MANY COUNTRIES did not require passports before the first world war. But as the conflict spread, states scrambled to introduce travel documents to help secure their borders. The result, after the armistice, was a bewildering smorgasbord of different information for different nationalities that could create chaos rather than clarity at border crossings. But returning to a world where people could travel freely across borders was by then unimaginable.
In 1920 the League of Nations stepped in. It designed a 32-page booklet with the country’s name on the cover and such basic personal information as place and date of birth. Some governments grumbled—France thought the booklet too expensive to print compared with its single sheet—and it took a few years for them to adapt. But today all passports follow the same format. Whether at Heathrow in Britain or Moshoeshoe I International in Lesotho, officials can glance at a passport and be fairly certain of its bearer’s travel privileges.
During the co-19 pandemic, a similar process is under way. States have rushed to create vaccine passports to stop the virus at the border—or at the doors to the restaurant or gym. Often people must prove that they have been vaccinated, recently tested negative, or had co and recovered.
This time governments are not alone. Tech has thrown open the doors to firms like IBM and Microsoft, industry associations like the International Air Transport Association and non-governmental organisations like the World Economic Forum. Three undergraduates at the University of Applied Sciences Upper Austria spent last summer pulling all-nighters to build a pass that works across the European Union. They can’t afford much marketing, but the app, the GreenPass, has been downloaded 100,000 times.
As during the Great War, urgency has trumped co-ordination. India, which has administered over a billion jabs, has a “CoWIN” certificate with a QR code, identifying information and, confusingly, a photograph not of the bearer but of Prime Minister Narendra Modi. People in England can choose between a QR code on the National Health Service (NHS) app or website or a letter of certification from their doctor. In America, where President Joe Biden has vowed not to create a national vaccination database, many different state and private health passes are in use.
The trouble is that these passes are not interoperable. Most look the same: a QR code on a smartphone or piece of paper. Yet even scanning the codes can be a problem: different verifier apps read different passes. Once scanned, the codes serve up widely varying information, depending on the national or local health systems or attitudes about privacy. Some vaccine passports, like the CommonPass used in parts of America, share raw data on vaccination status. Others, like the one issued by the NHS, yield only a symbol, a tick or a cross. And the rules of the game are not fixed. During a surge of infections this month, Israel retracted its “green pass” from 2m people who had not yet received booster jabs.
The administrative, commercial and even psychological burdens are obvious at airports. Traveller numbers have dropped between 85% and 90%, yet reaching the gate has become a more demanding obstacle course than ever. Queues lengthen as anxious travellers fumble for slips of paper and QR codes. Officials struggle to keep track of which vaccines state regulators have approved and how long which test results are valid for which destinations. As Corneel Koster, chief customer and operating officer at Virgin Atlantic, an airline, puts it: “It’s kind of a jungle out there.”
It is past time for standardisation. Yet designing a digital health pass is trickier than designing a travel document. Passports may reveal age, but vaccine passes are gateways to personal health information, potentially a great deal of it. That scares people. Even in the rich world, where most people have been jabbed, support for vaccine passports varies from 65% in Britain to 43% in Japan and 41% in Germany (see chart). In India people are used to sharing their fingerprints and iris scans as part of the Aadhaar biometric ID system. Yet many, like Debjani Mazumder, a publishing executive in Delhi, worry about pharmaceutical companies and insurers getting hold of their health records. “I feel like a guinea pig,” Ms Mazumder says.
In theory, digital technology should make it easy to verify vaccination status. Yet because verifying apps cannot recognise all QR codes, many verifiers take what Edgar Whitley at the London School of Economics calls a “flash-and-go” approach, simply eyeballing them. A black market is raging. Oded Vanunu at Check Point Software Technologies, a cyber-security company, has posed as a buyer and sourced fake French vaccine certificates for €75 ($87), Russian ones for 9,500 roubles ($134) and Singaporean alternatives for €250 on the dark web and Telegram, a messaging app. These sham passes look the part but would fall short if properly scanned.
When airline agents, employers and bar staff scan QR codes, they check for two things: confirmation that the bearer has been vaccinated or tested for co and a digital signature proving the information comes from a trusted issuer. Uniformity across digital health passes would require broad agreement on exactly what health information to include, and how to label and package it. That ought to be relatively easy. In August, the World Health Organisation (WHO) published guidance recommending the minimum data for a certificate. The name and date of birth of the bearer plus the brand and batch number of a jab are considered necessary. Identifying who administered a jab—information some passes include—is not.
What is trickier is creating a unified system for checking the digital signatures of health authorities. Creating a repository of all trusted signatures is an expensive and politically fraught task. Countries with a national health service, like Britain, have just one issuer. But in America, there are around 300, including state governments, hospitals and pharmacies.
Without a trusted way to verify certificates across borders, even the most advanced technology falters. George Connolly is chief executive of OneLedger, a firm that designed OnePass, a blockchain-based vaccine passport. He says it has access to data only from around 20 jurisdictions. So he gets contractors to check passes from elsewhere by phoning and e-mailing health authorities. Dakota Gruener, head of ID2020, a public-private partnership focused on digital IDs, rolls her eyes. “Do you need blockchain? No,” she says. “Is blockchain a distraction? Yes.”
Luddites have reason to feel smug. As Albert Fox Cahn of the Surveillance Technology Oversight Project, an advocacy group, puts it: “There is so much money being spent on building this really shiny new metal fence around our society when the wooden gate was working just fine.” Bits of paper signed by clinicians, like the WHO’s “yellow card”, have sufficed as immunisation records for decades. These are more globally inclusive, given many people in poor countries do not have smartphones. Judging by black-market prices, they are not much easier to forge. Fake versions of paper vaccine certificates issued by America’s Centres for Disease Control and Prevention go for $150 apiece on Telegram, more than some digital alternatives.
Over the borderlineThe biggest impediment to sensible vaccine passports is not technology but geopolitics. It would take a universally trusted organisation with sophistication in health, technology and diplomacy to get countries to agree on global standards. This might seem an obvious role for the WHO. But, embroiled in the rivalry between America and China, the organisation has been blasted from all sides for its handling of the pandemic. On digital passes, the WHO has got itself in a muddle. Even as it has published lengthy documents describing what vaccine passports should look like, it has insisted that proof of vaccination should not be required for international travel when vaccine distribution is so skewed to rich nations.
Crucially, the WHO has declined to involve itself in validation and verification. Maintaining a register of trusted signatories would require a large staff. It would also require politically charged choices, like whether to recognise signatures from Palestine or Afghanistan, and which vaccines are good enough. The WHO would also have to take some kind of action when a state broke the rules. Carmen Dolea, head of the International Health Regulations Secretariat at the WHO, says this task goes beyond its mandate. “There are liability issues,” she adds.
Still, clumsily, the world does seem to be converging on a handful of standards and technologies. The European Union’s standards for digital co certificates, for example, are also being used by Turkey and Switzerland. India’s have been picked up by Sri Lanka and the Philippines.
The next step, the WHO says, is for countries to negotiate bilateral or regional arrangements. Recent negotiations between Britain and India illustrate how messy this can be. Britain had refused to accept India’s CoWIN vaccine certificates, in part because they did not state the bearer’s precise date of birth. The government in New Delhi included only the year of birth because many poor Indians do not know their exact birthdays. A tit-for-tat escalation in travel restrictions kept families apart and business trips on hold for weeks, before an agreement was reached earlier this month. India added the precise date, reasoning that most people who can afford international travel know their birthdays.
Some wonks still think they can fix the problems of poor governance with more technology. Nandan Nilekani, co-founder of Infosys, a tech giant, and the driving force behind India’s Aadhaar system, is pinning his hopes on “adaptors” that convert one type of pass into another. Creating the right adaptors would be like finding a way to save shoppers from having to walk around with American Express cards, MasterCards and Visa cards in case shops require different kinds of payment. But technology that builds bridges between passes would not solve the problem that issuers would have to trust one another—and users would have to trust the adaptors fiddling with their health data.
Perhaps, from the ashes of the pandemic, the world will devise a seamless digital vaccine passport that will replace the yellow card. But when co is still killing thousands of people a week, the bickering over QR codes and digital signatures among multilateral organisations, tech groups and states is a sideshow, if not a distraction. Vaccine passports will never contain the virus. Only vaccines will. More than three-quarters of people in Denmark, Singapore and Qatar are fully vaccinated, according to Johns Hopkins University. Yet less than 1% of those in countries like Ethiopia and Uganda are. Someday, vaccine passports might help keep the peace. But right now the world needs to focus on winning the war.
