A year ago, Americans were confronting the unnerving reality that the Covid pandemic wouldn’t be a shared experience: Disruption and risk would unroll differently depending on where they lived and how their local politicians responded. Nationwide, deaths had just crossed 100,000. Washington, DC, remained under a stay-at-home order. In New York state, Governor Andrew Cuomo was about to declare that masks would be mandatory inside businesses. But in Texas, Governor Greg Abbott reopened professional sports, and in Georgia, Governor Brian Kemp did the same with bars and nightclubs.
If you thought 2021 would be different: Sorry.
Here's all the WIRED coverage in one place, from how to keep your children entertained to how this outbreak is affecting the economy.
By Eve Sneider
Consider the Centers for Disease Control and Prevention’s recent decision to lift mask mandates for vaccinated people—widely interpreted, if not originally intended, as permission for any adult to go maskless, vaccinated or not. Next, add in the Biden’s administration’s decision to remove the federal government from any significant role in certifying immune status. Realize that leaves us reliant on some proof of vaccination to know who is safe to be around. And then note that, while some state governments are creating verification apps that let people gather safely, others are refusing to allow so-called vaccine passports in their states, and some governors are threatening to bar businesses from using them.
The chaos looks a lot like where we were a year ago. Federal health authorities refused to create national mandates for using protective tools: masks then, immunity certifications now. That required people to make their own calculations of possible exposure and forced them into running greater or lesser risks depending on where they happen to live.
“This leaves us where we’ve been in so many aspects of the pandemic response: in a complete patchwork of different rules, approaches, and outcomes,” says Josh Michaud, associate director for global health policy at the Henry J. Kaiser Family Foundation, which is studying the passports problem. As soon as the CDC changed its mask guidance, he points out, many states tossed whatever masking rules they had retained. (Within five days of the change, 23 states and Washington, DC, all dropped their rules, according to WebMD.)
“One can understand that there’s a scientific basis for dropping the masking mandate,” Michaud says. “But it does leave institutions—employers, colleges, universities, governments—in a position of trusting people who say that they are vaccinated. Which could lead to conditions where people who aren't vaccinated yet aren't following the recommendations and therefore are possibly putting other people at risk.”
Passports were supposed to solve this. (“Passports” is a mostly inaccurate term, since actual passports are created by a sovereign government to vouch for its citizens outside its borders—but it’s catchier than, say, “digital certification of vaccination status.” So we’re stuck with it.) And in some places, they have. Israel created a vaccination “green pass” in February that brought something approaching normal life back to its cities, before the current wave of conflict over Gaza. Meanwhile, the European Union has proposed a “digital green certificate” that will verify vaccinations or negative test results in order to let residents of member nations cross borders.
There’s no such unity in the US. The CDC’s decision to authorize vaccinated adults to take their masks off, even indoors, while expecting unvaccinated adults to keep theirs on, was widely viewed as putting Americans on an honor system. (As the Deseret News of Utah asked: “Are we honorable enough for that?”)
The CDC cast the decision as freeing vaccinated adults from an unnecessary burden, while also offering the unvaccinated an incentive to take the shot. ”If you are vaccinated against Covid-19, you are safe … You can take off your mask,” CDC director Rochelle Walensky tweeted. But for many individuals and some professional organizations, the new guidance moved too far, too fast. The Infectious Diseases Society of America and HIV Medicine Association warned in a statement: “The CDC recommendation should not send the message that the pandemic is over.” The largest union of registered nurses asked the agency to reverse its policy. Multiple media voices pointed out that only about half of the US is fully vaccinated and that children under 12 can’t be yet. (One Esquire columnist: “Parents Are Still Screwed.”)
Meanwhile, the new guidance doesn’t seem to account for the fact that millions of Americans whose immune systems are weakened by infections or by treatment for illnesses such as leukemia or lupus might still be in danger even after vaccination, because their bodies can’t create an adequate immune response. And it appears to ignore the risk created by vaccination’s significant equity gap: According to the CDC’s own numbers, white Americans have persistently received vaccinations at about 1.5 times the rate of Black and Hispanic residents.
Given all that variation in vulnerability, having some independent verification of immune status could make life less perilous for those at medical risk and more trustworthy for everyone else. It could define safe zones in public spaces, places where children or the immunocompromised can enter with less risk of exposure. (This is how New York state plans to use its new Excelsior Pass, to reduce the risk of transmission at sports events and concerts.) “I don't think this needs to be forever,” says Mark Hall, a bioethicist and director of the Health Law and Policy Program at Wake Forest University, who cowrote an analysis of vaccine passports’ legal standing in the New England Journal of Medicine in March. “We’re working our way toward herd immunity, and this seems like a reasonable sort of stepping stone toward that.”
The natural way to create a vaccine passport is to make it a federal function, as Israel and countries in Europe are doing, because national governments have the most comprehensive data about their citizens’ health status. Or, well, they ought to have. In fact, a decision made during the Trump administration renders it practically impossible for a federal vaccine passport to be created.
Last year, when the CDC asked the states to start planning to distribute Covid vaccines, the agency included a requirement that they build IT systems to record who received each dose, and when and where—systems that were intended to report that data up to the federal level within 24 hours. But it turns out that, between the states and the feds, that data becomes anonymized. What the feds receive is aggregated information that indicates vaccination rates and vaccine supply, but nothing that can be linked to individuals. In other words, the federal government literally doesn’t know who has been vaccinated.
Instead, that information is held by state health departments, who maintain the vaccine registries; health insurers, if they have been notified that a recipient received a shot; and the health records systems of at least some providers. Which means that building a vaccine passport involves a choice. Either you keep it specific to a single state, as New York’s does—it queries the state registry when someone vaccinated in New York wants to enter a New York venue—or you take on the task of drawing and verifying data from more than 50 idiosyncratic systems, including the health departments of major cities, Washington, DC, and Puerto Rico and the other territories.
This seems like a significant challenge for any passport whose use would cross state borders, whether that’s vaccinated grandparents from one state visiting grandkids in another and wanting to take them to the movies, or a corporation with offices in multiple states wanting to secure a safe workplace in every location. (It also doesn’t consider whether certain states whose governors are hostile to the whole idea of passports might not permit any data to be drawn from their registries.)
For passports to be usable across state or national borders, they will have to be built to common standards. The largest effort toward that so far is being built by the Commons Project, an open source nonprofit supported in part by the World Economic Forum and the Rockefeller Foundation. Engineers at the project developed the CommonHealth Android app, a digital wallet for personal health information, and now are working on CommonPass, which actually will serve as a passport, verifying vaccination and testing data for cross-border travel. (The group prefers the term “verifiable digital certificates” to “passport.”)
The states have proven difficult to work with, says Paul Meyer, the project’s cofounder and CEO. The states’ databases “are not uniform, and it's not easy to allow direct consumer access to all their registries,” he says. “So we primarily have been working on going through the actual health care providers.”
Within US borders, the first test of the nonprofit’s certificates and standards, beyond its own app, is likely to be an app that Walmart plans to make available to people who received their vaccinations at its pharmacies. It is tricky work: It requires electronic health-record interoperability, which the US has been working on (and sometimes ailing at) since the Clinton administration. “We just don't have a model for building public infrastructure for the digital era,” Meyer says.
The crucial point is that a passport isn’t merely an app or piece of paper that records the immune status of an individual and gets volunteered by them to some other entity. It’s that its production involves a third party to confirm the accuracy of its information. Look at your vaccine card if you’ve gotten the shot already: It records not just the vaccine type and lot number but also the date and place where you got it—records that could be used, if needed, to confirm the vaccination actually took place. By definition, verification allows a third party some degree of access to private records. Creating a framework in which that information can be used to control access to public life imbues verification with extraordinary influence.
The potential harms of passports have to be thought through carefully, lest they end up not as society-openers but as a means of social control. Two weeks ago, the Ada Lovelace Institute, a British nonprofit, published a lengthy set of checkpoints that it recommends governments and developers should meet as passports move forward. The top-level issues hint at how much needs to be solved to make these tools ethical and acceptable: scientific confidence in their impact, specific and limited purpose, ethical and legal clarity and attention to privacy, system design, protection against their being used in a harmful way, and public acceptance.
“There are some really serious risks that need to be weighed against the potential benefits,” says Imogen Parker, the institute’s associate director for policy and the leader of the checkpoints project. “The fact that these are novel technologies, the fact they're built on uncertain evolving science, and the fact that they are fundamentally building digital infrastructure for risk-scoring at an individual level and for shaping rights and freedoms based on health status in society, and facilitating a number of different actors policing that status—governments should be facing some very high tests in order to take this forward.”
Because societies (and airlines and tourism economies) want to reopen, some form of passport seems inevitable, for some countries at least. In the US, they could close the gaps in information and trust created by health authorities’ changing guidance. Stalling on them risks re-creating the mistakes of 2020, when every jurisdiction did things differently, and the lack of a single standard kept people from knowing whether they were safe.
“This moment in time is like where we were with masking,” Michaud says. “In the same city, if you go to Costco and then you go to Target or Walmart you might encounter different masking requirements. We might end up having different vaccine certification requirements depending on exactly which employer or business plans to use them.”
“Which is a completely inefficient and problematic way to approach this,” he continues. “But that would be in keeping with how the US has approached the Covid response to date.”