Inside the race to create a vaccine passport With lockdowns set to be lifted, start-ups are already competing for Government approval

It has been exactly a week since Boris Johnson unveiled his “roadmap” out of lockdown and already Britons are booking holidays and reserving tables at their favourite restaurants. The vaccine rollout is proving a huge success, and there is a growing sense that if you’ve had your jab, the world will soon be your oyster.

The natural extension of all of this euphoria has become the need to prove that you’ve been immunised. And so the concept of the “vaccine passport” has been born; a digital document or smart phone app, a magic ticket that will allow you to hop on a plane, go to the theatre or pop to the pub.

Only last week, after facing pressure from countries reliant on summer tourism – including Greece, Italy and Spain — European leaders confirmed their intention to create an EU-wide vaccine certification scheme that would record people who had received approved jabs. “Everyone agreed that we need a digital vaccination certificate,” Angela Merkel, the German chancellor, said after a virtual summit. “This will make travelling within the EU possible and could pave the way for further travel from third countries into the EU.”

It’s hardly surprising, then, that an array of British start-up companies is now jostling to produce a bewildering collection of “travel passes”, “immunity certificates” and “health passports”. But what, exactly, are they? And how will they work?

First, it is important to remember that proof-of-vaccination documents are nothing new. Seasoned travellers have long been required to have certain inoculations before being granted access to some countries. These have, however, never existed in the context of a pandemic; so, in the past, if you had not had a jab against yellow fever, then you would have been barred from only a handful of countries — if you haven’t had a Covid vaccination, the effect on your travel plans could be much more profound.

The vaccination passports currently being mooted are broadly divided into two types: those intended for international travel and those you might be required to show if you wanted to access an office or entertainment venue — though the best solution (if, indeed, you regard such passports as a “solution” at all) would be for a vaccine passport to be recognised both by national border officials and pub bouncers.

Whatever their purpose, all these documents and passports do have one thing in common: they provide verification of a person’s identity — usually through biometrics or facial recognition — as well as up-to-date access to medical records showing their vaccinations, boosters and so on. Some also record whether a person is positive for antibodies, indicating that they have already had Covid-19.

In the UK, it’s worth noting that this path was not always inevitable. In fact, a succession of ministers initially said vaccine passports were not being considered by the government. But, with the prospect of lockdown being lifted now on the horizon, they have rowed back in the past couple of weeks. Indeed, in spite of the government’s initial reticence, almost half a million pounds in grants had already been awarded to eight companies working on variations of vaccine passports before Johnson’s “roadmap” was announced.

Among them is Logifect, a “global digital health solutions provider” which has received £37,000 to help develop a smartphone app to confirm immunity. Before the pandemic, Logifect was already involved in what it described as “the next generation of digital health”, which would enable individuals to access their medical records, receive healthcare advice and manage medical devices from their smartphones.

Its immunity passport, says Commercial Director Sean Power, would be a spin-off of that. First you would download its app to your smartphone. Using your camera within the app, you would be asked for a scan of your passport or driving licence, and then to have your picture taken for comparison and verification. Then, when you needed to demonstrate that your vaccines were up to date, you would open the app and give permission for your vaccine record to be accessed and for a QR code to be produced. This could then be read by the checker’s smart device, which would display a message with your photo confirming your vaccine status.

“Your picture links you to that record — your name doesn’t even appear,” says Power. “The communication is fully encrypted at both ends for complete security and then everything is deleted in seconds.

“We see this as a way of making a positive contribution to the community, with our costs being covered by a small fee — probably pennies — to the venue or authority that requests the information. It would cost the user nothing.”

Meanwhile, iProov, a biometrics ID company that lists the US Department of Homeland Security and the UK Home Office as clients, and cybersecurity firm Mvine, which has already worked on projects with the Cabinet Office and NHS, have been given a joint £75,000 grant to develop an app that would perform a similar task to Logifect’s.

iProov’s founder and CEO Andrew Bud tells me their system involves the creation of a certificate to demonstrate that you have been vaccinated. They have developed a number of options, some of which will need the involvement of the Department of Health.

Currently, vaccination records are held by the National Immunisation Management System, which is run by Public Health England, Scotland and Wales independently of the NHS, and within GP surgery patient records. The iProov/Mvine system proposes storing these vaccination records using cloud technology, so they are neither held on your phone nor within existing NHS record systems.

“One of the defining features of the Mvine/iProov system is that it is designed for privacy,” says Bud. “It doesn’t require a name or address or date of birth or National Insurance number or any other irrelevant data. Our system is designed to associate the existence of a valid vaccine certificate with a face.”

Other companies that have received grants include: EAS Technologies (£137,877), which is focusing on vaccine verification for sporting events; the Hub Company (£49,448), which features PayPal and IBM among its clients; Enduring Net (£49,678), which says it usually focuses on technology “in humanitarian work”; and Verifiable Credentials (£89,000), which is planning to create “Covid-19 certificates” that cannot be forged.

But they are not only runners in this race. In fact, the UK Government is undertaking a three-month review of “vaccine passport” technology and may even consider repurposing the pre-existing NHS app — separate to its track and trace app — which gives people access to their medical records.

However, according to Phil Booth, co-ordinator of medConfidential, a campaign group promoting best practice in safeguarding the confidentiality of medical records, this would likely be unpopular among NHS staff.

“It would essentially turn the NHS into a clearing house for information requested by the private sector,” he says. “This would find great resistance among those responsible for NHS Login [the online portal that patients can use to access a host of services and see their GP medical records]. Being forced to be a certification authority in the midst of all their other pandemic work would be a massive drain on resources and, frankly, a distraction.”

Moreover, Booth says, it is unclear what the purpose of all this technology would be: “It would be impossible for the government to partner up with private companies to produce vaccine passports until everybody had had the offer of a vaccine — otherwise requiring a passport to get through everyday life would be discriminatory.

“But the vaccine take up is so great — about 90 per cent in the higher age groups — that by the time everybody has been offered one, we will probably have reached herd immunity. So, what’s the point of having a passport that will get you into a pub in those circumstances?”

Still, that hasn’t deterred countries across the world from investing in this technology. Israel was one of the first, followed by Greece, Malta, Portugal, Israel, Estonia, Sweden and Norway. None of these countries has said that foreign internationals without proof of vaccination would be refused entry, but instead would be subject to other — more laborious and time-consuming — testing or quarantine regimes.

Domestically, Israel is the only country to have vaccinated enough people to have a system that is already functioning. About half of its 9.3 million citizens have received the two jabs required to qualify for a “green pass” that they can display using a Health Ministry app on their phones — people with such passes are already being granted access to restaurants, shops and theatres.

Airlines, too, are getting in on the act, courtesy of the pre-existing International Air Transport Association (IATA) Travel Pass app. This provides information to travellers on the Covid requirements of the country they are travelling to, tells them where they can get tested if required, enables labs to send results directly to passengers, and, crucially, provides for the creation of a digital vaccination record once governments make them available.

Among those already trialling aspects of it are Singapore Airlines, Etihad, RwandAir, Emirates, Qatar Airways, and Air New Zealand. Moreover, on top of all these initiatives is a whole host of private sector travel and vaccination record schemes, among them IBM’s Digital Health Pass, Daon’s Verifly (currently being trialled by BA and American Airlines) and Microsoft’s Vaccination Credential Initiative.

But with the creation of so many disparate apps and vaccination confirmation systems, surely we will need some kind of international co-ordination for them to be practicable. And there is currently only one body that has an internationally-recognised proof-of-vaccination scheme — the World Health Organisation’s Yellow Card. Indeed, it increasingly seems that the WHO will be called upon to provide a solution to all this apparent chaos.

Already it has teamed up with Estonia — arguably the country with the world’s most efficient joined-up governmental IT architecture — to come up with a system that would enable national “vaccine passport” solutions to work in an international setting.

At the forefront of this partnership is Marten Kaevats, National Digital Adviser to the Estonian government and a member of the WHO’s Digital Health Technical Advisory Group. He says no new technology would be needed for an international system to work. Instead, building up trust among nations, so that they can rely on the information provided by others, would be paramount.

“We currently see most of the different governments deploying various sorts of their own technologies,” he tells me. “In order for these technologies to be able to co-operate with each other, we need to agree upon common global standards and principles.”

The WHO has set up a Smart Vaccination Certificate Working Group in order to achieve this. But, says Kaveats, “the WHO doesn’t currently have a mandate to become the global anchor of trust for cross-border health data services. It could be given that at the end of May when the World Health Assembly [the decision-making body of the WHO] next convenes.”

With the threat of other Coronavirus variants — or entirely new viruses and pandemics — continuing to loom over us, it certainly seems only a matter before an international solution such as the WHO’s is devised. In the meantime, the race for a vaccine may be over. But the race to create vaccine passports has only just begun.

 

---