ACLU warns ‘a lot can go wrong’ with digital vaccine passports

The American Civil Liberties Union says plans to roll out a standardized vaccine passport must account for social inequalities and privacy rights. Anything short is a “nonstarter.”

President Joe Biden’s administration is working to establish a set of standards for people to prove they’ve been vaccinated against Covid-19, an administration official said last Sunday.

The official said the White House is working with government agencies, tech companies and non-profit organizations to plan and coordinate the effort, which is likely weeks away from being finalized.

Still, ACLU senior policy analyst Jay Stanley warns “there’s a lot that can go wrong.”

“Any proposal for vaccine credentials must be primarily paper-based, decentralized, and protect privacy,” he said in an article published on the organization’s website Wednesday.

Passports should be paper-based

Several organizations and tech companies have already started developing smartphone apps and other digital systems to store and verify vaccination information.

The idea is to make it quick and easy for individuals wishing to board flights or attend events to verify their vaccination status.

But Stanley said any system that is exclusively digital would alienate individuals and communities without access to mobile devices or knowledge how to use them, such as senior and low-income people, or those with disabilities.

“There are a lot of people who don’t have cellphones, especially some of the most vulnerable people in our society,” Stanley told CNN. “Over 40% of people over 65 do not have smart phones, so any system must have a paper-based functionality or it’s a nonstarter.”

The ACLU recommends a system that’s primarily paper-based, but with a digital option, so that no one is left out.

“We don’t want people who can’t afford to have cellphones to be excluded from societal benefits,” Stanley said. “We want people to be able to go to concerts or private events even if they don’t own a cellphone.”

Information should not be stored in a centralized database

Stanley said a digital passport system must be decentralized and open sourced to protect user privacy and keep individuals in control of their own data.

“If it involves putting some sort of government or corporate app on your phone but it’s not open sourced and you can’t see how it works, that will be bad for privacy,” Stanley said. “Does it report back every time you present a credential? Every time someone asks to see you’ve received a vaccine? Does it report back to some government agency? That would also be very bad.”

White House press secretary Jen Psaki said Monday there will be no centralized universal federal vaccinations database. While that’s good news to the ACLU, Stanley worries that a rushed system could still lead developers to overlook other important details.

In his article, he warned that a digital passport “built on architecture that is not good for transparency, privacy, or user control” could set a “bad standard” for future apps and systems that host credentials, such as health records, memberships and licenses.

User privacy should be respected

Any passport system that tracks and records users’ whereabouts and actions is a bad idea, Stanley said.

“In the absence of airtight legal protections for privacy, any such information could then be sold for commercial purposes or shared with law enforcement,” he wrote.

“That would affect all of our freedoms, but will have a particular chilling effect on communities of color, including immigrant communities, that are already over-policed.”

That fear could lead some people to opt out of a passport system or vaccines altogether, further marginalizing communities already at risk.

A passport system that scares users away would be counterproductive, he added.

The devil is in the details

Some sectors, like the travel industry, are calling for a uniform system to verify Covid-19 vaccinations.

Although the Biden administration previously said the federal government should not be involved in efforts to create such a system, they are now working to do just that.

Still, Psaki said in her statement on Monday that the administration will not require Americans to obtain vaccination credentials.

At a briefing on March 12, White house coronavirus coordinator Jeffrey Zients described the system they envision.

“Our role is to help ensure that any solutions in this area should be simple, free, open source, accessible to people both digitally and on paper, and designed from the start to protect people’s privacy,” he said.

An administration official told CNN the standards are still in the early stages of development but expects them to look similar to what Zients outlined — that the ultimate product should be free, private and safe from being duplicated or forged.

Stanley said the ACLU is “heartened” that the White House’s efforts appear to be in lockstep with their concerns and will remain cautiously optimistic.

“The devil is often in the details, and any proposed system will have to be examined closely,” he said.