New York’s 'Excelsior Pass' is the first Covid-19 vaccine passport in the US

It is accessible, for now, only to people who have been vaccinated in the state

On the Upper East Side in Manhattan, a well-heeled crowd flashed it to get into a socially distanced dance performance at the Park Avenue Armory. In Chelsea, people showed it to attend a John Mulaney stand-up set at City Winery. And in Troy, New York, patrons are using it to enter an intimate, speakeasy-style bar that admits only vaccinated guests.

This magic ticket is New York state’s Excelsior Pass, which was introduced in March as the first and only government-issued vaccine passport in the country, accessible, for now, only to people who have been vaccinated in the state.

Officials are hoping that it can help New Yorkers feel confident about the safety of businesses and jump-start a statewide economy that is still reeling from losses experienced during the pandemic. But for that to happen, they will need more people and businesses to start using it and vaccine passports to become more universally accepted.

Though it is basically just a QR code on your phone that indicates your vaccine status, the pass, and vaccine passports more generally, have become a political flashpoint among conservatives who say the passports violate privacy concerns.

Read more: The world should learn from India’s Covid-19-19 cataclysm

About 1.1 million Excelsior passes have been downloaded onto phones and computers since the passport’s introduction, according to the state, which is only a fraction of the 8.9 million New Yorkers who have so far been fully vaccinated.

But officials are hopeful that it will catch on more widely.

Eric Piscini, the vice president for emerging business networks at IBM, which developed the Excelsior Pass for the state, said New York was in discussions with other states so the pass could be used by out-of-state residents in New York and by New Yorkers elsewhere.

Also read: Covid-19-19 vaccination policy: Supreme Court must step in

“In the application space, when you reach a million people, that’s a pretty good threshold to pass,” Piscini said. “That is a really good indication that people find value in this.”

Nationally, a range of states including Georgia, Alabama, Arizona and Florida have already banned the use of vaccine passports, presenting the bans as measures to protect individual privacy and vaccination choice.

In New York, some lawmakers are backing new legislation that would provide additional privacy protections.

But though major sports venues and a growing number of smaller New York businesses are embracing using the app, the vast majority of businesses are not requiring any proof of vaccination to enter. (The state would not say how many businesses had signed up.)

For those that take the Excelsior Pass, paper vaccine cards must also be accepted as a form of proof, the state said.

Some businesses — especially those catering to adult audiences, like arts venues — are jumping into the world of verification. Aside from accepting the Excelsior Pass, City Winery in Chelsea, for example, also uses the CLEAR pass as a way to verify health and vaccination status. Gov. Andrew Cuomo has encouraged the move toward fully vaccinated crowds by permitting businesses to disregard social distancing if everyone is vaccinated.

But civic technology experts warn that the passes can be gamed relatively easily, just like the paper vaccine card itself.

It took Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, a nonprofit watchdog group, just 11 minutes to download someone else’s Excelsior Pass using information they had posted on social media and Google searches, he said. Many people have posted pictures of their vaccination cards, which include a person’s name, birthday, date of vaccination and type of shot.

And each pass can be uploaded to a limitless number of devices, or printed out and copied. The Excelsior Pass, which cost the state $2.5 million to develop, contains no biometric data for privacy reasons, so it needs to be compared against an ID, an extra step that, in practice, sometimes isn’t taken.

“We need to realize that as much as we want a magic piece of software to be able to tell us whether the person next to us is vaccinated, these apps really can’t,” Cahn said. “At the end of the day, it’s largely built on trust.”

At the City Winery on Wednesday, outdoor hosts sometimes asked for ID when people flashed their Excelsior Pass or paper vaccination cards to enter, but sometimes they didn’t. At the Armory, Covid-19 compliance officers in face shields carefully checked IDs, but they just eyeballed the pass’ QR code, instead of scanning it to double-check its veracity.

There is no law mandating such steps be taken.

“We trust our audience,” said Michael Dorf, CEO of City Winery, adding that his employees use their discretion to make those choices.

Accessibility is another worry. New York’s vaccine rollout was marred by a heavy reliance on a complex internet appointment system, which gave tech-savvy people an advantage. Many older New Yorkers and those without good internet access struggled.

Now those same people face another technological hurdle if the pass becomes popular. Noel Hidalgo, executive director of BetaNYC, a nonprofit public interest technology organization, said he didn’t think the state should be investing millions in a vaccine passport when more time and effort could be spent on things like helping improve vaccination rates among Black and Hispanic New Yorkers and figuring out how people could quickly replace a lost or damaged paper card.

“Why are we focusing on providing a tech tool to a small group of New Yorkers who are digitally literate and understand how to get access?” he asked.

Delays in entering data and data entry mistakes are also limiting who gets the pass. About 4% of people who tried to get passes were unable to do so, said Jennifer Givner, a state spokesperson.

The pass pulls its information from the state and city immunization databases. If the information is entered incorrectly — for example, with misspellings or a wrong initial — the pass cannot be found.

IBM recently added a phone number check to the identification field of the app to make it easier to find someone’s vaccination. Only four of the five fields — including first and last name, date of birth and ZIP code — need to match for someone to get a pass.

A thread on Reddit dedicated to helping people who could not get passes noted that sometimes putting in an old ZIP code seemed to work.

“Yeah, for me it was a ZIP code I hadn’t used in 14 years,” one user wrote on the thread.

People who can’t get a pass can fill out a complaint form and call a state hotline, but for the most part, the organization that vaccinated them has to correct the data, which is not always easy. The Excelsior Pass also does not have access to federal vaccination data, so people who got their vaccines at veterans’ hospitals, like John Taylor, a 77-year-old Vietnam War veteran who lives in Pleasant Valley, New York, are out of luck.

“I had it laminated,” Taylor said of his paper vaccine card. “I’m just going to forget about the pass.”

State officials emphasized that the paper card could always be used, so the Excelsior Pass was not essential. Cuomo recently said that he still showed his paper card.

Outside shows at the Park Avenue Armory and City Winery on recent days, it seemed that about half of the patrons waiting in line flashed their Excelsior Passes to prove vaccination and that the rest used their cards or photos of their cards. Both venues had additional alternatives for unvaccinated guests, such as rapid testing on site, or accepted proof of recent negative coronavirus tests.

“I’m proud of it,” Scott Hernandez, 42, said of his Excelsior Pass. “There needs to be more education about it.”

But the extent of social acceptance of the Excelsior Pass may vary around the state. In more conservative areas, the blowback can be severe.

In Auburn, New York, a tiny five-table chocolate store, Gretchen’s Confections and Cafe, was inundated with social media hate from around the country after photos of a sign asking people to be vaccinated to sit indoors went viral. The store took down its sign, and it now welcomes everyone.

“It is very polarizing,” said Gretchen Christenson, the owner. “They have been calling us Hitler and fascists, ‘Segregation Cafe.’ I think the number of people against it is tiny, but they are just extra loud and threatening.”

And when Matt Baumgartner announced that one of his bars, the Berlin Lounge in Troy, New York, would allow only vaccinated guests because of its small size and lack of outdoor space, he was also hit with social media hate.

In both cases, loyal customers rallied in support, and the lounge and the shop have been doing well in recent weeks.

“I’m someone who very strongly who believes in the vaccine, and part of me feels like getting to visit more places is kind of a reward,” Baumgartner said.