Immunity Passports May Liberate Us From Lockdowns or Invite New Privacy Invasions

The idea is looking less like a Get Out of Jail Free card and more like a hall pass.

Are you looking forward to resuming something that resembles a normal life in terms of travel, concert attendance, and public gatherings? Vaccines for COVID-19 are a big step towards putting pandemic fears behind us. But if hosts aren't satisfied with knowing vaccines are available, they may want proof that event attendees and travelers have had their shots. That's where immunity passports come in, and they may help us move past the pandemic—or add new intrusiveness and frustration to our activities.

The idea of immunity passports originated in the spring as a recourse for those who had already suffered a bout of COVID-19. They would be "digital or physical documents that certify an individual has been infected and is purportedly immune to SARS-CoV-2," noted a May article in The Lancet. "Individuals in possession of an immunity passport could be exempt from physical restrictions and could return to work, school, and daily life."

Immunity passports, then, were conceived as something liberating for those no longer at risk from the disease. "This has at least some potential as a way to loosen the ties that have brought so much work and so many lives to a standstill," Ron Bailey, Reason's science correspondent, observed in April.

Since then, however, the idea has morphed more than a little. For starters, it's looking less like a Get Out of Jail Free card and more like a hall pass.

"International air travel could come booming back next year but with a new rule: Travelers to certain countries must be vaccinated against the coronavirus before they can fly," The Globe and Mail recently reported.

Carriers will also impose restrictions. The International Air Transport Association (IATA) endorses immunity passports and has developed its own Travel Pass. Qantas says it will require proof of vaccination and other airlines are bound to follow. Norwegian Cruise Lines is considering a similar move.

Domestically, Hawaii currently requires COVID-19 tests for travelers who want to skip quarantine; state officials are considering a vaccine requirement.

Similar rules may apply to many entertainment venues. Ticketmaster points out that "one idea to keep the event entry process as simple and convenient as possible is to find a way for fans to link their digital ticket to their negative test results, vaccine status, health declaration or any other info that is determined to greenlight access."

Accomplishing that task shouldn't be difficult, given that there are already competing implementations of immunity passports seeking to make the process painless and to address potential concerns.

The IBM Digital Health Pass, which is designed to "bring people back to a physical location, such as a workplace, school, stadium or airline flight," boasts that "privacy is central to the solution, and the digital wallet can allow individuals to maintain control of their personal health information and share it in a way that is secured, verifiable, and trusted." IATA's Travel Pass promises that "travelers always remain in control of their data with their privacy protected." The similarly travel-oriented CommonPass, sponsored by the World Economic Forum (WEF), claims that it "delivers a simple yes/no answer as to whether the individual meets the current entry criteria, but the underlying health information stays in the individual's control."

That's a promising start with the various offerings all offering privacy assurances. But there's a very real possibility that, instead of anonymous codes in competing apps, our vaccination status will end up as entries in a government database that follows us from one checkpoint to the next.

For starters, both IATA (through its One ID) and WEF have been pushing "touchless travel" in which biometric identification becomes the norm and "your face and body are your passport," as a WEF article about post-pandemic travel puts it. The authors specify that, ideally, "the individual is in possession of and controls their identity attributes, such as their date and place of birth and physical characteristics, but also travel history, health information and other data." Fundamentally, though, people's movements would be governed by databases accessed through iris scans and fingerprints. "Health information" would, presumably, include vaccinations for COVID-19 and whatever bugs emerge in the future.

Under such a system, immunity passports look less like competing apps that you can swap out if they screw up, and more like government websites to which you upload required documents and hope that the inevitable glitches aren't too awful as they follow you … everywhere.

What kind of glitches? Just look at the government no-fly lists of people who are supposedly too dangerous to allow on airplanes, which have been so notoriously inaccurate and difficult to correct that they were ruled unconstitutional by a federal judge last year. "Even in clear cases of mistaken identity or clerical blundering, a name can linger in the system for years," CNN noted in 2015. The ACLU calls them "Kafkaesque."

This was seven years after then-Homeland Security Secretary Michael Chertoff admitted, "we do have circumstances where we have name mismatches," amidst suspicions that a journalist had been added to the list because he criticized the TSA. Placement on the list has been used by the FBI as a punishment for people who don't play ball—a lawsuit over that abuse is working its way through the courts right now.

This isn't a peculiarly American problem; Canada's no-fly list has been similarly mismanaged. Thirteen years after implementing the list, Ottawa "hopes to have a new system for individuals who have names similar to those of genuine terror threats in place later this month—and up and running in time for the holiday travel season," according to a November CBC report.

So, a system of immunity passports could mean picking a widely accepted app with a good reputation for privacy that will offer scanners nothing more than a QR code certifying your health status. Or it could require you to call a federal agency—business hours only, please—to explain that the document you just uploaded was a vaccination certificate and not a pregnancy test.

And yes, this objection applies not only to immunity passports, but to the whole database approach embodied by "touchless travel." Vaccine information is just one important place to hold the line for competing, decentralized solutions rather than submit to yet another bureaucratic boondoggle.

In the current pandemic-panic environment, it seems inevitable that we'll be asked to offer proof of vaccination in the near future, at least for international travel and possibly even for attending large gatherings. The potential exists for satisfying such requirements in a way that's relatively respectful of privacy. But immunity passports will only be tolerable if we can resist the pressures to turn them into entries in a larger-scale and more-intrusive version of no-fly lists.