This post is also available in: 简体中文 繁體中文
With a month still to go before Ontario launches its vaccination verification app, concerns are being raised about how easy it is to modify the province’s existing vaccination certificates — potentially letting unvaccinated people gain access to restaurants, bars, gyms and even flights.
According to forensic document examiner Shabnam Preet Kaur, the existing vaccination certificates, which are in the form of Portable Document Format (PDF) files, can be quickly edited to change the name, birthdate and other personal information using a number of easily accessible programs.
For instance, Microsoft Word allows a user to open the watermarked vaccine certificate and change the name and other identifying information to that of an unvaccinated person, then re-save the file as a PDF. The Star verified that this can be done quickly and easily using the existing software found on most home computers.
Kris Klein, a lawyer with nNovation LLP and an expert on privacy, access to information and information security, said the editability of the certificate makes him worry about fraudulent activities that could jeopardize someone’s health or life.
“In the haste to move quickly, it seems like some pretty basic steps weren’t taken,” he said in an email. “The government will need to find a solution very quickly or risk having to suspend the proof of vaccination campaign.”
If done properly, a QR code would be much more effective at fighting fraud, Klein said.
In an email, Ministry of Health spokesperson Alexandra Hilkene said using the PDF certificates as proof is an interim measure until the QR code certificates are available on Oct. 22, when the province’s verification app will also be launched.
“When it comes to the health and safety of our communities, we are confident the overwhelming majority of Ontarians will do the right thing,” said Hilkene, noting that the majority of Ontarians over 12 have received both their doses and therefore will have a certificate ready to use.
Failing to comply with the proof-of-vaccination regulations can result in charges under the Reopening Ontario Act, according to the ministry’s vaccine certification guide for businesses. If charged under Part I of the Provincial Offences Act, individuals can be fined $750; the maximum penalties of a prosecution under Part I or Part II of the POA can include fines of up to $100,000 and up to a year in jail.
Ryan Mallough, Ontario regional director of the Canadian Federation of Independent Business, said certificate fraud is a growing concern for business owners right now, who are worried they’ll be held responsible if they fail to spot a fake. He said it’s the CFIB’s understanding that if business owners let someone through in good faith, they shouldn’t be on the hook.
In theory, the QR code system set for Oct. 22 could make the certificates harder to fake, said Mallough — but even that isn’t for certain, and depends on how information is included on the new certificates.
For example, if the new vaccine certificates still have editable text and the QR codes on them only contain a proverbial “check mark” for vaccination status, someone could still theoretically alter the name and other identifying information, Mallough said.
He said the QR code should contain not only a person’s vaccine status but also their name and other identifying information so that the same code can’t be used by more than one person.
“However, that comes with its own pitfalls,” Mallough said, and would need to be done in a secure and private manner.
Asked what kind of information will be contained in the QR code and what kind of information will be in plain text on the new certificates, Hilkene said the province will provide more information before Oct. 22.
The QR-code vaccine certificates coming on Oct. 22 will likely be much harder to fake, Kaur said, as most people don’t have the knowledge or ability to change or forge QR codes. But that doesn’t mean they’re impervious to fraud.
The most secure way to present a QR code would be through a dedicated app, instead of on a PDF or piece of paper, said Kaur.
Rocco Rossi, CEO of the Ontario Chamber of Commerce, said he was aware that the vaccine certificates were easily editable at the moment.
“If there are people out there who want to cheat … there will be opportunities to do so,” he said.
He said he hoped that the QR codes the government will be releasing will be more difficult to doctor. But in the meantime, he said, it’s best to have something imperfect in place rather than nothing.
Rossi also noted that in order to doctor a vaccine certificate, one would still need access to a real vaccine certificate to begin with, which not everyone has.
Article From: The Star
Author: Rosa Saba
