But what shocked me even more was the wide coverage for the top comment from Jeff Livesay, who is the CEO at Execution LLC. Here’s what Jeff wrote (and gave me permission to share):
“I think there are a lot of very extreme overreactions to the idea of vaccine passports. Presently, our lives are filled with passports. If you don’t want to travel internationally, you don’t need a travel passport. If you don’t mind waiting in longer airport security lines, you don’t need a TSA fast-pass. If you don’t mind waiting in longer lines at Disney World, don’t buy the Fast Pass. If you don’t mind waiting longer for a U.S. patent, don’t buy the 'Fast Track' pass. It is the same for COVID passes. They don’t have to be mandatory, but they can speed things up for people who choose to use them. Israel has already successfully deployed its 'Green Pass' (although they failed to consult security experts and it may have security flaws). New York is deploying its Excelsior Pass. It’s just an app, folks, on your phone, that has a QR code saying, “Yes, Jeff has been vaccinated.” I’ve been using QR codes from Fandango to get into movies for years, so I don’t have to stand in the ticket line and so I have reserved seats. And I’ve been using QR codes for airline boarding passes since they were first introduced. If you don’t use these, that’s fine, you can be old school. It’s a free country.”
Why did this comment (with over 230 likes and 140 replies) surprise me? Mr. Livesay wrote that comment in response to an article from New Express News that I'd posted several weeks earlier, entitled “Vaccine Passports, Covid’s Next Political Flash Point.”
You can check out the heated LinkedIn exchanges and hot debate on this topic here. Nevertheless, the arguments for and against vaccine passports, and how to implement them fairly and securely, do not always follow the typical left-right divide.
Definitions Please
But first, backing up a bit, what is a “vaccine passport”?
The concept, which has evolved in several expected and unexpected ways over the past year, comes from the important challenge of finding an easy-to-use system for verifying vaccine status for every person worldwide.
While most local health departments have databases on individuals that track all types of vaccine status information, a person’s ability to prove that they were vaccinated often relies on white paper cards given to people when the vaccines are administered.
Complicating matters further, these cards rarely have pictures or other information on the card holder, beyond the name of the person and the date the vaccine was given. The potential for fraud, misuse of paperwork, lost and stolen cards, different formats, and several other problems make just showing your vaccine card unworkable as a travel document and/or proof of vaccine status for the wide list of uses during the COVID-19 emergency.
Adding to the challenge, the global pandemic has shut down international travel and even some domestic travel in many countries, and as vaccines are administered, the travel industry is looking for ways to open up more travel safely.
The Wall Street Journal writes it this way:
“The world’s airlines are betting on vaccinations to restart international travel.
“Two of Europe’s biggest airlines, British Airways and budget carrier Ryanair Holdings PLC, have started allowing fliers to provide COVID-19 vaccination and test-result details alongside personal data, like passport numbers and visa information, during bookings. The airlines say the move will eventually help passengers show they have been inoculated when landing at destinations that have started to welcome vaccinated travelers.
Across the U.S., domestic travel is picking up amid stabilizing or falling COVID-19 cases and a relatively quick vaccination drive. That rebound isn’t yet happening with international traffic, where a patchwork of travel bans, quarantine rules and testing requirements have stymied cross-border flights.”
Tough Questions
While almost everyone shares the common goal of opening up travel and the hospitality industries securely, there is a wide debate on how best to do this.
First, who would need a vaccine passport? There are huge debates raging over this now. This question, not surprisingly, crosses over into the delicate topics of who can even get a vaccine right now and what about those who never intend to get the vaccine for a myriad reasons.
Second, why do they need this passport? Is it just for international travel?
In Israel, the concept goes far beyond travel. This article in The Guardian explains more about Israel's new Green Pass system:
“As the UK and other governments consider whether to give COVID-vaccinated people certificates that allow entry to bars, hotels and swimming pools, one country, Israel, has already deployed its ‘green pass.’
“The state of 9 million, which has administered jabs to half its population, released an app a week ago that shows whether people have been fully inoculated against the coronavirus or if they have presumed immunity after contracting the disease.
“Malls and museums have reopened for all, but green pass holders get exclusive access to gyms, hotels, theatres and concerts, albeit with some limits. Indoor dining in restaurants and bars is due to be included in the green pass scheme next week.”
While the when and where questions will certainly evolve over the next six months, the rules are being argued, and in some cases implemented, now. No one wants anyone penalized who can’t even get the vaccine today because they are humbly waiting their turn. But will that sentiment change when vaccines are more widely available to all who want them? Will the public perception of those who do not have a vaccine passport change? Could there be some form of unfair discrimination for those with special needs?
How Can We Get a Vaccination Credential Standard Implemented?
While the questions about “who, what, when and where” are certainly the most controversial, and will be debated for months (and perhaps years) to come, the “how” answers are at the top of the agenda right now for technology and security pros.
Some central questions include: How complex will this be? Can one standard be agreed on that will work worldwide?
This WSJ article claims that coming “vaccine passports” aim for simplicity:
“Designers of the health passes hope unfussy apps will reduce stress for passengers pre-flight, quickly providing proof of a negative COVID-19 test or a vaccination.
“‘We’ve really been focusing on simplicity from Day One,’ said Alan Murray Hayden, head of airport, passenger and security products at IATA, which counts American Airlines and Emirates among its members. ‘So much so, that when I demoed Travel Pass to our senior management, I was terrified they were going to be like, ‘We’ve given you all this money and you’ve only got five or six app screens to show for it’.’
“Requirements to prove a vaccinated status or a negative COVID-19 test to enter countries including the Seychelles and Cyprus can lead to longer lines and delays, as airport staff manually verify passengers’ health paperwork. Digital health passes won’t be mandatory for airline passengers, Mr. Murray Hayden said, but their gradual uptake will provide a sort of 'herd immunity for queuing' at the airport.”
Other big questions revolve around identity proofing, standards, vendors involved (and profiting from the work), privacy implications and security controls.
One set of answers is coming from the Vaccination Credential Initiative. The website describes the initiative this way: “The Vaccination Credential Initiative (VCI) brings together healthcare organizations, technology firms, nonprofits, academia and startups working to empower consumers to conveniently access, store, and share digital COVID-19 vaccination records.”
There is support for this effort from many companies, and Walmart just joined the group. Here’s an excerpt from the New York Times article on this topic:
“People who get COVID-19 shots at thousands of Walmart and Sam’s Club stores may soon be able to verify their vaccination status at airports, schools and other locations using a health passport app on their smartphones.
“The retail giant said on Wednesday that it had signed on to an international effort to provide standardized digital vaccination credentials to people. The company joins a push already backed by major health centers and tech companies including Microsoft, Oracle, Salesforce, Cerner, Epic Systems, the Mitre Corporation and the Mayo Clinic.”
Pros and Cons of Vaccine Passports
This video lists some of the pros and cons of vaccine passports and asks if they can work well.
Some cybersecurity experts are very concerned: “Medical record access is a major concern with any healthcare app; if it's hacked, then suddenly criminals can access nearly everything about you, from your place of birth to your blood type. And it isn't limited to cyber attacks: the [U.K.] NHS app needs access to your medical records to show vaccine information, and if used as a passport must, by definition, be handed over at a border.”
Final Thoughts
This topic of vaccine passports is sure to be a hot issue for the year ahead for a wide variety of reasons. The technical challenges and privacy implications are immense, but one of the biggest issues is trust. Some believe that this platform will be used for much more than a one-time COVID-19 vaccine record and fear that, once established, the apps and platform could be expanded and become “Big Brother” for a range of future issues.
Still, these vaccine passports are likely coming, at least for those who want to travel overseas, so we must get ready and ensure that the proper security and privacy protections are in place.
One thing is for sure: I will be revisiting this topic before 2022 security predictions are released.
