As many of you may know, starting April 1, 2022, CCI became an independent Linux Foundation (LF) project operated separately from Linux Foundation Public Health (LFPH). We joined LFPH in December 2020 to fight against COVID together and became a Joint Development Foundation (JDF)-chartered project (JDF is a part of LF) in June 2021 in order to have the proper legal structure to conduct rapid standardization of COVID credentials. Now that the COVID situation is eased, it is time for CCI to explore our next steps as an independent entity by building on our conversations and work in the past two years.

As we kicked off this new journey, many things will remain uncertain for a while. However, one thing is certain — we are committed to keeping CCI as an open and global community that welcomes diverse perspectives and constructive feedback. To that end, today we are releasing the Digital Health Credential System Implementation Guide V1 for public review and consumption and launching our community Discord to provide a forum for ongoing discussions and development of the Guide.

In 2021, CCI and our community members contributed significantly to the writing of the Good Health Pass Interoperability Blueprint, which proposed a set of interoperability requirements and standards to verify travelers’ COVID-19 status in a way that ensures the protection of core principles, such as privacy, security, user-control, and equity. Inspired by the Blueprint, Erran Carmel, a business professor at the American University, reached out to Kaliya Young, CCI’s Ecosystems Director and the co-chair of the Good Health Pass Interoperability Working Group, and created the preliminary version of this Implementation Guide by summarizing the requirements in the Blueprint. At the invitation of Lucy Yang, CCI’s Community Director, Erran took this work into the CCI, and co-led it to fruition with Sankarshan Mukhopadhyay, a long-time CCI community leader, with the contributions and support of the broader CCI community.

The Implementation Guide V1 provides a set of baseline recommendations to the CCI community of application and services developers, implementers with which to evaluate product designs. We believe that with more participation from our community we can refine this guide to reflect the state of the art — enabling a documentation of the best practices. We encourage users of this Guide to apply a critical lens and reach out to us with any issues and improvements we need to address for further versions.

As a follow-on activity to the release of the Guide, our Global Implementation Forum June event will host a presentation by two experts from gematik GmbH, the leading German healthcare organization, to share their “Insights from a Prototypical Implementation of Vaccinate Certificate” and relate their approach to the requirements in the Guide.

We invite you to join this upcoming event and our Discord to engage further on the Implementation Guide and discuss the future of CCI!

When the COVID-19 Credentials Initiative (CCI) was formed in April 2020, we were a self-organizing group of companies and individuals, held together by a few mailing lists and working groups, to explore how Verifiable Credentials (VCs), an open standard and an emerging technology, could be used for the public health crisis unfolding with COVID-19. Recognizing our limits early on as an informal group, we quickly pivoted from developing a solution together to supporting each other to build for their local contexts. Over the course of nine months, we have seen over 20 projects present their work to the CCI community and developed an MVP governance framework that can be adapted to specific COVID-19 use cases.

As our work evolved and as vaccine development showed promising progress, the need to align efforts around VCs for COVID-19 and educate decision-makers on the use of VCs for COVID-19 became clearer and stronger. However, the limits of not having a formal organizational home hinder us from engaging with key stakeholders and conducting necessary development efforts. So, we began exploring options for a home in summer.

Linux Foundation Public Health (LFPH) emerged in the middle of the pandemic, right after we started our search. There was a natural alignment between LFPH and CCI on building on open standards to ensure interoperability and developing open-source code bases of minimal-viable privacy-preserving software components to make interoperability easier and cheaper to implement. So here we are today; after achieving success with privacy-preserving exposure notification apps, LFPH officially took CCI in before the end of 2020, kicking off our journey to advance the use of VCs for public health with vaccination record as a start.

At the tail end of holiday spirits, we hope to spread our joy by sharing with you the invitation letter (below in italics) from Brian Behlendorf, the Executive Director of LFPH. You can find the official press release here.

Dear CCI Community,

We are excited to extend this invitation to you to join Linux Foundation Public Health and work together with us to advance the use of Verifiable Credentials and data and technical interoperability of Verifiable Credentials in the public health realm.

Linux Foundation Public Health (LFPH) was founded in July 2020 as a collaborative effort to combat COVID-19 and future epidemics through building, securing, and sustaining open- source software to help public health authorities (PHAs). We started with exposure notification apps and have achieved success with COVID Green™ and COVID Shield™, which are being deployed in 4 US states and 7 countries around the world. The early achievements were made possible within such a short time frame through our merger with TCN Coalition, a global community promoting privacy-preserving and interoperable exposure notification apps.

As COVID-19 tests mature and vaccines are around the corner, we have identified an increasing demand for responsible and interoperable credentialing solutions to issue and manage COVID-19 credentials, especially vaccine records, from PHAs. Therefore, we would like to work with the COVID-19 Credentials Initiative (CCI), supporting you to build on your existing work and enabling open-source development for vaccine records or key components of it, which can be implemented widely by PHAs with the help of the CCI community. We view this as a starting point of a long-term partnership to advance the adoption of verifiable credentials for wider public health use cases, such as patient ID and patient centered information exchange.

At LFPH, we have been following CCI’s work; we value the resources and assets created by the community and the tight relationships you have developed with small, grassroots solution providers. We foresee the scope of our partnership to go beyond open-source software development. The nature of the problem we are solving requires us to build solutions that are interoperable, so we are committed to supporting CCI in leading work around open standards, e.g. definitions and schemas for public health credentials. We also will provide CCI resources to strengthen community and knowledge building, broaden and deepen engagement with key stakeholders (e.g. PHAs, commercial entities, software vendors, relevant identity and technical communities) and conduct public and strategic advocacy.

As the next step, we will join the CCI Group Update call on December 11 from 10 to 11 am ET to answer any questions you have. In the meantime, we plan to commission the following three members of the CCI Community Guidance Team to lead the migration of CCI into LFPH once the community is ready:

- Lucy Yang, Co-Lead of the Coordination and Communications Workstream of CCI

- John Walker, Co-Lead of the Coordination and Communications Workstream of CCI

- Kaliya Young, the Identity Woman, an active contributor at CCI and a super-connector in the credential community. (Kaliya made the initial connection between CCI and LFPH and facilitated the formation of the partnership.)

While LFPH does offer different levels of paid membership for companies and we welcome interested parties to join, membership will not be a requirement for individuals and organizations to participate in any CCI activities. We will strive to respect the community-driven and open nature of CCI to the maximum during migration and onwards, and only leverage LFPH’s structure and infrastructure to improve efficiencies and effectiveness.

This is a strong alignment of efforts between two communities that share the same vision and aspiration. We look forward to meeting you and working with you.

Brian Behlendorf

Managing Director for Blockchain, Healthcare and Identity

The Linux Foundation

Happy New Year! We appreciate your support in 2020 and look forward to working together for a better 2021.

James Loperfido, Director of Business Development @Tangem

Edited by Celia Yeung, Chief Marketing Officer @ID Lynx; Coordination & Comms @CCI

We are all painfully aware of the economic and social restrictions imparted on us as a result of the COVID-19 pandemic. In order to reopen offices, restaurants, local private and public facilities — and most importantly, international borders — will likely require a flexible, interoperable, and ubiquitous system that preserves individual agency and privacy. The COVID-19 Credentials Initiative (CCI) focuses its efforts on supporting technology projects that work to meet these requirements through the utilization of W3C compliant ‘Verifiable Credentials (VCs)’, a tamper-evident credential that has authorship that can be cryptographically verified.

To contain further spread of the virus and restart the economy effectively, broad access and participation in contact tracing, testing, and other programs are necessary, and a reliable system for managing vaccination records is critical when vaccines become available. Many countries or health institutions are still using traditional approaches like paper certificates, email, and websites to communicate proofs of COVID-19 status of their citizens. However, new digital alternatives, which are cryptographically secure and privacy-preserving — that ensure veracity, portability and interoperability — are emerging.

As always, new technologies come with new challenges. One of the key success factors of implementing mass verifiable health credentials for targeted groups or the general public, like COVID-19 testing or vaccination results, is the availability and accessibility of the technologies. This means the issuing parties of the credentials, i.e. government authorities or health institutions, should consider and provide solutions to individuals who are less tech-savvy, don’t have constant internet access, or simply do not own a smartphone. Otherwise, their rights and needs to re-engage in society will be limited. Ideally, from a public safety and disease control perspective, someone with a digital or physical wallet that contains their verifiable COVID-19 test results or vaccination credentials could potentially grant them access to private and public facilities or places, such as hospitals, stadiums, nursing homes, train stations, airports, etc, without worries of spreading the virus further. This could be a crucial solution for people to resume their lives socially and for the government to restart the economy locally and globally.

To that end, Tangem, a Swiss company that enables universal access to digital assets, has been working diligently to expand the capabilities of its NFC-enabled card. Originally intended for personal custody and payments, the card can be used as a physical wallet/storage of digital ID in the form of Verifiable Credentials.

Tangem has a vertically integrated technology stack that is a unique combination of card-based hardware, firmware, and mobile applications capable of signing transactions directly to almost any database. It presents a physical solution for Self-Sovereign Identity (SSI) that is conformant to FIDO and W3C standards. With respect to COVID-19 mitigation, this inexpensive hardware wallet enables anyone to physically take ownership of their own testing history, vaccination records, and other credentials to ensure no one is excluded by this new technology.

This video demonstration shows a reference UX flow with Tangem’s own ID application. However, the functionality of the Tangem cards can be embedded in any mobile app through open source SDKs. Tangem continuously seeks enterprise partnerships to bring innovative solutions to the market and has considered the needs for interoperability and flexibility in its products’ deployment. Its involvement in the CCI is no exception.

Tangem participates in CCI for a few reasons. Firstly, Tangem believes in the foundation of SSI as a precursor to irrevocable civil rights and liberties. Its potential to create interoperability through global standards allows for flexibility and portability among systems and solutions by which all will benefit. Most importantly, CCI is seeking to solve a critical issue that can potentially result in reopening borders, offices and public facilities more quickly and spurring economic activities in a way that respects individual privacy. Thus, Tangem seeks to partner with software providers and solutions that need a physical component capable of offline issuance/verification/presentation of VCs.

Storing VCs in a hardware wallet controlled by the holder has invaluable implications. Agency, control, selective disclosure, and portability are critical factors in the issuance, verification, maintenance, and presentation of digital identity credentials. Like a physical ID card, these qualities can now be imparted to anyone in the world, even if they do not have a smartphone or constant internet access. Ubiquitous distribution, as we now know, is a prerequisite for solving supranational problems like COVID-19 credentialing given the important role SSI plays in making these credentials universally acceptable. Presenting a COVID-19, or any credential, is as simple as tapping a Tangem card to any smartphone with relevant applications. Physical entry and secure access controls are solved with a powerful and simple UX because of the affordable price point.

The convergence of identity and payments is a foreseen phenomenon in the digital asset space and Tangem aims to enable self-sovereignty, privacy, and utility to individuals around the world. The unique value proposition of the hardware-based wallet is that the keys or DID can be self-generated within the chip using only the passive power of NFC contact. Therefore, no trusted manufacturing environment is required and dependents can rest assured that the DID or keys are unique and cannot be extracted. By doing so, Tangem hopes to leverage trustless attestations and uniqueness such that identity at a global scale can be easily solved. Currently, Tangem has several public use cases including the National Bank of Cambodia on Hyperledger, Aurus (tokenized gold), New Balance Real Chain (product authenticity).

To learn more about Tangem through a live demo and Q&A, please join the upcoming CCI use case group call at 10 am ET on Tuesday, November 10. If you are not an existing member of the group, you can sign up by sending an email (no subject line or body text) to main+subscribe@usecaseimplementationCCI.groups.io, or you can register only for the bi-weekly calls by filling out this form to receive a calendar invite.

Kaliya Young, Identity Woman, Co-Founder of the Internet Identity Workshop; Lucy Yang, Co-Chair of the COVID-19 Credentials Initiative

We submitted this position statement to the “Privacy & Pandemics Workshop: Responsible Uses of Technology and Health Data During Times of Crisis — An International Tech and Data Conference” by the Future of Privacy Forum. The aim is to, from two participants’ point of view, share an abbreviated case study of CCI and to highlight key challenges that arose in our efforts to responsibly use new privacy-preserving technologies to mitigate the spread of COVID-19. We wanted to share our submission with the CCI community and the public in the hope to invite some further discussions.

So what is this emerging technology that is just coming to market with very early adopters and innovators leading the way (including the US government, the government of British Columbia, etc.)? It is called Verifiable Credentials (VC or VCs), a data format standard developed and published by the W3C last year. It is a universal data format for one entity (person, organization or thing) to assert something about another entity. The issuer packages up the credential and cryptographically signs it to seal the data it contains. It passes this to the subject, or holder, so that the subject can share it with the receiver of the credential, the verifier. At that point, the receiver is able to use cryptography to check the seal and the validity of the issuer. VCs are privacy-preserving because the issuer (identity provider) and verifier (relying party) do not form a technical/federated link with each other. The information does not pass directly.

This technology gives people the ability to collect and manage digital credentials — similar to the cards we find in our physical wallets — in digital wallets. These digital credentials act like paper credentials because individuals do not need to have the verifier directly connect to the issuer. Why is this new? Until now, to have provable information exchanged online, the issuer and verifier would need to directly “federate” to exchange information about the data subject.

Immunology is a complex science, but simplified basics about how it works with some viruses are known. It was based on these simple understandings that possibilities for how VCs might be used by people and institutions to better manage risk began to be explored. One obvious use case was the ability to issue VCs that reflect some type of COVID-19 status, a proof that one:

• Tests positive for antibodies and therefore not infected/or vulnerable to being infected.
• Has recently tested negative and therefore the risk of being infected is low and that one could go to work, travel or visit a facility with vulnerable populations.
• Has received a vaccine for COVID-19 and therefore safe to travel or access a large in-person event.

Some of these use cases as articulated are not new (e.g. the Yellow Card); it’s just new to digitize them. It makes sense to consider how this simple paper-based technology can be updated to digital. However, the mild hysteria raised about doing things today done on paper via digital means that concerns were triggered without fully understanding or exploring how to use the technology. Some individuals were so concerned that they resigned from organizations whose leadership floated these ideas.

COVID-19 status is currently shared in two forms: 1) with the patient via a phone call or text message from the doctor or testing site or 2) in a patient medical record. Neither of these solutions provides a clear way for the subject to prove results to an entity that wants to know this information (e.g. an airline). VCs offer a new innovative format that provides people with information about their COVID-19 status that is under their control and verifiable by a relying party.

The VC approach is in strong contrast to the CommonPass effort, led by a Rockefeller-Foundation-backed nonprofit, that co-arose in the same time frame. The leadership at CommonPass is connected to the conventional medical records world and proposed the creation of a global system where patient medical records in some yet-to-be-determined way would be shared with a centralized decision engine that CommonPass would run globally. They held several global meetings with hundreds of people, including government leaders attending to build momentum for their proposed solution. There are also scores of siloed proprietary solutions popping up to solve these data-sharing challenges. For example, CLEAR is offering a biometric data sharing solution. In a public health crisis, these non-interoperable solutions are only good when only one of them is widely adopted, which doesn’t seem to be the case.

The community that formed around CCI was mostly made up of small, early-stage startups who were already implementing VCs for other use cases and decided to collaborate on exploring COVID-19 use cases. This makeup of the community means that it is not connected to global elites, governments, health departments or healthcare institutions. One exception to this is a startup that had political connections and worked with a California State Legislator to have the bill AB2004 proposed, which opened up a committee to study the use of VCs for COVID-19 medical test results. The bill just passed the Senate and is now waiting to be signed by the governor to become a law. However, the Electronic Frontier Foundation has repeatedly voiced its opposition [1] [2].

CCI has struggled to “raise voice” and be “heard” by the powers that make decisions. The experience of this group raises questions:

• How can emerging technology be “seen” by actors (governments, public health officials, airlines, workplaces) in the marketplace looking for solutions? Which technologists are listened to by policymakers? How are these actors making decisions about the claims these technologists are making?
• How can networks of potential issuers of COVID-19 status credentials be spun up in such a way that the credentials issued are seen as valid by verifiers (airlines, etc.)? This set of challenges around the technology are not technical as much as they are about process and accountability systems.
• How can existing norms of information sharing about people that are paper-based today be translated into a digital form in ways that make themselves and those concerned about human rights implications comfortable with the technical deployment?
• How can a new privacy-preserving technology based on open standards be used for public health crises or any other time-sensitive occasions when its deployment and adoption require a lot of coordination, collaboration and communication? How can these things be facilitated by funders seeking to make a difference?

We hope to hear your thoughts on the raised questions.

The COVID-19 pandemic has, in a few months’ time, taken the lives of almost half a million people worldwide and brought economies into lockdown globally. While many are struggling with the effects of social distancing, financial distress, or fear of contracting the virus, here at the COVID-19 Credentials Initiative (CCI), nearly 300 individuals from 100 organizations have united around a cause worthy of our collective efforts: supporting projects that deploy privacy-preserving Verifiable Credentials (VCs) to mitigate the spread of COVID-19 and strengthen our societies and economies.

We are a global community that shares a vision for the effective use of technology to mitigate the impact of COVID-19. We believe that, when used responsibly, VCs can be great privacy-preserving components of solutions addressing the numerous social and economic challenges caused by this and future pandemics. We are aware that without a holistic perspective from the onset, many COVID-19 technology solutions may introduce unintended results (e.g. surveillance, abuse of personal data, social inequalities). To avoid such outcomes, we have committed ourselves to open collaboration with a diverse range of experts, embracing open standards, and protecting the fundamental privacy and personal data rights of all stakeholders.

If you lead a project implementing VCs in your local communities and are aligned with our values, we want to hear from you. We also wish to share and discuss our work openly, including its technical, medical, legal, ethical, and business implications. We invite your input on these considerations as well as any other important aspects that can help build responsible, human-centric VC solutions to fight COVID-19.

If you are ready to contribute or collaborate, please join us at https://www.covidcreds.com/.