The case for vaccine passports: the real world versus the digital world

The case for a real-world approach

As the political debate over vaccine passports heats up, commentators inevitably turn to the high tech world of the smart-phone for a solution. Recent history, however, tells us that journey is likely to be a painful one, littered with over-budget, poorly functional and easily hackable systems.

While 98% of the UK population aged 16-24 have a smartphone (source: finder.com), this falls to 53% for the over 65s (almost the inverse of the risk profile to Covid-19) and would disenfranchise more than 10 million people.

Yet we already have tried and trusted mechanisms for recording vaccination status. The International Certificate of Vaccination, or Prophylaxis, has safely protected the world against yellow fever, typhus and other nasties since the 1930s. It is internationally valid, linked to a passport and – being paper-based – has an excellent battery life.

So, do we need anything else to show at the pub? Having had my vaccination, I was presented with a sticker. This sticker is compatible with all mobile phones and now sits proudly on my smartphone cover – so, sorted.

Yet, I hear you cry: “Surely a sticker is no good – it can be copied and forged. Let’s have a cryptographic solution with a long, long key length.”

Well, if you like, but let’s look at the data that is being protected. That data is merely whether a particular person has been vaccinated, period. Not whether they are infected, or a carrier of the disease: vaccines don’t work like that. And the provenance of that data is poor. No-one presented a photo ID when they were vaccinated. They could have lied.

Yes, a sticker can be forged, as an app can be hacked. Protecting data with an expensive digital solution is to flatter the quality of that data and create a false sense of security. A sticker, on the other hand, seems about right.

The case for a digital approach

Digital development is fraught with difficulties. From a technical standpoint, look no further than the many contact-tracing apps that have been developed over the past year – some have been extremely successful, such as South Korea and Singapore, but others less so.

At a time when concerns around privacy and ethics are hotly debated, you may ask who would want to develop yet another digital solution at record speed, let alone a state-sponsored one?

Putting to one side the pertinent questions regarding whether vaccine passports should exist in the first place, I would give the development a go. Certificates and stickers can be lost, forged or sold online to the highest bidder, and are not strongly tied to any formal record. They are also antiquated – pulling out a certificate twice a year for a flight is very different from pulling one out twice a day to get a coffee.

A digital solution won’t be perfect – some people will inevitably fall through the gaps, and considerations must be in place to support these individuals. But consider the following model:

• A government builds a public, read-only application programming interface (API) that returns a binary response – vaccinated or not.
• Populate this API with data from health records, mapping everyone to a unique ID – such as their NHS number, or some completely random ID.

That’s it. Nothing fancy, just a query-able API designed to limit access to the bare minimum, using data that is already available to many healthcare providers. All an individual needs to do is prove who they are. Associating a photo to an individual is nothing new – passports and driving licenses have done it for decades.

The model above definitely is far from perfect, but I’d sooner trust a query validated against a government database than I would a sticker.