Get Ready To Show Your Vaccine Passport Everywhere

It's too late for health passports to make a difference, but the damage could be immense.

Originally touted as an innovative means of reducing the reach and duration of pandemic restrictions, health passports have moved beyond speculation to reality with the recent debut of several versions of such credentials. But after a year of lockdowns, travel restrictions, and surveillance justified on public health grounds, it's likely that, rather than live up their liberating promise, health passports will become just another bureaucratic hurdle for people trying to go about their lives. For better or worse, though, the new credentials look destined to be part of the post-COVID-19 world.

"The Biden administration and private companies are working to develop a standard way of handling credentials — often referred to as 'vaccine passports' — that would allow Americans to prove they have been vaccinated against the novel coronavirus as businesses try to reopen," The Washington Post reported over the weekend.

The federal government is something of a johnny-come-lately to a phenomenon already in motion.

"IATA Travel Pass is a mobile application that helps travelers to store and manage their verified certifications for COVID-19 tests or COVID-19 vaccines," according to the International Air Transport Association. "By the middle of March 2021, a total of 17 airlines had signed up to trial IATA Travel Pass. Singapore Airlines was the first airline to launch a full pilot on March 15 on the Singapore-London route, followed by Qatar Airways on March 18."

IATA's Travel Pass is a leading contender among a host of competing credentials sponsored by governments and private entities and intended to demonstrate to authorities with a renewed fear of contagion that the bearer poses minimal risk. IATA's digital credential (with paper alternatives available) offers information on destinations' testing and vaccine requirements, connects travelers with their test and vaccination certificates and, by verifying and storing those certificates, acts as a "digital passport" for health purposes.

IBM's blockchain-based Digital Health Pass offers similar capabilities and is customizable for organizations that have different requirements for travel and access to facilities. "[T]he solution is designed to enable organizations to verify health credentials for employees, customers and visitors entering their site based on criteria specified by the organization," the company says.

The European Union is developing its own Digital Green Certificate that will serve as proof that a person has been vaccinated against COVID-19, received a negative test result, or recovered from the disease and accordingly gained immunity. "The Digital Green Certificate will be accepted in all EU Member States," the European Commission promises. "It will help to ensure that restrictions currently in place can be lifted in a coordinated manner."

Such credentials aren't entirely unprecedented; the World Health Organization's International Certificate of Vaccination or Prophylaxis, or "yellow card," serves as proof of vaccination for travelers headed for places where certain diseases are common (yellow fever, for example). But the yellow card is a low-tech paper document that doesn't store health data or link to a network, it's in limited use, and it applies only to travel. Pandemic-era health passports are already taking on a larger role.

"Governor Andrew M. Cuomo today announced the launch of Excelsior Pass — a free, voluntary platform developed in partnership with IBM, which utilizes proven, secure technology to confirm an individual's recent negative PCR or antigen test result or proof of vaccination to help fast-track the reopening of businesses and event venues in accordance with New York State Department of Health guidelines," New York State announced last week. 

An implementation of IBM's Digital Health Pass, the Excelsior Pass is voluntary for both businesses setting policies and customers seeking entry. But it's easy to see how people might feel pressure to adopt the standard in order to stay in the good graces of regulators and licensing authorities. Major New York venues such as Madison Square Garden and Barclays Center have already implemented the Excelsior Pass as a means of satisfying state testing and vaccination requirements for attendees, and other venues are likely to follow.

Of course, to demonstrate that you're tested, vaccinated, or otherwise immune, these various passes need access to relevant health data. All of the systems promise tight security for users, but they still need potentially sensitive information.

"When you receive a COVID-19 vaccination or test in the State of New York, the Department of Health receives a copy of your records from your vaccine administrator, provider or lab," New York State says. "Using the information you provide, Excelsior Pass searches the Department of Health's records for your COVID-19 vaccination or negative COVID-19 test results and then provides you a Pass showing your name, date of birth, Pass type and Pass expiration. No other information is accessed or stored."

IATA goes further, assuring that "Travel Pass does not store any data centrally. It simply links entities that need verification (airlines and governments) with the test or vaccination data when travelers permit."

Still, these systems need some degree of access to sensitive health information in order to function, and that creates an unavoidable vulnerability.

"If you have your health records attached to something you have to carry that has to be verified, you have created an opening into the most private data you have," Member of Parliament David Davis last week cautioned fellow British lawmakers considering vaccine passport requirements. "It is straight away a problem and it will grow because, inevitably, once we have the mechanism, it is common sense that people will try to use it for other uses and it will grow and grow."

That's the next concern. Having already expanded beyond air travel to encompass access to sports and concert arenas, it's easy to see COVID-19 being only the first entry in credentials designed to be scalable. They can all be easily tweaked to record conformity with any imaginable public health requirement. Underground entrepreneurs certainly anticipate a large role for such documents—they've established a brisk business selling bogus vaccine certificates to buyers unable or unwilling to secure the real thing.

A year-plus into the COVID-19 pandemic, health passports are far too late to mitigate the damage done by lockdowns, surveillance, and travel restrictions. Even so, they're almost guaranteed to be a part of the world to come.