Your Covid Pass, Please

Covid Passes in Aotearoa

Source: 123RF

Almost 100 years ago, the modern passport, as we now know it, was introduced in Europe.

It started as a temporary measure during World War I, but was kept on due to the Spanish Flu. Countries from what was to become the League of Nations agreed on their permanent adoption at the Passport Conference of 1920, with an eye to regulating the sojourn of travellers in accordance with “their health regulations, their economic situation and with the interests of national security.”¹

Such measures are always introduced for benevolent reasons like health or security. But once individuals are forced into these regimes of compliance, they become a normal fact of life. They tend to outlive their original purpose, particularly as governments find new uses for them.

Governments across the world are introducing vaccine passes to restrict the movement of people within their own country. The reason why is to contain Covid and limit the number of deaths from it. Once more, we are faced with the same questions: Will these temporary expedients actually be temporary? Or will they last forever? How much should the government know about me? And what is it that I am really being forced to give away to them?

New Zealand’s Covid Pass

Two weeks ago New Zealand rolled out its Covid Pass system. The Covid Pass is a QR code that confirms that you have been double vaccinated. You now have to present it to get into many places under the new traffic light system:

• Green: businesses may require customers to have a Covid Pass, but it’s not necessary; you still need the Covid Pass to get into large events

• Orange: businesses don’t need to check, but if they don’t, they may only operate at reduced capacity

• Red: businesses may open only if they check Covid Passes

Some businesses—like supermarkets—are considered essential, and you don’t need a Covid Pass to enter them.

Your QR code is a picture that encodes some data. The data includes your name, date of birth, vaccination status, and a digital “signature”, generated from the rest of the data, using a private key known only by the Ministry of Health.

To check a customer’s Covid Pass, businesses use the Covid Pass Verifier app, made by the Ministry of Health. The app decodes the data in the QR code and validates its signature using the public key.

A valid signature is proof that the QR code (and the data in it) was issued by the Ministry of Health. If someone tried to tamper with the data, there would be a mismatch when you go to validate the signature with the app. Once you know a QR code is valid, the data will tell you the person’s vaccination status, and you either let them into your business, or you don’t.

In addition to scanning the QR code, businesses should also check the identity of the person who presents it, for example, by asking for a passport or driver’s licence. This confirms that the person presenting the QR code is the same as the person in the QR code, otherwise you could be using someone else’s vaccination status to get into a place.

This point is often lost. I have never been asked for my ID, and often businesses just look at the QR code without actually scanning it. Still, for the most part, people tend not to cheat the system, so it still kind of works. As with everything, it’s not exactly black and white.

Are There Privacy Risks?

Because smartphones can do a lot, it’s easy to imagine the Covid Pass Verifier app could be doing something nefarious.

All the app is doing is checking the signature and the data in the QR code. It is not opening up a connection to some government database somewhere. You can actually check this by scanning a Covid Pass on your phone with the internet turned off.

The app will periodically reach out to the Ministry of Health via the internet in order to retrieve the public key, which it needs to verify signatures.

It also collects some “basic analytics events” when you scan a pass, including whether the scan was a success or a failure, and some basic “demographic information” about your phone, such as its operating system.

According to the app's privacy policy, it does not collect any information that could relate an analytics event to a particular person. It's not 100% clear what this data is used for or whether it could be traced back to a particular phone though. I've reached out to clarify this, but everyone is currently on Christmas leave. Alas.

When you scan into a business, you are giving your name, date of birth, and vaccination status to that business. The app presents no easy way to store this information. For most businesses, there is no obvious way to exploit that data either.

Some QR code scanners can track your location by requesting your GPS data and passing that on. The Covid Pass Verifier app does not request this information. The only permission it requests is for your camera (to scan the QR code).

There is also no way to smuggle extra information into the QR code without your knowing so. If information was added inside the QR code, the signature would no longer match. The Ministry of Health would instead have to issue you a new QR code with the new data and a new signature.

Surveillance Superstructure

Analytics aside, from a technological standpoint, the use of QR codes is rather elegant. The privacy risks, as I see it, are fairly minimal and well thought through.

What I see as the biggest risk of Covid Passes is their presumption of a new surveillance superstructure: you now have to carry a government-issued QR code. You have to let that information be scanned by government software. If you don’t do that, you can’t do anything except eat baked beans in your flat.

It is true that we already had mandatory contact tracing, but you’ve always had a choice not to use the contact tracing app. The alternative is to sign in with pen and paper and keep a personal diary of where you’ve been. Personally, I always do this, no matter how many groans it induces: “What, don’t you have a phone?”

When I write down my details, I am leaving a paper trail of where I’ve been. In theory, I could still be tracked based on this data, but collecting it is so inconvenient that there aren’t many practical ways to use it against me.

This system is also easy to subvert. If I want to opt out of signing in at a particular business, I can sign in with a fake name, or scribble in some nonsense, or put a fake phone number or e-mail address. I have done this only once, when I was asked to “sign in” manually by putting my details into a computer at a bank.

At most places, I just put my contact details without any more information. Thus I still get contact tracing without having to give away unnecessary personal details.

The Covid Pass is much more demanding than this. The current app may be benign, but using it requires you to present yourself in a way that is amenable for general digital capture. Pretty soon, you stop thinking about the ritual you have to perform to enter a shop. It just becomes a normal part of everyday life, like unlocking the door to get into your house, or turning the lights on when you enter a room.

If the government wanted to extend this system in ways you didn’t agree with, whether to collect more information or to exclude you from society based on things you have or haven’t done, they now have a very efficient way to leverage you into compliance. The cost of resisting is much higher when most of your everyday freedoms are now locked behind your Covid Pass.²

What is captured may be used against you, for reasons you may not want or anticipate, long after the original issue has been resolved. Hence we still have passports a century after World War I ended.

And new security measures, once implemented, tend not to be walked back. If they can be adapted or expanded for new purposes, they will be. That is the real danger: that exclusion by default from public spaces becomes the norm, and your entry into them requires the government’s say-so, based on whatever criteria of the day.

Abuses of Power

Maybe you trust this current government and don’t believe they will ever misuse their newfound powers. It’s not just this current iteration of government you have to trust: you must trust all future governments too, as well as their various branches and departments. There are plenty of reasons—historical and current—to be sceptical.

In 2015 the Edward Snowden leaks revealed that New Zealand’s Government Communications Security Bureau (GCSB) was spying on New Zealanders and on our Pacific neighbours with the United States National Security Agency (NSA).

This was illegal. Who could stop them though? The very nature of what the GCSB does is skulduggery. There can’t be any legal transparency into it. Our only protection is the assurance of trustworthy governments that they will sort out the administrative and surveillance state when a line is crossed.

The activities of the GCSB were retroactively made legal in 2017 with the passage of the Intelligence and Security Act. Despite Labour’s then-opposition, they have not touched the act since.

Ten years before that, police conducted a series of raids into Te Urewera in 2007, alleging that Tūhoe separatists were running paramilitary training camps. Several searches were executed, including on environmental activists with seemingly no link to the alleged terrorists.

In the end, only a handful of people were found guilty of shooting some illegal firearms in the woods. Most of the charges had to be thrown out because the evidence was either flimsy or gathered illegally. Still, the police felt they were justified in doing what they were doing for the public good. To achieve it, they were willing to throw out the usual presumptions of innocence and privacy.

In more recent years, The Customs and Excise Act made it a legal requirement for you to hand over the passwords to your devices and subject yourself to a digital “strip-search” if customs has a “reasonable suspicion” that you may have data connected to criminal activity.

“Reasonable suspicion” is one of those phrases that really means nothing, and which the average person has no standing to challenge, unless they’re willing to lawyer up for a massive fight. This is an appallingly broad standard for the police to glimpse into every part of your life, as Thomas Beagle from the Council for Civil Liberties puts it:

Nowadays we've got everything on our phones; we've got all our personal life, all our doctors' records, our emails, absolutely everything on it, and customs can take that and keep it… They don’t have to tell you what the cause of that suspicion is, there’s no way to challenge it.

Just last year, it was also revealed that police had trialled facial recognition software without proper clearance. New Zealand’s Privacy Commissioner, John Edwards, rather than denouncing this obvious violation of privacy, was more peeved that proper procedure had not been followed:

Edwards said facial recognition technology was inevitable in New Zealand, but there were ways to reduce its risks, including by reviewing the technology before it was trialled.

“Inevitable”? Really? Why? The idea of having data about your public movements gathered like this just in case it is needed is like your mum smacking you over the head for no reason, just in case you did something wrong.

Perhaps if you were in the police—or the GCSB—you might see these violations as a necessary evil to catch criminals and keep the country safe. It’s easy to see concerns about privacy and the proper exercise of power as mere grandstanding.

But the tangible difference between a despotism and a liberal democracy is whether we agree upon, believe in, and respect the individual rights and liberties of each other, and trust that those boundaries aren’t going to be crossed by the improper exercise of power. This is no legal fiction; it is the very thing that is worth protecting.

Life Within the State of Exception

Covid Passes enable and normalise a culture of digital capture, but the way in which they have come to us is also troubling.

Because of New Zealand’s unique constitutional make-up, it is very easy for a majority government—such as we currently have—to pass whatever laws it likes. The political system consists of a single parliament, unchecked by any upper house, senate, house of lords, or president. Some of the most important public sector posts, such as the Chief Justice, the Attorneys-General, and the Police Commissioner, are appointed by the Prime Minister of the day.³ There is a very weak separation of powers.

Like most other countries, New Zealand’s parliament has a mechanism for subverting the usual law-making process in an emergency. The use of this power is unfortunately commonplace: no special requirement is needed for parliament to move a bill under urgency, and it’s become something of a tradition for any incoming government to pass a bunch of laws this way before the Christmas break.

The new traffic light system, moved under urgency, was introduced in its entirety and passed into law in a single day.

Is Covid the kind of emergency that justifies subverting the usual lawmaking process? To answer this requires you to know what the government’s long-term strategy is. When that information has not been forthcoming, it has been inconsistent.

The government, for its part, has shrugged off official information act (OIA) requests, refusing to release policy advice on Covid passes or redacting all of the relevant information. This is technically illegal, or at least against the spirit of OIA requests, but what are you gonna do about it?

It has also been unclear on its own goals and rules. Most recently, after announcing that quarantine-free arrival for vaccinated New Zealanders in Australia was “locked-in”, this was walked back within a week, even though the goverment was meeting its own declared targets. It has generally acted more cautiously than the Ministry of Health has recommend.

Like everyone else, those New Zealanders in Australia will have to apply for a spot in the MIQ lottery system if they want to enter the country. Some particularly unlucky New Zealanders have been locked out for a while and can’t get back in because they haven’t been lucky enough to win a slot; this is despite our (supposedly entrenched) Bill of Rights guaranteeing New Zealanders the right to freedom of entry.

All sorts of post-hoc rationalisations have been made for why this is okay: those people should have come home earlier, no right is absolute, etc. etc. These are perfectly reasonable responses, but the fact still remains that if a Kiwi is stuck overseas through no fault of his own, it’s the government’s own laws which stop him from coming home.

The use of urgency, the disregarding of the bill of rights, the stubbornness regarding OIA requests… even if you agree with the goal being pursued, power, so improperly exercised, whittles the pith off our democracy.

Life After the Emergency

On October 4, Prime Minister Jacinda Ardern announced a policy shift from eliminating Covid towards mitigating it. Instead of hard lockdowns, which basically stop us doing anything, we have more flexible Covid Passes, which allow a degree of freedom to the vaccinated. We will continue to maintain these restrictions, easing them in line with the vaccination rate and the state of the health system.

Epidemiologist Michael Baker outlines two broad “Covid destinies”: either we eliminate the virus, which doesn't seem possible, or we allow it to spread until the majority of the population has some form of immunity:

The other main trajectory for a new infection is that it becomes endemic. During this process the organism spreads widely and infects most people in a population. The majority mount a successful immune response and recover but some may become seriously ill and die.

Moving towards an endemic appears to be the desired goal implied by the shift in policy. It is not clear what happens to Covid Passes though, which still exist at the most relaxed restriction level. What would the situation have to be in order to get rid of these systems and go back to normal? What if new strains of the virus render our vaccines useless, and we never quite arrive at a point of widespread immunity? No one expects a perfect timeline here, only broad expectations and clear decisions.

The following exchange between Geoffrey Palmer and Attorneys-General David Parker during the passage of the latest legislation, recorded by Thomas Manch, is revealing of the government’s mindset:

Former prime minister Sir Geoffrey Palmer, in the audience, said “in some respects” the Government had imposed greater restrictions on citizens than had been done during wartime.

He asked Parker why the government had decided against having a parliamentary select committee review its latest Covid-19 law.

Parker, in response, said the Fraser government during World War II had implemented “far more draconian” laws that curbed citizens’ freedoms.

The government sees itself as piloting the country through a crisis like that of World War II. But where wars have a more definite stopping point—either we’re dead, or they are—it’s not always clear when health emergencies end. We have already met our vaccination targets. Healthcare systems are not overloaded, and will anyways always be unable to cope with sudden spikes in caseloads. Does this situation really warrant Covid Passes?

Despite the government’s soft language and phrasing—“team of five million”, “in this together”—the atmosphere is still one of an emergency, for which the government may override any personal decision in the name of public safety. Their role is to ensure us health and plenty, a dangerous new understanding of government, with few obvious limits on its power.

One of the most pointed critiques in this regard has come from the philosopher Giorgio Agamben, who points out that a society which lives in a constant state of exception can never be free:

… the epidemic is clearly showing that the state of exception, which governments began to accustom us to years ago, has become an authentically normal condition… A society that lives in a permanent state of emergency cannot be a free one. We effectively live in a society that has sacrificed freedom to so-called “security reasons” and as a consequence has condemned itself to living in a permanent state of fear and insecurity.⁴

It is neither feasible nor right for the government to control every aspect of how we live our lives. At a certain point, we have to assume the freedom of decision for ourselves: whether we get vaccinated, whether we test ourselves, whether we stay at home when we are sick, and whether we avoid crowded places if we are vulnerable. The lurch away from elimination, achingly slow as it has been, needs to arrive at this destination.

Better Days Are Coming You’ll See

People often have trouble separating the broad argument—the use of emergency lawmaking and the arrogation of sweeping new powers of lockdowns and medical checks—from the specific problem being solved—coronavirus. Whether the risk of Covid demands the use of emergency powers to contain it is a separate issue from what I have described.

The different parts of government, its interlocking departments, ministries, civil servants, and politicians, all carry out different duties. Their minds are focused on different things. As such, they have a tendency to want to use everything at their disposal to do the job, with little regard to how your information flows into, and across the boundaries of their authority.

Temporary provisions, adopted for seemingly adequate reasons, have a tendency to become permanent. From there, they morph into general surveillance and social credit systems. Hence, the GCSB’s illegal activities were simply written into its purpose. The MIQ’s violation of the right of return has been rationalised post-hoc as a new legal doctrine. Modern passports, introduced during World War I as a temporary measure, are now a permanent fixture of international travel, just like the invasive random security checks carried out at airports because of 9/11.⁵

The Covid Pass may join these. I don’t know for certain—and I hope not—but decades from now we may look back in astonishment that people would simply go out in public without having taken the entire cocktail of seasonal vaccines, just like we look back on smoking indoors or passportless international travel: is that what it was really like back then?

On the other hand, the fact that New Zealand is moving towards opening up again, however slowly, shows that we are travelling in the right direction. But we need to be clear on the ultimate destination: a life unregimented by the government, in which the risk of Covid is as minimal as it can be, consistent with the freedom to make our own decisions for our own good. Or is it really too horrible, too tragic a thing to risk dying before our time, that we would rather shut down the possibility of having lived our lives in the first place?

1. Resolution Adopted By the Conference On Passports, Custos Formalities And Through Tickest In Paris On October 21st, 1920.

2. There’s something oxymoronic about this sentence: if an “everyday freedom” is locked away then it’s not really an everyday freedom.

3. Technically they are appointed by the Governor-General on the advice of the Prime Minister. The Governor-General is a now all-but-ceremonial position, a relic of the days from when we were a colony of Great Britain.

4. Giorgio Agamben. Clarifications. 17/03/2020. English translation published in the European Journal of Psychoanalysis: https://www.journal-psychoanalysis.eu/coronavirus-and-philosophers/

5. My missus has a childhood memory of being invited into the cockpit of a passenger jet while it was in flight. That is absolutely unthinkable now. For my experience, I can’t recall ever not being subject to at least one random bomb test when flying internationally, probably because I look somewhat ethnically ambiguous, speak in an unusual accent (by international standards), have long hair, and wear scruffy, ill-fitting clothes.