Show HN: How does the French health pass work?(sanipasse.fr)
sanipasse.fr
Show HN: How does the French health pass work?
https://sanipasse.fr/french-health-pass
86 comments
It's been the same pattern for all Covid measures, it's so tiring.
Still I'm thankful we never ended up having age-based or disability-based curfews because it seemed to be heading that way for a while.
[deleted]
I find the principle of a "health pass" a little disturbing. Do we want to live in a society where we have to prove something about our health in order to attend events ?
I think there's a distinction to be made between diseases that are infectious and those that are not. If you have cancer and you want to attend an event, that's nobody's business because they're not going to catch it from you. If however the disease you have is serious and highly-transmissible then that's another matter entirely.
Its been the case internationally for decades. Yellow fever in african countries for example
Showing a pass every time you attend any kind of event is a bit more intrusive. But in the end, I do agree with you that there is nothing fundamentally wrong with the approach.
Yellow fever is debilitating at a very high rate...
Covid is highly lethal for some category of people..
Note: I corrected my comment to say "debilitating", although relatively "lethal" is probably not inaccurate.
Is not the vaccine available for anyone who wants it? The point of the Yellow Fever vaccine is to get it when traveling to a country where it is prevalent and you don't have the immunity of the local population, and not to bring it back to an unprotected population.
Is not the vaccine available for anyone who wants it? The point of the Yellow Fever vaccine is to get it when traveling to a country where it is prevalent and you don't have the immunity of the local population, and not to bring it back to an unprotected population.
So I'm not sure what your point is.
Both diseases are dangerous.
Yellow fever vaccine is mandatory when you travel in a country with high risk.
Covid vaccine will be mandatory when you want to go in situations / places with high risk.
So why would you be against covid health pass and not yellow fever health pass ?
Yellow fever vaccine is mandatory when you travel in a country with high risk.
Covid vaccine will be mandatory when you want to go in situations / places with high risk.
So why would you be against covid health pass and not yellow fever health pass ?
He is saying in general YF vaccine is mandatory when you PASS THROUGH a high risk country (such as kenya) BEFORE going to the coubtry requiring the vaccine (such as tanzania)
Which properties define that category?
Edit: the weak and frail, the ones with multiple comorbidities (avg 4)? The ones that are vulnerable for any virus in general?
Yes. Are you familiar with what public health is? Such restrictions are so people are encouraged to get vaccinated. Taking something away so far is most effective way to convince people.
That's not what "convincing" is. That's "coercing".
If you want to convince, do it with data and logic, not by taking away rights.
If you want to convince, do it with data and logic, not by taking away rights.
hntroll1221(2)
In general no, we don't.
But pragmatically in the current circumstances this seems to be the best option (or least bad) until things are sorted.
But pragmatically in the current circumstances this seems to be the best option (or least bad) until things are sorted.
> current circumstances
As Milton said, "Nothing is so permanent as a temporary government program."
Officials have already hinted that masks, lockdowns, etc. will be implemented (at least seasonally) forever.
As Milton said, "Nothing is so permanent as a temporary government program."
Officials have already hinted that masks, lockdowns, etc. will be implemented (at least seasonally) forever.
To clarify for anyone else like me who haven’t had their coffee, this is Milton Friedman, not John Milton (I figured the lingo sounded a bit too modern).
Milton is a genius, but this particular thing won't continue for the simple reason that, if as in Denmark, you have to be tested 3 times a week to have an always current pass, then the public will notice and be strongly incentivized to care.
And that kills these kinds of programs, unless there is a very good reason.
And that kills these kinds of programs, unless there is a very good reason.
Well, of course masks and lockdowns will be mandated if needed in the future.
If there's an outbreak of a serious contagious disease then measures deemed necessary when that happens will be implemented. It's nothing sinister, just common sense and that has been the case for centuries.
If there's an outbreak of a serious contagious disease then measures deemed necessary when that happens will be implemented. It's nothing sinister, just common sense and that has been the case for centuries.
[deleted]
Do you think governments are going to give up their power after implementing digital passes?
Yes. There is no reason for people to keep being tested all the time for Covid if/when that is no longer a risk.
Once/if the risk has passed this will all stop because there is neither a justification nor value for governments to continue.
It's a little paranoid to claim that governments are continuously trying to create totalitarian states. Or that, in any case, they can do what they want, they can't. We already see that with all the debates on these passes and safety measures put in place. They are a hard sell to the public and everyone's watching. There is already huge pressure not to have them for a day longer than absolutely necessary and politically governments will have to stop as soon as possible.
It's a little paranoid to claim that governments are continuously trying to create totalitarian states. Or that, in any case, they can do what they want, they can't. We already see that with all the debates on these passes and safety measures put in place. They are a hard sell to the public and everyone's watching. There is already huge pressure not to have them for a day longer than absolutely necessary and politically governments will have to stop as soon as possible.
> It's a little paranoid to claim that governments are continuously trying to create totalitarian states.
What in human history makes you think that?
What in human history makes you think that?
[deleted]
There is evidence of governments using power beyond their intended use to create totalitarian states.
I already have to show my ID to get into some events, and that has my full name, DoB, weight, address, and organ donor status on it. Date of vaccination hardly seems more sensitive than any of those. I could certainly imagine categories of health data that raise concerns but honestly this isn't it.
[deleted]
I guess you never traveled internationally or to countries which have mandatory vaccinations. Polio, Yellow Fever etc.
Yes I do want the events that I attend to not be attended by self-centered people who think "their rights" (to an enclosed space during a pandemic) trump the collective safety of the place.
So no, what I do find disturbing is that some people prefer to spread deadly diseases because they can't be bothered with the collective
So no, what I do find disturbing is that some people prefer to spread deadly diseases because they can't be bothered with the collective
If the alternative is death, sure.
Which it certainly is not, if you look at the numbers.
People sick with corona going to events will clearly cause statistical deaths, it's not ambiguous.
People who drive (especially SUV) will clearly cause statistical deaths, it's not ambiguous.
sure and we require them to have a pass (you might know it as driving license) to mitigate the loss.
If you do not think that driving license counts, from the health angle, people with visual impairments are required to wear glasses (or have corrective surgery) to drive.
If you do not think that driving license counts, from the health angle, people with visual impairments are required to wear glasses (or have corrective surgery) to drive.
Sure, we make all sorts of trade offs. The other poster is arguing that people should people able to choose for themselves whether they risk infection, which isn't the point of these passes, they are a community health measure.
Cars don't infect other cars on the road.
Neither do people anymore, or at least those who aren't comfortable with that risk, since the vaccine is widely available for all...
If the vaccine works, why in the world do you care who doesn't want to take it?
If the vaccine works, why in the world do you care who doesn't want to take it?
> since the vaccine is widely available for all...
They sure as fuck aren't. There's three countries in the world where the percentage of fully vaccinated is over 50% (two of which have <1m people, and the third one being Israel that doesn't even pretend to count Palestinians). In France that number is 14%. In my country we haven't even reached 1%.
> If the vaccine works, why in the world do you care who doesn't want to take it?
Because there are millions of people that can't receive one due to the weaker immune system, which is where herd immunity is supposed to kick in.
They sure as fuck aren't. There's three countries in the world where the percentage of fully vaccinated is over 50% (two of which have <1m people, and the third one being Israel that doesn't even pretend to count Palestinians). In France that number is 14%. In my country we haven't even reached 1%.
> If the vaccine works, why in the world do you care who doesn't want to take it?
Because there are millions of people that can't receive one due to the weaker immune system, which is where herd immunity is supposed to kick in.
> People sick with corona going to events will clearly cause statistical deaths, it's not ambiguous.
People with any kind of cold symptoms going out and mingling also clearly cause statistical deaths, it's not ambiguous. Yet, we lived in a world where people did that routinely and it was left up to parents to protect their children from influenza, something far deadlier than Covid19 for them.
Also, destroying economies, livelihoods, preventing socialization, travel will also clearly cause statistical deaths, it's not ambiguous.
But, I guess, Covid19 means the saint class never owning up to their mistakes.
Beatings will continue until morale improves, I guess.
People with any kind of cold symptoms going out and mingling also clearly cause statistical deaths, it's not ambiguous. Yet, we lived in a world where people did that routinely and it was left up to parents to protect their children from influenza, something far deadlier than Covid19 for them.
Also, destroying economies, livelihoods, preventing socialization, travel will also clearly cause statistical deaths, it's not ambiguous.
But, I guess, Covid19 means the saint class never owning up to their mistakes.
Beatings will continue until morale improves, I guess.
You wrote this after I said in a sibling tree that we do make all sorts of trade offs. I agree there's lots of places that we could make better ones!
> we could make better ones
Who is the "we" deciding what tradeoffs are better?
Who is the "we" deciding what tradeoffs are better?
Various different 'societies'.
I mean, humans have lived as groups with rules for thousands of years, I'm not sure what you are getting at.
I mean, humans have lived as groups with rules for thousands of years, I'm not sure what you are getting at.
Ok so the actual alternative is a non-functioning healthcare system and routine procedures suddenly becoming an issue.
So perhaps it's not death, but definitely economical stagnation.
So perhaps it's not death, but definitely economical stagnation.
> But starting from that, can we implement what seemed to be the initial goal stated in the government's document ?
why not simply having 2 QR codes, one full, one light ... ?
why not simply having 2 QR codes, one full, one light ... ?
What would you put in the "light" QR code ? If you put the date of the test, then the organizer can access it. If you don't, then they can't check whether your test is recent enough to be authorized to attend their event.
Like the original author states, than can't be done without a trusted 3rd party ( say a token with a service telling you whether the pass is valid at current date)
Because
- People would have to know which QR to show - Organizers could get more access to data by telling users "not that QR, the other one" ?
- People would have to know which QR to show - Organizers could get more access to data by telling users "not that QR, the other one" ?
> citizens will have to present the pass either as a printed document, or a code in the french government's TousAntiCovid mobile application
What about people who don't have phones or printers?
What about people who don't have phones or printers?
They give you the paper at the vaccination center or when getting your test result.
In Germany this paper is just that, a paper. It has 0 safety measurements. You can get blank ones for cheap, via the internet or your doctor. From Biontech or the other vaccine manufacturers you can get the blank charge number thingies which you can then stick onto the paper. You have to fake a signage but nobody can tell whether it's fake or not.
The danish one has even less safety features, because it is your choice whether to use a printed document (which you can download as a PDF that you can then edit), through the official app or, by the SMS that was sent to you at the test place where you took your test.
You can trivially fake either, but you can also just claim you are excempt. Almost nobody is, of course, but they are not allowed to ask for documentation and must let the doubt come to your benefit.
In practice, this works mostly. Probably because people don't want to fake their tests, which is a serious crime.
You can trivially fake either, but you can also just claim you are excempt. Almost nobody is, of course, but they are not allowed to ask for documentation and must let the doubt come to your benefit.
In practice, this works mostly. Probably because people don't want to fake their tests, which is a serious crime.
Then can it really be trusted at a time when people fake vaccination cards in the US, lie about COVID and don't even wear masks ?
The paper one: nope. The digital one: Supposedly yes, you can trust it, but there needs to be a way for already-vaccinated people to get the digital one. And how that is verified... well... not clear yet, but likely via the physical one.
You present the document given either when you got your vaccine shot, or when you did your pcr test ( both actually includes a signed datamatrix that you can scan with the app )
You go to a print shop and spend 5 cents to get it printed? That is if you lost the copy given when getting your second dose...
Gattaca. I’m curious tho where does it stop. For example, US stopped TB vax long time ago while half of EU continues. Those born in EU bear the scars on their arms from the vax. Sure TB isn’t as prevalent in the US as it used to be but there’s nothing stopping it from coming on a plane.
Bacterial infections of the lungs are very hard to fight esp with the increase of antibiotic resistance. A single cough from a TB infected individual used to be a death sentence to the receiver (prior to antibiotics).
So where does all this start and end. If we are serious about health while traveling then let’s go all in across the germ spectrum and see what happens ;-)
I’d love to see planes reporting on cabin air quality as well. I’m sure I’m not the only one who gets sick (pre Covid) when traveling long haul.
Bacterial infections of the lungs are very hard to fight esp with the increase of antibiotic resistance. A single cough from a TB infected individual used to be a death sentence to the receiver (prior to antibiotics).
So where does all this start and end. If we are serious about health while traveling then let’s go all in across the germ spectrum and see what happens ;-)
I’d love to see planes reporting on cabin air quality as well. I’m sure I’m not the only one who gets sick (pre Covid) when traveling long haul.
It'll probably stop shortly after France achieves a high enough level of vaccination to (more or less) stop community spread.
Based on the UK, Israel and the US, 60% looks like it gets you pretty close to that.
Based on the UK, Israel and the US, 60% looks like it gets you pretty close to that.
Which is where we are now apparently, 60%! https://abcnews.go.com/Politics/video/us-reaches-60-adults-d...
Right. The outbreak in Michigan is subsiding even as people are doing less mitigation, for instance.
With ~75 million children in the US, we aren't quite at 60% of the population though. Hopefully the number of vaccinated goes up quite a bit more.
With ~75 million children in the US, we aren't quite at 60% of the population though. Hopefully the number of vaccinated goes up quite a bit more.
Yup, even Denmark has recently announced plans to phase out the vaccine pass in a matter of months.
Yes, but it is going to phased out when everybody who wants to has had the shot, not when the most vulnerable has had it, over we get over 60%.
I don't get it why we can't store something in centralised database, provided it's encrypted via key that only user has (NFC or on QR code itself). Present one key for events, another one for airlines.
"In the backend, it has a small SQL database which stores no personal information: just the list of invitees and their status."
This status is private medical information : in France (and all Europe probably) it is illegal to store these datas, unless you use specialized "health datas secure hosting". You cannot legally do it yourself this way.
French Official Documents :
Health Datas Hosting : https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI0000...
Health Datas : https://www.cnil.fr/fr/quest-ce-ce-quune-donnee-de-sante
This status is private medical information : in France (and all Europe probably) it is illegal to store these datas, unless you use specialized "health datas secure hosting". You cannot legally do it yourself this way.
French Official Documents :
Health Datas Hosting : https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI0000...
Health Datas : https://www.cnil.fr/fr/quest-ce-ce-quune-donnee-de-sante
Storing name, DOB, test date, test result in the QR code is a good solution IMHO and indeed using a database as a private organisation is fraught with problems.
Name and DOB are reasonably needed to assert the person's identity. Especially in France everyone carries an ID card so people can show ID and certificate together.
Safeguarding private information is important but some must be disclosed as necessary.
Name and DOB are reasonably needed to assert the person's identity. Especially in France everyone carries an ID card so people can show ID and certificate together.
Safeguarding private information is important but some must be disclosed as necessary.
What surprises me is that the person's address is stored there. It seems to me absolutely unnecessary, and I'm not even sure where they get it from as the address on record by Social Security is not supposed to be disclosed even to health professionals.
I think this is only the address one gives freely to the vaccination/test center and which is not checked by anyone.
I still can't think of any case where it would be useful in conjunction with your vaccination status.
I think this is only the address one gives freely to the vaccination/test center and which is not checked by anyone.
I still can't think of any case where it would be useful in conjunction with your vaccination status.
According to the article the address is not included in the 2D-DOC QR code.
I agree with you that it's not useful information for the purpose of a "health pass" used to gain access to venues and events. On the other hand, as a matter of Covid response strategy and enforcement of any restrictions (so for the authorities at large) it is very useful to know where a person that has tested positive lives.
I agree with you that it's not useful information for the purpose of a "health pass" used to gain access to venues and events. On the other hand, as a matter of Covid response strategy and enforcement of any restrictions (so for the authorities at large) it is very useful to know where a person that has tested positive lives.
That's right! I had read it wrong somehow. I don't find the information that is actually included to be too sensitive then.
It might have been useful in this case but the French government itself is not allowed to have a general-purpose database of citizen's addresses. Even the address that the social security has for contact purposes cannot be legally used for this (and is probably unreliable anyway as people forget to update their address when moving) and I don't think many people would have been comfortable with communicating their addresses for the purposes of Covid tracking.
It might have been useful in this case but the French government itself is not allowed to have a general-purpose database of citizen's addresses. Even the address that the social security has for contact purposes cannot be legally used for this (and is probably unreliable anyway as people forget to update their address when moving) and I don't think many people would have been comfortable with communicating their addresses for the purposes of Covid tracking.
Of course they can collect addresses for this if they want. It's not a general-purpose database, either.
One problem we're having in this pandemic is the squeamish and "can't do" attitude on about everything.
One problem we're having in this pandemic is the squeamish and "can't do" attitude on about everything.
I don't think the status counts as medical information. It is an indication of whether you will participate to the event or not. Not participating may mean that you didn't want to participate, or that you didn't have a valid health pass. The database doesn't allow you to make the difference between the two.
Otherwise, any guest list would now be "medical information".
Otherwise, any guest list would now be "medical information".
My bad. You are right. To me "status" referred to the health status, but it is about attendance to the event : A vaccinated person might choose to not participate.
Previous paragraph : "From that link, they can confirm their attendance, but only if they have a valid health pass."
Previous paragraph : "From that link, they can confirm their attendance, but only if they have a valid health pass."
Positive status implies a negative test result and negative status more than strongly correlates with positive test.
To me that's just semantics but in fact it is basically a medical status.
To me that's just semantics but in fact it is basically a medical status.
The list of participants to a sport competition has never been considered medical data (the CNIL even mentions that explicitly), even though it correlates with your medical status: you have not to be handicapped and to be healthy to run a marathon for instance.
In our case, the correlation is even thinner: a yes in the database means that you have been EITHER tested OR vaccinated, and a no means that you either haven't answered the invitation or didn't have a health pass.
In the end, I guess it would be for a judge to decide if that fits the definition of health data, but I am confident enough to leave it online.
In our case, the correlation is even thinner: a yes in the database means that you have been EITHER tested OR vaccinated, and a no means that you either haven't answered the invitation or didn't have a health pass.
In the end, I guess it would be for a judge to decide if that fits the definition of health data, but I am confident enough to leave it online.
> The list of participants to a sport competition has never been considered medical data
That's obviously quite different here.
> a yes in the database means that you have been EITHER tested OR vaccinated
Yes, that's extremely specific and that's why I think that's medical data.
In any case, my take is that this is complicated for no actual reason. I don't see the problem with the data contained in the 2D DOC QR code: Test result is needed, name and DOB is also needed. These are limited, reasonable data to share.
The only thing the database does is to replace test and/or vaccine details by a single flag. In effect the only information removed is indeed whether the person has been tested or vaccinated (unless a test is needed in any case). That seems of little value to me.
That's obviously quite different here.
> a yes in the database means that you have been EITHER tested OR vaccinated
Yes, that's extremely specific and that's why I think that's medical data.
In any case, my take is that this is complicated for no actual reason. I don't see the problem with the data contained in the 2D DOC QR code: Test result is needed, name and DOB is also needed. These are limited, reasonable data to share.
The only thing the database does is to replace test and/or vaccine details by a single flag. In effect the only information removed is indeed whether the person has been tested or vaccinated (unless a test is needed in any case). That seems of little value to me.
@mytailorisrich : How is it different from the attendance to a sport event for which you need a medical certificate ?
In addition to the added privacy, sanipasse has a very practical advantage: for event organizers, they don't have to scan the passes anymore, and for guests, they can validate their pass ahead of time, at home, instead of waiting in line for someone else to scan their pass at the entry of the event.
In addition to the added privacy, sanipasse has a very practical advantage: for event organizers, they don't have to scan the passes anymore, and for guests, they can validate their pass ahead of time, at home, instead of waiting in line for someone else to scan their pass at the entry of the event.
Medical certificates for sport events are very French... But the point is that they don't provide any medical data, they just state that the person is fine (in very general terms) performing that activity. For instance if you plan to go diving your GP will ask you a few questions and examine you then in effect write down "Sure, no problem".
Here you have a piece of information that very specifically says that persons is negative to Covid or vaccinated. Perhaps its does not say which one it is but my understanding is these are both medical piece of data anyway.
That's why I think this is very different. It's like if the only criterion for diving was being HIV negative. If a driving instructor was provided with a medical certificate that said "Sure, no problem" in that case it would be the same as getting the HIV test status of that person.
In that respect, the advantage of scanning the QR code is that there is no need to store sensitive data anywhere but within the QR code itself, which remains under the control of the individual. I think this is actually one consideration for deciding to implement the system that way.
Here you have a piece of information that very specifically says that persons is negative to Covid or vaccinated. Perhaps its does not say which one it is but my understanding is these are both medical piece of data anyway.
That's why I think this is very different. It's like if the only criterion for diving was being HIV negative. If a driving instructor was provided with a medical certificate that said "Sure, no problem" in that case it would be the same as getting the HIV test status of that person.
In that respect, the advantage of scanning the QR code is that there is no need to store sensitive data anywhere but within the QR code itself, which remains under the control of the individual. I think this is actually one consideration for deciding to implement the system that way.
> they don't provide any medical data, they just state that the person is fine performing that activity
It's the same with the "validated" boolean information. It does not provide more medical data, it just validates the absence of risk of you participating.
Not having HIV is obviously not required to go scuba diving because it is completely unrelated. But for shooting in certain kinds of movies for instance, you do need to test negative to HIV. And the list of actors in the movie is not considered "medical data".
It's the same with the "validated" boolean information. It does not provide more medical data, it just validates the absence of risk of you participating.
Not having HIV is obviously not required to go scuba diving because it is completely unrelated. But for shooting in certain kinds of movies for instance, you do need to test negative to HIV. And the list of actors in the movie is not considered "medical data".
This app/website have nothing to do with official french government or authorities.
It's an open source project [0] for those who eventualy don't want to use official app
[0] https://github.com/lovasoa/sanipasse
It's an open source project [0] for those who eventualy don't want to use official app
[0] https://github.com/lovasoa/sanipasse
I think it's made clear in the article, isn't it ?
Six months later it became "well there are pros and cons". And now here we are, on the verge of enacting another CCP style measure that breaks multiple constitutional rights.
I'm sickened by the accelerating pace at which we are implementing every totalitarians' wet dream. The best of 1984, Brave New World and Fahrenheit 451 combined.
A Japanese documentary filmed in Wuhan to illustrate my point: https://youtu.be/N4ABOJ1y5iM?t=704