- Jay Stanleysenior policy analyst for the ACLU’s Speech, Privacy and Technology Project.
As people try to find a safe way to gather and travel during the pandemic, there is growing interest in documenting who has been vaccinated or tested negative for COVID-19. The World Health Organization has warned so-called vaccine passports may not be an effective way to reopen, and healthcare professionals argue vaccine certificates may further exacerbate vaccine inequality. New York is already testing a digital vaccine passport app made by IBM called the Excelsior Pass, while countries including the U.K. and Israel have issued their own versions of electronic vaccine certificates. The U.S. government has ruled out the introduction of mandatory vaccine passports at the federal level, but many private companies are now developing COVID-19 tracking systems. ACLU policy analyst Jay Stanley says smartphone-based vaccine passport apps “raise a lot of questions” around privacy, access and discrimination. “We have systems in place already for proving you’ve been vaccinated,” he says. “Is that system so broken that we need to construct an entirely new electronic system?”
AMY GOODMAN: This is Democracy Now!, democracynow.org, The Quarantine Report. I’m Amy Goodman, with Nermeen Shaikh. To sign up for our Daily Digest, you can go to democracynow.org or send the word “democracynow” — one word — text it to 66866, and get our headlines and our stories every day.
As people try to find a safe way to gather and travel during the pandemic, there’s growing interest in documenting who’s been vaccinated or tested negative for COVID-19. On Monday, British Prime Minister Boris Johnson announced his government will test the use of COVID-19 status certificates. Israel has already been using a “green pass” system to allow vaccinated people into restaurants and large events, raising concerns about a two-tier system. On Tuesday, the World Health Organization warned so-called vaccine passports may not be an effective way to reopen.
DR. MARGARET HARRIS: Again, this is why we, as WHO, are saying, at this stage, we would not like to see vaccination as a — or, the vaccination passport as a requirement for entry or exit, because we’re not certain at this stage that the vaccine prevents transmission, and there are all those other questions, apart from the question of discrimination against people who are not able to have the vaccine for one reason or another.
AMY GOODMAN: Here in the United States, New York is already testing a digital vaccine passport app made by IBM called the Excelsior Pass. Meanwhile, the Republican governors of Florida and Texas have signed executive orders banning vaccine passports. The Biden administration’s chief medical adviser, Dr. Anthony Fauci, said Monday COVID-19 vaccine passports are, quote, “not going to be mandated from the federal government.”
This comes as The Lancet medical journal published an editorial arguing vaccine certificates threaten to exacerbate vaccine inequality and risk, quote, “generating hierarchical societies in which vaccinated individuals have exclusive privileges that are denied to those who have not received the vaccine,” unquote. As all of this plays out, the ACLU, the American Civil Liberties Union, has also raised concerns about vaccine passports.
For more, we go to Jay Stanley, senior policy analyst for the ACLU’s Speech, Privacy and Technology Project, who wrote a recent piece headlined “There’s a Lot That Can Go Wrong With 'Vaccine Passports.'”
Jay, lay it out.
JAY STANLEY: So, first of all, the main push for our country really needs to be trying to get to herd immunity, so that COVID becomes another disease, like measles or others, where we just don’t have to worry about it on a daily and hourly basis. Nobody is running around asking us for our measles vaccination certificates left and right. And we want to get to the same point with COVID. That should be the number one goal. And this should be really a sideshow.
Of course, there are situations, in our view, where it’s legitimate to ask people to prove that they’ve been vaccinated for various things. Schools have long done that, for example. And perhaps if you’re a doctor working with cancer patients who are immunocompromised, or a nurse, that could be legitimate. And we have systems in place already for proving you’ve been vaccinated — notes and paper documents from doctors. And so, one question is: Is that system so broken that we need to construct an entirely new electronic system?
And if we do, you know, a lot of people have sort of an intuition that, well, in the age of the smartphones, it would be convenient and just make sense to have an electronic version of this that you can have on your phone. But that raises a lot of questions. The first one is equity. A lot of people, 15% of the country, do not have smartphones, disproportionately some of our most disadvantaged people. Forty percent of people over age 65 don’t have smartphones. People with disabilities, low-income people are disproportionately lacking in smartphones. And so, if you create a system that relies on having a smartphone, you’re going to create the kind of two-tiered society that you were quoting people as talking about.
There are also questions about privacy. So, the idea of having electronic verification and credentialing systems has been around for decades, and there are a lot of different parties that are working on those kinds of a system, whether it’s an electronic driver’s license, electronic boarding passes, electronic gym memberships. And there are a lot of work being done on creating sort of a unified, standardized system for providing electronic credentials. And this conversation about vaccine credentials is playing into that.
And there are different ways that you could build that kind of credential system, and some of them are decentralized, privacy-protecting and empower individuals, so that you would go, you’d get your shot, and the person or the entity that gives you your shot also gives you a certificate, printed or on a phone, that can prove that you’ve been vaccinated, using cryptography. And then you hold that certificate, and you choose whom to show it to. There are other systems for doing digital credentials that are centralized, that are not privacy-protecting, and that would, for example, hold a lot of your medical information, create new databases, but would also, every time you show that credential somewhere, would report back to the entity that it’s being shown, allowing for the creation of a lot of data about you.
And so, we think that there has to be a paper option if there’s to be any new, more secure system. One of the complaints is that the CDC card that you get is very easily forged. And it’s possible to make electronic systems that cannot be forged easily on paper. And so there needs to be a paper option for people so that we don’t have these inequities.
And finally, we want to make sure that people who cannot get vaccinated are not left out of the system. There are many people who are medically contraindicated. Their doctors have told them, because of medical conditions that they have, disabilities that they have, that they shouldn’t get a vaccine, it’d be dangerous to them. And what happens to them in a society where everybody is running around demanding your passports all the time? Do they get admission to places where nonvaccinated people are excluded, because they can’t get a vaccine, or are they treated like somebody who has just decided not to get vaccinated?
So, those are difficult policy issues and difficult technological issues. And it is possible to have a system that is done well, that perhaps increases the security and decreases the ability to fake vaccine certificates, that is equitable and that does protect privacy, decentralized. And that’s the kind of system that if we are going to have something here, it would have to be that. But, unfortunately, we don’t have a lot of confidence that that’s what’s going to emerge.
One reason is that there are a number of entities out there that are pushing this, big entities with far reach, companies like IBM, MasterCard, the airlines. There are also some nonprofit entities that are pushing the sort of more decentralized, privacy-protecting schemes. And I think that one of the outcomes here is that we end up with a lot of different systems, and we all have to put five different apps on our phones. And so, I think that when the White House originally got involved in this, I think that’s what they were trying to avoid, that there be one standard here. And so, you know, I think that that’s where we stand.
NERMEEN SHAIKH: Jay, could you talk about — some people have drawn a comparison between what’s being proposed now by way of a vaccination certification and the World Health Organization’s Yellow Card, that provides international proof of yellow fever vaccination. Now, of course, that’s a card; it’s not digital. Would something like that be safer and more easy to access for more people?
JAY STANLEY: Yeah. I mean, I think that whatever solution is settled upon, if there is a unifying solution, which may not be the case, it has to be simple and paper. There can be secure paper systems that have, for example, QR codes, that use cryptography to prevent forgery, or maybe — you know, maybe just the regular CDC cards that we already have is good enough.
I mean, is there actually a big problem of forgeries? Is it such a large problem that we need to construct an entire infrastructure requiring individuals to engage in mass adoption, requiring those who give vaccines to adopt software that’s standardized, requiring verifying parties, anybody who wants to check a vaccine, to get the proper software that interfaces into it? By the time anybody is able to create such a system, we may, hopefully — hopefully, we will be at a point of herd immunity, and a lot of this is just going to go away. You’re not going to be asked for your vaccination left and right. And hopefully that will never happen. But there can be — we can just rely on the paper that we have now, which is the CDC card you get when you’re vaccinated.
We could rely on a more secure paper version. And that involves what’s called public-key cryptography. So, when you get your vaccine, the vaccination place would digitally sign, using a private key, an electronic token, that would either be put in your phone and could be put in the form of a printed QR code, and they digitally sign that with their private, secret digital signature, and then they publish their public key. So it’s a private key and a public key that are a matched pair. And that QR code or phone token can only be read with a public key that was created with that private key. So, if I check your vaccine and you give me the QR code, I look at the public key of the person who gave you the vaccine, and if it decrypts your code, then I know that you got your vaccine from an authorized vaccine provider and didn’t get this printed out by your uncle in his garage, and I know that it hasn’t been altered. And so, that’s a more secure version that would not have the disadvantages of a purely electronic system.
AMY GOODMAN: We have five seconds.
JAY STANLEY: But even that may be — OK, sorry.
AMY GOODMAN: Well, just to say clearly, we need to discuss this further, and there’s a large debate brewing in this country and around the world. Jay Stanley, senior policy analyst for the ACLU. We’ll link to your piece, “There’s a Lot That Can Go Wrong With 'Vaccine Passports.'”
And that does it for our show. Democracy Now! is currently accepting applications for a senior news producer to join our team here in New York City. Learn more at democracynow.org. I’m Amy Goodman, with Nermeen Shaikh. Stay safe.