On June 20, about 20,000 fans gathered at Madison Square Garden in New York City for a Foo Fighters concert. The venue was at full capacity for the first time since the start of the pandemic, but it wasn’t a full return to normalcy: To get in, ticket holders needed to show proof that they’d been vaccinated—in the form of either a paper card or the state’s Excelsior Pass, a much-debated smartphone app that launched earlier this year.
The pass now has about 2 million downloads, which represents just 10% of fully vaccinated New Yorkers. Implementation has been rocky—marked by persistent glitches, privacy concerns, and outrage over the state government’s failure to prioritize the material needs of working-class communities of color—and businesses that require vaccination proof are already seeing backlash. Despite these concerns, though, it’s becoming more commonplace across the city to require such proof, and other states have expressed interest in launching similar passes. (You can read more about those with our vaccine passport tracker.)
So what is it like to use?
In anticipation of attending my first comedy show in years, at Union Hall in Brooklyn, I registered for the Excelsior Pass. Spoiler: It did not go smoothly.
Downloading the app to my iPhone was simple enough. But like many users, I was greeted with an error message when I tried to register on the website. Many people have been unable to use the pass because it cannot verify their vaccination status. The system works by tapping into state immunization records, but database errors can cause problems, especially if there were data entry errors at vaccine sites. A misspelled name or wrong birthdate can mean that the Excelsior system can’t pull up your record. So when the pass couldn’t verify my identity, I followed the suggestions on the error page and dug up my paper vaccination card to ensure that I was entering vaccine site information correctly. After three attempts, in which I reentered the same information each time, it worked.
After three attempts, in which I reentered the same information each time, it worked.
Limited use
Although I found a use for the pass, it’s been essentially confined to sporting events, gyms, and other high-end leisure venues—which means the pool of users is limited. For working-class New Yorkers who lost low-wage jobs and remain unemployed in the face of mounting debt, entry to a pricey concert or basketball game is well out of reach.
That raises concerns about whether it’s a wise use of resources. The state has spent $2.5 million on the system so far, and under the contract signed with IBM, which developed the platform, it could cost anywhere from $10 to $17 million over the next three years in a scenario where driver’s license information, proof of age, and other data might be added to the pass.
“This passport program feels like a continuation of all the state government’s and Governor Cuomo’s policies around the pandemic,” says Sumathy Kumar, campaign organizer at Housing Justice for All, a statewide coalition of organizations fighting for tenants. “They just want life to go back to normal for people with tons of disposable income.”
And if the pass does get more widespread use—becoming a requirement to enter job sites or essential shops, for example—that raises questions about privacy.
Experts question security
Users must enter their name, date of birth, zip code, and phone number to verify their vaccination status or covid-19 test results. New York State’s website tells users that Excelsior data is safe and secure, while the privacy policy says it does not store the information sent via the app, or use location services to track people’s location. IBM assures users that their data is kept private and secure using blockchain and encryption technologies.
But experts claim the privacy policy is woefully inadequate. Albert Cahn, executive director of the Stop Technology Oversight Project (STOP), which opposes local and state surveillance in New York, points out that businesses use a separate app to scan the pass; when he tested it, he found that a user’s location could potentially be tracked by those scanners. As a result, the comedy club I go to might have a log of my visits there—and to any bars I go to afterwards that require proof of vaccination. Neither New York State nor IBM responded to requests to clarify whether scanning information could be collected or tracked.
The lack of transparency is a problem, says Cahn. “I have less information on how the Excelsior Pass data is used than the weather app on my phone,” he says. Because the pass is not open source, its privacy claims cannot easily be evaluated by third parties or experts.
“If IBM’s proprietary health data standard catches on, they could make huge sums of money… Transparency can threaten their entire business plan.”
Albert Cahn, STOP
But there’s little incentive to be more transparent. In developing Excelsior, IBM used its existing Digital Health Pass, a system it could sell in customized forms to customers from state governments to private companies seeking to reopen their offices.
“If IBM’s proprietary health data standard catches on, they could make huge sums of money,” Cahn says. “Transparency can threaten their entire business plan.”
Privacy and security questions become more urgent if the pass becomes more widely used. The pass is intended to build trust, allowing people to feel comfortable in crowds, yet for many it instead evokes fears of how it could be used against them.
Vulnerable to surveillance
Many groups have genuine, well-founded concerns over tracking and government surveillance. Historical precedent shows that the use of such technologies, even if limited initially, tends to spread, with especially damaging results in Black and brown communities. For example, anti-terrorism legislation passed in the weeks after the 9/11 attacks expanded surveillance, detention, and deportation of undocumented Muslim and South Asian immigrants.
The Electronic Frontier Foundation (EFF), a digital civil liberties organization, has adopted a strong stance in opposition to vaccine passports. “Mostly these apps are a waste of time and money,” said Alexis Hancock, director of engineering at EFF. “Governments really need to consider the resources they have in place and allocate them toward getting the public to a better place after the pandemic, not putting people in a position of more paranoia and privacy concerns.”
Imran, an undocumented immigrant from Bangladesh who spoke to me for this story, says he has no practical use for the pass at the moment. “This app isn’t for poor people like me,” he says. Imran was unemployed during the height of the pandemic, but now he works two jobs—at a hotel and an office—to support himself and his family in Bangladesh. He would not consider downloading the pass, which he said would be “anxiety-inducing” to him as an undocumented immigrant who can face deportation if detained by immigration authorities.
Jamie Garcia, a nurse and organizer with the STOP LAPD Spying Coalition, a group in Los Angeles that campaigns for the end of surveillance in policing, says that even small pieces of information can be used to criminalize Black and brown people. The data “seems sparse,” she says, “but when you take into consideration the layers upon layers of data they have on you, whether crime or location data, data from your cell phone, every bit of your life has become data-fied.”
Advocates in New York have proposed legislation to prevent vaccination records from being shared with local law enforcement or immigration authorities, but it was not passed in the legislative session that recently concluded. (We’re watching state policies, plans, and legislation related to vaccine passports in all 50 states.)
Experts also worry it’s not fair to require proof of vaccinations that not all groups have been able to access equally: Black and Latino communities in New York lag behind other groups, including white and Asian communities, in vaccination rates. Although the pass can also be used to show a negative covid test, transportation and financial challenges mean those tests are not much easier for many people to obtain than the vaccines themselves.
The pass could become yet another unfair hurdle for communities hit hardest by the pandemic, according to community organizers. “The idea that we need to restore trust is so much deeper than just outreach and public relations,” says Farihah Akhtar, an organizer at CAAAV, a community group for poor and working-class Asian communities in New York. “It’s a matter of who the system prioritizes and cares about. Will working-class people ever be prioritized?”
National implications
Despite all these concerns, a 2021 study by the Institute for Technology and Global Health found that 66.5% of respondents in the US were supportive of digital vaccine credentials, raising the question of whether other states will adopt a system similar to New York’s.Most respondents felt that it was most appropriate for businesses to require them as opposed to schools or other venues. The survey was conducted online, in English, with 1,000 respondents who were considered nationally representative in terms of age, race, and gender. Respondents were not representative in terms of income or class, factors that play a major role in vaccination rates.
To Stop LAPD Spying’s Garcia, digital vaccine passports are just another example of techno-solutionism, where technology is celebrated as the singular solution to complex problems. Contract tracing apps, likewise, were initially touted as a means to mitigate the spread of covid but ultimately struggled to do so.
A vaccine passport “doesn’t resolve covid,” Garcia says “Variants will come our way too. There won’t be a time when we won’t experience them. Unless we’re all safe, internationally, none of us are safe.”
This story is part of the Pandemic Technology Project, supported by the Rockefeller Foundation.
