As the world looks to slowly emerge from the grip of the coronavirus disease 2019 (COVID-19) pandemic, and more than a year of associated border closures, travel restrictions, widespread shutdowns and other limitations on once-normal activities, the idea of a digital “vaccine passport” for COVID-19 is also gaining momentum. While proposals come in different varieties, sometimes called “vaccine passports,” “immunity certificates” or “green passes,” among other names, the underlying idea is the same — to provide a digital certificate or credential intended to prove something about an individual’s health status with respect to the pathogen responsible for COVID-19, such as whether the individual has been vaccinated against, tested negative for or recovered from the virus.
Each implementation requires a combination of health information, identity verification tools and a mechanism for presenting the certificate or credential, typically in the form of a digital wallet that can present a Quick Response (QR) code or another digital artifact. While we are quite focused on the health information and technology components, we should not lose sight of the third identity-related pillar. In fact, rather than thinking about vaccine passports as temporary, isolated, public health-related measures, we should view them as just one example of how the pandemic is accelerating the rollout of digital identity infrastructure and consider the broader implications for society, particularly as commercial and economic incentives predominate.
To date, the conversation around vaccine passports has largely focused on the trade-offs between their potential utility for reopening economic activities and the privacy and security risks they present to individuals. For example, when the European Union’s President Ursula von der Leyen initially announced the Digital Green Pass, she asserted that it would “respect data protection, security [and] privacy.” But this narrow lens ignores a wide array of other, potentially more worrying concerns, particularly with regard to the risks of driving further inequity, discrimination, exclusion and stigmatization. In addition to expressing serious concerns about the digital tools and technologies implicated in vaccine passport schemes, public health experts and ethicists have also raised critical issues of inequitable vaccine distribution and vaccine nationalism.
Rather than thinking about vaccine passports as temporary, isolated, public health-related measures, we should view them as just one example of how the pandemic is accelerating the rollout of digital identity infrastructure.
Evidence of the need for — or utility of — vaccine passports is unclear, particularly as compared to the many risks. For example, a group of public health experts convened by the Ada Lovelace Institute in the United Kingdom found that “there may be a comparatively narrow window where there is scientific confidence about the impact of vaccines on transmission and enough of a vaccinated population that it is worth segregating rights and freedoms. Once there is population-level herd immunity it will not make sense to differentiate, and passports would be unnecessary.” Despite additional warnings from public health experts about the insufficient scientific foundations or evidence for such vaccine passports and the serious concerns from civil society about the associated risks, there is tremendous pressure from economic and commercial interests. Proponents typically fall into three camps — travel industry stakeholders, economies heavily dependent on tourism, and the wider digital identity industry.
Long before vaccination schemes were even under way, airlines, such as Qantas and British Airways, and trade associations, such as the International Air Transport Association, announced their plans to implement digital vaccination passport schemes for international air travel. Similarly, the Airports Council International, which represents nearly 2,000 airports worldwide, became a member of the World Economic Forum’s Common Trust Network, which is promoting the CommonPass platform for digital health credentials with thin details about its technical architecture or implementation. In the United Kingdom, the government is also facing pressure from the Association of British Travel Agents, while President Joe Biden is facing mounting pressure to support vaccine passports from travel industry stakeholders in the United States, even as his administration had previously rejected the federal government’s involvement in such a scheme. Despite the pressures from industry, the World Health Organization (WHO) continues to caution against the passports’ use on the basis of significant practical and ethical considerations, although it has also opened a public solicitation for comments on a potential “Smart Vaccination Certificate.”
Likewise, the governments lobbying hardest for vaccine passports are, unsurprisingly, from countries that are highly dependent on travel and tourism. Efforts in Europe have been led by Greek Prime Minister Kyriakos Mitsotakis, who has been pushing for an EU-wide COVID-19 vaccination certificate and entering into various bilateral agreements with countries around the world. Similarly, the Thai government is exploring the use of vaccine passports in an attempt to revive tourism as the country faces one of the worst economic contractions since 1998. Israel has already introduced a “green pass” that effectively creates a two-tiered system, opening large swaths of the economy, including hotels, bars and restaurants, to those who can present “proof” of either vaccination or presumptive immunity after having recovered from COVID-19. Some law makers also appear to be motivated by the pressure to get ahead of industry. For example, in a February press conference, European Commission President von der Leyen said that the Commission needed to put forward a “European solution” for digital vaccination certificates before large American technology companies such as Apple and Google introduce them, despite no evidence that either company is working on such a solution.
Underlying all of these schemes is the question of digital identity, a complex and hard-to-define socio-technical concept. Technologists often reduce digital identity to a “set of claims made by one [digital] subject about itself or another subject” or “the unique representation of a subject engaged in an online transaction.” These definitions are misleading as non-digital subjects, i.e. real people, have a lot at stake with respect to digital identity, both online and off, as vaccine passports clearly demonstrate. Digital identity encompasses all of the systems and methods by which we identify ourselves through the use of digital tools in the context of specific interactions or transactions, which need not be digital — we might present an app or QR code when boarding a plane — but it is achieved at least partially through digital means. All vaccine passport schemes rely on digital identity systems that implicate sensitive personal data (i.e. health status), and often rely on advanced biometrics like facial recognition and highly experimental technologies such as blockchain or distributed ledger technology. Proponents wield the usual buzzwords of “speed,” “convenience,” “frictionless interactions” and, especially popular in light of the pandemic, “safety,” which is increasing the adoption of “touchless” or “contactless” digital payments and identity solutions (despite little scientific evidence of viral transmission through surfaces).
While digital identity is already a multi-billion-dollar industry projected to exceed US$30 billion by the year 2025, the pandemic is accelerating its growth more generally. Researchers predict that the number of digital identity apps in use will exceed 6.2 billion in 2025, a 520 percent increase from 2020, driven in large part by the pandemic hastening a shift toward digital services. The pandemic is also supercharging funding for digital identity ventures, which, despite previously struggling with adoption, are now raising money at record levels. Recent examples include an identity start-up raising US$100 million in a Series C round, based on a unicorn-status US$1.5 billion valuation; an artificial intelligence and machine learning-focused identity verification start-up raising $100 million in a Series D round, based on a US$1.3 billion valuation (growing its customer base by more than 85 percent in 2020); and another UK start-up raising US$100 million at an undisclosed valuation. In this context, it should come as no surprise that identity industry participants, large and small alike, are among the most active proponents of digital vaccination certification schemes.
While industry interests are driving much of the rollout of this digital identity infrastructure, little is known about the particulars of these solutions, because the pathway from vendor to end-user is typically a matter of obscure procurement processes — with limited consultation of the public or civil society along the way. As those in the digital identity industry know, creating secure, interoperable digital credentials at scale is exceedingly difficult (e.g., implementation of the Real ID Act in the US has been delayed multiple times since its passage more than 15 years ago). And even as privacy and data protection-by-design norms and standards are growing in popularity, most of these solutions are designed and implemented without due consideration for the fuller array of the individual and collective rights at stake in the broader context of these systems in practice, including in the case of vaccine passports. We also have limited accountability mechanisms for systems or solutions designed, developed and controlled by the private sector (with some industry participants proactively pushing for liability protections for their experimental technologies).
It is critical that we consider vaccine passports in this broader context of accelerating digital identity adoption, with the risk that digital identity infrastructure built and deployed in response to COVID-19 becomes permanent. To assuage to these concerns, some governments promise the solutions are temporary. For example, the European Commission has said, “The Digital Green Certificate system is a temporary measure [that] will be suspended once the World Health Organization (WHO) declares the end of the COVID-19 international health emergency.” But history tells us that the infrastructure and tools deployed as “temporary measures” are unlikely to disappear, especially when they are already being built as “extensible” solutions that will be applied in so many other contexts, including workplaces, schools, the hospitality sector, entertainment venues and more. As a result, rather than asking how a given digital vaccination passport scheme protects individual privacy and security, we must examine how the introduction of these schemes would shift power and normalize ubiquitous identification across many aspects of our lives.
As Harvard scholar Shoshana Zuboff outlined in her seminal work, The Age of Surveillance Capitalism, the terrorist attacks of September 11, 2001, thwarted any momentum for emerging online privacy efforts in the United States, instead ushering in an era of surveillance exceptionalism and contributing to the rise of surveillance capitalism. As the US government came to see the internet and large Silicon Valley companies as instrumental to the intelligence community’s mission, it pushed for sweeping and extraordinary measures that privileged security over privacy or any liberty, among them the USA PATRIOT Act, which dramatically increased the government’s ability to surveil and collect information. Twenty years after 9/11, the PATRIOT Act and other “temporary” measures remain in effect. If 9/11 ushered in an era of mass surveillance, the pandemic has the potential to introduce the “ID turn” or the age of ubiquitous identification and the end of anonymity. Such a shift would, in turn, threaten the notion of “public” life, which requires the ability to be one of many in the crowd. In this way, what may appear to be temporary public health-related measures could risk embedding permanent digital identity infrastructure without our full consideration of the consequences.
