A year ago, vaccines to tackle the covid pandemic still seemed like a far-off idea. Today, though, doses have been delivered to almost 40% of the world’s people—and some are being asked to prove they’re among them, leading to the rise of so-called vaccine passports. The details of these credentials vary from place to place, but at their heart they are the same: digital health records, stored on your phone, to use as proof that you are a low risk to others.
Supporters of digital vaccination credentials say the benefits are clear: they make congregating less risky while incentivizing vaccination. But critics see drawbacks and disadvantages. They say introducing restrictions infringes on civil liberties, unfairly punishes those who cannot get vaccinated (and discriminates against those who will not), unleashes another form of surveillance, and worsens inequalities rather than eradicating them.
Faced with this divergence of views, governments are taking very different approaches. In Europe, for example, seven countries launched a “digital green certificate” at the beginning of June, with another 21 nations due to join shortly. But some places are taking the opposite stance, strictly limiting the use of such documents or even banning their development altogether.
Along with these debates, there is still basic confusion about how systems would be used. Some, like the EU’s app, are for traveling between nations. Others, like New York State’s, are for getting into everyday places like restaurants and events. The term “passport” itself is becoming more ambiguous and more politically loaded: when California governor Gavin Newsom announced the launch of his state’s digital certificate, he specifically stated, “It’s not a passport; it’s not a requirement.”
We looked at the status of digital vaccine systems in all 50 states
President Joe Biden has already said there won’t be a national app, leaving the choice to states. Some states have banned the apps outright as examples of government overreach. Often the debate over the technology seems like a proxy for a larger question: Should governments and businesses be allowed to require vaccination for covid?
A few key takeaways:
- Most states have addressed the technology in some way, either in legislation or in comments from a lawmaker, a public health official, or the governor.
- 7 states have active vaccine certification apps, rising from 4 at our last count.
- 22 states have banned the systems to some degree, typically through executive orders. Most, though not all, of these states are Republican-led.
Each state is listed on the map according to the current legal status of vaccine apps at the time of publication. “Active” indicates that a state has created and released a digital system for showing that you have been vaccinated against covid. It does not mean that presenting vaccination credentials is mandatory state-wide, although there may be such requirements on a local level.
- Alabama: Governor Kay Ivey signed legislation on May 24 to ban digital vaccine credentials. The Alabama House of Representatives voted 76-16 to approve the bill. (Source: AP News)
- Alaska: Governor Mike Dunleavy issued Administrative Order No. 321 on April 26 stating that the state of Alaska will not require vaccine certification in order to travel to, or around, Alaska. (Source: Alaska State Website)
- Arizona: A bill passed on June 30 says employees cannot be required to get vaccinated if they have “sincerely held religious beliefs, practices or observances that prevent them from getting the covid-19 vaccine.” But exceptions can be made, and health-care institutions can require employees to be vaccinated. (Source: NASHP)
- Arkansas: On April 20, Governor Asa Hutchinson signed a law that prevents state and local governments from requiring covid-19 vaccine or proof of vaccination in order to access services. The state’s majority-Republican Senate voted 23-8 to ban digital vaccine credentials. (Source: ABC Little Rock)
- California: As of June 11, California offers a Digital Covid-19 Vaccination Record, and effective September 20, vaccine proof for 1,000+-person events will be required. (Source: NBC LA) Workers in schools and state and local governments need to be vaccinated by October 15 or take weekly tests. (Source: State Governor’s website). San Francisco now requires vaccine proof for many indoor leisure spaces, and Los Angeles could follow suit. (Source: NPR)
- Colorado: While presenting vaccine credentials is not required, residents can create a digital record of their vaccine cards on a state app. (Source: Denver Post) On July 30, Governor Jared Polis announced that unvaccinated state employees have to wear masks at work and get tested twice a week (Source: AP News), while Denver city employees and high-risk private workers will need vaccinations by September 30. (Source: AP News)
- Connecticut: There is no vaccine certification requirement, but in March Governor Ned Lamont said that vaccine passports could be introduced in Connecticut through the private sector (Source: CT Post) An executive order signed on August 6 mandates that all employees of long-term care facilities receive at least one dose by September 7. (Source: AP News)
- Delaware: No plans to establish a digital system. Governor John Carney is considering a targeted approach that would aim vaccine mandates at high-risk groups. Verification of vaccination status remains a hurdle, the governor says. (Source: Delaware Public Media)
- Florida: Governor Ron DeSantis signed Senate Bill 2006 on April 2, effectively banning vaccine certification, blocking any business or government entity from requiring proof of covid-19 vaccination (Source: FL Governor website)
- Georgia: Governor Brian Kemp issued an executive order on May 25 prohibiting vaccine proof in state government: No vaccine passport shall be required for entry into the state of Georgia. State employers shall not have different rules for employees based on vaccination status, unless such rules are implemented using an honor code system and no proof of vaccination is required. (Source: GA Governor website)
- Hawaii: Travelers to or within Hawaii are required to upload proof of vaccination in the state’s Safe Travels program or vaccine records via several partners, including AZOVA, CLEAR, and CommonPass. State and county workers need to get vaccinated as of mid-August (Source: Hawaii News Now), while college and university students are also required to show proof of vaccination or take weekly tests. (Source: Star Advertiser)
- Idaho: Governor Brad Little issued an executive order on April 7 banning the state government from requiring or issuing vaccine digital vaccine credentials. (Source: U.S. News/AP)
- Illinois: Public health commissioner Allison Arwady said that the “Vax Pass” will be required to attend concerts and other summer events. (Source: Illinois Policy) On August 13, Chicago Public Schools announced vaccine mandates for all teachers and staff . (Source: Chicago Sun-Times)
- Indiana: HB 1405, passed on April 22, bans the state or local governments from issuing or requiring vaccine certification. (Source: WFYI Indianapolis)
- Iowa: On May 20 Governor Kim Reynolds signed a law, House File 889, that will withhold state grants and contracts from local governments or businesses that require customers to prove they have received a covid vaccine. The law also prevents state and local governments from including a person’s vaccination status on a government-issued identification card. (Source: Des Moines Register)
- Kansas: On May 7 lawmakers approved a proposal that includes a ban on vaccine certification, which has been signed into law by Governor Laura Kelly. The law “prohibits state agencies from issuing covid-19 vaccination passports to individuals without consent, or requiring vaccination passports within the state for any purpose.” (Source: NASHP)
- Kentucky: State Representative Brandon Reed has proposed a bill that would ban the government from enforcing vaccine requirements. (Source: The Times Tribune) State workers need to get vaccinated or get tested twice a week starting October 1. (Source: Lexington Herald Leader)
- Louisiana: Vaccine certification is not required, but residents are able to show digital proof of vaccination via the LA Wallet mobile app, the state’s digital driver’s license app. (Source: AP News) A citywide vaccine mandate is slated to soon require proof of vaccination or a recent negative test for entry into restaurants, bars, and other indoor venues in New Orleans. (Source: nola.com) A statewide ban on vaccine mandates was proposed but vetoed by the governor.
- Maine: Officials are not planning on developing a statewide vaccine certification system. Residents are encouraged to use their CDC-issued immunization record card if vaccination proof is required for an activity or for travel. (Source: AP News)
- Maryland: Vaccine certification is not required currently but is not off the table. (Source: 11 News) The biotechnical distribution company MyBioSource.Com surveyed 3,000 Marylanders, and overall, 63% of Marylanders believe vaccine passports should be used. (Source: CBS Baltimore)
- Massachusetts: Governor Charlie Baker said on April 8 that he is opposed to requiring proof of vaccination, but no ban has yet been passed. (Source: Boston Globe)
- Michigan: The state house of representatives passed a bill, HB 4667, on June 2 to ban digital vaccine certification or any other system where individuals’ civil rights are diminished by vaccine status. (Source: U.S. News)
- Minnesota: The state senate passed bill S1589-2 in May, stating that “no person must be required to possess, wear, or display” any indicator “that the person received a negative or positive test result or possesses the antibodies for a communicable disease.” The Minnesota Department of Health has been prohibited from forcing people to participate in covid testing, contact tracing, or digital contact tracing. (Source: Minnesota State Republican Caucus website)
- Mississippi: The state is currently not pursuing the use of a certification system. Governor Tate Reeves said in April that he doesn’t support vaccine passports. (Source: CNN) House Bill 719 was introduced to ban vaccine mandates but failed to pass in April. (Source: Mississippi Clarion Ledger)
- Missouri: In June Governor Mike Parson approved provisions to House Bill HB271, a bill that aims to ban vaccine certification systems. It prohibits local governments that receive public funds from requiring proof of vaccination for access to public transportation or other services. (Source: Springfield News Leader)
- Montana: Governor Greg Gianforte issued an executive order on April 13 prohibiting state-sponsored development and required use of vaccine proof. (Source: Montana State website)
- Nebraska: Governor Pete Ricketts issued a statement on March 13 saying that the state will not participate in the vaccine certification program. No update on statewide ban or legislation yet. (Source: Nebraska Government website)
- Nevada: Vaccine proof is not required within the state, but there is no active statewide ban on it. Senator Jacky Rosen said on May 4 that she does not support requiring vaccine passports for local events. (Source: Las Vegas Review-Journal). Two counties, Elko and Lander, have passed resolutions to ban vaccine passports. (Source: The Nevada Independent)
- New Hampshire: Governor Chris Sununu signed the “medical freedom” immunization bill into law on July 25. The bill prohibits government agencies (including school districts) from mandating vaccines or requiring proof of vaccination for access to their buildings or services, although that may change if covid-19 vaccination is added to the state’s required immunizations list. Some exemptions apply. (Sources: AP News, New Hampshire Bulletin)
- New Jersey: Governor Phil Murphy said in April that he was open to the idea but that the state would follow federal guidance. (Source: Philadelphia Inquirer) In July, the governor unveiled a phone app called Docket, which is a place to store a digital vaccine record but “is not a vaccine passport.” (Source: nj.com)
- New Mexico: The state has no plans to issue its own certification system or limit access to services based on vaccine status, but businesses are free to make their own decisions about whom to admit and serve. (Source: New Mexico Magazine)
- New York: The state has implemented a vaccine status system, the Excelsior Pass (Source: MIT Technology Review), which is available for iPhone and Android in nearly a dozen languages.(Source: NY State website) By September 13, New York City will require proof of covid-19 vaccination for indoor leisure activities. (Source: MIT Technology Review)
- North Carolina: The state house of representatives urged Governor Roy Cooper to reject attempts to create a vaccine proof system on April 21, with 65 Republican lawmakers sending a letter to oppose it. (Source: WCNC Charlotte)
- North Dakota: Lawmakers passed a limited ban on vaccine certification and amended the ban into HB1465 on April 29. The law bans state and local governments from requiring proof documents and prohibits business—with some exceptions—from requiring vaccination documents of customers and patrons for access, entry, or services. The legislature also passed a resolution, SCR4016, urging Congress to refrain from passing a system for showing proof of vaccination. (Source: The Bismarck Tribune)
- Ohio: Governor Mike DeWine made a commitment that the state will not create or require vaccine certification, but he has left the issue of private-sector requirements up to individual businesses. Bill SB 111, which prohibits vaccine mandates, has passed but has not been signed into law by the governor. (Source: NASHP)
- Oklahoma: Governor Kevin Stitt issued an executive order on May 28 banning state agencies from requiring vaccinations as a condition of entry to public buildings. He also signed SB658, which prohibits schools from requiring covid vaccinations for K-12 students or implementing mask mandates that would apply only to unvaccinated students. (Source: The Oklahoman)
- Oregon: In early August, Governor Kate Brown issued new rules requiring health-care workers to get vaccinated or submit to regular testing. (Source: AP News) The state will require all state employees to be vaccinated by October 18, including teachers and school staff. (Source: AP News) Brown also announced a strict new statewide mask mandate that even applies outdoors. (Source: AP News)
- Pennsylvania: On July 1, Governor Tom Wolf vetoed Senate Bill 618, which sought to ban vaccine certification and limit future actions during health emergencies. (Source: PA Governor)
- Rhode Island: Governor Dan McKee said on May 18 that he was leaving it to business owners and employers to decide mask-wearing and vaccination rules for themselves. (Source: The Providence Journal) But in August he announced that health-care workers at state facilities must get vaccinated before October 1 or get tested regularly. (Source: Boston Globe) City workers in Providence will face the same measures starting in October. (Source: WPRI)
- South Carolina: Governor Henry McMaster issued an executive order on May 11 that prevents local governments and schools from creating mask mandates. The order also bans local governments, state agencies, and state employees from requiring vaccine credentials. (Source: WebMD)
- South Dakota: Governor Kristi Noem issued an executive order on April 21 banning the development or use of vaccine proof systems. (Source AP News)
- Tennessee: The state senate passed a ban on vaccine passports with SB0858 on April 14; Governor Bill Lee said in April on Twitter that he “opposes vaccine passports,” adding: “The covid-19 vaccine should be a personal health choice, not a government requirement.” (Source: The Hill)
- Texas: On June 7 Governor Greg Abbot signed bill SB968, which bans businesses from requiring proof of vaccination; vaccine proofs are prohibited in the state. (Source: Texas Tribune) Local vaccine mandates are also banned via executive order. (Source: NPR)
- Utah: A law passed in April, HB308, blocks the state government from requiring people to get vaccinated. (Source: Salt Lake Tribune) Governor Spencer Cox confirmed that vaccine certification will not be used in the state. (Source: CBS Local KUTV)
- Vermont: The state house of representatives introduced a bill, H452, to ban vaccine proof systems on May 20, but the bill did not advance. (Source: Vermont Daily Chronicle) In a recent announcement, Governor Phil Scott instituted a vaccine requirement for staff at some state facilities. Unvaccinated workers at these facilities will have to submit to regular testing. (Source: VPR)
- Virginia: Governor Ralph Northam has not ruled out proof of vaccination as a condition for entry into certain places—but in May he said his administration has no plans to use such policies in the state. (Source: Wavy.Com)
- Washington: Although a senator introduced a ban in April (which has not passed), Governor Jay Inslee announced new vaccine mandates for state and health-care workers, who will be required to show vaccine proof by October 18. (Source: AP News) Amid a spike in cases, the requirements expanded to include teachers and school staff, including those at state colleges and universities. (Source: AP News)
- West Virginia: No requirements, but Governor Jim Justice has not prohibited proof-of-vaccination requirements at any level of government. (Source: Ballotpedia)
- Wisconsin: A series of bills were introduced in April to ban vaccine proof systems in the state. (Source: CBS Milwaukee)
- Wyoming: Governor Mark Gordon issued a directive on May 7 preventing state agencies, boards, and commissions from requiring people to show vaccination status to access state spaces or get state services. (Source: Oil City News) Representative Chuck Gray said on June 8 that he is drafting a bill to officially ban vaccine certification systems in the state. (Source: Oil City News)
If you have information on how in your city, state, or country is using vaccine certification, or if you know of unusual uses of covid status apps, please help us keep our list up to date by emailing [email protected] We will update as new information comes to light.
A previous version of this story was published on July 1, 2021. This story is part of the Pandemic Technology Project, supported by the Rockefeller Foundation.
2021 has broken the record for zero-day hacking attacks
“Part of the reason you’re seeing more now is because we’re finding more,” says Microsoft’s Doerr. “We’re better at shining a spotlight. Now you can learn from what’s happening at all your customers, which helps you get smarter faster. In the bad situation where you see something new, that will impact one customer instead of 10,000.”
The reality is a lot messier than the theory, however. Earlier this year, multiple hacking groups launched offensives against Microsoft Exchange email servers. What started as a critical zero-day attack briefly became even worse in the period after a fix became available but before it was actually applied to users. That gap is a sweet spot hackers love to hit.
As a rule, however, Doerr is spot on.
Exploits are getting harder—and more valuable
Even if zero-days are being seen more than ever, there is one fact that all the experts agree on: they are getting harder and more expensive to pull off.
Better defenses and more complicated systems mean hackers have to do more work to break into a target than they did a decade ago—attacks are costlier and require more resources. The payoff, however, is that with so many companies operating in the cloud, a vulnerability can open millions of customers up to attack.
“Ten years ago, when everything was on premises, a lot of the attacks only one company would see,” says Doerr, “and few companies were equipped to understand what was going on.”
Faced with improving defenses, hackers often must link together multiple exploits instead of using just one. These “exploit chains” require more zero-days. Success at spotting these chains is also part of the reason for the steep rise in numbers.
Today, says Dowd, attackers are “having to invest more and risk more by having these chains to achieve their goals.”
One important signal comes from the rising cost of the most valuable exploits. The limited data available, such as Zerodium’s public zero-day prices, shows as much as a 1,150% rise in the cost of the highest-end hacks over the last three years.
But even if zero-day attacks are harder, the demand has risen, and supply follows. The sky might not be falling—but neither is it a perfectly sunny day.
How these US schools reopened without sparking a covid outbreak
“Cleaning high-touch areas is very important in schools,” Cogan said. But mask-wearing, physical distancing, vaccinations, and other measures are “higher protective factors.”
8. Give agency to parents and teachers in protecting their kids.
Last school year, many districts used temperature checks and symptom screenings as an attempt to catch infected students before they gave the coronavirus to others. But in Austin, Indiana, such formalized screenings proved less useful than teachers’ and parents’ intuition. Instructors could identify when a student wasn’t feeling well and ask them to go see the nurse, even if that student passed a temperature check.
Jetelina said that teachers and parents can both act as a layer of protection, stopping a sick child from entering the classroom. “Parents are pretty good at understanding the symptoms of their kids and the health of their kids,” she said.
In Andrews, Texas, district administrators provided parents with information on covid symptoms and entrusted those parents to determine when a child may need to stay home from school. The Texas district may have “gone way overboard with giving parents agency,” though, Cogan said, in allowing students to opt out of quarantines and mask-wearing—echoing concerns from the Andrews County public health department.
9. We need more granular data to drive school policies.
Throughout the pandemic, I’ve consistently called out a lack of detailed public data on covid-19 cases in schools. The federal government still does not provide such data, and most states offer scattered numbers that don’t provide crucial context for cases (such as in-person enrollment or testing figures). Without these numbers, it is difficult to compare school districts and identify success stories.
My research on school reopenings illuminated another data issue: most states are not providing any covid-19 metrics down to the individual district, making it hard for school leaders to know when they must tighten down on or loosen safety protocols. At the tiny Port Orford–Langlois district in Oregon, for example, administrators had to rely on covid-19 numbers for their overall county. Even though the district had zero cases in fall 2020, it wasn’t able to bring older students back in person until the spring because outbreaks in another part of the county drove up case numbers. Cogan has observed similar issues in New Jersey.
At a local level, school districts may work with their local public health departments to get the data they need for more informed decision-making, Jetelina said. But at a larger, systemic level, getting granular covid-19 data is more difficult—a job for the federal government.
10. Invest in school staff and invite their contributions to safety strategies.
School staff described working long hours, familiarizing themselves with the science of covid-19, and exercising immense determination and creativity to provide their students with a decent school experience. Teaching is typically a challenging job, but in the last 18 months, it has become heroic—even though many people outside school environments take this work for granted, Jetelina said.
Districts can thank their staff by giving them a say in school safety decisions, Cogan recommended. “Educators—they’ve had a God-awful time and had a lot more put on them,” she said. But “every single person that works in a school has as well.” That includes custodians, cafeteria workers, and—crucially—school nurses, who Cogan calls the “chief wellness officers” of the school.
11. Allow students and staff the space to process pandemic hardship.
About 117,000 children in the US have lost one or both parents during the pandemic, according to research from Imperial College London. Thousands more have lost other relatives, mentors, and friends—while millions of children have faced job loss in their families, food and housing insecurity, and other hardships. Even if a school district has all the right safety logistics, school staff cannot truly support students unless they allow time and space to process the trauma that they’ve faced.
P.S. 705 in Brooklyn may serve as a model for this practice. School staff preemptively reached out to families when a student missed class, offering support: “705 is just the kind of place where it is a ‘wrap your arms around the whole family’ kind of a school,” one parent said.
On the first day of school in September 2021—when many students returned in person for the first time since spring 2020—the school held a moment of silence for loved ones that the school community has lost.
New challenges ahead
These lessons are drawn from school communities that were successful in the 2020-2021 school year, before the delta variant hit the US. This highly transmissible strain of the virus poses new challenges for the fall 2021 semester. The data analysis underlying this project led me to profile primarily rural communities, which may have gotten lucky with low covid-19 case numbers in previous phases of the pandemic—but are now unable to escape delta. For example, the Oregon county including Port Orford–Langlois saw its highest case rates yet in August 2021.
The delta challenge is multiplied by increasing polarization over masks, vaccines, and other safety measures. Still, Jetelina pointed out that there are also “a ton of champions out there,” referring to parents, teachers, public health experts, and others who continue to learn from past school reopening experiences—and advocate for their communities to do a better job.
The Solutions Journalism Network supported this project with a reporting grant, as well as trainings and other guidance. Learn more about the five school communities I profiled in this project for the COVID-19 Data Dispatch.
This story is part of the Pandemic Technology Project, supported by The Rockefeller Foundation.
US unfairly targeting Chinese over industrial spying, says report
For years, civil rights groups have accused the US Department of Justice of racial profiling against scientists of Chinese descent. Today, a new report provides data that may quantify some of their claims.
The study, published by the Committee of 100, an association of prominent Chinese-American civic leaders, found that individuals of Chinese heritage were more likely than others to be charged under the Economic Espionage Act—and significantly less likely to be convicted.
“The basic question that this study tries to answer is whether Asian-Americans are treated differently with respect to suspicions of espionage,” said the report’s author, Andrew C. Kim, a lawyer and visiting scholar at the South Texas College of Law Houston. “The answer to that question is yes. “
The study, which looked at data from economic espionage cases brought by the US from 1996 to 2020, found that just under half of all defendants were accused of stealing secrets that would benefit China. This is far lower than the figures laid out by US officials to justify the Department of Justice’s flagship China Initiative.
According to the report, 46% of defendants charged under the Economic Espionage Act were accused of activity that would benefit Chinese people or entities, while 42% of defendants were accused of stealing secrets that would benefit American businesses.
The numbers directly contradict much of the Justice Department’s messaging around the China Initiative, which was launched in 2018 to combat economic espionage. The department has stated publicly—for example, in the first line of its home page for the China Initiative—that 80% of its prosecutions would benefit the Chinese state, reflecting “theft on a scale so massive that it represents one of the largest transfers of wealth in human history,” as FBI director Christopher Wray described it in 2020.
Since 2019, the program has largely targeted academic researchers.
“Strong evidence of charges with less evidence”
The report was based on an analysis of public court filings, as well as Department of Justice press releases, for all Economic Espionage Act prosecutions between 1996 and 2020. It’s an update of an earlier analysis, published in the Cardozo Law Review, which covered the period up to 2016.
Charges for “theft of trade secrets” and “economic espionage” were both included, with the “economic espionage” charge requiring proof of a “nexus to foreign entity” and accompanied by higher penalties. (These two categories make up only a portion of the charges under the China Initiative; Kim briefly mentions “false statements and process crimes,” and people have also been charged with grant fraud and lying on visa applications, among other crimes.)
Because demographic information and citizenship data is not included in court filings, Kim used names as proxies for race, and he used Google searches when names, like Lee and Park, were ethnically ambiguous. For citizenship, Kim noted that press releases often make prominent mention if a defendant is a “foreign national,” so he assumed that defendants were all citizens unless otherwise indicated.