System Profile

General Description 

Electronic Validation Électronique (EVE) is a website designed for the purpose of allowing users to check the validity of digital documents issued by Transport Canada. 

With the events of the Covid-19 pandemic, and the mandate of taking a digital-first approach to service delivery, business lines are moving away from issuing paper documents to clients. 

EVE was designed to solve three main problems: (1) Help address digital document security concerns, (2) provide up-to-date information on document status, and (3) meet IMO requirements. 

The shift to digital documents has required security considerations as there is an increased risk of these documents being modified. One of the security features being adopted is the use of electronic signatures. Another is the introduction of validation sites like EVE and Marine Electronic Document Validation (MEDV). Users may leverage EVE to validate that the electronic document they are reviewing is authentic and was, in fact, issued by Transport Canada. 

Some business lines issue documents to clients that change status over time. For instance, a document has expired and must be renewed or replaced, or a document is no longer valid and has been cancelled. EVE provides the user with a real-time status of the document without needing to contact the business itself for an update on the certificate status. 

IMO requires that electronic certificates be verifiable. Their guidelines state: “Verifying means a reliable, secure and continuously available process to confirm the authenticity and validity of an electronic certificate using the unique tracking number and other data contained on or embedded in the electronic certificate” (Guidelines on the Use of Electronic Certificates, FAL.5/Circ.39/Rev.2, 20 April 2016). For full requirement details, please see the IMO Guidelines on the Use of Electronic Certificates linked in the Resources section. 

Capabilities 

Link through QR code 

There are two means by which to validate a document in EVE. The first is by scanning the QR code on the document. The user may scan the QR code using the camera on their phone or tablet. They will receive a notification prompting them to open their web browser. When they tap on this notification they will be directed to EVE and linked directly to the metadata information for that document. 

Search 

The second way of validating a document in EVE is by visiting the EVE website and searching for the document. Currently, users may search by official number, vessel name, IMO number, certificate number, or company name. EVE will return a list of search results and displays to the user the number of results returned for their query. Search results are sorted by vessel name, then status, so the user sees the “Valid” certificates first. If there are no results for the given search, a message is displayed. 

Accessibility 

The EVE website was designed and implemented to be WCAG 2.1 level AA compliant. (Link to compliance report?) 

Responsive Design 

The EVE website was designed and implemented using responsive design principles in order to be usable on desktop computers, tablets and mobile phones. The minimum browser width EVE has been designed to support is 320px. 

Constraints 

In its current state, the EVE website does not have user authentication. All information displayed on EVE can be accessed by any member of the public with the URL. EVE should not display protected information, personally identifiable information (PII) or any information that could be damaging to an organization or client of Transport Canada. Before pushing metadata to EVE, it should be verified to ensure that it does not violate any privacy requirements. 

EVE is not a document database and does not provide document storage. The metadata displayed on EVE should allow users to identify the digital document so that they may verify its authenticity and check its status. However, this is not a substitute for the document itself. For example, vessels requiring marine insurance certificates must always carry a copy (paper or digital) of their certificates on board the vessel in order to comply with IMO regulations. 

EVE and Marine Insurance Certificates 

Business Case 

EVE is a necessary tool for the introduction of digital marine insurance certificates as it addresses the security concerns they raise. Previously certificates were printed on card stock unique to TC and were embossed after signing to prove their authenticity and make them harder to alter or forge. While digital certificates are encrypted upon signing, they can be printed by clients, making them susceptible to alterations or forgery. Pushing certificates metadata such as vessel information and certificate expiration dates to EVE allows inspectors and clients to verify digital certificates are authenticated and unaltered. 

EVE solves several existing issues with marine insurance certificates related to their status. During early research inspectors reported having to contact the MIU team on a regular basis. When a certificate is cancelled before its expiration, vessel owners are required to return the certificate to Transport Canada. The MIU team reported that certificates were rarely returned upon cancellation and as a result, inspectors would have to contact the MIU team to confirm a certificate had not been cancelled. In the event a vessel could not provide a certificate during an inspection, inspectors had to contact the MIU team to confirm whether the vessel had the necessary certificates. With EVE, inspectors can look up certificates themselves rather than having to reach out to the MIU team for confirmation a vessel has the necessary certificates and that they are still valid. EVE will not display the reason for cancellation of cancelled certificates for privacy reasons. If necessary, users can reach out to the MIU team to inquire about the reason for cancellation. 

EVE also provides support to international inspectors when reviewing Canadian marine insurance certificates. Marine insurance certificates are required by vessels that enter the waters of any country that is a member of the International Maritime Organization and is signatory their marine insurance conventions.  Despite this, the look and information on a marine insurance certificate varies by the country issuing the certificate, meaning each county’s certificate will have a unique format. Directing international inspectors to EVE allows them to easily and quickly verify a certificate is authentic without having to rely on prior experience with Canadian marine insurance certificates. 

EVE is a simple yet effective MVP that addresses digital certificates security concerns while also saving time for the MIU team and inspector. By simply pushing metadata from MIUS to EVE after certificates have been delivered to the client, inspectors and clients are shown enough information to confirm their certificates are authentic and valid. 

Context of Use 

Transport Canada issues marine insurance certificates to Canadian and foreign vessels as proof they hold the appropriate marine insurance policies. There are 3 International Maritime Organization conventions that Canada is signatory of , each covering a different insurance policy; Wreck, Bunker and CLC. Certificates have a maximum lifespan of 365 days but can be cancelled before their expiration if a vessel no longer has the proper insurance. Per IMO requirements, vessels must carry a digital or paper copy of their certificate onboard their vessel to present during inspections.  

As the Marine Insurance Unit transitions to providing clients with digital certificates, EVE will allow its users to verify that a marine insurance certificate is authentic, unaltered and valid. Users will be able to view a certificate's status and metadata one of three ways; via QR code, link or searching EVE. Scanning the QR code on a certificate with a mobile device links the user directly to the certificate information in EVE. Similarly, selecting the link on a certificate or in the certificate delivery email links the user directly to the certificate information in EVE. This feature will not be available on digital certificates for MVP due to software constraints but is hoped to be implemented later when the necessary software has been acquired. Users can also search for a certificate in EVE by entering search criteria such as the vessel's official number, the vessel name, owner or company name and more.  

Users 

Primary Users

EVE’s primary users are inspectors looking to verify the authenticity and status of a vessel's marine insurance certificate during inspection. Because marine insurance certificates have a long lifespan (maximum of one year) and can be cancelled for a few reasons after issuance, its important inspectors are able to verify a certificate is still valid. Additionally with the transition to digital certificates clients are now able to print certificates themselves, therefore inspectors need to be able to confirm a certificate is authentic and has not been altered.  

Inspectors may be sent certificates via email prior to the inspections, in which case they can scan the QR code or select the link on the certificate (not yet available), or search for the certificate in EVE. An inspector may also be presented with a certificate during an inspection, similarly they can verify the certificate using EVE. In the event a vessel owner is unable to provide a marine insurance certificate, inspectors can use EVE to search for certificates by a variety of search criteria to confirm whether the vessel has an active marine insurance certificate. Certificates can’t be viewed through EVE, in this situation inspectors would only be able to confirm that the vessel has a certificate and the status of that certificate. 

Secondary Users

Clients such as vessel owners or agents are secondary users of EVE. Similarly to inspectors, they can scan the QR code or use the link on their certificates (not yet available) to view portions of the information from the certificate(s) in EVE and verify their status. In the event the client can't find a certificate, they can use the search function in EVE to confirm their vessel has a certificate and its status. As certificates can’t be viewed or downloaded from EVE, if the client has lost the certificate, they will have to reach out to the Marine Insurance Unit team to resolve the issue. 

EVE API 

The EVE website and API stores document meta data within aan Azure Cosmos DB, a results card to display that meta data and logic to determine if the documents are valid, cancelled or expired.  EVE’s API allows document metadata to be stored in EVE without it being surfaced on the website. This means other teams could utilize EVE’s database to store, link to and surface data to locations outside of EVE. URL linking is supported, so QR codes can be inserted within the TC documents for easy linking. EVE is a shared component and is authorized for Protected B data.  Integrating systems can push document meta data or updates using the EVE API hosted on Azure cloud. Only tenants of the TC organization can push data to this system, by using API authentication.  

Resources 

EVE Website (Acceptance): https://ncasafsecsurapp-eve-external.azurewebsites.net/

EVE Website (Production): TBD 

IMO Requirements on the Use of Electronic Certificates: Ref (imo.org)