Protecting Australia's Border with Cryptographically Secure Credentials

GoSource delivered cryptographically verifiable border credentials that let regulators and traders trust digital trade documents without relying on paper originals.

Challenge

A certificate of origin is a piece of paper. Its authority comes from a signature and a wet seal, which is exactly why forging one is worth somebody’s time. Fraud that slips through a border costs money and occasionally costs lives.

The obstacle to digitising these documents was never the technology. International supply chains run across many parties with different systems, different legal frameworks and very different levels of technical maturity. A solution that required everyone to adopt it at once would not be adopted at all.

Solution

We built on two W3C specifications: Decentralised Identifiers and Verifiable Credentials. A credential is issued to a DID much as a passport is issued to a citizen, and anyone can check it cryptographically without contacting whoever issued it.

Pairing that with the Open Attestation framework solved the adoption problem. A QR code printed on an existing paper document lets a party verify it if they want to and ignore it if they do not. Nobody has to move first.

The proof of concept ran between Australia and Singapore on certificates of origin. It worked, and ABF extended the scope to declarations of origin, CITES permits and VI-1 wine certificates. We built the Digital Verification Platform on Node and React, using the Open Attestation library the Singaporean government had released. ABF can now put a digital stamp on any document it issues, and a third party anywhere can confirm it is genuine.

Then we gave the work away. VCKit, the tooling for creating and verifying these credentials, went to UN/CEFACT as open source so other nations would not have to build it twice.

Outcomes

Documents can be checked faster and more reliably, which means more seizures of illegal goods. The platform was built for ABF’s documents, but there is nothing ABF-specific inside it, so any issuing authority could run the same thing. The Australia to Singapore exchange proved the approach across a real border, and the scope has since grown from certificates of origin to three further document types.

The UN/CEFACT contribution matters more than it sounds. Lowering the cost of implementing verifiable credentials is what turns a national capability into an international one.

Technologies

W3C Decentralised Identifiers and Verifiable Credentials. The Open Attestation framework from the Singaporean government. Node.js and React for the platform itself. QR codes for backward compatibility with paper. VCKit, contributed to UN/CEFACT as open source.

On who gets left out

Interoperability was the design constraint, and it has an ethical edge. A standard that only works for parties with mature systems pushes everyone else out of the supply chain. QR codes on paper were the answer: a trader with no digital capability at all is not excluded from trading.

Releasing VCKit through the UN was the same decision at a larger scale. A developing nation can implement verifiable trade credentials without paying licence fees to anybody.