Swiss COVID-19 certificate system subjected to public security test and gradually implemented

Switzerland launched its own COVID-19 certificate system on June 7, both in paper and digital formats. Rollout will be gradual, and the system is expect to be fully functioning by the end of June.

Thanks to the fact that the system's source code was made publicly available by Federal authorities, the Swiss COVID-19 certificate is also already subject to a public security test process involving security "experts and interested persons."

Test results are collected by the National Cybersecurity Centre, which will then evaluate them, and act according to the severity of the identified vulnerabilities. Findings "will be recorded and integrated into development on an ongoing basis", writes the Federal Office of Information Technology, Systems and Telecommunication.

A first batch of them was published on June 4, including description, impact and mitigation strategies for each vulnerability that is found in the process.

This stands in stark contrast to the opaqueness surrounding the deployment of many similar certification tools.

With the Swiss certificate system in place, individuals "who are vaccinated, have recovered, or have tested negative" will be able to require the document and accompanying QR code from hospitals, pharmacies, vaccination centres and medical practices.

The QR code is allegedly "forgery-proof", as it contains "the electronic signature of the Swiss Confederation". It will also be possible to scan it and save it on mobile devices through the "COVID Certificate app" that will be contextually launched on both Apple and Google stores. The Federal Office of Public Health guarantees that "Your data are not stored in a central system" as a result.

Finance Minister Ueli Maurer declared that "The goal of the certificate is clear: it should create freedom of movement by showing one has been vaccinated, recovered or tested. In particular it will make travel in the Schengen area simpler," Reuters reports. Its precise use within the country is however still being discussed.

Authorities have in fact devised a "three sectors" system in which access to "green" sector activities (such as workplaces, schools and public transportation) does not require a certificate, while enjoying "red" sector ones (clubbing, large public events) does. The certificate might however be voluntarily adopted for "orange" sector activities, such as accessing bars, cinemas or restaurants, and even required for those very activities in case of rising infections.