California: Tell Your Senators That Ill-Conceived “Immunity Passports” Won’t Help Us

NOTE: If you live or work in California, use this link to find out how to contact your State Legislators to stop this nightmare in its tracks http://www.legislature.ca.gov/legislators_and_districts/legislators/your_legislator.html

By Hayley Tsukayama

Californians should not be forced to present their smartphones to enter public places. But that’s exactly what A.B. 2004 would do, by directing the state to set up a blockchain-based system for “immunity passports”: a verified health credential that shows the results of someone’s last COVID-19 test, and uses those to grant access to public places.

By claiming that blockchain technology is part of a unique solution to the public health crisis we’re in, A.B. 2004 is opportunism at its worst. We are proud to stand with Mozilla and the American Civil Liberties Union’s California Center for Advocacy and Policy in opposing this bill. We encourage you to tell your senator to oppose it, too.

Tell Your Senator: Immunity Passports Are a Bad Idea. Use this link: https://action.eff.org/o/9042/p/dia/action4/common/public/?action_KEY=10970

While the latest version of A.B. 2004 steps back from previous plans to create a pilot program for immunity passports, it’s still written to push a hasty and poorly planned system onto Californians. The bill would empower the California Department of Consumer Affairs (CDCA) to authorize health care providers to issue verifiable health credentials, establish procedures for doing so, and maintain a blockchain registry of such issuers.

But the bill says nothing about how long a credential should be valid, how it should be updated, or how it can be revoked if you’re exposed or even infected after you receive the passport. It doesn’t say anything about how those procedures should interact with existing medical privacy laws. And while the bill would require CDCA to consult with a working group (also created by the latest version of the bill) that includes civil liberties and privacy representatives, CDCA can ignore those recommendations. The bill doesn’t even limit when or how CDCA may exercise its powers.

And there are many problems with the underlying concept of immunity passports. In the short term, medical experts have warned it’s too early to use them for the COVID-19 pandemic. The World Health Organization in April warned against the idea. The WHO said that the medical community’s understanding of SARS-Cov-2—the virus that causes COVID-19—was not sufficient to certify that those who have antibodies in their system posed no risk to others.

EFF also opposes the very purpose of these credentials which, according to the bill’s fact sheet and official analysis, is to identify those who should be excluded from workplaces, travel, and “any other processes.” That has ramifications beyond the current pandemic. Handing your phone over to someone—a security guard, a law enforcement officer—creates the significant risk that they may look through other information on the device. You should never have to do that to enter your workplace or your school.

Finally, by suggesting deploying credentials that rely on having a smartphone to control access to public spaces, A.B. 2004 would limit those without smartphones—often lower-income Californians—from being able to move freely. That ensures that the Californians who are disproportionately hit hardest by COVID-19 are also those hurt most by this bill—now and in the future. Some have suggested that the accessibility issue can be addressed by allowing people to print out a paper version of a credential. That would exacerbate the security issues, and not address any of the privacy, security, or safety concerns. In fact, it could make it even easier to present a health credential that isn’t current or valid. It makes it even more difficult to verify the credential and makes it easier for someone to present another person’s immunity passport as their own.

The latest version of A.B. 2004 doesn’t take any of these concerns seriously. It instead pushes a system, based on unproven science, that would give people false hope of returning to a normal life. As Mozilla wrote in its blog post opposing an earlier version of the bill:

A better approach would be [to] establish design principles, guardrails, and outcome goals up front…[i]mportantly, the process should build in the possibility that no technical solution is suitable, even if this outcome forces policymakers back to the drawing board.

A.B. 2004’s authors still aren’t listening. But you can tell your state senator: don’t let those taking advantage of the pandemic push California into making bad policy.