New York’s ‘Excelsior Pass’ is America’s first vaccine passport

On the Upper East Side in Manhattan, a well-heeled crowd flashed it to get into a socially distanced dance performance at the Park Avenue Armory. In Chelsea, people showed it to attend a John Mulaney stand-up set at City Winery. And in Troy, New York, patrons are using it to enter an intimate, speakeasy-style bar that admits only vaccinated guests.

This magic ticket is New York state’s Excelsior Pass, which was introduced in March as the first and only government-issued vaccine passport in the country, accessible, for now, only to people who have been vaccinated in the state.

Officials are hoping that it can help New Yorkers feel confident about the safety of businesses and jump-start a statewide economy that is still reeling from losses experienced during the pandemic. But for that to happen, they will need more people and businesses to start using it and vaccine passports to become more universally accepted.

Though it is basically just a QR code on your phone that indicates your vaccine status, the pass, and vaccine passports more generally, have become a political flashpoint among conservatives who say the passports violate privacy concerns.

About 1.1 million Excelsior passes have been downloaded onto phones and computers since the passport’s introduction, according to the state, which is only a fraction of the 8.9 million New Yorkers who have so far been fully vaccinated.

But officials are hopeful that it will catch on more widely.

Eric Piscini, the vice president for emerging business networks at IBM, which developed the Excelsior Pass for the state, said New York was in discussions with other states so the pass could be used by out-of-state residents in New York and by New Yorkers elsewhere.

“In the application space, when you reach a million people, that’s a pretty good threshold to pass,” Mr Piscini said. “That is a really good indication that people find value in this.”

Nationally, a range of states including Georgia, Alabama, Arizona and Florida have already banned the use of vaccine passports, presenting the bans as measures to protect individual privacy and vaccination choice.

In New York, some lawmakers are backing new legislation that would provide additional privacy protections.

But though major sports venues and a growing number of smaller New York businesses are embracing using the app, the vast majority of businesses are not requiring any proof of vaccination to enter. (The state would not say how many businesses had signed up.)

For those that take the Excelsior Pass, paper vaccine cards must also be accepted as a form of proof, the state said.

Some businesses — especially those catering to adult audiences, like arts venues — are jumping into the world of verification. Aside from accepting the Excelsior Pass, City Winery in Chelsea, for example, also uses the CLEAR pass as a way to verify health and vaccination status. Governor Andrew Cuomo has encouraged the move toward fully vaccinated crowds by permitting businesses to disregard social distancing if everyone is vaccinated.

But civic technology experts warn that the passes can be gamed relatively easily, just like the paper vaccine card itself.

It took Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, a nonprofit watchdog group, just 11 minutes to download someone else’s Excelsior Pass using information they had posted on social media and Google searches, he said. Many people have posted pictures of their vaccination cards, which include a person’s name, birthday, date of vaccination and type of shot.

And each pass can be uploaded to a limitless number of devices, or printed out and copied. The Excelsior Pass, which cost the state $2.5 million to develop, contains no biometric data for privacy reasons, so it needs to be compared against an ID, an extra step that, in practice, sometimes isn’t taken.

“We need to realise that as much as we want a magic piece of software to be able to tell us whether the person next to us is vaccinated, these apps really can’t,” Mr Cahn said. “At the end of the day, it’s largely built on trust.”

Accessibility is another worry. New York’s vaccine rollout was marred by a heavy reliance on a complex internet appointment system, which gave tech-savvy people an advantage. Many older New Yorkers and those without good internet access struggled.

Now those same people face another technological hurdle if the pass becomes popular. Noel Hidalgo, executive director of BetaNYC, a nonprofit public interest technology organization, said he didn’t think the state should be investing millions in a vaccine passport when more time and effort could be spent on things like helping improve vaccination rates among black and hispanic New Yorkers and figuring out how people could quickly replace a lost or damaged paper card.

“Why are we focusing on providing a tech tool to a small group of New Yorkers who are digitally literate and understand how to get access?” he asked.

Delays in entering data and data entry mistakes are also limiting who gets the pass. About 4 per cent of people who tried to get passes were unable to do so, said Jennifer Givner, a state spokesperson.

The pass pulls its information from the state and city immunisation databases. If the information is entered incorrectly — for example, with misspellings or a wrong initial — the pass cannot be found.

People who can’t get a pass can fill out a complaint form and call a state hotline, but for the most part, the organization that vaccinated them has to correct the data, which is not always easy. The Excelsior Pass also does not have access to federal vaccination data, so people who got their vaccines at veterans’ hospitals, like John Taylor, a 77-year-old Vietnam War veteran who lives in Pleasant Valley, New York, are out of luck.“I had it laminated,” Mr Taylor said of his paper vaccine card. “I’m just going to forget about the pass.”

The New York Times