In an office close to Waterloo station in central London, standing desks are complimented by arcade machines, a basketball hoop, and coffee bars. But for the rain streaming down the windows, this could be a Silicon Valley tech campus, and the product developed here may be just as significant to our economy as any Big Tech innovation. This is home to iProov, a biometrics company that is developing an app to help Britain escape future lockdowns.
This is part of a multi-billion-pound race to create “digital health passports” that will allow people who have been vaccinated against Covid-19, or who have recently tested negative, freedom in a post-pandemic world. But such freedom could come at a price.
Supported by the government, iProov is working to create a future in which facial scans could dictate our access to many parts of society.
The company has spent the past year working alongside software firm Mvine to design a Covid-19 immunity and vaccination status “passport”, which could be integrated into the NHS app introduced last summer as part of the Test and Trace programme.
In January NHS public health directors began live-testing a prototype of the app – which received a grant of £75,000 from government agency Innovate UK last spring – with the potential for a mass roll-out subject to a Cabinet Office review. The company has previously won contracts to supply identification technology to banks, HMRC and US border security.
Andrew Bud, iProov’s CEO, says that should the app be adopted, it could lead to a future in which we all have a unique QR code on our phones to disclose our health status. This code, verified by a facial scan held in a central database, would be used as a passport for entry into spaces ranging from pubs and restaurants to mass events.
“I think that people will be willing to make a one-off investment in enrolling their face,” Bud told me. “If you have to go through this rather convoluted process of getting the certificate set up, enrolling your face… that’s an investment.
“If the result is that you can turn up to a thing, show your QR code, present your face, and you’re through – that’s a lot faster, and a lot more private than the alternatives.”
Bud says that iProov is also working on alternative methods of verification, but that he believes facial biometrics provide more “integrity” in identification. Such data can only be used for public health purposes, and must include “active, informed, revocable consent”, as required by the 2018 Data Protection Act.
But what happens to people who withhold consent for their biometric data to be used in this way?
“Whether a pub is entitled to refuse access because someone hasn’t given consent to their face verification is a choice for that pub,” Bud says. “It’s a choice for civil society to take a view as to whether that should take place or not”.
***
Immunity passports were first discussed in April 2020 as a possible route out of lockdown, and were included in the government’s scrapped “Operation Moonshot” plan to reopen the economy.
In February, the government committed in its roadmap to review the use of “Covid status certification”, as it calls immunity passporting, in reopening the economy. Boris Johnson has acknowledged the “deep and complex issues” that such a policy could create, and the concern of some in his party. “I know the fervent libertarians will object,” Johnson has said, “but other people will think that there is a case for it.”
A Cabinet Office review led by Michael Gove will consider the “ethical, equalities, privacy, legal and operational aspects of this approach”.
[see also: Plans for Covid-19 vaccine passports may stoke intergenerational divides]
“This is complicated. I personally have a great deal of sympathy for Whitehall at this moment and for the government, because these are complicated choices,” says Bud. “I know what I would prefer to see happen, but that’s not the same as saying ‘this is what the government should do’.”
But others say there is a pressing risk that restricting access to many areas of life – from pubs to jobs to international travel – to people with health passports would discriminate against people who can’t (or won’t) be vaccinated or regularly tested.
“When our entire economic life is hinging on immunity, being able to choose and consent is a wilting right,” says a 2020 report on immunity passports by Privacy International.
“If we base this purely on ‘consent’, without any support or back-up… how then, are we able to say no, when that person is our employer, a bouncer, a police officer, or a landlord, or these other people with power over you?” asks Tom Fisher, a senior researcher at Privacy International.
The members of society who are historically the most afraid to engage with the state, such as undocumented migrants, could be at the highest risk, Fisher says. Undocumented migrants have previously been tracked by the Home Office using NHS data.
However, iProov insists that it would require that protections are put in place between user and product in order to preserve privacy.
“We demand that there’s a privacy firewall put in place by our customers [contractors], between us, and the citizen’s real identity,” explains Bud. “The architecture of our system says that our customers, the enterprisers, know a lot about the person, but may not even know what they look like. We [iProov] know what a person looks like, but we have no idea – and no way of having an idea – as to who they actually are.
“This separation of functions protected by this privacy firewall is designed specifically to maximise privacy and minimise any risk of identity leakage.”
The adoption of biometrics centred around the use of technology would almost certainly exacerbate the “digital divide” between those who do and those who don’t have access to the requisite technology. In the UK, for example, 16 per cent of adults don’t own a smartphone, and the divides are greater still in many other countries.
“There are no silver bullets,” Bud says. “We’re going to live in a new world in which we have to continuously live with a level of risk that we’re not used to living with… These technological solutions, these regulations, will help to mitigate these risks – but they won’t eliminate them.”
Not everyone, however, will agree about the effectiveness or necessity of these particular solutions.
Fisher argues: “The tragedy is that the digital identity industry is not really putting mitigations or solutions to these problems, but rather they’re selling the same old products… saying that our digital identity system that we had before this unprecedented pandemic, happens to be the perfect solution now.”
***
Whatever Michael Gove’s Cabinet Office review decides, digital health passports are coming, for international travel at the very least. Airlines, including BA, are already launching their own vaccine passports, while China has introduced a digital health certificate for its citizens and the EU has announced a similar plan.
Digital health passport and certification is a new but already lucrative market, which could be worth up to $23bn, according to one estimate.
“The key to all of this working at a global level, or even just a regional level, is that all these systems need to interoperate,” says Darren Toh of AOKpass. His company uses a cryptographic hashing algorithm designed to make communication between clinics and an individual’s phone untraceable and highly secure.
“Hopefully, there’ll be a single digital standard that allows all the solutions to stitch together, all the immigration authorities, the clinics and labs,” says Toh, although he admits to being doubtful this will happen. “The ecosystem is too diverse and too big.”
iProov CEO Andrew Bud agrees: “There is a lot of innovation to be done here… interoperability can dramatically reduce complexity in the market, but it can also, if it’s done wrong, slow down or destroy a market.
“If there are potential downsides, then it would be the role of government to use regulation to mitigate that risk.”
But there are further philosophical and ethical questions to be answered. “The Covid genie is out of the bottle,” says Toh. “We need a viable solution that doesn’t breach people’s privacy, and that is accessible to everyone to get us to a place where we can feel safe.
“Do you really want to be carrying around a pile of papers? Or do you want all that stored on an app that you carry with you everywhere that’s secure?”
[see also: Why we shouldn’t worry about vaccine passports]
Content from our partners
Related
