[music]

Brian Lehrer: It's the Brian Lehrer Show on WNYC. Good morning, everyone. You could be forgiven for having some cognitive dissonance this morning about where we are in the fight against COVID. Vaccine supply is increasing, anyone over 30 becomes eligible in New York today, New Jersey added food service workers, and others, yesterday, and things are reopening.

Opening day at Yankee Stadium is coming Thursday, City Field, next week, with around 10,000 fans to be allowed at each game. They're already having fans at the basketball and hockey arenas. Mayor de Blasio announced a plan to bring city workers back to their offices in May, shows back to Broadway in September, and he's urging tourists to return to New York. Ready for the crowds? Governor Cuomo has created a digital vaccine passport to get you into things, hopefully, decreasing anyone's risk inside entertainment venues.

We'll describe the pros and cons of the vaccine passport in a minute, but amid all this, cases are rising nationally and locally faster than at any time since October, which is when the last big surge began and similar to the rise in Europe just before the really big surge with new lockdowns that they're in right now. Now, Europe is having more trouble than us with the vaccine rollout so it's not entirely apples to apples, but cases and hospitalizations here are going up, not down, more deaths are likely to follow shortly. Here is the Centers for Disease Control Director, Rochelle Walensky, yesterday, she appeared to be fighting back tears.

Rochelle Walensky: Now is one of those times when I have to share the truth and I have to hope and trust you will listen. I'm going to pause here, I'm going to lose the script, and I'm going to reflect on the recurring feeling I have of impending doom. We have so much to look forward to, so much promise and potential of where we are, and so much reason for hope, but right now, I'm scared.

Brian Lehrer: Impending doom. Shortly after Walensky spoke, President Biden did too.

President Biden: I'm reiterating my call for every governor, mayor, and local leader to maintain and reinstate the mass mandate. Please, this is not politics, reinstate the mandate if you let it down.

Brian Lehrer: "Impending doom," says the CDC director, "Reimpose the mass mandate," pleads the president, "Come on down," said Mayor de Blasio and Governor Cuomo. You can be forgiven for having some cognitive dissonance about where we are in the fight against COVID this morning. Yesterday, I signed up for Governor Cuomo's new voluntary reopening tool called the Excelsior Pass, and in under a minute, it was able to verify that I have indeed been vaccinated and gave me a QR code to print out or use on my phone, good for allowing me to enter certain entertainment venues plus wedding and bar mitzvah halls, restaurants, travel hubs, eventually, and we'll see who starts using it.

You can also get one to show you had to negative COVID PCR test within three days or a negative antigen and/or rapid test within the last six hours. Personally, I'll choose to follow the CDC guidelines that even vaccinated people should not go into crowds right now, but I wanted to see what getting an Excelsior Pass was like, including what online privacy concerns it raised so I signed up and took the download.

We will get two views now on the Excelsior Pass and vaccine and negative COVID test passports, in general, and we'll take your questions and experiences on the phones. First, with Brian Behlendorf, executive director of Linux Foundation Public Health, a tech group focused on helping governments and other institutions build open-source technology to help fight the spread of COVID. Within that, he is general manager of Blockchain Healthcare and Identity at the Linux Foundation of Public Health. Brian, thanks for coming on, welcome to WNYC.

Brian Behlendorf: Thank you for having me. It's a pleasure to be here.

Brian Lehrer: Can you first describe your group, Linux Foundation Public Health, for our listeners? Most people won't know what that is or what open source or blockchain mean in this context.

Brian Behlendorf: Yes. The Linux Foundation is about a 20-year-old organization. We've been at the heart of the open-source community, working not just on the Linux operating system, which runs everywhere in the cloud and on every Android phone, but also in all sorts of other domains.

Last year, we launched Linux Foundation Public Health to serve the needs of public health authorities in the fight against the pandemic, focusing first on exposure notification. In fact, the New York State exposure notification app, within it, underneath it is open source software called COVID Green that was developed by many of the companies in the community, and since December, we've been focused on this question of standards, and soon, implementations of open source software for implementing these vaccine passport apps.

Brian Lehrer: Companies in the community, these are major tech companies, who are some of those companies?

Brian Behlendorf: Yes. The vast majority of the Fortune 1000 companies are a part of the Linux Foundation as part of Linux Foundation Public Health. We have companies like Cisco and VMware and IBM, but also a very large number of startups involved and also a huge community of volunteers, software developers, medical technology experts, and increasingly, the public health authorities and experts engaging directly with the technology community.

Brian Lehrer: Okay, so this is big tech and big government, if people want to be cynical about it, or these are the people doing the work if people want to be optimistic about it. What's Governor Cuomo's vision and what's yours for how widely these kinds of passports can be used?

Brian Behlendorf: It's a very good question. Obviously, we're not taking a position at Linux Foundation Public Health on when and where such a vaccine passports should be used. Obviously, they build on the tradition of requiring vaccinations since the early part of the 20th century in the fight against yellow fever, smallpox, and polio for travel between countries. For enrollments in school, most States in the United States do require vaccinations for children to attend public school and other professions require it as well.

It's pretty natural I think to ask, is there a digital way to represent that yellow card, the WHO standard yellow card, or even the CDC card that anyone who's been vaccinated in the states has received, especially since we're moving into a world where so much of our engagement is through the digital sphere. The question is, how to do this in a way that has as much confidentiality and security as we can provide, but at the same time, allows for reopening and the like? It was very encouraging to see the Excelsior Pass launched and to see folks involved with that, but I think there are some very valid and substantial concerns about privacy, especially in 2021, we know a lot more about how privacy works and doesn't work on the web, through third-party cookies and the likes.

The technologists that we work with are really focused on how do we help guarantee privacy and confidentiality to individuals as they use passes like this in many circumstances, and things like Excelsior Pass and similar apps that are launching now all over the world and in many different states are really good steps in the right direction, but I think we'll see a second wave of such apps before the end of the year that are actually much more converged and more privacy-preserving.

Brian Lehrer: Now, listeners, I'm sure you have questions about this, and we can take your phone calls for our first guest here. Then, later, we're going to talk to a bigger skeptic about all this, Albert Fox Cahn, who's an online privacy advocate. What are your questions about New York's Excelsior Pass or other such things? 646-435-7280, 646-435-7280, your questions welcome here. Let's take one right away. Here's a very practical question from Leah in Spring Hill, Florida. Leah, you're on WNYC, hi there.

Leah: Hi, Brian. Yes, I am in Spring Hill, Florida, although I'm a New Yorker. I am here helping my mother clean out her house, and I became eligible in both Florida and New York last week when they went to 50+. I got a shot down here because you can literally walk in and get a shot without an appointment. It's very easy. Nobody really wants the shots. I got it and I will be returning to New York in a few days and get my second shot there. I actually went to the Excelsior Pass website last night and it says that you have to get both of your shots in New York. I'm sure other state’s systems work the same way. How do I get a pass to show that I've been vaccinated?

Brian Lehrer: Brian, can you help Leah in Spring Hill, Florida?

Brian Behlendorf: This reminds me of the early days of the internet. I mean, I got online in 1991 and the internet already, by that point, was more than two decades old, but in the early days, you had email systems that only worked in a local domain within a business, within something like AOL or CompuServe or Prodigy, and then, there were the open standards that did allow for email to go between every site that was connected to the internet. Eventually, those different systems, AOL, et cetera, grafted onto the internet, and suddenly, an AOL user could email somebody at a college using a college internet account. I think a similar thing will happen here.

The community of technologists that we've been working with are really focused on answering this question of how do we get these, what we call vaccination credentials, these digital documents that are signed by an issuer, somebody who gives you the vaccine or the state immunization board that keeps track of who's been vaccinated, how these credentials can be issued and be portable, usable across state borders, across international borders, used for different use cases like boarding a plane or going to a concert and private so that your path across these isn't tracked. The state shouldn't know which restaurants you eat at or anything like that. We're not there yet.

That's something that this first wave of apps we're going to see, like the Excelsior Pass, like others are really going to be for these closed-loop systems and it, unfortunately, does mean that there's these arbitrary limits like you're describing. This is where there should be some pressure from citizens, from public advocacy organizations, and others to make these kinds of systems portable, and at the same time, guaranteeing privacy. That's really been a keen focus for the organizations and software developers that we work with.

Brian Lehrer: Do you have an understanding of what alternatives there might be for someone like in Nora's position-

Brian Behlendorf: I do not.

Brian Lehrer: -when they come back to New York, got their shots elsewhere, and maybe they want to go to one of the theaters or ball games or whatever else, will start requiring these passports for either a negative task or a vaccine? I think you can use your printed-out vaccine card in New York State, but I'm not sure.

Brian Behlendorf: My hope would be that she could take her proof of vaccination to a clinic somewhere, to some representative of the New York State Health Authority somewhere, and turn that into a digital record that then could be used in the Excelsior Pass. I'd be surprised if they don't set a facility like that up soon, but my hope would be that before the end of the year, we have tooling that works across all states to make that kind of thing, just ordinary and possible, it should work like email.

Brian Lehrer: All right. Let's take another call with, I think, what's going to turn out to be very common concern here. Nora on Staten Island, you're on WNYC. Hi, Nora.

Nora: Hi, Brian. Good morning to your guest. I am in that class of people that cannot afford to be on the internet. I cannot afford the monthly fee that requires a smartphone or a computer. I have already received my first shot. I have my CDC card that I received my first shot. I presume the second shot will be recorded there also. First of all, do the people who come up with all of these apps have any concept that some people are not on the internet, and secondly, is my CDC card sufficient?

Brian Behlendorf: Very good questions. First, let me start with stating the primary importance of paper credentials to how these systems should work. The WHO has been very clear that a paper record of a vaccination should stand as sufficient proof in any of these kinds of face-to-face engagements as well as crossing borders and that any digital version of those should be about supplementing those use cases for people who do wish to, for example, enroll in a school online, or to book a flight, or to do other procedures that might need a digital credential. In the standards work field, there's a tremendous amount of focus on how do we make sure that these credentials could serve the needs of those who don't use cell phones so that they have a paper backup.

In fact, this is a big focus of a group that we're a part of called The Good Health Pass Collaborative, who have stated a set of principles around how these systems should behave and are currently driving a specifications process as a way to certify these applications as having met the very high bar for ethics and privacy in all those, and that does include very much making sure that equity is guaranteed by having modes of use and coexistence with those kinds of paper records. What I don't know is whether, specifically, the Excelsior app has a way to- those businesses that are using the Excelsior app will also accept those printed CDC cards. I'm not sure if they will, but my hope would be that they would.

Brian Lehrer: If you're just joining us, we're talking about Governor Cuomo's new Excelsior Pass, a digital download for proving that you've been vaccinated or have had a very recent negative COVID test, and we're talking about it with the general manager of Blockchain Healthcare and Identity at the Linux Foundation of Public Health, Brian Behlendorf. Let's take another question. Kathy in White Plains, you're on WNYC. Hi, Kathy. Kathy, are you there?

Kathy: Oh, I'm on.

Brian Lehrer: Oh, hi. Now you're on. Hi there.

Kathy: Hi. I had a question about the pass because I have received both shots of the Pfizer vaccine and tried to sign up for the card, but it said that my information wasn't sound. What is someone supposed to do at that point to be able to take advantage?

Brian Behlendorf: Oh, I think whenever you roll-out a system like this at scale, there are challenges with making sure that it's done in a way that's fair and equitable. Again, I'm not representing Excelsior Pass so I am not sure what the support mechanisms are for that, but this is an important thing for the state to get right, and for the rollout to really be successful is to think about the equity issues and ensure that that there aren't any gaps in the system that where people have received these shots, and yet, their information can't be found in the enrollment process.

Our hope is that, in the long-term, you don't actually need to involve the state in the issuance of these vaccination records, just like today, you hold this paper record of your vaccination and that alone is sufficient to be able to provide that proof. In the future, that issuance shouldn't have to go through the state. That issuance should be able to be done by the clinic, the pharmacy, the vaccination site, and direct to you, they're on the phone or in a paper receipt that then can be used digitally.

There's still some kinks to be worked out, and I have sympathy for the state authorities who are rolling this out under a tremendous time pressure and the complexity of essentially upgrading the state's health information systems to be able to make something like this possible, but I think it's very important for them to also make sure it doesn't leave anyone behind.

Brian Lehrer: Yes, that's unfortunate if some people who did actually get vaccinated have fallen through the cracks and have not had their names entered into the system. It's funny because some people with privacy concerns worry that the state knows about their vaccine and other health status, other people like Kathy, and we have another call with the same question, I won't take it because it's the exact same question, but there are multiple people calling up right now who seem to have fallen through the cracks, and they are not in this database, at least, it didn't appear that way when they try to sign up for their Excelsior Pass online.

Do you have an indication? I realize you're not a New York State official. Do you have an indication of what Kathy's first step might be, like who to contact to get herself in the database?

Brian Behlendorf: I don't. That feels, to me, like it's something that the governor's office will have to respond to and account for. I know that'll be a challenging situation for a while. This is an important thing, is that so often when these technology systems are rolled out, especially in the midst of a pandemic, there's a tremendous amount of pressure to reopen, a tremendous amount of pressure to get moving on things, and so for the early stages of technology, I think there's a little bit of capacity we might need for things to be not perfect.

This is definitely a 1.0 product. In fact, we have a saying in the tech industry, if you aren't embarrassed by your 1.0, you waited too long to release it, but in health technology, that's not acceptable. The traditional Silicon Valley move fast and break things concept is not what's applicable here or appropriate, so getting this right early on is important.

Brian Lehrer: Kathy, we'll try to get you an answer to that if we can, as to where you go. My first impulse would be maybe back to-- Let's see. Depending on where it is, it could be difficult. If you have a relationship with, let's say, a local pharmacy where you got the shot, if you got it at a place like that, where you can actually talk to a human being, then see if they entered you in the system or have them do it again based on the record that they will still have. Of course, if you went to the Javits Center or something like that, it might not be that easy, but that's one possible way.

It's funny, Brian, because I had the opposite experience when I went online for the pass last night. The first thing that struck me signing up is that it already knew who I was by just entering my birthday, name, and zip code. It made me prove who I was by asking for the date of my last shot, the county, and which company shot it was, and it was only when I got all three of those things right that it would give me my Excelsior Pass. I was not particularly creeped out from a privacy standpoint, but some people might be. How did it know all that about me?

Brian Behlendorf: There aren't systems that are run by many of the state and health authorities called IIS, Immunity Information Systems, that for years have centrally tracked vaccinations by the state. That vaccination record is something that they have by default, and it includes your name, date of birth, home address, and that information. They've maintained that for public health purposes to understand how much of the population has been vaccinated.

In many cases, those types of systems are the data sources for the issuance of these vaccination credentials, these vaccine passports. I would expect that especially if she was vaccinated or if your listeners are vaccinated at one of the mass vaccination sites or the top tier hospitals, that that data would be reported. I understand from the governor's announcement, they're still working with some of the labs and some of the vaccination sites and clinics to get that reporting set up.

What I think is new here though is that we're reporting not just vaccination but also test results, and historically, negative test results have not been reported to state health authorities, only the positive test results. There's a little bit of additional data-sharing going on that I think some people are rightfully not as comfortable with. Again, our hope is that in the mid to long-term, the issuance of those things happens very locally, the state doesn't even need to be involved in issuing your negative test results, and that's a problem that sorts itself out, but it's important for the public to keep pressure and an eye on that.

Brian Lehrer: Michael in Inwood, you're on WNYC. Hi, Michael.

Michael: Hi. Can you hear me?

Brian Lehrer: I can hear you. You have an Excelsior Pass, I see.

Michael: Yes, I do. I signed up for it last night, and it expires in less than 30 days. I got the Moderna shot, which I hope is better than just a 30-day vaccine. Why is that?

Brian Lehrer: Yes, I had the same question, Brian. I was surprised to see that this is good for 28 days. Now, I understand with the negative COVID test portions of the Excelsior Pass with the PCR test, it's good for 72 hours, with the rapid test, it's good for just six hours, but the vaccine, supposedly, is a relatively permanent thing. I know we don't know how long the immunity will last and we may all have to get boosters every year or six months or who knows what it's going to be, but do why the state of New York would have rolled out the vaccine pass as only a 28-day pass, and then, you have to go back in and do it again?

Brian Behlendorf: Yes, that surprises me. I don't know. I understand there's a difference between getting a digital version of that WHO yellow card or your CDC white card, a difference between that and what I think you get with it with the Excelsior Pass, which is the ability to enter a space, the ability to present it and go to a concert or a sporting event, that's not intended to be a long-term pass. It's more of like an airline boarding pass or something like that. My assumption would be that you'd get to renew that without having to go and get another vaccination shot, worst case, right?

Really, we should try to get to the point where that digital version of that yellow card or white card that you present, it has the information about which vaccine you received and when, and then, locally, those decisions can be made about whether to grant you access to a facility based on, is that sufficiently recent, or if you're traveling in here from another country and you received Sputnik or Sinovac or one of the other vaccines, and if the public health consensus changes on the effectiveness of those vaccines, that might become a part of the rules about whether you're able to pass or not.

It's important, I think, that information not suddenly disappear from your health wallet, disappear from your data. Again, this should work like email, no one would feel comfortable with the state reaching in and deleting emails out of your inbox, maybe I'd be happy because I have too many emails, but your health information should belong to you. It should be something that can't be taken away from you, right? That's really the standard we need to hit with these vaccination credentials.

Brian Lehrer: All right. Now our next guest digital privacy advocate, Albert Fox Cahn, says he's concerned about the terms and services, which have nothing to do with the type of app it is, and he cites the type of technology used here. On the terms and services, I'm going to read this for you, then, I'm going to read this from him. On the terms and services, when I got my Excelsior Pass last night, I had to click agree to the following page called authorization to disclose.

Part of it says, "Your completion of this screening website results in the disclosure of personal information and constitutes your consent to the collection and disclosure of such information by New York State, for the purposes of providing your COVID-19 test results or vaccination status, follow-up communications, contact tracing, or similar services. The application may be hosted by third parties working with New York State, certain information you provide to or that is collected by the application may be shared with these third parties. These third parties shall limit their use of the information solely to the purposes described with access only to the results provided and not to the underlying data."

That's a lot of words but can you explain in your opinion, why people should or should not be alarmed by that with respect to their privacy.

Brian Behlendorf: Privacy policies across the web, across these apps, they're always written by lawyers with the intent to wave, and by companies, who tend to put these together to try to wave a magic wand and tell people, "Don't worry. It'll be okay. It'll all be right." Often, it has the opposite effect. People read in the words may or might the implication that such sharing will happen far beyond, and of course, they need to get that language open because they don't know what regulations look like in the future, especially around public health data.

I don't think that should be something that folks accept as the standard here. I think they should demand greater visibility and greater protection, both from the authorities that say these are the right apps to use but also from the technology builders that inherent in the technology should be better protections. Much the way that we launched the web and started using email before we figured out how to make those secure, I have a lot of confidence that that will come to this as well down in the plumbing later, but we also have to make that evident and very real for the users of these kinds of applications to build public trust and public confidence in them.

Brian Lehrer: Brian Behlendorf from the Linux Foundation for Public Health, thank you so much for coming on and for explaining more to our listeners about how this is going to work and for expressing some of your own concerns as well. We really, really appreciate it.

Brian Behlendorf: Thank you, Brian.

Brian Lehrer: We'll get that dissenting view in a minute by privacy advocate, Albert Fox Cahn, and why he's more concerned than a lot of other people about the Excelsior Pass and other vaccine passports. Stay with us.

[music]

Brian Lehrer on WNYC, and with me next, on vaccine passports and negative COVID test passports, including the Excelsior Passport introduced for New York State last week, is Albert Fox Cahn, an attorney and founder of the Surveillance Technology Oversight Project, an advocacy group that fights for online privacy rights. Some of you saw him quoted in the Gothamist article on the Excelsior Pass. Hi, Albert, welcome back to WNYC.

Albert Fox Cahn: Thank you so much for having me back.

Brian Lehrer: You were quoted on Gothamist saying, "They are high-tech hydroxychloroquine." That's harsh. Why did you say that?

Albert Fox Cahn: Well, this is wishful thinking. Once again, we're faced with the seemingly impossible choices, do we delay the reopening and let businesses go bankrupt, or do we rush to reopen and put lives at risk? When you look at the Excelsior Pass, I think the point you made at the start of the last segment was crucial. The CDC guidance isn't for us to behave any differently once we've gotten this life-saving vaccine. Instead, we should still be socially distancing, we should be wearing masks, and we should be behaving the same way to protect everyone, and yet, this entire rollout is premised on an app that is badly designed, but even if it worked as it's supposed to would be in conflict with the public health guidance.

Brian Lehrer: Yes. That's not the question that we brought you on for, but it is, of course, an extremely relevant question. You're right, it's how I opened the show this morning. They're rolling out all this stuff, and at the same time, the president and the director of the CDC are saying, "No, please, people, stay conservative." The official CDC guidelines, even for vaccinated people, is to not go out and crowds, and yet, they're opening up stadiums and concert venues and everything else.

Yes, there is that cognitive dissonance out there, but with respect to the passports, I mean, I could pile on to what you just said and said I have a big question about these antigen tests, the ones where you can get into a theater or something, theoretically, just by taking a rapid test. Those have the reliability of maybe 70%, people say, so that's not 100% confidence or the 95% confidence that you have from a vaccine, let's say, that the person is actually not able to transmit something or that they're going to even find the positive result that might actually be in the person's body. How good is the rapid antigen test, 70% or whatever the real number is? They vary somewhere in that vicinity for actually creating safe, crowded theaters, and other things like that, but that's another show. What about your concern with respect to the passports and privacy?

Albert Fox Cahn: Well, this is one of the most opaque pieces of software I have seen rolled out. If you look at the initial rollout, we got a few screenshots of what the user interface look like. We got a lot of buzz words like the fact that it supposedly uses blockchain, but we got absolutely no details about the server encryption, the server of data collection, the real nuts and bolts of how this system will operate.

You're rolling out, potentially, one of the most invasive apps that we will have in New York State, not because of the health data but because it will be used to track our location data. It's something that, right now, we're talking about restaurants and concert venues, but some of the developers of these vaccine passports want it to be something that you have to use to go to the local supermarket. The idea that you're going to be collecting the record of every time I buy a quarter milk from Bodega, and you're not even telling me how this app is operating, how the data is being collected, and whether there are any safeguards against access from ICE or law enforcement. To me, that is just a dystopian nightmare in the making.

Brian Lehrer: Let me be a skeptic toward your point of view and ask, why should I care about that, or what does this actually change every time I use a credit card, for example? The system already knows what carton of eggs or quarter of milk I bought in what Bodega?"

Albert Fox Cahn: Well, for me, it wouldn't make a difference, but for my clients, for individuals who are undocumented, who have criminal justice involvement, for people who specifically don't have a credit card because of the risk of how that data is going to be tracked, who live in the cash economy, this creates another layer of tracking that suddenly becomes compulsory.

That's the thing when we're talking about these apps, the only way they would actually work as advertised is if every single person is using them because, otherwise, you're not going to be able to actually create this herd immunity bubble. If you're actually forcing everyone to use it, you're creating a lot of dangers for New Yorkers who are over-policed and are from historically marginalized communities.

Brian Lehrer: Now, the Excelsior Pass website did say that it's voluntary. My understanding is if somebody has a physical vaccination card, the thing they hand you when you get your shots, that that's also usable in these same contexts. Is that your understanding, and does that get around the problem, and the voluntariness of it makes it able to be used just by people who don't have the concerns that you just rightly articulated for people in some populations, and it's this voluntary convenience thing and you can always use your hard ticket?

Albert Fox Cahn: Well, just because it's voluntary doesn't mean it's not coerced. One thing we've seen is none of the final regulations are out or the final executive orders, but what we've heard, including from some of your colleagues at WNYC, is that there will be the ability to reopen at higher density if you're a restaurant, if you're a business, if you're using Excelsior Pass. It's unclear to me whether the paper card is going to be allowed as a substitute for that because, again, we're making up the rules as we go along. It can be a technically voluntary program, but if you're telling restaurants that the only way they can reopen with enough capacity is by using this, not just to test all the patrons but to scan all of their employees, suddenly, that looks a lot less voluntary to me.

Brian Lehrer: Ryan in Brooklyn, you're on WNYC. Hi, Ryan.

Ryan: Hey, how are you doing?

Brian Lehrer: Good.

Ryan: I guess my concern is that if we start requiring passes to do everything in society like go into a store or get on an airplane, then we're pretty much just forcing people to take this vaccine. At this stage, this is still an experimental vaccine. Who knows what the side effects are going to be? Who knows what's really in it? This thing is pretty much being forced upon us if we lose our right to choose by having this pass for everything.

Brian Lehrer: Right. Well, the data seems to indicate that those things are not proving to be actual concerns, but you have a right, I would argue, to not get a vaccine, but then other people, if you're going to go into mixed company and into crowds, have a right to know if you're vaccinated or not before you're allowed in. Why wouldn't that be the case, Ryan?

Ryan: Oh, I would just tell them. I would say I didn't get the vaccine or something, but that doesn't mean that I shouldn't be able to go into stores and be able to live my life because I don't have a vaccine because that's just forcing it on everyone.

Brian Lehrer: Right. I don't think it's for stores. What are you thinking listening to Ryan, Albert?

Albert Fox Cahn: Well, this is my fear. I want every New Yorker to get this vaccine. I was eligible for the vaccine because of underlying health condition, and I was so enthusiastic to get it. I want everyone to get it, but when we use this sort of force and coercion to get people to use the vaccine-- Some of the logic of this pass is that it will create an incentive for people to get vaccinated, but there's increasing concern within the public health community that this will backfire and further politicize and polarize the vaccine when this is something we should be coming together and say, "It doesn't matter what your political party is. It doesn't matter what your belief system is. This is something that every single New Yorker should be getting because it's the only way we can keep our families, our communities safe."

Brian Lehrer: To be clear, again, this is not for stores. They're certainly not talking about that now anywhere that I know, correct me if I'm wrong, this is for crowded, very voluntary things like stadiums and theaters and wedding halls and things like that, Albert, so that's a different level of voluntary and coercion. Do you have a comment on that?

Albert Fox Cahn: One of the concerns we have here is it was first rolled out with the largest venues, the Barclays Center with Madison Square Garden. It was then expanded to these other venues that you just mentioned. If you actually look at the documentation from the Commons Pass Project, that VCI initiative, and some of the other people working on this technology, they actually have talked about using it in commercial settings and grocery stores and things like that. While that's not something that's currently mandated by the technology, it's something that has been raised by the people who are actually developing it themselves. I think we have to be very clear about what the risks are today, but also look at what the trend line could be going forward.

Brian Lehrer: John in White Plains, you're on WNYC. Hi, John.

John: Hi there, Brian. Hello, big fan.

Brian Lehrer: Thanks. Go ahead.

John: In the context also of what we're talking about regarding security here, this is protected medical information, I would think. Yes, people might think they have a right to know if someone else is vaccinated, but there's very good reasons that as the previous caller mentioned that people wouldn't be vaccinated. I want to first mention this, that perhaps someone has a medical condition that prevents them from receiving the vaccine. Therefore, especially naming it as they had, as the Excelsior Pass, pass implying access, this seems to clearly be a venue for discrimination for those who can't get the vaccine. Now, counter that against the fact that, and I'm just learning that they can get a PCR test to give them a positive pass for three days-

Brian Lehrer: Right, or even a rapid test at the entrance to the venue in a lot of cases.

John: Which also isn't accurate. There's a lot of holes in this thing, but in the end, it's very convenient for people who have vaccines and not convenient for those who can't get them for some reason. Therefore, this whole thing I think is going to be eventually teased out as an act of discrimination. On top of that, I should mention also that when you say a vaccine gives you 90 or 95% effectiveness, those are tested on people who are not immunocompromised.

You have to understand that the population they tested on are healthy individuals, not people who are immunocompromised. I don't believe and maybe if there's an expert there, a doctor of any sort that you might have on hand today, they can confirm this, that that's necessarily going to be the result in the general population. It's something else to consider, all of these things. As you mentioned, we need to go on as if, and if everyone were to continue what they're doing, you have to understand even with a 95% effectiveness, if they don't have that actual result, there's going to be people who are going to infect other people. That is really the important thing here, and this whole Excelsior Pass not only is, again, a venue or a vector for discrimination but it's a vector for contagion.

Brian Lehrer: John, I'm going to leave it there, thank you very much. I will say, kind of an opposition to that, that the CDC released new data yesterday on the vaccine efficacy and effectiveness in the general population, not just the trials, and it does seem to be proving to be about as good as in the trials, which is really, really, really good. There's that. Albert, we're going to run out of time in a minute, but nevertheless, the vaccine is voluntary and for whatever concern that an immunocompromised person might wind up having after consulting their doctors or any other objection to the vaccine, it is voluntary. The Excelsior Pass, ultimately, does give the option of a negative COVID test. Why then does it become coercive?

Albert Fox Cahn: Again, with this rollout, it's been, as noted in the prior segment as well, very inconsistent. One thing that's unclear is whether the PCR and rapid testing options will remain part of the pass over the long-term. In general, what we've seen is because the PCR window is three days, realistically, for a lot of people, it's going to be exclusionary if they don't have the vaccine.

I just really want to reiterate as many times as I can that none of this skepticism about vaccine passport should in any way be equated with vaccine skepticism. We are so supportive of the vaccine roll out more broadly, but when we look at the capacity to really say that you can't go to school, you can't go to work, you can't go to local venues without having the vaccine, or very frequent testing, that's going to potentially exclude the communities of color that have been so underserved by this entire response to COVID-19. We're going to translate that medical inequity into broader segregation.

Brian Lehrer: Final thing, I mentioned to the previous guest the authorization to disclose page of the Excelsior Pass website that I had to click, I agree on last night to get my Excelsior Pass, why shouldn't I find this more reassuring about my privacy than alarming? I said I would read part of this to you as I read part of it to him, and the lines I'll read to you are where it says, "These third parties shall limit their use of the information solely to the purposes described with access only to the results provided and not to the underlying data. The information you provide will be retained by New York State only for the purposes described herein."

Albert Fox Cahn: I am a privacy lawyer, and I can tell you that almost every time when I read a privacy policy, I have no idea what it means in practice. They are incredibly opaque. When you look at the protections are being described there, it's quite unclear who those third parties are, what the scope of their involvement will be, and also, I believe it allows them to change which third parties are receiving that information in the future.

One thing I should note is New York State passed a law late last year to become one of the first states in the country to prevent police or ICE from accessing contact tracing data. That was something that had been allowed until a large coalition including my group pressured lawmakers to fix that loophole. Unfortunately, that same issue exists for vaccine passport data today, and what we clearly need as part of any rollout is a clear wall separating any police access to data in these sorts of vaccine passports.

Brian Lehrer: Albert Fox Cahn, attorney, and founder of the Surveillance Technology Oversight Project, an advocacy group that fights for online privacy rights. Thanks a lot, Albert.

Albert Fox Cahn: Thank you so much, Brian.

 

Copyright © 2021 New York Public Radio. All rights reserved. Visit our website terms of use at www.wnyc.org for further information.

New York Public Radio transcripts are created on a rush deadline, often by contractors. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of New York Public Radio’s programming is the audio record.