A look at the challenges in building workable vaccine passport apps, including dealing with forged records, protecting privacy, and interoperability
David Ingram / NBC News :
Context & Ripple Effects
By early April 2021 the credential buildout is already two-track: a coalition including Microsoft, Salesforce, and Oracle is developing a private-sector pass, while New York has shipped the first US state app on IBM's blockchain-based health pass platform. This NBC News piece steps back to name the three problems both tracks share — forged records, privacy, and interoperability.
The corpus since then reads as a scorecard on those three questions. New York's own app showed low adoption and persistent technical glitches, Canada's Portpass exposed private user data through a security flaw, and by August cities like NYC were mandating proof of vaccination anyway — making verification accuracy a live regulatory problem rather than a design nicety.
First-order effects
- Vendors building passes — the Microsoft/Salesforce/Oracle coalition and IBM's health pass platform — now have to treat anti-forgery verification and privacy engineering as core requirements, because state deployments put them in front of real venue staff and real users.
- New York's Excelsior Pass becomes the reference deployment: its glitches and thin uptake set expectations for every state considering a similar IBM-style launch.
Second-order effects
- Security failures at smaller players like Portpass shift credibility toward big-vendor coalitions, but also hand ammunition to privacy critics arguing that any centralized health-credential database is an attack surface.
- Mandates like NYC's force venues to accept multiple incompatible passes, which turns interoperability — the hardest of the three problems named here — into a day-of-entry operational cost for businesses.
Third-order effects
- If the pattern holds, the market consolidates around whichever standard solves cross-system verification first, with laggard apps abandoned; failure would leave a fragmented patchwork where each city or state accepts only its own credential, undermining the whole premise of a portable pass.
The trend: Digital health credentials are moving from pilot projects to mandated infrastructure, with forgery-proofing, privacy, and interoperability determining whether one portable pass or a patchwork of local systems wins.