Ontario’s QR-code vaccine certificates have arrived early, but while the system does speed up the process of vetting customers at gyms and restaurants, experts are concerned that the new system does nothing to help prevent fraud.
The Star reported in September that Ontario’s initial vaccine certificate could be easily doctored in Microsoft Word. Business owners responsible for checking the certificates worried they would be on the hook if they failed to spot a fake.
Now, even though the QR-code vaccine certificates are available, the original certificates will still be accepted as proof of COVID-19 vaccination.
Kris Klein, a lawyer with nNovation LLP and an expert on privacy, access to information and information security, thinks it’s a “real shame and potentially very dangerous” that Ontarians can still use an easily edited vaccine certificate to access gyms, restaurants and other venues.
Given the percentage of the population that has yet to be vaccinated, “I’m afraid there will be some fraud with respect to vaccine receipts,” said Klein in an email. “I think the government should do better to recognize that fraudsters are out there and they should implement safeguards to try and stop them.”
Yuan Stevens, the policy lead on technology, cybersecurity and democracy at X University’s Leadership Lab, said Ontario has removed a layer of security by not making the QR code mandatory, or putting it in an app instead of on paper or PDF.
“There’s a tradeoff here,” said Stevens, adding that the gaps in Ontario’s system may undermine public trust in the process.
A spokesperson for the Ministry of Health said in an email that the government is confident the majority of Ontarians will do the right thing, noting there are fines in place for anyone caught using a fake document.
There has been criticism of Ontario’s app even before it launched, which some say could have been released much sooner if Ontario had just used the software created by other jurisdictions, such as Quebec.
“We knew there’d be problems,” said James Rilett of Restaurants Canada, whose association called for a QR code from the start.
While Rilett said switching to the QR code would be much more secure, he added that voiding the older certificates at this point could cause further complications for businesses and customers.
But, “if the government decides to go that route, we’re happy to enforce it,” he said.
Ontario’s new QR code certificate still shows in text the person’s name, date of birth, and vaccine information. The QR code itself contains the same information. It also includes the jurisdiction of the administered vaccines as well as other information that follows SMART Health Card standards, according to the second page of the vaccine certificate.
It does not include an individual’s health card number, and as of yet doesn’t include valid medical exemptions or clinical trial exemptions.
The text information on the new certificate can still be edited on Microsoft Word.
When a business scans a valid QR code, the app displays a check mark, along with the holders name and date of birth which are then checked against the person’s ID and the name and birth date on the certificate.
Ontario’s QR code certificate is built to the SMART Health Card standard used in other provinces, including Quebec and British Columbia, according to the Ministry of Health.
In Quebec, there is an app for patrons to display their QR code, as well as the business-side app for scanning. Quebecers can access their QR code on the app, or in a downloadable and printable form, much like Ontario’s QR code. But unlike in Ontario, Quebec does not have a version of the certificate without a QR code.
Recently, forged Ontario vaccine certificates were being used to acquire Quebec’s QR code.
Julie Kwiecinski, Ontario provincial affairs director for the Canadian Federation of Independent Business (CFIB), said there are a lot of unknowns for business owners, many of whom are concerned about the potential liability if they fail to spot a fake.
Not all businesses are using the new app yet, she said, as they are still training staff or waiting on new devices so that staff don’t have to use their personal devices.
There are also a number of third-party options floating around, such as the Grassroots tool, which allows Ontarians to upload their vaccine certificate to their Apple Wallet, and created a QR code before the Ontario government’s QR codes were available.
These third-party options are adding to the confusion, said Rilett.
Business owners have to deal with customers who weren’t aware that those third-party options are not sanctioned by the government, and who don’t have a valid vaccine certificate available, he said.
The only accepted forms of vaccination proof are government-issued receipts, and the only app the Ontario government endorses is Verify Ontario, said the Ministry of Health spokesperson.
“While we appreciate groups bringing forward novel solutions, we strongly encourage Ontarians to examine any product’s privacy and security policies, and to be cautious of sharing personal data, especially health information.”
The spokesperson said Ontario is working on a way to allow users to upload their vaccine certificate to an Apple or Android wallet.
Rilett said Restaurants Canada is still waiting for exemptions to be included in the QR code, as doctor’s notes are difficult for restaurant employees to verify.
“Every time there’s an exception, there’s a potential conflict,” said Rilett.
Joshua S. Gans, a digital strategist and professor of strategic management at the University of Toronto’s Rotman School of Management, doesn’t think the fact that Ontarians can still use easily faked vaccine certificate is a big deal.
“Let’s face it, there is a big risk if you are caught and there are surely very few people who would take that risk rather than get vaccinated,” said Gans in an email.
Vass Bednar, the executive director of McMaster University’s Master of Public Policy in Digital Society Program, said it’s important to remember that the vaccine certificate program has another purpose — to convince people to get vaccinated.
For that reason, she hopes that the relatively small number of people who will fake a vaccine passport is a fair tradeoff for a widespread program that keeps people safe and encourages inoculation.
Article From: The Star
Author: Rosa Saba
