QR passes and vaccine passports: what is happening?
How COVID certificates are arranged and why falsifications with them are excluded in Europe.
Since the beginning of this week, citizens of Moscow need to obtain QR codes in order to get into catering establishments, and from today, vaccine passports have been introduced in the EU. Both are QR codes which are stored in a government application and can be scanned by inspection authorities. Despite the situation in Russia, when offers to sell fake certificates and vaccine certificates began to appear on the Internet simultaneously with the introduction, such fraudulent schemes are excluded at all in Europe - all due to the digital signature.
What new coronavirus restrictions come into force and how they affect the digital rights of citizens.
Europe
Since July 1st, so-called vaccine passports have been introduced in all 27 EU member states. This is a digital document confirming that:
· a person has been vaccinated with the coronavirus vaccine;
· have been ill and recovered;
· received a negative PCR test within 72 hours.
Since the beginning of June, such passports could be obtained in Bulgaria, Croatia, Czech Republic, Denmark, Germany, Greece and Poland. This kind of a vaccine passport allows you to travel around Europe without the need to comply with the 14-day quarantine and actually return to life before-the-pandemic.
The vaccine passport is a QR code that can be saved on a mobile phone or hard copy. It is issued in two languages: English and in the language of the country of issue.
A number of countries have developed separate applications for storage of such certificates. For example, France issues own different COVID certificates and before going on a trip to Europe the certificate must be converted into a European certificate format through the online e-health portal. The new QR code can then be scanned and uploaded to the French Covid app.
Unlike Russian ones, every COVID certificate issued in Europe contains a digitally signed QR code that protects it from falsification. Each authority that issues such certificates (e.g. hospital, testing center, health authority) has its own digital signature key. All information is stored in a secure database in each country. Whenever such a certificate is scanned, the regulatory authorities verify digital signature on it.
In Belgium, technology company Zetes was involved in the introduction of COVID certificates. Unit of ZetesConfidens provides digital signatures embedded in QR codes to ensure the authenticity of submitted data through its Public Key Infrastructure (PKI).
Meanwhile in Germany CovPass and Corona Warn applications are used for COVID certificates. In the Netherlands, CoronaCheck app is used to confirm negative coronavirus test result. QR code issued by the app allows access to public places, such as events, catering establishments and museums.
Not everyone sees only advantages in introduction of COVID certificates. Firstly, additional checks and appropriate equipment will be required to scan such codes. Secondly, it takes longer, especially at the airport. Several European airlines have already appealed to regulatory authorities to implement a solution that allows checking the availability of a vaccine certificate before a passenger arrives at the airport.
Russia
In connection with a sharp increase of cases in a number of regions, restrictions on attending cultural public events are again introduced. And workers in various industries (first of all, the service provision field) and certain categories of citizens are massively forced to get vaccinated, the working hours of catering establishments is limited.
Moscow has introduced QR codes for visiting cafes and restaurants since June 28. Such a code can be obtained by those who completed the full course of vaccination against coronavirus, got COVID-19 within six months before the visit to the cafe (the fact of the disease must be recorded by doctors), or received a negative PCR test result three days prior. Without a QR code you can only stay on summer terraces until July 12th.
Citizens of Moscow need to apply for a QR code at the reception desk in a Moscow hospital or the mos.ru website, EMIAS.INFO resource; to the electronic medical record of Moscow; to the Unified portal of state and municipal services or the application "State services. Stopcoronavirus" (“Госуслуги. Стопкоронавирус”). Citizens of Moscow can also obtain a temporary QR code if they have antibodies.
The presence of passes will be checked through the applications "Moscow Transport" («Московский транспорт») and "Moscow Assistant" («Помощник Москвы»).
At the same time, a number of establishments were not ready for the new format of work and were closed for a while, and citizens themselves complain that even after vaccination they cannot obtain QR codes due to errors in the operation of the issuing services. Difficulties with obtaining QR codes also arose among foreigners working in Moscow, including employees of embassies.
The very next day after the introduction of QR passes in Moscow catering establishments, the authorities started talking about what other industries such a system can be applied in. In the near future, QR codes may also be introduced in theaters and cinemas, as well as in shops and public transport.
Simultaneously with the introduction of QR passes, scammers have become more active on the Internet, offering fake vaccine certificates and even schemes for falsifying QR codes for visiting restaurants. “Roskomnadzor” (“Роскомнадзор”) has already reported on the blocking of 150 sites offering to buy a fake vaccine certificate, and in St. Petersburg a man selling fake certificates of PCR tests was detained.
The rest of the world
Today, July 1st, Australia cancelled the curfew, which has been in effect in the country since November 2020, but at the same time, quarantine remains for part of the Sydney population due to the outbreak of the delta strain of coronavirus.
Since late May - early June, several Australian states have introduced mandatory registration of store visitors via QR codes in a government application. Victoria state residents are required to scan the QR code posted in front of stores in the Service Victoria app each time before visiting.
Similar requirements for lodging establishments and beauty salons apply in state of New South Wales, starting from July 12th, mandatory scanning of QR codes will be extended to retail outlets, supermarkets, individual stores in shopping centers, entry points to shopping centers, gyms, offices, manufacturing and warehouse enterprises, universities and schools as well. Each state uses its own separate application for QR-check-ins, in New South Wales this is the Service NSW application.
In the state of South Australia, the once separate COVID SAfe application was integrated into the Australian analogue of “State services” (“Госуслуг”) – an application mySA GOV. Now you can select the COVID SAfe Check-In section there and also scan the QR code before visiting public places.
Fiji has a CareFIJI CHECK-IN application where citizens also scan QR codes. In this case, organizations must first generate, print and place their unique QR code in front of the entry and exit points.
A similar QR check-in system in the government application has been operating in Cambodia since February, and may be soon introduced in New Zealand, in particular, in places with an increased risk of infection.
As for COVID certificates, Israel was one of the first countries to introduce such a system. They were originally introduced at the end of February 2021 in order for the vaccinated citizens to be able to visit restaurants and sporting events, but later cancelled, reaching record highs for vaccinations and lows for new cases. In March, digital vaccine passports were introduced in China, they can be accessed through a government app, and authorities can check a person's vaccination status by scanning a QR code in the app.
In the UK, the functionality of the previously introduced NHS Covid-19 application has been expanded, so that it can store information about vaccinations and provide this data on demand.
In mid-July, vaccine passports will be introduced in Japan to allow citizens to travel the world again, with the country's government urging other countries to remove or shorten the mandatory quarantine for vaccinated travellers. This kind of a document, issued in Japan, will contain the owner's name, date of birth, passport number, date of vaccination and vaccine manufacturer in Japanese and English. Initially, they will be issued as a hard copy, later it is planned to introduce digital documents.
Similar vaccine passports may soon be introduced in Northern Ireland, Taiwan and Vietnam.
Meanwhile, the United States does not plan to introduce such certificates everywhere, and a number of states (Alabama, Arizona, Florida and Georgia) have announced their rejection of such an idea.
In India, a CoWIN vaccination registration platform has been developed and is already in use. The Indian authorities claim that the governments of more than 50 countries are interested in using the same platform, and the country's Prime Minister has already commissioned the development of an open source version.
Introduction of vaccine passport arouse big controversy among human rights defenders on user data privacy. Firstly, the document reveals information that should be secured from inspection authorities (e.g. the date of either vaccination or recovery). Secondly, experts draw attention to the fact that applications that store sensitive information can use outdated encryption methods, which will undoubtedly affect the safety of user data.
Thus, almost a year and a half after the start of the pandemic, governments continue to introduce digital tools to prevent the spread of the pandemic. Their use is mandatory, not voluntary. Vaccine passports and QR passes have already been or are being introduced in different countries, and the collected data is stored in government applications and information systems. Currently citizens do not know how long this data will be stored, who will have access to it, and how reliably it is protected from possible leaks.