Earlier this month, the State of California launched one of America’s first digital vaccine verification systems for the Covid-19 vaccine, or what’s often known as a “vaccine passport”.
On June 25th, the Electronic Frontier Foundation, a technology and consumer privacy watchdog group, published a critical report pointing out several privacy issues with California’s Covid-19 verification system.
The EFF’s main criticisms focused on the use of a QR code and the development of a centralized database of patient information, which the group said “can become part of the groundwork for National ID systems...which in one central government repository would store all manner of information about our activities.”
The EFF analyzed the technological framework behind the state’s Covid-19 vaccine QR code, concluding that the framework itself allows for digital signing of vaccine cards using a cryptographic key, and not necessarily the sharing of data.
Still, the EFF worries that “with minimal effort, businesses could use the information in the vaccination record to track the time and place of our comings and goings, pool that information with other businesses, and sell these dossiers of our movements to the government.”
The EFF points out that bars already do this with customer’s IDs, using the documents to verify a customer’s age but also storing the data contained on the ID’s barcode, aggregating it, and using it for marketing or other purposes. No law exists to prevent this use for Covid-19 vaccine records, the EFF points out.
Here’s how that would look. You go to a bar or restaurant, which scans your Covid-19 vaccine QR code. The scanner app checks the code with the state’s database, ensuring that it was properly issued. But the app also stores the personal information contained in the code (including your name, date of birth, and vaccine status), storing it in a third-party database. Later, the owner of the database uses this data to market products to you, or provides it back to the state so that the data on your movements (or even purchases) can be linked back to your vaccine record.
There’s no guarantee that such a system would be built, and the EFF acknowledges “It’s good that California has not, at least so far, created any infrastructure to make it easy to turn vaccination status into a surveillance system that magnifies inequities.”
Still, the group says that because no laws exist at the Federal level to govern companies’ use of customer data, “we must assume that when companies process our data...they will take it down the most exploitative road possible.” For Covid-19 vaccine records, that road could involve aggregation and provision of data back to the state, forming the basis of a National ID system which logs multiple data points about individuals’ behaviors, the EFF worries.
The EFF also worries that the system was enable the development of Digital Vaccine Bouncers that “limit access to life’s necessities and amplify inequities for people who legitimately cannot get a vaccine.” If a person cannot be vaccinated for health reasons and cannot show a vaccine record QR code, they could be locked out of visiting restaurants, concerts, stores, or more, the EFF says.
Ultimately, the EFF praises the open source software used in California’s system, and the fact that users need not download an app in order to access it. Still, the EFF concludes that “we wish California had skipped the QR code”, and that California’s government must establish safeguards on how the system’s data is used, in order to “help ensure privacy in future use of such technologies, during healthier times and in any future health crisis.”
This is original content from NewsBreak’s Creator Program. Join today to publish and share your own content.