%20-%20https://sketch.com%20--%3e%3ctitle%3e3ECBBF50-FD08-412A-943D-2CFC5E025A16%3c/title%3e%3cdesc%3eCreated%20with%20sketchtool.%3c/desc%3e%3cg%20id='Stylesheet'%20stroke='none'%20stroke-width='1'%20fill='none'%20fill-rule='evenodd'%3e%3cg%20transform='translate(-926.000000,%20-668.000000)'%20id='BUTTONS'%3e%3cg%20transform='translate(100.000000,%20597.000000)'%3e%3cg%20id='BTN-/-RIGHTS'%20transform='translate(816.000000,%2065.000000)'%3e%3cg%20id='ICON-/-Rights'%20transform='translate(10.000000,%206.000000)'%3e%3cpath%20d='M13.5752841,0%20L1.34943182,0%20C0.59375,0%200,0.586666667%200,1.33333333%20L0,22.6666667%20C0,23.4133333%200.620738636,24%201.34943182,24%20L17.6505682,24%20C18.40625,24%2019,23.3866667%2019,22.6666667%20L19,5.36%20L13.5752841,0%20Z%20M13.5752841,1.89333333%20L17.0838068,5.36%20L13.5752841,5.36%20L13.5752841,1.89333333%20Z%20M1.34943182,22.6666667%20L1.34943182,1.33333333%20L12.1988636,1.33333333%20L12.1988636,5.36%20C12.1988636,6.10666667%2012.7926136,6.69333333%2013.5482955,6.69333333%20L17.6235795,6.69333333%20L17.6505682,22.6666667%20L1.34943182,22.6666667%20Z'%20id='Shape'%20fill='%23595959'%20fill-rule='nonzero'%3e%3c/path%3e%3ccircle%20id='Oval'%20stroke='%23595959'%20stroke-width='1.5'%20fill='%23595959'%20cx='9.5'%20cy='13.5355339'%20r='5.5'%3e%3c/circle%3e%3cpolyline%20id='Path-2'%20stroke='%23FFFFFF'%20stroke-width='1.5'%20transform='translate(9.500000,%2013.035534)%20rotate(45.000000)%20translate(-9.500000,%20-13.035534)%20'%20points='8%2016.0355339%2011%2016.0355339%2011%2010.0355339'%3e%3c/polyline%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
I. Introduction
In May 2021, the European Union (EU) approved the adoption of the EU Digital COVID Certificate from 1 July 2021, which will facilitate the resumption of free movement throughout Member States.Footnote 1 While offering a paper version, the certificate will be most effective as a digital instrument to ensure safe travel across borders. Renamed from the Green Passport, it will contain a limited data set, will be encrypted and may be shown independently of the passport.
The speed of agreement and delivery of the COVID-19 vaccine passport suggests that there has not been sufficient time to fully consider the risks or to develop policy around their regulation. There are clear issues concerning restricting movement based on one’s medical profile. While understanding of the immunology of COVID-19 is advancing, driven by, for example, the Sinai Immunology Project,Footnote 2 it may not be seen as providing sufficient policy expertise to underpin vaccine passport regulation. The prospect of limited vaccine production capacity and inequities in distribution, alongside issues of intellectual property, creates some concern about global access to the vaccine. In addition, the technological gaps experienced by those negatively impacted by the global digital divide will mean that the excluded both inside and outside the EU may exceed those connected and included for some time to come.Footnote 3
Issues concerning fairness, responsibility and the erosion of civil liberties have been well rehearsed.Footnote 4 The exclusion of people who are unable to have the vaccine for medical reasons, the discrimination against vaccine-hesitant ethnic minorities and others, the differential rollout of vaccines in different countries and the differential access to vaccines and medical care are some examples of the social and ethical issues associated with vaccine passports.Footnote 5 It can be argued that not only will a vaccine passport be ineffective if vaccination has not extended to appropriate epidemiological levels, but also it will create new borders based on safe or unsafe bodies.Footnote 6
However, less attention has been given to the ethical and regulatory issues associated with the digital platforms and networks appropriated to develop vaccine passports. These technologies involve substantial integrated networks, connecting a range of institutional actors and leading-edge technologies such as blockchain. The development of the passports and associated applications involve technology companies and open-source communities in application programming in an ecosystem in which regulation is weak and risks are significant.
Regulatory frameworks in these areas are in their infancy. For example, in the UK, the National Health Service (NHS) risk assessment of digital health applications, implemented as the Digital Technology Assessment Criteria, was only introduced in early 2021.Footnote 7 Efforts to regulate the growing population of digital health applications is hampered by the lack of sources of evidence about their use, benefits and harms.Footnote 8
This contribution summarises the technological basis and processes for four health passes currently under development/being deployed to expose the regulatory risks and policy vacuumsFootnote 9 we suggest must be incorporated into any proposed regulatory framework. In doing so, we explain that the potential risks associated with technical implementation demand attention as much as the issues associated with the validity of vaccination passports as potential instruments of border mobility and the broader epidemiological and medical issues.
Section II offers a brief analysis of four technical proposals, identifying some regulatory and policy issues, and concludes with a discussion of the EU Digital COVID Passport. Section III discusses the regulatory risks associated with three technology platforms involved in digital vaccine passports – blockchain, open source and data networks. Section IV concludes that the key regulatory issues lie in the positioning of the digital passport in an ocean of networks, connected data sources and interested parties, such that the application cannot be considered for regulatory purposes as a simple standalone artefact, but rather is one node located in a complex network, which may pose intractable regulatory problems.
II. Regulatory issues in four technical proposals
There are currently several vaccine passport technologies being developed, each of which has its own technical and ethical challenges. The rationale for examining the four vaccine passport technologies below is that they were identified by the Ada Lovelace Institute expert examination of vaccine passports in society as the leading technologies in this area.Footnote 10
1. Vaccination Credential Initiative
The Vaccination Credential Initiative (VCI) is an alliance of twelve technology and health service providers, including Microsoft, Oracle, The Mayo Clinic and others,Footnote 11 which was expected to be available in May 2021.Footnote 12 The goal is to power open-licensed, secure and decentralised solutions through an application programming interface to ensure the solution is interoperable and broadly adopted across several platforms and stakeholders. The solution will facilitate the sharing of verifiable clinical information such as COVID-19 laboratory results, immunisation and other relevant data in the form of a smart health card or digital health wallet. As such, it will require an interoperable ecosystem of applications, data and processes contributed to by a wide range of stakeholders. In an open environment where responsibilities and provenance for technical changes may be difficult to determine, any contributor could be liable for the regulatory consequences.
There will be three main actors: the issuer, the holder and the verifier.Footnote 13 The verifier validates the records on the smartcard by checking whether it is valid and cryptographically signed. The digital health wallet could be installed as a mobile app on smart devices, while the card could be issued as identity cards with QR codes. The VCI alliance claims that the solution satisfies the privacy issue because signed data reside only with the end users, and they have the prerogative to only present the data for verification.Footnote 14 However, the commercial nature of this approach means that there may be greater complexities with verifying General Data Protection Regulation (GDPR) compliance, and regulators may feel forced to compromise transparency for interoperability. Furthermore, the number of involved organisations from different jurisdictions makes this option difficult to regulate.
2. COVID-19 Credentials Initiative
The COVID-19 Credentials Initiative (CCI) is “an open global community looking to deploy and/or help deploy privacy-preserving verifiable credential projects to mitigate the spread of COVID-19”.Footnote 15 Supported by the Linux Foundation (a non-profit organisation), one of its main aims is to develop a set of privacy-preserving verifiable credentials (VCs) that will be used responsibly within other projects. This initiative advocates a data minimisation approach whereby a trusted credential issuer (eg government or health services) can provide a holder of the VC with proof that the VC has the specific characteristic required (eg vaccination status), without any need for there to be communication directly between the verifier and the issuer. As with the VCI, this is much like holding a physical driver’s licence or passport, but with privacy-preserving features such as data minimisation. The health data credential can reside with health providers such as the NHS or trusted providers. Like the VCI, the networked nature of the approach creates the potential for data protection issues that cannot be fully rectified by data minimisation.
3. The International Air Transport Association’s Travel Pass Initiative
Successfully trialled by Singapore Airlines in March 2021, the International Air Transport Association’s (IATA) Travel Pass Initiative is now set to be used by several airlines as a global solution to validate and authenticate law and policies regarding passenger travel requirements during COVID-19.Footnote 16 This technology is based on four independent open-sourced components that can interact with each other using blockchain technology and can be combined for an end-to-end solution. These include: (1) a registry of global health requirements that provides information on vaccine status, testing and travel requirements; (2) a registry of testing vaccination centres to identify labs and testing centres at departure locations; (3) a lab app through which labs and test centres can send test results or vaccination certificates to passengers; and (4) a digital passport module, which will enable passengers to create, verify and share their certificates.
However, as there is currently no global standardisation in terms of the key elements of a digital certificate, this app and similar ones may have no capability to differentiate between fake certificates and even fake results. The travel pass communicates with different governments, airlines, test centres, vaccination providers and passengers. This means that it interacts with different data protection laws and regulations. This clearly creates concerns about compliance with GDPR, and there is little to indicate that the registries will not be used for other purposes such as marketing.
4. IBM’s Digital Health Pass
IBM’s response to COVID-19 is pitched around helping customers to get people back to work and back to physical spaces,Footnote 17 and it aims to be adopted in Germany.Footnote 18 Underpinning the technology of the digital health pass is IBM’s approach to blockchain.Footnote 19 IBM’s Digital Health Pass includes three major leading-edge technologies that are already combined in the online marketing material. Firstly, an application issuing credentials as used by approved issuers such as test centres or hospitals is included. A second application, the digital wallet, receives the validated credentials. This is embedded in the phone in a complex array of algorithms and encryption mechanisms. A third application, used by verifiers, processes and identifies challenges and responses and, significantly, has access to keys and schemes from the blockchain distributed ledger.Footnote 20 IBM acting as gatekeepers to the system alongside their approach to blockchain means that there will be transparency and commercial interests that may result in regulatory barriers. IBM’s offering confronts the regulatory challenges raised by both blockchain and open source.
5. The EU Digital COVID CertificateFootnote 21
Agreed by the European Parliament on 21 May 2021 and due to be implemented on 1 July 2021, the renamed EU Digital COVID Certificate sets out to standardise and harmonise the vaccine passport approach across all EU Member States (with a few exceptions) (9a, 25a).Footnote 22 The aim is to enable the free movement of people during the period of the pandemic, with the intention being that its use would end after twelve months (42). From a techno-ethics perspective, the digital divide has a major impact on individuals’ access to services, and vaccine passports introduced without low-tech options could lead to further exclusion of already-vulnerable groups.Footnote 23 By offering both paper and digital formats (14), the EU Digital COVID Certificate addresses this issue. There are strong GDPR and personal data protections built into the regulation, and the document is at further pains to emphasise both the twelve-month time limit and the specifically COVID-19 nature of the regulation (42). There is also a requirement that no central database will be maintained, which also prohibits the retention of personal data by Member States (40), a reassurance that may allay the fears of some regarding mission creep.
However, the framework will operate utilising a public key infrastructure (39), which, as discussed below, creates regulatory concerns regarding GDPR and ownership/access/further processing of the data. The problems of regulation in a distributed system that utilises blockchain technology are in part because it is so complex, with many interlinked gateways and entry points. A key element of data protection for the individual is to be able to edit or add notes to records should they be incorrect. Due to the trusted nature of blockchain, editing is not possible, and so this could result in people being unable to travel based on earlier records that they had been unable to delete or revise.
The EU Digital COVID Certificate approach includes a “strong preference” for the use of open-source technology (15), which begs two questions: (1) Who will be developing this technology? And (2) would a partial open-source disclosure be acceptable in order to get the systems up and running ahead of the 1 July 2021 deadline? The involvement of commercial interests, alongside a preference rather than a requirement for open-source technology, could be potentially problematic for regulators in attributing liability should there be a data breach or other problems in the future.
III. Risk-bearing vaccine passport technologies
1. Blockchain
Several vaccine passports employ blockchain in their implementation. The technical foundation of the IBM Digital Health Pass is Hyperledger Fabric, an open-source blockchain modular framework for building a distributed ledger. Hyperledger Fabric enables the building of a network of networks.Footnote 24 Data can remain private while sharing hashes as validation evidence. It uses a permissioned architecture that requires a centralised authority to define and operate the blockchain system, granting access according to the authorities’ rules. While Hyperledger Fabric has been developed by an open-source software community, IBM envisages its implementation as meeting the needs of the client owners, supported by IBM consultancy. IBM’s Digital Health Pass is already operating in the field with voluntary testing in New York State.Footnote 25 The use of blockchain as the engine of the EU Digital COVID Certificate, the IBM Digital Health Pass and the IATA Travel Pass Initiative requires a focus on the ethics of blockchain as a transaction technology.Footnote 26
Tensions arise, for example, between blockchain and GDPR, depending on the use case and the type of blockchain. Opinion differs as to whether blockchain is an aid or a hindrance of GDPR.Footnote 27 Blockchain is a distributed ledger technology that allows a network to validate a transaction and is based on a distrust of any centralised control.Footnote 28 It is trustless by design, being outside the control of centralised databases, platforms or protocols.Footnote 29 The philosophy of the technology is essentially anti-regulatory. Blockchain has been compared to other technologies without central control such as M-PESA.Footnote 30 The effectiveness of M-PESA depended on it being kept out of the usual scope of financial regulation. A technology that promotes non-regulation poses significant problems when it is incorporated into health technologies that should be subjected to the rigour of regulation.
Blockchain technology is being used to support the implementation of self-sovereign identity in which the owner of the data chooses what data items to show, over which the owner has exclusive control, and which are stored locally. The concept, in its experimental phase,Footnote 31 may have consequences for laws of identity and hence the regulation of digital vaccine passports.
The use of blockchain raises questions concerning issues such as anonymity, erasure and data control. As far as personal data are concerned, however, hashing cannot be an anonymising technique, and therefore it is not a solution to the data protection concerns (depending on the use case). Being an “append only” system, the vaccine passport’s immutability concept makes it difficult to exercise a data subject’s right to rectification and erasure (GDPR Articles 16 and 17), even with the identification of a data controller or indeed joint data controllers. Being a decentralised system, it is impossible to delete or update records without tampering with the chain process. Even what constitutes erasure is not defined in GDPR and has been opened to interpretation. It is important that data subjects’ right to minimisation is enhanced by making sure that the protocol is designed in such a way that each piece of data is accessed only by parties that need to do so and can be deleted or rectified upon request. Furthermore, as part of data subjects’ right of access (GDPR Article 15), individuals should be able to be informed when their data are being processed for automated decision-making (GDPR Article 22). One report recommended avoiding storing personal data on blockchain for this reason.Footnote 32
The vaccine passport blockchain model is based on collective processing of personal data using a shared protocol; therefore, identification of the data controller responsible for determining the purposes and means of processing under Article 4(7) of GDPR becomes difficult, particularly if blockchain transactions are written by the data subject.Footnote 33 Based on the interoperable nature of the vaccine passport model, one solution may be to adopt a joint controller approach where a consortium of entities is accountable for demonstrating compliance with GDPR.
Privacy by design and by default raises another tension for vaccine passports. The development of technical, procedural and organisational measures through the lifecycle of the processing of personal data is very important (GDPR Article 35). One way to achieve this is by conducting a data protection impact assessment.Footnote 34 This should be done as a default mechanism that aligns the process and outcomes of the blockchain technology to privacy and data protection. Currently, it is not clear what these measures are or how they will be achieved to comply with this requirement. Although a lawful basis for the processing of vaccination details for the purposes of providing access to services or venues can be established under public interest (GDPR Article 6(e)), being data concerning health, an individual’s vaccination details fall under special category personal data (GDPR Article 9), making them subject to special protection.Footnote 35
2. Open source
Open-source software development has gained considerable traction in the software industry. Firms such as Microsoft and IBM, which were previously resistant to open-source development, have embraced the concept and deliver services using open-source software. IBM bases both its blockchain and quantum computing services on open source. Specifically, the definition and programs for implementing a Hyperledger blockchain are readily available and non-proprietary, and open standards are applied in both the blockchain application and its security. The specifications for the IBM Digital Health Pass use cases are available on GitHub, as is some information on the EU Digital COVID Certificate. Furthermore, the VCI consortium also offers access to the Smart Health Cards Protocol, which takes an open-source approach.
IBM, in marketing its Digital Health Pass, emphasises trust and transparency, citing the open-source nature of the technologies used. However, the argument that open source is transparent is one that needs evaluation. Transparency is a complex concept. That the open-source nature of the blockchain development environment renders the specific blockchain implementation transparent is a debateable point. Indeed, the complexity of blockchain renders it somewhat opaque. Furthermore, one needs to ask what any vaccine passport provider means by “transparent” and whether the governance and execution of open-source development are any more open than a proprietary development by software houses, who may not be subject to regulatory frameworks.
Several of the proposed implementations depend on open-source development by third parties. While the EU has addressed open source,Footnote 36 the focus has been primarily on intellectual property rights. The EU Open Source Software StrategyFootnote 37 does not address responsibilities nor regulatory issues when the resulting software has significant legal, human rights and security implications. Accountability cannot be allocated. Although in many cases, while the platform and requirement definitions are open source, the delivery of the service may be a commercial proposition through a company such as Red Hat (owned by IBM). It may be legally difficult to allocate blame. The problem lies with the inherent philosophy of open source.
Open source developed as an offshoot of the Free Software Foundation, which promoted the sharing of software and changes to software. Open-source software is developed by decentralised and collaborative communities relying on peer review. This decentralised model has parallels in the development of the Internet and hence presents similar problems of regulation and control. Such projects are hosted on the GitHub software configuration database and cannot be managed or controlled by governments or companies. Hence, companies enter the open-source ecosystem by contributing to existing communities to the benefit of the companies. Since the consequences of GDPR for open source and the conditions imposed on open source are matters of discussion and are yet to be tested,Footnote 38 it is likely that the founding of vaccine passports on open source will pose future regulatory headaches.
3. Data networks
Vaccination passports will draw on a range of centralised and decentralised data sources to create a unique profile for everyone to represent their COVID-19 health status. As such, that digital description may not be simply constrained to whether the individual has had a vaccination, but may eventually relate to the whole health status of the individual, which may come to bear on their calculated risk to themselves and others.
A vaccination passport system is not an isolated app on someone’s mobile phone. Rather, it is a mass of connected systems, data and technologies. The marketing for the IBM Digital Health Pass references artificial intelligence (AI), the Internet of Things (IoT) and blockchain. The German implementation specifically partners IBM with a company whose focus is on the IoT. Further integration as a border pass will involve connection with biometrics and technologies such as facial recognition and data analytics, which depend on AI algorithms. Digital health passports may well be integrated with the IoT through Bluetooth beacons and wearable devices. The technology environment of vaccination passports is fluid and connected, which precludes the isolation of individual programs or technologies for ethical consideration, resulting in further policy vacuums and regulatory gaps. A more systems-based approach, however, treats the vaccination passport as an information technology ecosystem and that the connections demanded by blockchain, alongside the connections required to validate the data on which the pass is based, constitute a network of networks.
IV. Conclusion
Digital passports comprise a complex brew of technologies whose regulation is problematic. The technologies of blockchain and open-source systems and software are developed outside of traditional regulatory domains, which is antithetical to their founding philosophies. Furthermore, AI, which is used in the management of digital passports, and the potential for machine learning applications introduce a domain where ethics and regulation are matters of debate and global concern. The regulatory epistemologyFootnote 39 of digital vaccine passports poses a novel set of problems because of the variety of technology platforms and processes. Sources of expertise will be difficult to draw on, and only a surface understanding of blockchain implementations, AI algorithms and open-source specifications will not suffice. In an environment of authorities and actors, ranging from the EU, national governments and technology companies to individual programmers contributing to an open-source implementation documented on GitHub, there is a complex network and hierarchy of authorities and opinions. Furthermore, the malleability of purpose of vaccine passports and the future potential for extending purposes across, between and within states may threaten the regulatory process and trigger a regulatory crisis.
Our discussion of the implementation of blockchain identifies the multiple data sources, authorities and actors involved in the digital vaccine process. The passport, with its limited and defined dataset, cannot operate without a distributed and extensive network of sources to support it. The authority is not encoded on the passport, but rather with a population of institutions that maintain the blockchain and issue certificates. These authorities include the private companies running the tests, developing the blockchain applications, supporting the data sources through cloud offerings and interacting with one another. Thus, the passport floats in an ocean of data and connectivity that, when integrated, is open to hacking by individuals and states and can be corralled for a particular purpose by organisations occupying hubs within the network.
Blockchain is effectively a network of networks, supporting constant dynamic flows of information and vulnerable to intrusion at any point. Regulation of vaccine passports will be inadequate for managing the technological complexity and reach of the digital vaccine passport network of networks. The technical aspects are of equal if not greater significance than the health and border control issues being raised. As such, regulation of the network of networks will require a new regulatory and policy approach that addresses the systemic and entangled nature of digital vaccine passport technology. We would recommend that approaches from complexity sciences that address the boundaries, networks and hierarchies of the political, social and technological systemsFootnote 40 be explored in order to provide new approaches and models for the regulation of complex technological environments.Footnote 41
The response to COVID-19 becomes a solution to any imagined scenario and a permanent strand of risk reduction. The new normal irreversibly includes the monitoring of an individual’s health, whether mediated through a vaccination passport, embedded in the work and travel environment or embodied surgically. This irreversibility within the network of networks, in the terms of Latour,Footnote 42 becomes a black box whereby vaccination passports and their development as a complex means of health monitoring become taken for granted and further proliferate within the surveillance society. In this environment, regulators and policymakers should consider the much wider context in which the setting and upholding of standards and oversight is made much more difficult due to the leaky vessels that are sailing in the immense ocean that is the network of networks.
