So you have to be vaccinated to get into that hot new bar? There’s an app for that.

More and more places are starting to require vaccines for work, school or to get into concerts, bars and restaurants. That means we’re going to need a way to prove vaccination.

There’s the paper card from the Centers for Disease Control and Prevention everyone gets with their shots, but there are also vaccine passport apps.

Laurin Weissinger, a visiting cybersecurity fellow at Yale, co-wrote a paper for the Brookings Institution about vaccine verification systems. He says we’re starting to see these vaccine apps pop up in the U.S., but there’s a lot of variation.

The following is an edited transcript of our conversation.

Laurin Weissinger: Some states have developed their own vaccination apps. California, for example, has an app. In other states, you actually have orders or laws against verifying vaccinations, Florida being one of them. And the problem here is what happens when someone from one state, that might have an app or not, goes to another state where they require a different system? And in that case, we will probably fall back to our paper COVID vaccination record cards. 

Meghan McCarty Carino: What are some of the privacy and security concerns with these apps? 

Weissinger: One concern is really about, yes, what happens when someone checks your vaccination record at the door of a concert or a restaurant or whatever it might be, will there be a record somewhere of you being there? When we have a system that really goes more into the direction of being more interactive, you might see this, which is obviously a huge privacy concern and many people would be unhappy. 

McCarty Carino: So, from where you’re sitting now, seeing how things are unfolding in the U.S. and abroad, how useful do you think these systems are going to be, or do you think they will be used for certain applications and not others? What’s kind of your prediction? 

Weissinger: So my prediction, definitely, when it comes to international travel, we will continue to see requirements to either be vaccinated or to be tested, or both of that, and those will be validated. When it comes to those apps being used kind of locally, I think this will not last as long simply because as soon as enough people are vaccinated, there’ll be less of a need to really check everyone. Obviously, this prediction is for no further extremely worrisome variants popping up. If that were to happen, obviously, my prediction would go more into ‘We will see more of this happening in the future.’ 

McCarty Carino: So let’s look at an optimistic viewpoint. Let’s say we do reach a point where having these apps to show your vaccine status do become irrelevant, what could these kinds of apps, this kind of technology, morph into? Could we see it stick around and have sort of different uses if a good chunk of the population is using it? 

Weissinger: So I think these moves are already there. We, by the way, have looked at vaccination records in the past. This does not happen when you travel in the U.S. or some other countries, but in certain areas you do need a yellow fever vaccine to be allowed in. So we do check these records, and we have checked them for a long time, and this is one of the things where I see some of the app developers going where they’re trying to turn this into a system for travel, in particular, where it shows you’re fully up to date on your vaccinations. For example, one I can think of is Clear, the company that offers biometric identification when you travel by plane. They are offering you to put in your vaccination records, as well.

So I can see that a lot of firms would want to develop this into a bit of a digital identity and other kind of relevant data wallets, like we have our boarding passes inside our phones, right? We will also have our vaccination records in there, so when we go to a different country, for example, they can look them up and see this person is fully vaccinated. Maybe ID cards, things like that. Some states have already started with allowing you to put that in your phone, as well. And I think this is really what a lot of the companies in this space are thinking about, to become this identity provision system where this is not just about vaccines, but really about a lot of other things as well, replacing the way we do identification right now.

Related Links: More insight from Meghan McCarty Carino

We’ve got a link to the full paper Weissinger co-wrote for the Brookings Institution on vaccine verification systems. He points out their adoption will really depend on how much trust the public has in the entities creating and issuing this tech, and we might get a preview of how that will go by looking at contact tracing apps. Many of these are based on code that Apple and Google released to help alert the public when they had contact with someone who tested positive, but they didn’t really get great uptake, especially in the United States.

They have been a little more common in Europe, where Weissinger said there’s also been more buy-in on the idea of digital vaccine passports. Part of the difference, he said, is the relationship people have with government there. But a separate paper from Brookings points to another difference: the European Union, and many countries within it, have much stronger data privacy laws than the U.S.

Weissinger said one other concern with vaccine apps is access. You need a smartphone, internet and some technical know-how to use them.

And if you want a breakdown of the various digital vaccine verification systems in the U.S., MIT Technology Review has this article. Just four states have the systems now — California, Louisiana, New York and Hawaii — while more than a dozen states have banned the use of any vaccine credential (digital or otherwise).