BONUS: Balancing Privacy and Security with COVID-19 Vaccine Credentials

ROBERT JOHNSON
This is Public Health Review. I'm Robert Johnson.

On this bonus episode, the options for jurisdictions thinking about vaccine credentials as a tool to help them safely emerge from the pandemic. Kevin Richardson, outside counsel on global government affairs for Zebra Technologies, is our guest.

Welcome to Public Health Review, a podcast brought to you by the Association of State and Territorial Health Officials. With each episode, we explore what health departments are doing to tackle the most pressing public health issues facing our states and territories.

Today, as we look to recover from the pandemic, we consider how to safely manage the process for vaccinated and unvaccinated people and whether vaccine credentials might speed the work while soothing privacy concerns.

On this bonus episode of the show, we visit with Kevin Richardson, outside counsel on global government affairs for Zebra Technologies, an Illinois-based tech company supporting healthcare, public sector, and other industries with solutions, connecting them to assets and audiences. We ask Richardson, also the elected mayor of a Chicago suburb, about the options for jurisdictions considering vaccine credentials and whether we can expect more businesses and venues to ask people for proof they've received a COVID shot.

KEVIN RICHARDSON
You know, it's going to depend, really, on two things. First, what the venue decides it wants as a host. And then secondly, whether there are any local or state level requirements—one way or the other—that may exist and govern the activity. I suspect individuals will make their own decisions about what they want to do, and then they will simply do what's required by the venue or by the local or state authorities.

For example, I recently read an article that said some cruise lines are considering vaccine credential-only cruises. I've also seen in the news that the European Union is going to allow U.S. travelers who have been vaccinated to travel to the EU this summer. It's certainly the case that that's going to require something that verifies whether a person has been vaccinated.

You know, the big thing that people want is control. So, the issues that we see on this at Zebra is privacy, security, and equity. And the good news is there are a myriad of technologies out there that can help address those concerns and replace the current CDC paper card.

JOHNSON
The paper card is all people have right now, and I'm still dragging around my old social security card that I got when I was 14—maybe it doesn't look that good today, I have to say. It's like something that should be in the Smithsonian.

You are, at Zebra Technologies, working on making all of this digital and portable, correct?

RICHARDSON
Yes, we are. There are a couple of things that are complementary here that kind of go together. There are the widely discussed smartphone-based, biometrically-enabled apps. But what Zebra has really advocated for us is that those be complemented by a secure card that provides a physical form factor that addresses those key concerns of privacy, security, and equity, because people do want to get their lives back and they do want to be able to control where their information goes.

And so, yes, we're working with channel partners and working to educate policy makers on the entire array of technologies, including the ones where we have significant experience and leadership.

JOHNSON
Can you tell us about any of the people you are working with right now? Anyone getting ready to roll out this sort of application to their customers or their constituents?

RICHARDSON
Well, we're working in a couple of different ways, actually. One is with organizations like ASTHO so that policy makers at all levels of government, frankly, have access to the best and the most current information.

Two key points here, I guess. First is Zebra's secure card solution replicates the CDC paper card while providing important additional benefits in the form of a card-type form factor, and that complements the smartphone-based apps that are being developed.

Secondly—and this goes more to your question—we are a trusted long-term supplier to a number of companies that administer vaccines, such as retail pharmacies and large health systems. And we have longstanding relationships with them, and I know that we'll be continuing to support them as we have through the pandemic with a variety of technology solutions, including credentials, as they develop.

JOHNSON
So, you were working on this sort of thing before the pandemic?

RICHARDSON
Zebra has a long history of technology leadership in the area of secure identification and identity protection because of what we do.

JOHNSON
Given that you've done work on these credentials prior to the pandemic, has COVID-19 changed the way you look at the credential?

RICHARDSON
I would say that a couple of things stand out for me on this.

The importance of building public confidence: the pandemic has underscored—very understandable and very legitimate—public points of view about privacy, security, and equity. And people want to be able to have security for to their privacy, they want to be able to control when the information is displayed or provided to someone, they want something that's not easily counterfeited, and they want something that's fair.

And so, a form factor that accomplishes that is a good tool in complementing and providing the public confidence to help us reopen the economy safely.

JOHNSON
What are some of the obstacles that you've encountered so far?

RICHARDSON
Well, we think that technology provides a series of options and, to reiterate, the key issues around privacy, security, and equity really go to those concerns. We certainly have shared views with policy makers on this.

The form factors are multiple. There's the paper card that everybody sees, and then there are secure cards. And there are a couple of ways that they can work: you can have a secure card with a QR code or a barcode on it that does not enable the card or the card holder to be tracked, and it also controls when the card holder decides to provide their information to someone; you can also have a secure form factor card that's linked in real time to a blockchain-type, distributed ledger-type technology; and then you can have the smartphone-based, biometrically-enabled apps, again with either a barcode or a QR code in them or that are linked in real time to a blockchain or to a distributed ledger.

And what Zebra has worked hard to educate policy makers on—not only in the U.S. but in other countries—is that, depending on what a given country or a given state or given locality wishes, you can use any one of those to balance those interests of privacy, security and equity. And we think we've got a compelling story to tell there. We think that the secure forum card has greater levels of privacy, security, and equity, and can help lawmakers balance those very understandable and important public objectives.

JOHNSON
I remember the big pushback 20, 25 years ago when states were moving away from laminated driver's licenses to a credit card-style license that had a barcode on it, which simply turned all of the data on the card into a bunch of lines. Eventually, the pushback turned into general acceptance and now it's no big deal.

Is that the same sort of thing we can eventually expect to have happen with this issue?

RICHARDSON
I think the challenge is going to be not one of technology. I think the challenge is going to be where we as a country decide we want to land in balancing these issues.

People have a very strong, and very legitimate, and understandable desire to control their fate. We all want to make sure that we have the ability to determine where our information goes and who gets it. And that's balanced with our desire to see the economues safely reopen and the resume a more normal life like we had before the pandemic.

So, we will work it out as a nation. America has always had a can-do, get-things-done approach. This conversation is very important. It's going on not only in the 50 states, but in a lot of major cities as well. So, I think as those policy questions are undecided, the technology solutions will become more understandably acceptable as policy makers balance the public concerns.

JOHNSON
The way the technology rolls out, though, it does have an effect on the discussion, the debates, the arguments over whether or not to use it, proving that it's safe, proving that it's private, that it can't be hacked, taken advantage of, all of those things.

That falls on the technology side of the ledger, right?

RICHARDSON
Well, again, the notion of a technology spectrum that there are a series of options and they are more complimentary than anything else in nature: you start with the paper card; and then, you move to a secure card of PVC plastic that includes a barcode or a QR code that confirms the prior vaccination, but it's also physically durable, tamper-resistant, legible; and then, you've got the secure card that links in real time to a distributed ledger or blockchain as a way of authenticating or verifying vaccination; and then, you've got the biometrically-enabled apps on smartphones that either feature a barcode or QR code or have that same real time linking.

We've worked very hard to educate policy makers everywhere to understand the entire spectrum of options as you engage in the policy discussions. It would be regrettable, in fact, if people didn't fully appreciate the entire spectrum because solutions are often consisting of a couple of pieces rather than just one piece.

JOHNSON
And that's how you're helping policy makers work through these issues in their local jurisdictions.

RICHARDSON
Yeah, absolutely. And I, and again, as a local mayor of myself, I talked to my own council about this. I talked to my neighbors, and my citizens, and other mayors, and that's really the objective is to get the economy open safely again and get our lives back, but also respect citizens' desire to have control over their data and their privacy.

JOHNSON
Do you ever think about the best argument for moving away from a paper card when we're trying to get a handle on this vaccine record question? Is there one?

RICHARDSON
There are lots of reasons why moving away from a paper card is good policy.

As I mentioned previously, the paper card should give way to more secure credentials that are more physically durable, tamper-resistant. They're really not sustainable over time, and we think that you can find a way—because we've done it with things like drivers' licenses and so forth—you can find a way to graduate away from a paper card.

The reality is everywhere—and not just the United States, but other countries—we were faced with a given circumstance and we had to respond. What we're suggesting is part of an iterative improvement process and things always look to improve over time. There are ways to graduate away from that that balance the interests the public's concerned about and enable us to get a better outcome along the way with privacy, security, and equity.

JOHNSON
So, bottom line then—how important is a vaccine credential to a restored quality of life for people here in this country or anywhere else in the world?

Richardson: Well, I think that people are going to make their own decisions. We'll know that by how people make choices. And I suspect that individuals will make a decision about an activity or an event, and then do what's required by the venue host or by the local or state authorities.

There will be certain situations where a credential is useful and I think people will probably choose to do so, but again, I want to be respectful because I think it's very legitimate. People also have a strong desire to control their privacy and their information, and we want to present options that allow policy makers to balance those things.

JOHNSON
And Zebra works on all of those?

Richardson: We have great history in the secure card technology that would be a complementary technology to the smartphone-based apps that are also being considered and developed by others.

JOHNSON
Does the fact that we're all now carrying around a CDC paper credential help or hurt the effort to move to something that's a little more secure, a little more private, something that lasts longer?

Richardson: I think Americans—and this is true in other countries where we've worked, as well—we start where we started and we work with what we've got, and I think people are accustomed to carrying credentials with them. We have a driver's license or a credit card or a health insurance card or something. Some of them are still paper, but most have migrated to a more physically durable and secure form factor.

And I think this will be similar as policymakers lay on down where they want to give the state or given community to be on that spectrum of policy options. I think there's a history of seeing paper migrate over time to a more durable, more secure form factor—a classic PVC plastic secure card.

JOHNSON
Thanks for listening to Public Health Review.

If you like the show, please share it with your colleagues. And if you have comments or questions, we'd like to hear from you. Email us pr@astho.org. That's PR at ASTHO dot org. Also, we'd love it if you could leave us a rating and a review—that's two more are great ways to give us feedback.

Finally, make sure you never miss another episode by subscribing to the show—it's free and it guarantees that every new conversation will be delivered to your mobile device at the moment it's posted. Look for the subscribe button on Apple, Spotify, or anywhere you get your podcast.

This show is a production of the Association of State and Territorial Health Officials.

For Public Health Review, I'm Robert Johnson. Be well.