ER 5: On Vaccine Passports

And also why I hate the term "vaccine passports."

Welcome back to the Ethical Reckoner. Today, we’re talking about what’s on everyone’s minds: getting life back to normal. One aspect of this under heavy discussion is the idea of “vaccine passports.” A “vaccine passport” would certify that an individual has been vaccinated against COVID-19 and allow them more freedom (to see family, attend work, travel, etc.) while others remain under restrictions. As more and more governments and corporations begin probing development, they’re almost certainly coming, and you probably want one. But what will they look like, and what will they do? And, as always, are they ethical? 

First, the term “vaccine passports” is dumb and we’re not going to use it. It implies that they’re only for international travel, when in reality they’re being proposed for a variety of domestic liberties as well. Also, it obscures the technological nature of how they’re being implemented, making it seem that they’re the same as existing paper travel vaccination certificates, like the yellow fever vaccination certificates required for travel to many countries. I’ll discuss both of these more in-depth later. For now, let’s lay out what we mean when we talk about “digital vaccine certifications.” 

We’re going to talk about digital certificates that show that an individual has been vaccinated against COVID-19 and are used to grant users liberties restricted for the general public. These could take several forms depending on who’s creating them; Israel is implementing a virtual “green pass” to allow vaccinated individuals to go to concerts and gyms, while IBM is working on a “Digital Health Pass” to “provide organisations with a smart way to bring people back to a physical location.” We’re also talking specifically about digital incarnations because of the privacy issues they raise, although the questions about health and inequality apply to paper certifications as well. Finally, we’re not talking about “immunity certificates,” which certify that an individual has been vaccinated or has antibodies from previous infection. Immunity certificates have been largely dismissed by public health officials because the level and duration of immunity conferred by post-infection antibodies is uncertain. So, if digital vaccine certifications are used, they most likely will only be given only to people who have been vaccinated. Because of this, many problems with vaccine certifications are tied up with issues of vaccine distribution.

---

Let’s start by talking about some of the health questions. I’m not a public health expert, but one of the major issues experts are concerned about is that people who have been vaccinated can still spread the virus, in which case letting vaccinated individuals have greater liberties could pose a public health risk. Right now, signs point to vaccinated individuals being less likely to be infected and have lower viral loads if they are infected, redoing the risk of transmission. “Opening up” will always pose some level of risk, which must be balanced against the benefits to individual and national mental and economic well-being. (I’m also not an economist, but allowing people back into public spaces is crucial for reviving industries like hospitality, which in turn supports farmers, distributors, and other suppliers.) Right now, allowing vaccinated individuals more freedom of movement while still masking and social distancing seems like a lower-risk way to begin reopening—certainly less risky than declaring COVID to be over and everything to be “open 100%” (looking at you, Texas). 

---

With the assumption established that vaccination certifications will only be used if the balance of risk and reward is acceptable, we can dig into the meaty ethical issues. We’ll talk about two: inequality and privacy. 

There are two major conundrums when it comes to digital vaccination certifications and equality: that they will increase inequality within nations, and also that they will increase global inequality. Both of these reflect patterns of inequality in vaccine distribution as a whole.

One argument against vaccination certifications is that not everyone in a country will be able to get one at the same time, but the same is true of vaccines. Every country has its own vaccine distribution plan, most stratified by risk level and age. Because vaccine supply is limited, we are prioritising some groups over others. By one view of equality, the more “equal” thing to do would be to stockpile vaccines until we have enough for everyone, then vaccinate everyone all at once. Obviously, this would impose a huge amount of unnecessary suffering, so we accept some amount of discrimination for the common good. A similar argument can be made for vaccination certifications. Given the supplemental suffering—economic, mental, etc.—that is caused by not allowing people who pose an acceptably low level of risk to return to society, levelling-down equality (ensuring equality by reducing everything to the lowest common denominator) by keeping everyone locked down is doubly harmful. 

So, the temporary inequality of some having access to vaccination certifications and thus increased liberty before others may be acceptable. What would not be acceptable is allowing groups that are under-served to suffer longer than necessary because the state isn’t effective in getting them vaccines. Right now, vaccine distribution in America is hugely skewed; under-served neighbourhoods with more people of colour have received far fewer vaccinations than wealthier whiter areas, which is partly attributable to bias in booking systems and skepticism of the medical establishment due to historical and present abuses. This isn’t just an American problem. In the UK, about 3% of the population is Black, but only 1.8% of doses have gone to Black people. This kind of racial and socioeconomic distribution inequality is unacceptable and risks worsening existing socioeconomic stratification if certain groups are kept locked down longer than others. Also unacceptable is allowing people who are genuinely unable to get the vaccine for serious medical reasons to be left in the cold; reasonable and safe accommodations must be made in any vaccine certification system to ensure they are able to return to society. 

Vaccine certifications could also exacerbate global inequality. As with domestic inequality, this is an issue with the underlying vaccine distribution system. Wealthier and whiter nations have snapped up vaccine doses, resulting in 75% of all doses so far being administered in just 10 countries. If these trends continue, wealthier nations will be restarting their economies first, increasing the global economic gap. Or, if countries instead desperately try to reopen without vaccines, they’ll see more spread and fatalities. Vaccination certifications will likely be used by people from wealthier nations to travel, which could provide much-needed tourism income but also puts (often lower-income) destination countries at risk. Vaccination certifications are often compared to yellow fever vaccine certificates. Yellow fever certificates are aimed at protecting both the destination country and the traveller—though for travellers from countries without yellow fever, it’s exclusively the latter—and COVID vaccine certifications do the same. However, even though vaccinated travellers pose less of a transmission risk, they will likely still pose some risk, and it’s unfair to de facto require lower-income countries to accept travellers with digital vaccine certificates while their own population is unable to access the vaccine.* This isn’t a case of “hang tight and wait your turn” like we have domestically. At the current global vaccination rate, Bloomberg estimates it will take nearly 4 years till 75% of the world is covered. Will vaccination rates increase? Hopefully. But vaccination has barely begun in much of South America and Eastern Europe, and most of Africa hasn’t yet been able to begin their vaccination campaigns. Furthermore, there may be broader infrastructure problems that have to be solved before every country can achieve adequate coverage. 

So, this is not a temporary inequality that we can accept as part and parcel of pandemic recovery. We cannot support vaccine certifications without also supporting increased vaccine access for lower-income countries. The Covax vaccine pooling and distribution program has potential, but needs more money to ensure that enough doses will be secured. Public health leaders in Africa are aiming to have 60% of the continent vaccinated by 2022, but some estimates say that mass coverage won’t be achievable until 2024. In the meantime, even though Canada has made independent deals to secure 10 doses per person, it’s also drawing on Covax supplies—which, even though it’s technically entitled to do so, is extremely skeevy; the rest of the G7, Australia, and Israel all elected not to take Covax vaccines. As we in the West are able to flash our vaccination certifications and dine out, go to the gym, and travel without fear, we cannot forget that billions of people are not being afforded the same privileges because their countries are not being given sufficient access to the vaccine. 

---

Ethical issue #2 is privacy, and this is where the digital aspect really becomes important (and distinct from travel vaccine certifications). With a digital COVID vaccine certification, you have to link a person’s identity to whether or not they’ve had the vaccine. This may sound insultingly obvious, but it’s a bigger deal than it seems. All of a sudden, we’re creating a digital infrastructure that grants entities access to private medical information, which carries huge privacy implications. These entities could be state-run, or they could be private corporations. 

Government-run digital vaccine certifications are less of a risk to user data than privately-run ones, at least in GDPR-land, but measures will still have to be taken to protect user data, ensure that the scope of the collection is limited and constrained to the current crisis, and make sure that the system deserves public trust. As with any privacy-sensitive system, adequate security measures must be taken to prevent data breaches, but the bigger concern is not that data will be illegally abused; it’s that it will be legally exploited.

Privately-run digital vaccination certifications pose a much bigger risk to user data. Even in GDPR-land, private companies have managed to do sketchy things like send user data to the US even though its data protection standards aren’t as high, and in reality, privacy laws and privacy-preserving design don’t do as much as we’d like to think they do. Quoth the Ada Lovelace Institute’s digital vaccine certification expert panel: “Even with the most privacy-preserving technology, the expectation is that health data will be viewed by different actors, from healthcare settings, employers, clients, police and pubs to insurance companies, who may have different levels of experience and trustworthiness in handling personal data.” We have to assume that once we hand over our health data to private entities, we lose control over what it gets used for. I don’t mean to get too dystopian, but Big Tech is very, very good at getting access to our data, and even better at getting us to hand it over.** Maybe it starts with access to planes for the vaccinated; maybe next, Facebook asks for information about our vision and hearing to automatically adjust text size and video volumes. As we’ve discussed before, Big Tech uses your data to deliver content and ads. What if an employer only wants their ads delivered to people with 20/20 vision? Or, what if the government decides to (legally) compel companies to turn over health data they’ve collected with the justification of protecting public health? This process won’t be as explicit as in, say, China, where user information and “contagion risk” is shared directly with the police (via a subtly-named function “reportInfoAndLocationToPolice) by Alipay, a hugely popular payments app that’s also functioning as a digital health certification. We can follow privacy laws and still be surveilling individual health statuses in a way that raises serious concerns for privacy and individual liberty.

Also, initiatives led by private and public actors could be problematic if they lead to digital identity systems. India is developing a digital identity system called Aadhaar; it’s a unique 12-digit number assigned to citizens and linked to their biometric data. In theory, it’s great in that it is a lightweight identifier for people who may not have access to other forms of ID. However, despite Supreme Court rulings that the government cannot deny services to citizens without Aadhaar, it has become mandatory for many services—including accessing free COVID vaccines. While it may be convenient for residents to have their vaccination status automatically linked to their identity, it’s also creating a system where the government has access to personal health information and citizens have no choice in how the government accesses or uses it. When Aadhaar became necessary for HIV treatment, patients stopped treatment for fear that their health status would be disclosed to relatives. Given how vehemently opposed much of the West is to national identification systems,*** a government-run biometric identification system is unlikely, but a privately-run one is not out of the realm of possibility. 

Presently, the International Air Transport Association is planning the “IATA Travel Pass,” a digital vaccination certificate aimed at air travel, and several airlines have signed up to trial it. The app would allow travellers to upload pictures of their vaccination documents, which would then be verified. What concerns me is what IATA Senior Vice President Nick Careen said: that “eventually, travellers should be able to scan their face and thumb at the airport to move freely across borders.” Soon, your biometric data might be linked to your health data in the database of a private entity with potentially questionable data protection policies—and it’s not just for travel. CLEAR, the airport security biometric screening service,**** is expanding to sports arenas and other purchasing situations while also creating a “Health Pass” for COVID vaccination verification and more. It’s trying to “be the company that verifies your identity every time you would have swiped a credit card, shown your ID at a door, or handed over a health insurance card”—and CLEAR actively shares its data for marketing. That Facebook marketing example doesn’t seem so far off now, does it? By voluntarily giving Clear your health data, you’d be sharing it with any entity with whom you make a purchase or show an ID, creating a whole new layer of personal data to be leveraged in the endless churn of consumer data exploitation. 

---

Clearly, we need to be extremely careful if/when we roll out digital vaccination certifications. In terms of ethical issues, the best-case scenario is that they are government-led and time-limited as a crisis measure, then shut down when no longer necessary. More likely is that private actors play a significant role and we begin to see increased health status surveillance; as a participant in the Ada Lovelace panel said, “Once a road is built, good luck not using it.” Worst-case, and entirely possible if we keep freely providing our biometrics and health information to private corporations, is that digital vaccination certifications usher in a new mandatory or pseudo-mandatory private digital identification system. 

However, what seems very likely and is unacceptable is that these systems will be developed by and for the West, leaving other countries—especially in the Global South—behind. These issues are grounded in inequalities in the vaccine distribution system, but are magnified when it comes to using vaccination certifications to re-start the global economy. Thus far, there’s been a good amount of international collaboration on vaccination certifications, especially when it comes to travel; let’s use those dialogue platforms to ensure that access to vaccines—and thus “vaccine passports”—is fair and equitable. We must listen to the scientists when it comes to the health issues, yes. But we must also listen to the ethicists, and ensure that digital vaccination certifications aren’t a passport to increased global inequality. 

---

*Thanks to my brilliant friend Tania Calle for bringing up this point.

**For example, if you have an iPhone, you’re probably giving Apple (and maybe your employer or insurance company, if they offer health insurance discounts for achieving fitness goals) your step counts and other health information. On the scarier side of technically voluntary providing of health information, Amazon has patented Alexa voice recognition technology that would detect “abnormal” physical and emotional conditions, and then sell you meds accordingly. 

***The Nordic countries are notable exceptions; Finland, Sweden, Denmark, Norway, and Iceland all have some form of digital national identification system in place.

****For $179 a year, you give CLEAR your biometric data and get expedited security screening at airports.

Thumbnail generated by DALL-E 2 with the prompt “An abstract interpretation of the concept of privilege and power, dreamy watercolor”. It’s maybe a bit much, but it’s cool.

---

Thanks for reading.

Emmie is an MSc student at the Oxford Internet Institute. Check out the archive of past Ethical Reckoner issues here. If you haven’t already, click the big “subscribe” button to get the Ethical Reckoner biweekly, and spam all your friends with the “share” button.

Any suggestions or comments? Let me know on Twitter @EmmieHine.