Vaccine Passport: The QR Code Heard Around the World

ISSUE: The Final Mile of the Pandemic

Boston has one of the highest vaccination rates in the country; however, recent efforts to get to endemic vaccination rates have stalled. Restricting music venues, bars, and other public venues to residents with at least one dose of the COVID-19 vaccine could increase vaccine participation. Would the benefits of a digital vaccine passport outweigh the security risks and implementation costs?

STAKEHOLDERS: A “Boston Strong” Approach is Necessary for Execution

ANALYSIS: Getting to the Endemic

1. Mandates are Effective: While politically contentious, the vaccine mandates for city employees and government employees have been found to increase vaccination rates. “Hard” mandates requiring vaccination have been found to convince vaccine hesitant, especially in the private sector. The city of Boston has recently required city employees to become vaccinated, and the federal employer mandate has With FDA approval of the vaccine and many residents already vaccinated, a vaccine passport could be the final push for the vaccine hesitant. However, a subset of the population will continue to resist vaccination regardless of requirements. Given the limited number of months left of the administration, the burden of enforcement and implementation will fall on the next administration.

2. Security Measures for Data Use Must Be Clear: Given the roll out of vaccines in the United States, a digital QR code has been common to supplement paper cards for vaccine passports. Coming on the heels of the cyber-attack on the Boston Public Library, Bostonians may be reticent to download a new app with vulnerable personal information. As a model for reference, New York implemented the Excelsior App in its vaccine passport roll out and requests the following data: First Name, Last Name, Date of Birth, Telephone, Number, and Zip Code. Two threats to misuse of personal citizen data are “off-brand” state use of data and foreign (or domestic) cyber criminals.

a. Privacy experts have spoken out against New York’s Excelsior Pass for its opaque terms and conditions. In the terms and conditions for the Excelsior Pass, it lists four uses of data from the app, including “necessary to perform the statutory duties of NYS” and “made pursuant to a court order by law.” HIPAA also does not apply in the case where an individual voluntarily uploads information to a platform, and despite assurances that “blockchain technology” secures a user’s data, specifics have been sparse. Additionally, the use-case of vaccine passports explicitly involves location data as venues scan users into concerts, bars, and restaurants. The potential to track citizens has already been employed in Singapore and China. While the legal infrastructure in the United States may prohibit widespread use, the public outcry around privacy could be a concern, especially when linked to anti-vaxxer arguments.

b. The data itself remains limited in terms of commercial value. While it could be linked to location data, the data set does not include credit card, bank information, or other valuable assets. However, the potential for widespread disruption if the victim of cyber espionage would inherently damage the viability of the passport implementation. Nefarious actors could hold the app for ransom, eroding faith in other public IT infrastructure projects. This could have outsized impact in public fear, making it less likely that residents would get vaccinated.

3. Uneven Distribution of Burden: Vaccine-hesitant Bostonians are split by socioeconomic factors. As of July, there is a 14-percentage point gap between white Boston residents with at least one dose of the vaccine and Black and Hispanic residents [64% vs. 50%]. Implementing a vaccine passport would have disproportionate racial impacts in the city, particularly when intersected with income status. Vaccine passports are most effective when vaccine distribution and adoption has been spread equitably. Elderly populations may also struggle with technology, and they would continue to rely on paper.

Options:

Option #1: Status Quo: The city will not require any vaccine passport, and instead, it will encourage private sector companies to enforce vaccine mandates. Additionally, it will perform outreach vaccine hesitant populations through promoting access to vaccines (e.g., mobile vaccine clinics) and increasing awareness through traditional campaigns (e.g., Vaxmillions lottery).

Option #2: Old Faithful: The city of Boston can mandate that large venues (TD Garden, Fenway Park, and Harvard Stadium) require vaccination cards for entry, but these venues will require paper cards to retain entry. The city will leave enforcement to private actors.

Option #3: New York or Nowhere: Boston can require any high-risk indoor spaces require vaccination, including nail-salons, gyms, and restaurants. The administration can leverage the existing partnership with IBM and the state of New York to develop a sister mobile app to New Yorks, beginning a state-by-state movement to implement a digital passport nationwide. Paper cards will still be accepted.

Criteria: Scoring a Policy by Return on Impact

To, a successful policy should (1) health outcomes, (2) security, (3) equity, and (4) political benefit.

Recommendation: Lead, Don’t Follow

To increase health outcomes and secure your political legacy, I recommend Option #3: New York or Nowhere. The vaccine passport will encourage increased vaccination, and it will increase health outcomes for all residents of Boston. The pandemic has gone on long enough. This will also allow you to end your administration on a high note. The Biden Administration recognized New York for its vaccine passport, and Boston’s would be among the first to follow in the nation.

Risks and Uncertainties: Creating More Problems than it Solves?

There is a potential for fraud. A simple google search “hacking excelsior pass” leads a user to a reddit post with near step-by-step instructions of creating a QR code with the public keys of the app. New York has already had to patch a credential forgery option. Moreover, the technologically unsavvy may turn to other black-market forgeries. If the goal is to increase vaccine participation, fraud would curtail the effectiveness of the mandate, and it would create a false assurance that concert goers are safe. However, by joining New York in their app system, this distributes security costs. Security will still be a concern (as will adoption), but the return on investing in a shared system is greater than building a unique Boston app.

The timeframe is small: Given the limited duration of the administration’s term, there is a risk that the ideation will take up most of the efforts of the current administration’s term. However, the new mayor seems likely to implement a vaccine passport, so joining the effort will return political dividends. Additionally, much of the execution will be in the next mayor’s hands. This shields much of the challenges around public adoption and stakeholder implementation from the current administration.

Implementation: Making the Most of Partnerships

Digital Vaccine Passport: The Mayor could approach the Governor to encourage and accelerate plans for developing a digital vaccine passport. The Mayor would then work in tandem to develop a partnership with the Hochul administration in New York as well as IBM to develop its own version of the Excelsior app. This would require leaning on the existing security infrastructure and app development, while trying to balance new and unique users in Massachusetts. New York’s existing expense of $17 billion dollars on the app should be considered when developing an adjacent app on its infrastructure. However, this could encourage cross-state tourism and become a model for national vaccine passports.

Vaccine Distribution: Along with the implementation of the vaccine passport, the city of Boston should assure residents that vaccines will be widely available. This will require outreach to specifically vaccine-hesitant communities. Additionally, the city may need to create a new system of replacing paper cards as residents who continue to rely on them.