Enhanced QR code vaccine certificates are now available to all of Ontario, alongside the brand-new Verify Ontario mobile app. Businesses can use the mobile app to scan customers’ QR codes from their phones or a printed copy. The province has called the new certificate “easier, more secure and convenient,” but a few questions have been raised about improving security and ease of use.
“From what I can gather, fraud or forgery could definitely be possible,” York University assistant professor Evan Light told Yahoo News Canada. Light added that while secure QR codes which lose some functionality when photocopied do exist, they seem to be different from the SMART QR codes Ontario is using.
Despite these enhanced vaccine documents being available to all Ontario residents, the old version - vaccine receipts people received when immunized - will still remain valid. The previous vaccine document is a Portable Document Format (PDF) file, which from experts in past months about its susceptibility to editing and forgery. Given that the old document will remain in use, it appears that those safety concerns may remain unaddressed.
Ontario is making it easier and more convenient to verify proof of vaccination. Learn how & when you can download your enhanced vaccine certificate with official QR code: https://t.co/oe5YrSxcEt
If you still need to get your shot, book your appointment: https://t.co/IcpDOgxrLu
— Christine Elliott (@celliottability) October 24, 2021
“People have been making fake IDs — for great and not-so-great reasons — for ages,” said Light, who specializes in communications policy and privacy and surveillance.
Some strategies Light suggested the province might undertake to mitigate this risk include issuing “actual cards with QR codes that can't be duplicated,” and making the website to obtain the certificate easier to use.
“I'm pretty savvy and got sent in circles before I finally landed at the right spot, and then jumped through five more hoops before I could download the thing,” he said. “Ease of use and secure use could go a long way.”
Based on continued improvements to #PublicHealth and #HealthCare indicators, Ontario is lifting capacity limits in the vast majority of settings where proof of vaccination is required, starting today.
Learn about the changes you can expect: https://t.co/BNacXW775p pic.twitter.com/Hf3YFDegL5
— Ontario Ministry of Health (@ONThealth) October 25, 2021
Light also has questions about the nature of the mobile app and the information it collects, with his main concerns being “the lack of clarity around geo-location and their vulnerability disclosure policy.”
He says the lack of clarity around geo-location may introduce a new level of information sharing with the Ontario government based on the IP address of the phone being used: “Usually governments don't know where we go to eat, drink and party.”
However, this may not prove to be out of the ordinary for many Ontarians. “Most people, having become used to giving up personal information in exchange for stuff — followers, likes, et cetera — probably won't have any concerns,” he said.
“The Verify Ontario app should not collect any IP address information whatsoever,” he said. “Security experts should be given free rein to uncover bugs in the application without fear of prosecution.”
Access to vaccine passport isn't being discussed
Beyond questions of privacy and security, the introduction of what appears to be a more long-term personal vaccine certificate has also raised questions about accessibility.
“So many people in the world do not have smartphones nor access to a computer or printer,” said Light. “The onus is being put on individuals to create medical IDs for themselves in a way that hasn't been done before. That's a lot to ask from people who have been through what we've been through over the last 20 months, let alone from fellow humans who may not have the resources (technical, economic, social) one needs to be a part of this new world.”
“I'm a father of two kids in school too young to be vaccinated and absolutely support vaccination strategies for dealing with the pandemic,” concluded Light. “With the adoption of all new technologies to police people and their bodies, I think we need to continue to pay special attention to how these technologies can marginalize people or magnify the marginalization of people.”