This Isn’t Your Father’s Yellow Card

As the global vaccination effort rolls out in many countries, people will increasingly be required to provide evidence for various reasons, especially travelers. Earlier this month a coalition which includes Microsoft, the Mayo Clinic, Oracle, MITRE, and others announced an effort to establish digital vaccination records called the Vaccination Credential Initiative (VCI). This isn’t going to be a brand new thing, but rather an initiative to provide digital proof-of-vaccination to people who want it, using existing open standards:

  • Verifiable Credentials, per World Wide Web Consortium Recommendation (VC Data Model 1.0)
  • Industry standard format and security, per the Health Level Seven International (HL7) FHIR standard

In addition, the World Health Organization formed the Smart Vaccination Certificate Working Group in December. Various other countries and organizations also have technical solutions in the works or already deployed. If a consensus doesn’t form soon, we can see this quickly becoming a can of worms. Imagine having to obtain multiple certifications of your vaccination because of non-uniform requirements between countries, organizations, and/or purposes.

Older readers and international travelers may be wondering, “don’t we already have a vaccination card system?” Indeed we do: the Carte Jaune or Yellow Card. The concept of a “vaccination passport” was conceived and agreed upon at the International Sanitary Convention for Aerial Navigation in 1933. Over the years the names and diseases of interest have changed, but since 2007 it has been formally called the International Certificate of Vaccination or Prophylaxis (ICVP). In recent times, yellow fever was the only vaccination of interest to travelers, but other vaccinations or booster shots can be recorded as well. One problem with the paper Yellow Card is that it is ridiculously easy to forge. Nefarious or lazy travelers could download it from the WHO site, print it on appropriate yellow card stock, and forge a doctor’s signature. The push for a more secure ICVP is not completely unreasonable.

Reading the instructions on the Yellow Card brings up a couple of interesting points:

  • This certificate is valid only if the vaccine or prophylaxis used has been approved by the World Health Organization — Currently the Pfizer vaccine is the only one to be approved by WHO, and even that is only an emergency approval. If you receive a non-Pfizer vaccination, what then?
  • The only disease specifically designated in the International Health Regulations (2005) for which proof of vaccination or prophylaxis may be required as a condition of entry to a State Party, is yellow fever — This one is interesting, and suggests that member states cannot require proof of Covid19 vaccination as an entry requirement, a situation that will no doubt be quickly revised or ignored.

Note: This writeup is about vaccinations, not about immunity. While immunity certificates have been used from time to time throughout modern history, the concept of an international immunity passport is not well established like the ICVP.

59 thoughts on “This Isn’t Your Father’s Yellow Card

        1. I saw a picture of what was purported to be a 5g chip someone squeezed out of a covid injection site. It was a bicycle tire valve. It was sure big enough to fit a transceiver. Of course, it wasn’t exactly hypodermic needle sized. But, hey, gullible people…

  1. Microsoft and Oracle to deal with personal and health data ? Huhu … what could go wrong ?
    I am a bit surprised that amazon, google, facebook, alibaba did not generously help for this, for free :)
    PS: In France, health data do not belong already to big companies… we are fighting against it

    1. “PS: In France, health data do not belong already to big companies… we are fighting against it”

      Microsoft will know if french people are vaccinated or not, as France passed a similar law like in Belgium to store the vaccination in a database running on Azure.

  2. WHO? Aren’t they the people that used to tell us not to wear masks, that mask wearing might actually be harmful, then changed their minds and told us to wear masks? Aren’t they also the people who told us that there was no evidence for Human-to-Human transmission, then changed their minds and told us that there was evidence for Human-to-Human transmission?

    1. The thing that bothers me about the mask issue is I’ve STILL only seen one other person with a positive pressure HEPA mask. Everyone wants to stop the pandemic, but everyone is still using 10-70% effective masks.

      We have the technology to make far more effective masks, which are more comfortable, for fairly cheap. Ramping up production on those, studying them, and telling everyone to buy one should have been the top priority.

      Even if they had the vaccine from day #1, we don’t know if it would be enough to totally eliminate the virus. Powered masks are an engineered mechanical solution, not based on any complicated biology we don’t understand yet.

      The thing I’m worried about is using the vaccine as an excuse to do nothing else, so people can go back to dying of the regular flu and whatever new mutant strain comes out.

      We should be putting HEPAs everywhere, and leaving them there forever, so that cashiers and teachers are always protected, in addition to leaving the plastic shields. We should be redesigning ventilator to prevent unfiltered paths between people’s faces. Why can’t the bus have seat row dividers, and a long row of intakes that catch most exhaled air before it gets to people?

      Air filters should just be standard PPE that you give anyone who stands in semi-enclosed place like a cubicle for a long time.

      A different pandemic could happen, and regular colds and flus are reason enough to take every safe and non-disruptive measure we can.

      Especially with all the anti-vaxxers.

      They should be the biggest proponents of powerful air filters and more effective masks, to make vaccines obsolete, rather than just secretly hoping everyone does nothing at all.

      1. “The thing that bothers me about the mask issue is I’ve STILL only seen one other person with a positive pressure HEPA mask. Everyone wants to stop the pandemic, but everyone is still using 10-70% effective masks.”

        The problems include that PAPR are expensive, require proper cleaning and maintenance, are cumbersome, use filters that are expensive, and don’t protect others. Some models also have fit requirements to be effective. I am not taking a risk with my TR-600 at the grocery. There are times I depend on it for my life.

        I could address a number of your other points, but other than ask if you have ever worked in an environment with properly placed, effective HEPA units, and had to maintain them, you would never mention them dor places like a school.

          1. That’s kind of funny because I do know people who live effectively outside out of campers in the woods and they are all super healthy.

            Obesity has reached epidemic proportions globally, with at least 2.8 million people dying each year as a result of being overweight or obese. -WHO

            So yeah spending most of your waking hours inside parked on a chair is disastrous to your health and simply venturing outside for a 2 mile walk once a day mitigates a lot of the bad side effects of indoor living.

          2. Does your solution work for everyone or only for those wealthy enough to own a big piece of property? It’s easy to live healthy if you have unlimited money to throw at the problem.

          3. I see your point. Rich countries with little land will not be able to handle this but in America much rural land can be obtained for very little money. Maybe $20K per acre plus a camper. Hardly breaks the bank. Or in the case of one of the people I know they pay someone a few hundred a month to live on their land.

    2. Sorry, hit report rather than reply.

      It isn’t changing mind, it is updating message as new information becomes available.

      Saying there is no evidence of something, then once you have evidence saying you have evidence is not changing your mind.
      No evidence simply means we don’t know – could be, could be not, we have no information.
      With time and experience one may gather evidence, which could say it happens, could say it doesn’t happen. Once you have evidence one way or another, then you can say we have evidence.

      Unfortunately a lot of people don’t read things carefully and understand the way scientists (and programmers, mathematicians, etc.) think and write. So careful statements get misinterpreted and restated in media, etc., and twisted to try to make a case for something.

      Changing your position as new information comes in is fundamental to science and doing things evidence based.
      (As compared to belief, e.g., where one becomes attached to an idea, and then continues to defend it and try to bend/interpret the evidence to fit the idea.)

      With any complex system (like public health messaging about wearing masks) there can be complex reactions to whatever message you put out. (What happens to mask supply, what happens to people who wear masks, how do people respond to a given message about mask wearing, etc.)

      1. Fair point. Yes, “no evidence….” does technically mean that it may or may not be happening, but it gives the impression that evidence has actually been sought, and not found. I think the statement was made when they didn’t have a clue, and they should have just said that. Maybe “we have not yet found evidence, but we haven’t actually started looking yet……” might have been a fairer statement? Totally agree about the mask supply issue. I think there’s a very good chance that NGOs and governments were saying “don’t wear masks” because they needed them to go to medics, which is completely reasonable, I just didn’t buy any of the reasoning at the time and I don’t think many people did.

    3. I’ve been wearing the good 3M mask with purple P100 filters since the beginning. Got a cheap grow lamp for UV. They’re only $35 on amazone and probably limited supply, but I wonder if this might have been a better approach & national focus could have overcome the shortage by now or earlier.

    4. None of the statements from WHO were incorrect at the time they were made.

      There were studies which indicated masks didn’t significantly reduce the chance of the wearer getting infected, and there was a minor reduction in oxygen in the blood. At the same time studies started showing people were less likely to get infected by people wearing masks, which was a more difficult study to do, as it required infected people with the virus.
      And there was evidence of infected without symptoms spreading the virus without knowing. So acting like you are infected was advised.

      No evidence of human to human transmission, does not mean evidence of no human to human transmission, it simply means not enough data to make any conclusion on the matter.

      If news outlets didn’t take parts of the statements out of context, or people put an effort into understanding what the original statements were, we wouldn’t be in as big of a mess as we are now.

  3. They probably are indeed the people who told us that there was no evidence for Human-to-Human transmission, most likely because there was no evidence. They probably didn’t “change their minds” about the evidence as such, as that is not how science works. Rather, they told us that there was evidence for Human-to-Human transmission when they had, you know, evidence.

    1. Well, that’s one way of putting it. I’m 100% in favor of changing positions based on the emergence of new evidence but I think the initial position should have been “we can’t say for sure if this is going from human to human or not as we haven’t yet looked, but it might be” rather than “there is no evidence of human to human transmission.” (which gives the impression that they have done some research on it and actually found no evidence). There was actually quite a lot of evidence (people being hospitalised away from initial site, clusters etc). They were basically just parroting what the CCP was telling them. It was too reassuring at a time when the world should have been getting ready and putting policies in place. It was a political decision. This reply will probably be deleted.

      1. I get what you’re saying, but: there’s no evidence of invisible pink unicorns, and I’m perfectly willing to be loud and clear about there being no evidence of there being invisible pink unicorns even if I haven’t done any research to find out if there are.
        If you have no data, it should be okay to say “I have no data” without people deciding that implies anything.

    2. The WHO’s ‘no evidence for Human-to-Human transmission’ was based on investigations by the Chinese authorities. The same China that had at the same time millions of people all over China under lockdown. This shows a lack of common sense, critical attitude in the communication of these matters, or the exertion of political influence. Either way, it is on the WHO.

  4. “One problem with the paper Yellow Card is that it is ridiculously easy to forge. Nefarious or lazy travelers could download it from the WHO site, print it on appropriate yellow card stock, and forge a doctor’s signature.”

    Not entirely true.
    If I look at my Carte Jaune (which is not a card a such, but a little passport-like booklet), the yellow fever shot has, in addition to the doctor’s signature:
    – a date stamp
    – a vaccine stamp: name of the vaccine plus a space for the batch number of the vaccine
    – a stamp from the “Yellow Fever Centre” qualified to give the shot
    – a stamp for the doctor to sign over

    With Comirnaty (Pfizer’s Covid-19 vaccine) little stickers with the vaccine’s batch number are distributed.

    All of these can be forged as well, but it makes it a bit harder.

          1. Depending on location – some countries allow use of national ID to move between them.
            You could (not sure about now) enter Belorussia or Ukraine from Russia with Russian national ID only.

        1. If they don’t have a passport or drivers license then they should have some form of issued ID that is recognized by the state or federal government. You can go get an ID that just proves who you are with no privileges like driving.

        2. People without a passport won’t be travelling. The purpose of the yellow card is to show vaccination status for international travel. Domestic vaccination records can be handled exactly as they are currently.

        3. Interesting question. While the Yellow Card is ordinarily used in conjunction with a passport for international travel, it seems to be a completely stand-alone document. This hypothetical fellow could probably get one, although it might raise a few eyebrows.

  5. “One problem with the paper Yellow Card is that it is ridiculously easy to forge.”
    Mine have official stamp and signature. Not easier to forge than Letter of Invitation or OK to Board I hold every time I enter Africa or even police clearance. Would I like to be caught with fake documents anywhere in the world?
    By the way – my doctor removes stickers from shots and put them instead rewriteing them to the book. This alone makes it much more difficult to fake than any officially printed A4 document I provide when boarding or get from my employer.

    1. While I’m not sure the stamps and/or stickers are an actual requirement for the doctor’s entry on the card, that’s a good point. Regarding the risk of getting caught with forged documents, I was thinking about it from the government’s point of view. If Mr Bad Guy sneaks through the border on a business trip carrying forged letters of invitation, maybe they’ll catch him or not. If they don’t catch him, maybe he’ll just attend his meeting and go home, or maybe he will smuggle black market goods, etc. Whatever the risk is, let’s say K, it’s clearly acceptable since this is common practice of governments around the world.

      But say that Ms Covid Carrier sneaks through the border with a forged Yellow Card. Now we have a different kind of risk. Is this new risk K’ potentially much worse than K? If so, should the practice of accepting documents on paper which can be easily forged be continued, or does it need to stop and be re-evaluated?

      1. Time passed and we have new situation – Mickey Mouse was vaccinated in france and infamous austrian watercolorist was vaccinated at least in two countries. Aparently all it takes to forge any vaccination is greedy doctor.

        What did we gain? Yet another database with sensitive information that is soon leaked. Money that could be spent on real needs (medical research, equipment) flowed to IT sector to create useless data base. Some public trust was lost.

        In any case covid carrier that cross he board is now fraction of the crowd of people who have covid with no symptoms and can’t do more harm than smuglnig inteligence data or preparing terroristic attack.

  6. BTW Belgium and France passed a law in December to create a database of people (vaccinated: yes/no).

    In France, the government consulted the CNIL, but in Belgium they did not consult the APD, which should be against the GDPR art36.4:

    Government said they did not consult the ADP because it was “urgent”. Proper law making for dummies:

    And this vaccination certificate will be of course generated from this database.

    Belgian law also made a criminal act the fact to refuse being registered in this database (at least for the medical staff injecting the vaccine).

    I am wondering if this law would resist a legal challenge in front of the Courts.

    They will say fighting the disease and building a database of people is more important than the right to privacy.

    1. Covid-19 seems to turn the brains of our politicians into goo. The technology for secure and decentralized data storage has been around for more than a decade now, it’s the chip on credit/debit cards, IDs, social security cards, etc. they are cheap, available around the globe and good enough to hold a qualified digital certificate, sometimes also biometric and emergency data and prescriptions. State issued cards usually have a photo of the holder on them. Extending that with vaccination data would be an easy task.

      1. “Extending that with vaccination data would be an easy task.”

        I also forgot to mention that the Belgian law does not have a “goal”. Normally in GDPR, you might have to declare the purpose of storing personal data.

  7. Interesting that the Microsoft, Salesforce and Oracle mention ethic concerns. I would like to know their definition of ethics. A quick look at what the internet dictionary says, “adj. Being in accordance with the accepted principles of right and wrong that govern the conduct of a profession: synonym: moral”. Who exactly decides what the conduct of any given profession is? It is no mystery, business determines their own ethical code, business is in business to make money, therefore money determines ethical code for that profession. If they indeed used morals to base their ethical code, the world would be a better place. Here is the issue with the card thing, normally there is a fine line somewhere, the one that has to be ‘walked’ at some inevitable point, because people. This fine line for the card thing lays beyond a fine line that has already been crossed, namely the privacy fine line, which by the way, privacy intrusion by the tech industry was built upon an ‘ethical code’ determined by said industry. This makes tech companies mentioning ethical concerns in this case an absurdity. To think ethical might be a synonym for morals, please. People with morals should be designing this system, not some unknown, business based ‘ethical code’ standard that no regular everyday person will ever see written down. No thanks, give me a yellow card.

    1. I’m kind of surprised that they couldn’t do something with blockchain technology. After all if it is public record couldn’t they just put your certificate on a blockchain as an encrypted entry that is decrypted by some combination of your passport number and a pin or secret question? Salt the entry with some oneway key that is generated by the WHO once every 15 minutes and is unique to that block in the chain. You could even add a location based salt so you could id the administration site if need be although decrypting would then require running all of the possible location salts which could number in the tens of thousands unless the individual could give it out.

      Not an expert just kind of curious if something like that could work and if so any interest in designing it?

  8. I suspect you meant to hit regular reply instead of reply to me specifically, but just in case. I don’t really know exactly what you said, but maybe it could work. Apples and oranges I think. I am referring to having enough confidence in tech companies having influence on this topic to do what is called ‘the right thing’. History shows us, no. People in general, whether it be an individual or organization, is the issue. Tech, science, even Politics can all be very good thing’s, and in some cases it is so. When ethics and morals are mentioned together with said industries, organizations, then the looking glass comes out, or should come out, through the lens of history. A favorable outlook determines confidence or not, thusly I personally have next to zero confidence in thus particular case. Without a top down code of morals, not ethics, being implemented within business, no block chain will work in the end. Not personal morals, ones that everyone follows, meaning they aren’t hidden, have no place in a terms of service contract, an opt out actually means an opt out with one single click of a button. Your thought sounds good, could possibly work, but that would be a fix, not a solution.

  9. I work requires me to have various certified vaccines and sometimes confirmations of immunity. For example, having two doses of MMR, having Hep B antibody titres.

    The issue here is that firstly we know that vaccine != immunity, for example looking at the recent results from Gamaleya’s sputnik V, about 4% of people don’t seem to form neutralizing antibodies.

    We also know that being immune doesn’t mean you can not transmit it.

    So I can not see how any meaningful vaccine passport could be utilized.

    Now the passport lists Pfizer, does it specify that it’s two doses no more than 6 weeks apart as it was authorized in the EU? Is two doses 12 weeks apart as currently planned in the UK sufficient?

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.