Vaccine proof: How passports work, plus privacy concerns

Flashing digital proof of COVID-19 protection could become the norm at Las Vegas events this year, but privacy experts say they’re concerned about data collection by two new “vaccine passport” phone apps.

Clear’s Health Pass and VST Enterprises’ V-Health Passport are part of a burgeoning tech solution aimed at helping people gather more safely. The apps contain a digital record of a user’s recent negative COVID-19 test or vaccination verification, allowing users to gain entry to certain events or businesses.

Large venues and events in Southern Nevada’s tourism-driven economy are becoming early adopters of the two apps, while leaders in some surrounding states have taken action to limit all vaccine passports.

Catesby Perrin, Clear’s executive vice president of growth, said Health Pass will protect both visitors’ and workers’ health. At some events, he added, there could be on-site testing available for people who don’t have or want a vaccine passport app.

“We think we have a unique capability to help the world come back faster in this moment,” Perrin said.

Like choosing to get the vaccine, downloading the apps is an individual choice, but private businesses in Nevada can legally require customers present proof of vaccination or a negative COVID-19 test, so long as they don’t do it in a discriminatory way, said professor David Orentlicher, director of the UNLV health law program.

“There’s an important public health interest here,” he said. “We know that people who are vaccinated pose far less risk to others, and it’s important for businesses to have a safe setting.”

Privacy experts cite concerns

Vaccine passport apps are gaining popularity in part because they are more secure than paper vaccination cards, according to proponents. Nevada Attorney General Aaron Ford this week warned of fake cards being sold online.

But two privacy experts said users could be agreeing to share more of their personal information than they realize.

UNLV cybersecurity program director Gregory Moody and civil rights attorney Albert Fox Cahn reviewed the privacy policies of V-Health Passport and Health Pass at the request of the Review-Journal.

Both apps’ policies allow their companies to collect users’ location data and demographic information — data they could then share with business partners and police, the experts said.

Many apps have policies that allow collection of similar information from users. But Cahn and Moody said they’re worried about suggestions of expanding the use of digital health credentials for accessing everyday activities, like going to restaurants or movie theaters.

“They’re potentially tracking our movement around the city on a daily or hourly basis,” said Cahn, executive director at the Surveillance Technology Oversight Project in New York, a nonprofit advocacy organization aimed at curbing surveillance technology.

Executives at Clear and VST Enterprises pushed back against the criticisms about data collection and sharing policies.

They said their apps gather minimal information from users, store it securely and will delete an individual’s data upon request. The permissions requested by the privacy policies are needed to upload health documents to the apps and securely check-in users at events.

“What we’ve tried to do is build a tool that both protects consumer privacy and data, and allows the consumer to own and control that data,” Perrin said of Health Pass.

V-Health Passport creator Louis-James Davis said his app encrypts users’ data whenever it is sent and stored.

“None of the data is accessible without the user giving an administrator the right to see it,” he said.

Cahn said there are also broader concerns that the proliferation of vaccine passports could disadvantage people who can’t afford a smartphone or are uncomfortable using one. Moody added that there is little existing framework on requiring digital health credentials to access businesses.

“It goes explicitly contrary to what has been set up as legal practice in regard to health-related data in the United States,” Moody said. “There’s never been a precedent in place before that this is normal and acceptable.”

Two G4 Live cannabis events expected to draw a combined 23,000 attendees will utilize V-Health Passport in May and September.

Health Pass is already in use at Vegas Golden Knights home games. Las Vegas Sands Corp. and MGM Resorts International have both announced they will use the technology at upcoming conventions.

Clear reports it is unaware of any users’ data being stolen since it launched in 2010. Perrin said the app’s use as a pre-flight screening platform, means it must meet rigorous federal standards in protecting users’ data.

“That government-certified back end is a real advantage and differentiator for us,” he said.

A divisive technology

Proving vaccination against certain diseases is already commonplace in some situations, such as when registering children for public school and for travel to certain countries.

Nonetheless, vaccine passports have become a political and cultural flashpoint this year.

Last month, New York launched “Excelsior Pass,” a state-endorsed app that is now in use at stadiums and other large venues.

California state health officials are allowing businesses to hold larger indoor events if they require attendees to show health credentials. In the same state, a lawmaker has introduced legislation to block the apps’ use.

Governors in Arizona, Utah and Idaho have limited use of the apps, joining Florida and Texas.

Nevada COVID-19 response director Caleb Cage said he had not heard of any plans or interest by state officials here to endorse or regulate vaccine passports. At the local level, Clark County’s reopening plan explicitly states it would not require large events to track attendees’ vaccination status.

“I don’t think that there’s any support for or interest either in telling private industry what they can and can’t do in order to ensure that they have the safest possible venue,” Cage said.

Nevada Gaming Control Board chairman J. Brin Gibson said vaccine passports could serve a valuable purpose in Las Vegas, but at this time he didn’t see the state throwing its support behind any particular app.

“Privacy is always going to be paramount,” he said. “We can’t lose all of that just because we’re in the middle of a pandemic. It’s hard to claw it back once you get out.”

What do app privacy policies allow?

One key privacy concern is apps tracking where users check in, Cahn said.

In recent years, police in multiple states have sought cellphone users’ location records from Google, The New York Times has reported.

“An app that I might never think twice about downloading as a white, male, U.S. citizen, could pose a deadly risk to a user who is undocumented or has criminal justice involvement,” Cahn said. “The technology is poised to create a new, inescapable layer of geolocation tracking.”

V-Health Passport, part of the VPassport app, will only access users’ location data to ensure attendees are physically present when accessing an event and for disease contact tracing purposes, said Davis, the app’s creator.

Clear uses location data as part of its pre-flight screening platform, but users of only the app’s Health Pass service will not have to share it, company spokesman Ken Lisaius said.

Health Pass requires users to answer health survey questions, complete temperature checks and share their test and vaccine records, Lisaius said. However, it does not utilize many of the other activities outlined in the app’s privacy policy, such as subjecting users to background checks or sharing their information “in response to requests” from law enforcement agencies.

“We have a single privacy policy because Clear’s platform supports multiple services for our members, and we expect our members to move seamlessly between those services,” Lisaius said.

The Review-Journal is owned by the family of Sheldon Adelson, the late chairman and CEO of Las Vegas Sands Corp.

Contact Michael Scott Davidson at sdavidson@reviewjournal.com or 702-477-3861. Follow @davidsonlvrj on Twitter.