Couchfish: “Passports” please

Couchfish: “Passports” please

Old tech works just fine

So if my dire forecasts of last week come to pass, at least we have time to sort other things out. This week, I look at vaccine “passports”.

My take—we don’t need a new solution when one already exists. Attention should be concentrated on increasing vaccination rates. It should not be focused on forcing the adoption of technology whose painful legacies will far outlast Covid.

Arabic papyrus with an exit permit, dated January 24, 722 CE. Photo: By Osama Shukir Muhammed Amin FRCP(Glasg) CC BY-SA 4.0

Sidenote: If the last thing you want to read about is Vaccine Passports, I really enjoyed this piece on temple hopping in Tra Vinh, Vietnam.

A brief history lesson

What is a passport? To quote Wikipedia:

“A passport is an official governmental document that contains a given person’s identity. It helps its holder travel under its protection to and from foreign countries.”

Passports are issued by governments—not private companies.

Trivia klaxon! One of the first known references to something passport–like was around 450 BC in the Hebrew Bible. Also, passports were only standardised by the ICAO in 1980—2,430 years after a dude in the Bible wanted to go to Judea.

The Yellow Card

Yellow fever is a mosquito–borne disease found in tropical and subtropical regions of South America and Africa. According to the CDC, there are around 200,000 cases and 30,000 deaths each year.

An ICVP issued by the Bureau of Quarantine in the Philippines after being vaccinated with a COVID-19 vaccine in 2021. Photo: Rizalninoynapoleon CC BY-SA 4.0

There is a vaccine, and having the shot is a condition of entry for some countries where it is a risk. Vaccinations are recorded in the International Certificate of Vaccination or Prophylaxis (ICVP). Non–long–word–inclined people know it as the Carte Jaune or Yellow Card—there is a digital version too. Importantly, it is a travel document—not a vaccine passport. Once vaccinated, a yellow card is all you need to prove you have had the shot.

Covid is not yellow fever

Covid differs in plenty of ways from yellow fever, but the important one here is its scale. It spans the globe, is highly contagious, and doesn’t need mozzies. In under two years, it has infected over 200 million people, killing over four million.

In a miracle of science, a range of semi– to very–effective vaccines came to market in record time. Hampered by inept governance, the roll out has been neither smooth nor equitable.

As vaccination rates have nevertheless increased, so to has talk of travel “re–opening”. As I wrote last week, I think this is well premature, but The Guardian explains why better:

“So there is a danger of simply assuming because you’ve been vaccinated, you don’t then spread Covid-19, and that would not be a good scientific basis for a policy of passports”

A sanction on the one percent

A vaccine passport is the least of the concerns for most. As of today, just over 15% of the Earth’s eligible population are fully vaccinated. More worrying, only 1% of people in low–income countries have received a single dose.

Imagine this with a vaccination check added into the mix. Photo: Stuart McDonald.

Another group are those who cannot safely take a vaccine and who instead rely on medical exemptions. The CDC details considerations for people with allergies here. Grounds for exemptions vary from country to country.

A premature vaccine passport is essentially a sanction on the unvaccinated. Steps must be taken to avoid the creation of a two–tier society, to allow the rest of the world the time it needs to catch up. Writes the BBC:

“If a passport scheme was rolled out before everyone in the country has been offered a jab, this could unfairly disadvantage young people or people living in certain parts of the country. ... And, “people of different ethnicities have different levels of vaccine hesitancy,” Prof Mills said, which opens up the potential for discrimination against people’s “religious or political beliefs”— or where this hesitancy is linked to a long history of racism and marginalisation.”

Papers please

So some have legitimate reasons for their jab–less state, and billions are still waiting. Despite this, countries—and businesses—are already pulling up drawbridges for the un–jabbed. Treatment varies country by country and business by business. Proof of vaccination opens doors which are rapidly being closed to most others.

My vaccine certificate is in my phone, which is flat. Temple mural, Northeast Thailand. Photo: Stuart McDonald.

Worldwide, proof of vaccination takes on a maddening array of formats. There are paper print–outs, library–card style cards, government and private apps.

Writes the New York Times:

“A Covid-19 vaccination card does not always convey the significance of the document. Nor are the cards typically designed to counter fraud. Most of the hundreds of millions of people worldwide who got at least one shot of a Covid-19 vaccine in the past few months received a flimsy piece of paper.”

At some stage, people with flimsy pieces of paper will be able to go high tech. This leaves two questions. First, how do you prove your vaccination status when flimsy papers are so easily forged? Second, is moving to a technical solution desirable—or even necessary?

Prove it

How does one go about proving both their vaccination status and which jab they got? Why does knowing which jab you got matter? Because not all countries recognise all vaccines of course—that would be way too simple.


My Twitter Hive Mind pointed me to a bunch of sources on these questions. The consensus: there are tests to distinguish if you have had Covid already, or received a Covid vaccine. Testing for vaccine type appears to be far muddier waters.

So if countries allow only vaccinated visitors, but are shot snobs, how does that work? I guess they need to trust people not to lie when they’re asked which vaccine they received—or if they are vaccinated at all.

Does your head hurt yet? I had to go walk the dog and have a coffee at this point.

Which app?

Next are the vaccine passport apps. Many governments have their own and there are loads and loads of corporate ones. In both the US and the EU, governments are trying to herd the cats, but it is cowboy country, with few adopted standards.

Most of these apps need either a QR code or some type of interfacing with an official health body. Take CommonPass as an example. They note if you don’t have a QR code, you can get tested at one of their verified labs—the closest one to Bali is in Japan.

At some stage this disparate glad bag of vaccine apps will thin out and we’ll have a modern take on the Carte Jaune. If you’re one of the unwashed though, with a flimsy sheet of paper and no QR code, don’t bother.

But this isn’t a passport

A passport comes from a government, but most “vaccine passports” come from companies. Private companies whose interests may not be in your interests. What information do you need to prove you are vaccinated? Your name, date of birth, passport number, and vaccine type and jab date seems sensible.

There’s plenty of this to be made. Photo: Stuart McDonald.

To take one example, Verifly is an app developed for the US market. Daon, a privately held, for–profit company, owns Verifly. Daon’s founder is Dermont Desmond, an Irish billionaire. To quote Daon, they have:

“pioneered methods for securely and conveniently combining biometric and digital identity capabilities with large-scale deployments that span payments verification, digital banking, wealth, insurance, telcos, and securing borders and seamless travel”

I apologise in advance for not reading the entirety of Verifly’s 7,000 word privacy policy—I had ironing to do. At a glance though, the information it might collect is Facebook–ish. Data points include age, race, gender, nationality, health information, employer and school. I went to download the app and noted that it may collect what Apple terms as “Sensitive Info”, so I looked that up. Sensitive info includes:

“racial or ethnic data, sexual orientation, pregnancy or childbirth information, disability, religious or philosophical beliefs, trade union membership, political opinion, genetic information, or biometric data.”

Why does a vaccine passport need my religious beliefs, union memberships or political thoughts? The app is free—so much like Facebook and Google—use something like this and you’re the product.

The IATA Travel Pass is far less egregious in this regard. Their privacy policy is a mere 1,700 words and the data they look to be collecting makes a lot more sense. Testing is underway with 48 airlines.

Governments need not be better unfortunately. Take the Indonesian official app, PeduliLindungi. According to their privacy policy, the app tracks your location and other data points. Who is this data shared with? Google and arms of the Indonesian Government. Which arms? Why?

So if you value your privacy and are wary of companies and/or governments profiling you, or tracking your every move, do your research. If you think I’m being hyperbolic, you need look no further than China. Talking about what software within a contact tracing app was doing, the New York Times writes:

“It also appears to share information with the police, setting a template for new forms of automated social control that could persist long after the epidemic subsides.”

If it ain’t broke, don’t fix it

Through all my reading on this topic, the one story I agreed with more than any other, was one by the ACLU. Discussing what could go wrong with vaccine passports, they write.

It must not be exclusively digital

“A standardised credential should be primarily a paper–based system with an optional digital component, not the other way around.”

It does not allow for tracking and the creation of new databases.

“If some big company is getting notified any time someone reads one of your credentials, that would let them track your movements and interests.”

They go on to say:

“... but if a passport system makes it very easy to ask for and to provide proof of vaccination, it’s likely that such requests will become over–used as people get asked for credentials at every turn.”

You know what existing “technology” meets the above two criteria? The Carte Jaune.

Use that.

Couchfish is 100 percent independent and reader–supported. If you’d like to show your support, become a paying subscriber today for just US$7 per month, or simply share this story with a friend. Thank you!


The Couchfish podcast. Following a day by day itinerary through Southeast Asia—for all those people stranded on their couch.