A shot in the arm, not a shot in the dark

Momentum is ramping up on ‘vaccine passports’ – some form of digital certificate or app that would show someone’s vaccinations status or COVID-19 test status, for the purpose of easing lockdowns or offering or curtailing freedoms to lower-risk groups.

It’s not a new idea – it has been proposed by countries and companies since early on in the pandemic, but the roll-out of vaccines has triggered rapid movement by companies and countries around the world. Major companies like IBM and Salesforce are developing tools, and a number of countries are making calls, or even prototypes, for the development of a passport. The World Health Organisation (WHO) has now started work on a digitally enhanced International Certificate of Vaccination.

In the UK, we are approaching a unique global position in relation to vaccination: almost a quarter of the population has received one vaccination, while the country is still in national lockdown with schools closed, many workers furloughed, and international and most domestic travel banned. Recent comments from across Government demonstrate they are clearly engaged with the complexities this opportunity presents, and it’s easy to see why.

The attractions of a COVID-19 passport are easily grasped. If you could have a more precise understanding of risk, you could engineer a better balance between economic activity and community safety, by allowing a more fine-grained and targeted set of restrictions than sweeping measures of national lockdowns. Businesses and sectors that face almost irreparable damage could be opened more swiftly, and personal liberty could be restored to some at least. But the potential benefits of partially re-opening society must be weighed against the current evidence about immunity, and the serious risks arising from creating tiers of access in society.

To consider whether these tools could legitimately be deployed, we convened a group of experts for a two-day deliberation. Participants brought perspectives from technical infrastructure and privacy, public health and immunology, social sciences, ethics and law.

The urgency of the issues meant – by necessity – this was a limited exercise as part of a bigger project. Taken as a snapshot of our understanding of the evidence and the development of technical tools, it raises some important points.

The headline is that at present, any use of vaccine passports or health status apps is not justifiable given the lack of evidence on transmission. The vaccine passport relies on the assumption that my vaccine status tells you something about the risk I pose to you, not simply the risk I face from COVID-19. That’s not something we can currently know – we need more time to pass, and more evidence to accumulate. Add in different vaccine regimes combined with emerging mutations that may impact upon vaccine effectiveness, and it all makes for a complicated picture.

Evidence on transmission will develop, but there a number of important risks posed to individuals and society that deserve real scrutiny. To pull out four immediate concerns:

• The move towards a system of individualised risk scoring could undermine public health by treating a collective problem as an individual one, and reducing compliance with social distancing, hand hygiene and masks.
• Building infrastructure around vaccination could exacerbate distrust by marginalised groups and increase vaccine hesitancy, if this is seen as introducing mandatory vaccination by the back door, or building surveillance apparatus for communities that are already disproportionately monitored.
• Tying movement to vaccine certification could increase inequality nationally, entrench existing global inequalities, and potentially even supercharge vaccine protectionism.
• Infrastructure introduced for one purpose might be used for another – and information might flow to third parties or personal data may be repurposed. This isn’t an issue that can be solved by technical build alone; even the most privacy-preserving technology could be used to share some manifestation of health information or risk score to different actors, from potential employers to insurance companies.

Stepping back from the immediate issues, there are – no less weighty – concerns about future uses: that we are creating a long-term, powerful digital infrastructure, for a time-bounded crisis. We’ve seen the proliferation of security infrastructure post 9/11, and the once-limited, now essentially mandatory, Aadhaar identity systems in India. Once individualised risk scoring permeates society, it may not easily be stripped back.

These are real risks that need to be acknowledged and weighed. With momentum building internationally, and tools being piloted in the UK, the Government needs to offer clear direction of the conditions or specific use cases – if any – where vaccine passports might be justifiable.

How to get that clarity? I’d recommend seven steps:

1. Offer urgent clarity now about the current legality of any use of vaccine passports. Developers should not be in the position of creating the rules of how and where systems should be implemented, and there is a lack of clarity about how uses sit with data protection, equality and employment law.
2. Set scientific pre-conditions for any use, on transmission, efficacy and expected impact on complying with other public-health measures.
3. Identify the important uses so that the benefits and risks can be assessed if these pre-conditions are met. It may be that there are specific uses – visiting care homes for example, or organising frontline workers – where there is a case to be made for more granular assessment of risk. The costs and benefits will need weighing, and Government should evaluate the adaptation of existing mechanisms as well as a new system of passports and digital identity. Does this require new technology, or could it just be an update in the Green Book on immunisation for healthworker vaccination requirements in high-risk environments?
4. Consult on priority use cases with a wide group of experts…Disciplinary experts as well as those key to any practical implementation should be consulted on any plans for deployment.
5. …and publics. There will be some trade-offs that deserve to be put to the publics affected. It will be particularly important to engage with those groups who are likely to face disadvantage, discrimination or unique/particular risks through the roll out of these technologies – those in insecure work, without citizenship, unable or unwilling to have the vaccine or who face historic or continuing over-surveillance.
6. For international travel, work through the World Health Organisation. International standards will be vital for interoperability. Different countries leading different discussions outside the WHO’s efforts will only heighten the difficulties of international coordination and frustrate attempts to define standards. The UK should continue its important role in global thinking about vaccinations (through GAVI and COVAX), to 1) champion WHO as the more appropriate and legitimate venue to take a global view when making decisions about international travel passports and 2) have expert input to wrestle with the scientific evidence particularly on risk around mutations.
7. Identify and mitigate risks through policy measures, technical design and governance infrastructure prior to proceeding with schemes. As well as technical and governance requirements, Government(s) would need to develop policy measures at a national and global scale that could adequately counteract and mitigate the risks and issues outlined above, like employment benefits for those unable to work; international baselines of vaccine coverage; clear and limited purposes of any vaccine passport with strong legal protection for data subjects, and socio-technical design principles.

It’s a challenging to-do list, but it is right to set the bar high for any scheme that risks creating tiers in society. The scientific pre-conditions could be met later this year, and the risks we’ve identified may not be insurmountable, but it is unquestionable that careful thought is needed now, alongside policy instruments to mitigate inequalities like new laws or guidance, and the right technical format, among other protections.

Government must understand and communicate the real benefits vaccines can bring and not be distracted by attractive-sounding quick fixes that don’t have a solid basis in evidence. If they do this, they will give the economy the shot in the arm it so badly needs and take an active role is shaping the post-pandemic society.

Image credit: MarianVejcik