New York's digital COVID-19 vaccine passport now has about 2 million downloads, but some users have experienced tech glitches and discovered privacy issues, according to a July 6 MIT Technology Review report.
For the report, MIT Technology Review reporter Rebecca Chowdhury downloaded the app, dubbed Excelsior Pass, to test it out. Her report is part of the publication's Pandemic Technology Project.
Six details:
1. Excelsior Pass has about 2 million downloads, which represent 10 percent of fully vaccinated New Yorkers, according to the report. The state developed the app in partnership with IBM.
2. When Ms. Chowdhury downloaded Excelsior Pass, she wrote that she was met with an error message "like many users," adding that many people have not been able to use the pass because it couldn't verify their vaccination status.
3. Excelsior works by connecting to New York's state immunization records, but database errors can cause glitches, especially if there were data entry errors, such as a misspelled name or wrong birthdate, at the vaccine site, Ms. Chowdhury wrote.
4. Ms. Chowdhury wrote that the app couldn't verify her identity, so she "followed the suggestions on the error page and dug up my paper vaccination card to ensure that I was entering vaccine site information correctly. After three attempts, in which I reentered the same information each time, it worked."
5. New York's state website says that Excelsior data is safe and secure, and the app's privacy policy says it doesn't store the information including names, birthdates, ZIP codes and phone numbers, sent via the app. The app also doesn't use location services to track people's locations.
6. Albert Cahn, executive director of the Stop Technology Oversight Project, told MIT Technology Review that businesses actually use a separate app to scan the Excelsior pass, and when he tested it he found that a user's location could potentially be tracked by the scanners.
"As a result, the comedy club I go to might have a log of my visits there—and to any bars I go to afterwards that require proof of vaccination," Ms. Chowdhury wrote. "Neither New York State nor IBM responded to requests to clarify whether scanning information could be collected or tracked."
Click here to view the full report.