IATA Unveils Key Design Elements of IATA Travel Pass

Geneva, 17th December, 2020 - The International Air Transport Association (IATA) unveiled key design elements of the IATA Travel Pass. IATA Travel Pass is a mobile app to help travelers easily and securely manage their travel in line with any government requirements for COVID-19 testing or vaccine information.

“Testing is the immediate solution to safely re-open borders and re-connect people. And eventually this is likely to transition to vaccination requirements. In either case, a secure system to manage COVID-19 testing or vaccination information is critical. The IATA Travel Pass is a solution that both travelers and governments can trust. And it is being built with data security, convenience and verification as top priorities,” said Alexandre de Juniac, IATA’s Director General and CEO.

IATA emphasized these priorities with three critical design elements:

1. Putting travelers in control of their personal information for top level data security and data privacy. The IATA Travel Pass stores encrypted data including verified test or vaccination results on the mobile device of the traveler. The traveler controls what information is shared from their phone with airlines and authorities. No central database or data repository is storing the information. By keeping travelers 100% in control of their information, the highest standards for data privacy are ensured. IATA Travel Pass is also built on the highest standards of data protection laws, including General Data Protection Regulation (EU GDPR).

   Technically, the app is being built in accordance with Self-Sovereign Identity* (SSI) principles. The IATA Travel Pass is scheduled for release early in the first quarter of 2021 for Android and for iPhone. For iPhone it will use the “Secure Enclave” features of Apple devices and a similar security encryption technology for Android.

2. Global standards recognized by governments to ensure verified identity and test/vaccine information.
   a. Verified identity: A government issued ePassport is used to verify the identity of the user. It also serves to create a digital representation of the user’s passport to allow the information to be sent electronically in a secured way that is linked to their verified identity. The key to this are global standards developed by the International Civil Aviation Organization (ICAO) which match biometric passport data and a selfie taken by the user. This creates a Type 1 digital travel credential (a verified digital identify**) in line with ICAO standards.
   b. Verified test results or vaccine information: Currently the main vaccination requirement for entry into some countries is for yellow fever. Under the International Health Regulations, this is managed by the “yellow card” or International Certificate of Vaccination and Prophylaxis. The World Health Organization (WHO) is developing digital standards that will make these vastly more secure and will dramatically reduce fraud. When ready, the IATA Travel Pass will be able to accommodate such new global standards.

   Until a COVID-19 vaccine is widely available to the general public, the priority is on COVID-19 testing. Laboratories have well-established safety standards for managing and verifying test results to individuals. IATA is partnering with selected and established laboratories to securely link their test results with the verified identity of the IATA Travel Pass holder.

3. Convenience and biosafety will be enhanced with integration into contactless travel processes. The ICAO CART recommendations for biosafety include the use of contactless travel processes to reduce the risk of virus transmission when documents need to be exchanged in the travel process.

   The industry has been developing contactless travel processes as part of a One ID transformation program for several years. The IATA Travel Pass digital identity management module uses the well-developed principles of One ID (which are, in turn, based on ICAO standards). For the passenger this means that the IATA Travel Pass will also unlock the potential for convenient contactless travel processes from check-in to boarding. As such, while the need for COVID-19 information verification may eventually disappear when we overcome the pandemic, IATA Travel Pass, however, will remain as a bold step forward in the implementation of contactless travel.

   IATA research amid the COVID-19 crisis (September 2020) shows that contactless processes will be popular with travelers:

• 70% of passengers had concerns about handing over their passport, phone or boarding pass to airline agents, security staff or government officials at the airport

• 85% of travelers said that touchless processing throughout the airport would make them feel safer, and

• Already 44% of travelers said that they are willing to share personal data to enable touchless process, up significantly from 30% in June.

Interoperable Solution 

IATA is developing the IATA Travel Pass in four independent modules that can interact with each other. These modules will cover registries for regulatory entry requirements and labs/test centers, verified certificate issuance, digital identity and the possibility for passengers to share their tests results along their journey via their mobile device. Open standards enable the modules to be used as one solution or to complement capabilities being developed by other solutions providers. 

“We are building the IATA Travel Pass with one aim—to help reconnect our world safely. IATA has brought advancements in global standards like e-ticketing and mobile boarding passes to consumers in all parts of the world. This unique capability demonstrates that we can work with industry and governments to re-shape travel processes based on global standards. We are confident that we can deliver a complete solution with IATA Travel Pass. And we are building the IATA Travel Pass so that other solutions serving the same industry re-opening goal can also benefit from it. We want airlines to have a competitive marketplace with the widest range of options that meet their specific needs,” said Nick Careen, IATA's Senior Vice President, Airport, Passenger, Cargo and Security.

IATA’s Timatic offering is a foundational element of the IATA Travel Pass. For decades it has provided reliable entry requirement information to airlines and travellers. Integrating Timatic into the IATA Travel Pass entry requirements registry model brings with it an established process for the global collection, verification, updating and distribution of this information.

For more information, please contact:
Corporate Communications
Tel: +41 22 770 2967
Email: corpcomms@iata.org

Notes for Editors:

• IATA (International Air Transport Association) represents some 290 airlines comprising 82% of global air traffic.

• You can follow us at twitter.com/iata for announcements, policy positions, and other useful industry information.

• * Self-sovereign identity (SSI) is a term used to describe the digital movement that recognizes an individual should own and control their identity without the intervening administrative authorities.

• **The traveler Identification process is compliant with ICAO standards. The process that a passenger would take to securely identify themselves in the IATA Travel Pass uses government issued ePassports to create a digital travel credential as per the standards developed through ICAO. The process has six steps:

1. Download the free IATA Travel Pass to their Smart phone and login

2. Take a selfie with the smart phone

3. Complete a liveness test as instructed by the phone – i.e., move their head, close their eyes in front of the camera as instructed

4. Scan the data on the two lines at the bottom of the passport photo page with their smart phones and scan the data-chip on the passport as prompted by the phone

5. The IATA Travel Pass then matches the photo with the passport data (which contains a digital biometric photo of the passport holder) to verify that (1) the passport belongs to the person in front of the phone and (2) that the passport is genuine and has not been tampered with.

6. The verified digital travel credential is then stored on the passenger's phone and can be used as their ‘digital passport/ ID’.