Immunity passports and Covid-19: an explainer

Definition

An immunity passport (also known as a 'risk-free certificate' or 'immunity certificate') is a credential given to a person who is assumed to be immune from COVID-19 and so protected against re-infection. This 'passport' would give them rights and privileges that other members of the community do not have such as to work or travel.

For Covid-19 this requires a process through which people are reliably tested for immunity and there is a secure process of issuing a document or other credential linked to that individual and that immunity statement. It could be a certified document - actual or digital.

If a vaccine is created, the immunity passport could record that the individual has been vaccinated.

Who is calling for it?

Travel firms and airports, governments, famously illiberal former Prime Ministers of Great Britain, and the digital ID industry.

And people also want this, particularly as they are being told that this will set them free by giving them privileges that have so far been denied, such as going back to work or travelling.

Why does it matter?

It is presented as a solution which will create opportunities for unlocking, and for people to go back to their lives. The epidemiology of this is still under question.

The risks to individuals and communities emerging from this are huge. Immunity passports are essentially restricting the liberties of individuals on the basis of their "immunity" status, or lack of it.

How would it work?

You get a test for whether you are immune (which is different from a test for whether you have the virus at this moment in time), you get a credential.

You are then are asked to show it to enjoy certain liberties, to engage in social, civic and economic activities. If the whole system works, it means that governments, companies, employers, and others will all be asking for you to show it.

Why is this a problem?

At first, the problems are simple. You have to get a test to see if you are immune. Except nobody is quite sure if the tests work. Nor are we sure who will be able to get a test as governments buy up tests and companies charge for them.

On top of it all, medical scientists aren't sure if immunity works. The World Health Organisation continues to take the position that

At this point in the pandemic, there is not enough evidence about the effectiveness of antibody-mediated immunity to guarantee the accuracy of an “immunity passport” or “risk-free certificate" and also there continues to be serious concerns about false positives and false negatives of tests for COVID-19.

WHO

This has been their guidance since April. Other medical and public health institutions have also supported this position.

Once the test is done you have to get a credential. This is technically easy. A verified credential would be similar to a verification of a claim made about you (e.g. you are 'immune') by a third party (e.g. a testing agency). Smarter deployments would allow you to share your claim, 'I am immune' rather than the whole identity: "I am called Y, born X, favourite colour C, and am immune to covid".

You are going to be asked to show it. It will have to be verified. It will have to be trusted. That is, those looking to see the credential would be able to trust that the certificate of 'immunity' was from a trusted source.

If all of the above is achieved, which is a huge 'if' then it will be used to segment and sort people for things they have no control over. If history tends to replicate itself it is likely that this segmentation will reflect pre-existing biases and discriminatory practices seen in our societies.

But in theory it sounds useful?

That is the problem. If it becomes the currency for engaging in the outside world, then there are a number of follow-on ramifications.

First, people will want to get immunity. They could put themselves at risk, i.e. will try to get the virus to then recover and get back to their lives and to ensure their livelihood. If we build a world where immunity is valuable, the social and economic costs of not to being recognised as immune will be too high for many in society.

Second, people will struggle to get tested. The antigenic test that identifies the root of potential immunity is completely different from the virus test. Like the virus test, however, they are hard to come by. Because of the unavailability of tests, there are rules about who can get or barriers to access about who is entitled to get tested. Being able to procure a test will help people get back to their lives, so the value increases.

Third, people will struggle to get identified. If getting tested and/or the passport requires additional ID documentation, they will have to get that ID documentation intertwined with their immunity documentation to get back to their lives.

Fourth, testing centres will become incredibly important in global modern society. They will have to be trusted to run good tests, trusted to issue your certification, trusted to verify; and all of this trust will be needed across borders, e.g. a Floridian testing centre's claim of your immunity will be verified by an airline prior to you boarding at a London airport for a connecting flight to Germany.

Fifth, fraud will be rewarded richly.

Finally, it might lead people to change their behaviour and not comply with other public health measures if they are told they are immune, and unknowingly they could still infect others. This would spark further outbreaks.

Is immunity for COVID-19 a thing?

We still don't know.

In addition to the on-going concerns about the inaccuracy of antibody testing itself, the scientific validity/rationale of 'immunity' is still under question. It is premature to start desiging a system without a better understanding of immunity. Crucial questions have to be answered first:

• How and in what ways immunity to the virus is conveyed?
• What a testing regime would look like? For example, is it home-based or does it require a lab? Is it something that can be rolled out at scale quickly to broad populations or is it only accessible to some?
• How long does immunity last? and
• What are the prospects for a vaccine and how will that be deployed?

Without an understanding of these issues, it is not possible to design a system that both 'works' in terms of giving the information that's needed for public health reasons and for managing the next steps of measures to manage lockdowns including the associated economic and social strains associated, while at the same time protecting fundamental rights.

Once answered, then we will all know what problem the ID system is designed to solve. Without the knowledge of how immunity works, we cannot possibly yet say what the design should be.

The World Health Organisation (WHO) has been explicit about the current state of evidence:

There is currently no evidence that people who have recovered from COVID-19 and have antibodies are protected from a second infection.

WHO

Research from Imperial College London highlights the challenges in the testing of antibodies that would lead to 'immunity passports'. For instance, researchers identified that there are dangers present if non-immune people end up receiving a passport. They also noted that some presentations of the disease (for example, young people and those with mild symptoms) might not be able to qualify for a passport. They also reiterate the WHO's point that it remains unknown as to whether the presence of antibodies actually protects people from further infection.

There are also uncertainties about how test accurately distinguish between past infections from SARS-CoV-2 and those caused by the known set of six human coronaviruses which four viruses which cause the common cold the viruses which caused the Middle East Respiratory Syndrome and Severe Acute Respiratory Syndrome. The WHO has warned that "people infected by any one of these viruses may produce antibodies that cross-react with antibodies produced in response to infection with SARS-CoV-2.

It is also unknown as to how long any immunity may last. Therefore any technical choice, such as immutable ledgers and blockchain would be inappropriate.

To sum up, there are a lot of uncertainties and very little or no epidemiological evidence.

Who will it affect?

Many people will be left behind. People who haven't been exposed to the virus. People who have had the virus but don't have the antibodies. People who don't have access to tests, or to the wrong tests. People in countries where there is limited infrastructure.

And the same goes for people who are traditionally targeted or excluded and it has the potential to reinforce existing inequities and causing more harm. Policies that require people to show their status have left many broken lives behind. Whether it is Kenyan ethnic minority populations, the Windrush generation in Britain, or migrants in Chile, the damage identity policies have done should teach us important lessons about what to avoid when turning our attention to immunity passports. For example, demanding people show proof of entitlement to healthcare primarily effects those people who 'look foreign' as reported by frontline organisations working on migrants' rights to public services. Access to employment, health, and even access to public space could all be restricted, deepening the exclusion of disadvantaged groups.

As one public health researcher warned, immunity passports risk "enshrining such discrimination in law and undermine the right to health of individuals and the population through the perverse incentives they create" which go against the obligation of States to prevent discrimination as they progressively realise economic, social and cultural rights.

We've been here before, and recently. The rush for contact tracing apps was done with little regard to wondering who they would work for; and some proposed immunity passport solutions are smartphone based, limiting access to only those who have these devices.

How will this be deployed and enforced?

The goal is in theory a simple one: a credential that is available to everyone who is verified. In practice, and from our experiences in both public health and identity systems, the realities will be very different. This is because the two worlds have very different agendas: public health is supposed to be about inclusion and care; identity systems are about segmenting and targeting.

Many dangers arise from the contexts within which proof of immunity status may be demanded. Key questions include:

• Will it be required prior to economic participation, such as to work or enter shops?
• Will people be stopped from doing something unless they can show their credential because it is a symbol of economic viability, e.g. from renting or loans?
• Will people need to show their valid status in order to emerge, and in that case will enforcement involve showing your status to police at checkpoints? and
• Will it become necessary for travel or passing through borders, and if so, which credentials and claims will be acceptable across borders?

For instance, the Tony Blair Institute for Global Change, a particularly vocal proponent, states that "private office buildings should have the right to require all staff to present a credential on entry". For those working in industries where it is not possible to 'work from home' - or those whose bosses don't offer that solution - then this is essentially saying that people would need an immunity passport in order to continue to be employed. Given that they also note "trains could operate at maximum capacity if these checks were in place", we are also talking about limiting the ability of people to travel to work - again, excluding people from employment.

The powers of the police, and the security services, in regard to this is an important area of concern. OnFido, an aspiring provide of immunity passports, has stated in internal documents

that an immunity passport must be "recognisable to law enforcement and other agencies".

OnFido, Digital ID firm, in documents quoted from the Daily Telegraph

But the exact powers of the police in this need careful consideration: we already know that police enforcing the lockdown are far more likely to target minorities and previously targeted populations, e.g. in the UK black and ethnic communities in the UK.

Immunity passports could give the police and security services more powers to not only know information about our health, but also to stop people and demand proof of immunity -- in certain situations. Concerns of mission creep were already expressed by the WHO when it came to contact tracing measures and the institution demanded that such measures should

not be used punitively or associated with security measures, immigration issues, or other concerns outside the realm of public health.

WHO Guidance on Contact Tracing

When integrated with identity systems, which are nearly always designed with security and immigration concerns as drivers, we should expect mission creep in immunity passports.

Are these passports legal?

The uncertainties and variances makes immunity passports legally dubious. The conclusion of Matrix Chambers, a leading human rights firm in the UK, is that

we have seen no basis on which it could be said that profiling and immunity passports are strictly necessary, appropriate and proportionate to the objective of managing and monitoring the spread of COVID-19.

Could we build, this one and very important time, an unprecedentedly fair ID system for Covid?

Building this would require an unprecedented level of global fairness in health and identity. From our analysis of the identity industry's response to covid, immunity passports are being seen as market opportunities for identity companies. Unless extraordinary measures are put in place, these passports

• will be integrated and essential across our lives,
• will lead to further exploitation of people and their data, and
• these structures will likely remain in place well after the pandemic is over.

Industry and governments are counting on this. After all, once built identity system are rarely dismantled. Instead, the tendency would be for it to be turned into a more general 'digital identity'.

At the moment, immunity passports are not necessary nor are they proportionate responses to the pandemic. As our understanding of the nature of immunity changes, this may change - but only for a very limited number of use-cases, and even these need careful consideration.

This is a deeply challenging area, and it may very well become the case that there are no use-cases where the benefits outweigh the harms. These decisions have to be primarily made in the interests of the most vulnerable members of society: those who are worst-hit by the pandemic and who look likely to be worse-served by an immunity passport solution.

What do governments need to do?

• Decision-making around immunity passports must follow and respect the current epidemiological evidence on immunity and the covid-19.
• Immunity passports must be withdrawn and the policy and tech infrastructure removed after the pandemic.
• Any decision to deploy immunity passports must clearly articulate the scope and purpose in primary legislation to ensure the process is subject to open, inclusive process.
• Immunity passports must align with national and international legal obligations upholding principles of fairness, transparency and lawfulness, purpose specification, minimisation (necessity and proportionality), accuracy, storage limitation, and confidentiality and integrity.
• Consideration must be given to other types of harms and threats including exclusion and discrimination as well as targeting and profiling, and meaningful safeguards, monitoring, and auditing are established, when used across all society (by governments, private sector, and globally).
• The uses of immunity passports must be clearly articulated, and they must be firewalled from being used for other purposes.
• The design and tendering process must be open and transparent to public scrutiny.
• Measures must be taken to prevent immunity passports becoming the foundation for longer term digital identity systems.
• To ensure against abuse, targeting, and exclusion, the use of foundation identity documents for immunity passports must be avoided.

What does industry need to do?

• Industry must commit to not be leveraging an immunity passport to broader digital identity solutions, to promote their own services and products.
• Industry must commit to not deploy any technological solution until it is supported by the epidemiological evidence.
• The development of new models of digital identity must be separated from immunity passports.

What else is needed?

• Organisations working on global health such as the WHO must continue to provide advice on the topic of immunity, as well as being conscious of the deep human rights impacts of these types of measures.
• Organisations and alliances working on the essential work of vaccines should not also be proponents of digital identities.
• More research is required on the exclusion and targeting of populations in public health and in identity systems and their overlaps.