own webservers.
Being just a number means it can’t actually do anything; it can’t run malicious nasties on your phone. But it can carry trustable information. It can be downloaded, saved on a phone, saved on a USB stick or written in longhand on paper. Any number of apps can be written to download, save and display them. And all the software and experience to manage them is already out there, and is mature. The ITU X.509 standard that governs certificates is fairly mature in computer terms, being around since 1988.
A Covid certificate could work in a similar way to website ones. Maybe the WHO (who.int) signs each state’s health authority CA, which issues certificates to individuals as they get tested or vaccinated. The certificate could have mandatory fields like ‘name’, and optional fields like ‘vaccination status’, ‘antibody test status’, ‘QR code’, and a plethora of local others. The health authority would issue a new cert whenever there’s a change in status, such as vaccination. You could automate the processes, conceivably easily… if your government stores your vaccination on something better than an old spreadsheet.
This doesn’t answer what information should be stored or shared. But it does provide a trustable way to share information if that becomes necessary. And it doesn’t need a central store open to the world to look at – because we know state websites of private data are always a good idea. It’s akin to printing a document that says “This has serial number X, the bearer is called Y, and has vaccination Z” and has a contact phone number. You could call the number and ask “I have X, owned by Y who has Z. Is this true?” And they would answer Yes or No.