Infection barriers: the emerging ecosystem of COVID passports
As ever more governments introduce COVID passports, experts from the private sector and three national civil services explored the issues at a GGF webinar – debating both their potential to restore international travel, and the challenges around citizens’ privacy, governments’ capabilities, and global fragmentation. Elaine Knutt reports
For some, vaccination passports – by supporting the free flow of people across both national borders and the thresholds we encounter in day-to-day life – represent a way to safely liberate individuals from quarantine and lockdown, restoring individual freedoms.
There is, however, another school of thought, under which vaccination passports or certification schemes are viewed as coercive or restrictive, creating a two-tier society under which unvaccinated people are denied access to some services and find it harder to travel.
Aware that using vaccination passports as leverage to encourage people to get jabbed could well backfire – invigorating the anti-vaccine movement – many political leaders have avoided creating official schemes. Yet transport providers and hospitality businesses want to know that their customers are safe from infection, leading to keen interest in the topic. “I’ve seen, in the UK certainly, more COVID passport solutions floating around than the number of hot dinners I’ve had; every technologist, every company has come up with some sort of solution,” said Sandy Porter, co-founder and executive director of Avoco Secure, a specialist in cloud identity, security and privacy.
Speaking in May at a Global Government Forum webinar on vaccination passports, Porter and his fellow panellists were well aware of the tensions around the topic – including those between re-opening civil society and preserving equity for those as yet unable to access vaccines; and the need to protect people’s personal and medical data, while giving border staff confidence about individuals’ vaccination, antibody or test status.
But of the five experts on technology, ethics and digital citizenship grappling with these issues, three – from Estonia, Sweden and Singapore – had already implemented their own vaccination passports. Of the other two, the UK offers a vaccination certificate app via its National Health Service, and Germany is one of seven EU states in the “soft launch” of the EU’s Green Pass Certificate. Last week, the EU set out its plans to restore easy travel across the bloc, using digital certificates with information on the bearer’s vaccination, test or antibody status.
As the growing popularity of vaccination certificates demonstrates, perhaps the simplest arguments are the most compelling. In the words of Annett Numa, digital strategy adviser at the e-Estonia Briefing Centre: “I do still think in a very positive way that [vaccine certification schemes] helps us to not to spread the virus.”
The digital ID haves, and the have-nots
For countries with a high degree of digitised service delivery, or systems that allow citizens to interact with public agencies or private companies using ID data held in an app, there have been few technical obstacles to devising a digital vaccine passport.
Singapore’s HealthCerts, for example, are integrated with the country’s SingPass digital identity app: certificates are distributed via registered vaccination clinics, then carried via Singpass or an alternative digital identity wallet; the system can then generate a QR code to be scanned and verified at borders.
Steven Koh, director at Singapore’s Government Digital Service, explained that the system uses open-source document attestation and verification, based on blockchain encryption. Singapore has already deployed similar technologies to verify exam qualifications and trade documents.
Estonia, which benefits from a high degree of digitalisation in public services such as health, tax and justice, launched its VaccineGuard System in April 2021. The digital document is automatically loaded onto devices after an individual receives their second vaccine dose; as in Singapore’s system, it relies on generating a QR code to create a single-use certificate that can be presented and scanned.
“Confidentiality, availability and integrity is 100% always in place, whatever service we are talking about. Our citizens were able to get access to their vaccination passport thanks to the implemented ID cards, or mobile ID or smart ID solutions, where they could identify themselves securely, and we [the government] can be assured that this person was behind the access as well,” Numa explained.
But Sweden, dealing with a decentralised healthcare system, faced bigger challenges. Mats Snall, chief digital officer at Sweden’s Digital Development Agency for Digital Government, noted that “health care and e-health care is quite fragmented when it comes to the technical infrastructure, and it relies very much on every county’s or every region’s solution. I think this is also a picture in many states of the world, so it’s a challenge to come up with standards.”
Snall suggested that the standardised approach offered by the EU’s Green Pass Scheme could help national governments to build their own systems, calling on others to leverage the EU’s work. “The good thing with the EU standard now is that we have a lot of member states that can use this,” he said. “And of course, it will be possible for any nation or any other sort of global constellation to take part”.
A freedom for some, a constraint for others
While passport systems can be straightforward to build, they also need to be acceptable within their cultural and political environment – and that can be a harder nut to crack. Dr Steffen Augsberg, a professor of public law and member of the German Ethics Council, addressed some common counter-arguments, including the frequent charge that internal passports erode privacy rights.
“I would say the opposite: that monitoring ensures freedom,” he argued. “Scientific scrutiny should be a mandatory requirement in order to ensure that the fight [against] the pandemic is not compromised. Privacy is not an absolute right: data protection laws do challenge vaccination passport, but do not render them impossible.”
Augsberg also challenged the idea that vaccination passports create divisions and discrimination between vaccinated and unvaccinated groups, or the technological haves and have-nots. Calling this the “slippery slope” argument, he said: “It has been used and misused over and over again. It also shows a distinct lack of both understanding of, and trust in, the legal system.
“We are constitutionally obligated to ensure personal liberties; we’re also forbidden to discriminate against individuals or specific groups. However, differentiation does not automatically mean discrimination, just as formal equal treatment doesn’t imply equity.” Nonetheless, Augsberg did acknowledge the issues around data privacy in vaccination passports – a point picked up by Avoco’s Porter, who said: “There’s a lot of privacy issues globally. If we create a network, and everyone’s connecting, I think there’d be huge resistance.”
Instead, Porter advocated solutions that slipstream behind existing digital infrastructure, such as adding functionality to Google Pay or Apple Pay to demonstrate COVID status when buying travel or entertainment tickets. “It’s really low friction; we have to think about the average user,” he said.
Another solution for vaccinated people buying travel or entertainment tickets, he suggested, is to “piggyback” on the existing banking system: adding a COVID test or vaccination status to banks’ verification processes could provide an intuitive and accessible route to a vaccine passport system. “To link that and bring it together would be a revolution both for domestic venues and international airline ticketing, making it really, really simple,” he suggested.
Protecting privacy
Generally, however, the panel were confident that systems can protect data security and privacy: Estonia’s Numa, for example, stressed that VaccineGuard has no centralised intelligence-gathering – just bilateral information exchanges. “The different institutions… would just request this information and it would confirm that I had been vaccinated. But none of my personal information would be shared with anyone else,” she explained.
Snall also emphasised the data security built into Sweden’s system. “We issue the certificate to the person and it goes to their device or whatever storage they choose, maybe a digital mailbox. The certificate is quite safe, it goes with a cryptographic code and a system of public and private [digital verification] keys,” he said. Verifying time-sensitive COVID tests is harder, he added – but also possible, using a digital notarising system.
In Singapore, said Koh, the system uses blockchain encryption to prevent anyone from “tampering” with the certificate. Certificates can only be issued by authorized, registered clinics, and fraudsters cannot pass off someone else’s certificate as their own – “spoofing” the system – by using a digital identity wallet.
Ensuring equity
The panel agreed that systems should accommodate people who can’t have vaccinations for health reasons, including children and pregnant women, by offering a route to participation via up-to-date test results. “If someone cannot have the vaccine, it’s possible to have the COVID Test results for a certificate,” said Sweden’s Snall.
Porter agreed that tests should be a viable substitute for vaccination. “I do think inclusion is important. If somebody can’t have the vaccine, then, as part of a caring society, we take a risk and we look after them, whether we use tests or otherwise.”
The panellists also highlighted the risk that introducing passports might leave some countries out in the cold: those unwilling or unable to provide border staff with the right technology and systems might not benefit from the gradual restoration of international travel. “We’ve already seen airline travel virtually comes to a standstill, and the same could happen to countries that won’t play ball,” said Porter. “The European Union is a very powerful bloc, you potentially get Asia Pacific or others as powerful blocs”; so those countries not accepting their COVID passports may see tourists and business travellers heading elsewhere.
A fragmented landscape
So many individual countries are introducing their own COVID passports, while some global bodies – including air travel association IATA as well as the EU – are creating international systems. It seems likely that countries eager to restore travel will have to equip their borders staff with the equipment to accept any and all of these systems; certainly, the panelists saw little chance of a truly global system emerging.
Countries’ control of COVID infection rates is very uneven, noted Koh, while there is a continued risk of transmission even among the vaccinated, and no contact tracing system is fully reliable. “With all these [factors], we are not very optimistic that we’re going to have international system for safe travel at least over the next one year. Probably on a smaller scale, on a bilateral agreement, but not really in an international level,” he said.
Even as citizens show increasing acceptance of the concept of COVID passports, and countries implement secure, interoperable systems, a fully interoperable global system remains a distant prospect. The future – at least over the next year or two – is probably a fragmented one of disparate, incompatible passport systems operated by a range of governments, multinational bodies and international organisations.
In this – as in so many aspects of the world’s response to the pandemic – it’s easy to see a lack of global coordination and leadership. But these systems are at least being implemented, holding out the prospect of a return to safe, relatively easy international travel for those able to access them. After nearly 18 months of tight travel restrictions, that will come as a big relief to benefiting governments, businesses and citizens. And as some countries’ citizens begin to enjoy their restored travel opportunities, those governments that have been slow to provide COVID passport services may soon find their citizens demanding the same freedoms.
About Elaine Knutt
Related Posts
