Sunday 28 November 2021
Select a region
News

Work still underway to fix digital vaccine passport security flaw

Work still underway to fix digital vaccine passport security flaw

Monday 25 October 2021

Work still underway to fix digital vaccine passport security flaw


The Government is hoping to have fixed security flaws in its digital vaccine passport system by the end of this week.

After a privacy “exploit” was discovered on the Digital Covid Status Certification platform within hours of it launching on Wednesday (20 October), the website was shut down.

Government officers began investigating the problem alongside Microsoft officials overnight, and are continuing to work “at pace” to resolve the issue “as soon as possible”, the Government said in an update yesterday evening.

The current goal is for the service to be reinstated at the end of this week, meaning that the platform will not be available for those travelling during the busy half-term period – between Thursday and Sunday, more than 21,500 air and sea passengers are expected to travel in and out of Jersey. 

The Government emphasised that all “escalation procedures” had been followed in handling the security concerns.

This included informing Jersey’s data protection watchdog, the Office of the Information Commissioner, which was said to be “content” that all processes have been correctly followed. 

On Friday, Chief Minister Senator John Le Fondré gave thanks to “all the officers who are involved in finding a solution.”

He added: “I would like to remind islanders that the Covid Status Certification is a service for islanders travelling off-island to countries that use vaccine certificates for domestic use or entry to their borders. It is not used internally in Jersey, or for Islanders returning through our own borders. 

“If islanders are travelling over half-term and plan on calling the coronavirus helpline to request their QR codes, please remember to only call up a couple of days prior to travel to ensure the codes last for as long as possible.

“Officers will provide further updates as they progress in reinstating the service.”

Q&A...

Was it a hack?

No, the problem was a flaw in the platform’s privacy controls.

The issue was that anyone with the date of birth and social security number of another islander would be able to access their vaccine certificates. 

Has any data been stolen? 

The Government said it had no indication that islanders’ data had been stolen. 

Is Yoti safe?

Yoti, the Government's chosen digital ID provider, is not affected – the issue was only with the digital covid certificate platform, which has now closed. 

What if I need a QR code before it is fixed?

Islanders travelling to countries that require a digital vaccine passport/QR code over half-term can:

  • call the covid helpline on 0800 735 5566 to get a PDF version of their vaccine passport, including QR codes, emailed to them
  • or use the secure paper document that was sent to them in the post.

I downloaded a covid travel certificate online before the service went down… can I still use it?

Yes, islanders who successfully downloaded one before the service was pulled offline on Wednesday night will be able to use them for 30 days from that date.

How do I know if I need a digital vaccine certificate?

Islanders should check the covid entry requirements of any places they are visiting.

When arriving back in Jersey, islanders will not need to present their vaccine passports at the border, but instead must ensure they have completed a pre-departure travel form to confirm their vaccine status before making their return.

Because the QR codes expire after 30 days from the point of generation, islanders are reminded to only request their PDF version of their vaccine passport a couple of days before travelling to maximise their use.

Sign up to newsletter

 

Comments

Comments on this story express the views of the commentator only, not Bailiwick Publishing. We are unable to guarantee the accuracy of any of those comments.

Once your comment has been submitted, it won’t appear immediately. There is no need to submit it more than once. Comments are published at the discretion of Bailiwick Publishing, and will include your username.

Posted by John Henwood on
A very helpful Q&A, thank you. It must be said, however, that this sort of cock-up does not say much for our government's ability to deliver on-line solutions in what is supposed to be a digital showcase for the rest of the world. Jersey the digital Island? Evidently not yet as far as government is concerned.
Posted by IanSmith97 on
I can’t open a YOTI because I don’t have, nor want, a mobile. I have an Ipad and lap top. Why can’t I register for a YOTI?
To place a comment please login

You have landed on the Bailiwick Express website, however it appears you are based in . Would you like to stay on the site, or visit the site?