Risk of forged Covid vaccine passports, warns cyber expert

‘People will be incentivised to create a market of forged documents’ – Prof Carsten Maple

Old style: a certificate of vaccination against yellow fever (Simon Calder)

As the European Commission sets out plans for a “digital green pass,” a leading British academic has warned that criminals could exploit the demand from prospective travellers for vaccine passports.

Carsten Maple, professor of cyber systems engineering at the University of Warwick, said that if proof of vaccination against coronavirus conferred travel or other privileges, it would create “a market of forged documents”.

Ursula von der Leyen, president of the European Commission, has announced a plans for a pass that will provide “proof that a person has been vaccinated” and “results of tests for those who couldn’t get a vaccine yet”.

On the Radio 4 programme, How To Vaccinate The World, Prof Maple said a system providing the right to access a service, or to travel, will spur criminal behaviour.

“This really gives that kind of incentive. You’ll get people who’ve got these rights, especially if it’s mandatory. Other people will be excluded.

“People, where it is mandatory and really offers a significant difference, will be incentivised to create a market of forged documents.”

Israel has launched a “green pass” offering access to services for people who have been vaccinated.

“We know that in Israel they’ve made statements about anybody who tries to forge will face criminal proceedings and possibly be imprisoned,” said Prof Maple. “So they really think that this is a risk that could happen.”

Nations including Estonia, Georgia and Romania currently offer easy access to travellers who have completed a course of vaccination, while Saga has said that only passengers who have had both jabs will be able to take a cruise.

Prof Maple also raised concerns over how a vaccine passport, once issued, could be revoked if medical evidence indicated that immunity was relatively short-lived.

“What we need to do in dynamic environments is to consider: how can we revoke that certificate effectively? “That’s a real challenge we see in security of systems very often. I think it’s very pertinent in this case.”

At present all leisure travel within and from the UK is prohibited.

The government has said it will “review whether Covid-status certification could play a role in reopening our economy, reducing restrictions on social contact and improving safety”.

The prime minister’s roadmap said: “This will include assessing to what extent certification would be effective in reducing risk, and the potential uses to enable access to settings or a relaxation of Covid-secure mitigations.

“The government will also consider the ethical, equalities, privacy, legal and operational aspects of this approach.”

Despite repeated calls from the travel industry, there is no international agreement on certification for an individual’s vaccination or Covid test status.