Vaccine passports: How experts say B.C. can learn from Quebec's mistakes

Vancouver -

Mere hours after Quebec’s vaccine passport system launched on the government website, hackers were able to get the QR codes belonging to several politicians, including Premier Francois Legault.

Cybersecurity experts tell CTV News the hackers likely downloaded the QR codes from the government website using dates of birth, health insurance numbers and first vaccination dates. Now, they’re warning that B.C. needs to be vigilant for data breaches as it prepares to launch its own vaccine passports.

“It’s very easy for hackers to go online and find publicly available information on high profile government officials. Their name, vaccine status, their date of birth, these are very easy things to find. Unfortunately, the Quebec government did not put additional security layers on its website to ensure that only people downloading their own QR codes, are in fact doing so,” said Carmi Levy, a technology analyst based in London, Ontario.

While it may seem like a minor privacy breach, Levy said it could potentially open the path to identity theft.

“Here’s the thing about identity theft, you get one piece of information in one place, a couple more pieces of information elsewhere, if you’re a hacker, you can assemble a dose of data on your victim from multiple sources, and then you can go to town,” said Levy.

B.C.’s vaccine card is set to roll out Sept. 13 and users will need at least one dose of a COVID-19 vaccine to be permitted entry into events such as concerts, sports games and businesses like pubs, restaurants and fitness classes. By Oct. 24, users are will need to be fully vaccinated and with at least seven days having passed since receiving their second dose.

Cybersecurity experts hope the government of B.C. is watching what is happening in Quebec and learn from that province’s mistakes.

“We need to sit down and not rush through this. We need to think of all the potential threats and go through a threat modelling exercise to identity how could this data and these QR codes be misused?” said Dominic Vogel, chief strategist at Cyber.sc.

In a statement to CTV News, B.C.’s Ministry of Health said “Protecting British Columbians’ data and networks is a top priority for this government, especially where it concerns personal information. Security threat and risk assessments, as well as privacy impact assessments play an important role in privacy protection by helping government identify and mitigate risks.”

It also said that the Office of the Chief Information Officer is constantly evaluating potential threats and has systems monitoring 24 hours a day, seven days a week.

“We are working to make the BC Vaccine Card process as easy as possible for people, while ensuring it is secure protecting people’s privacy. More details will be provided to the public in the coming days,” continued the ministry’s statement.

However B.C. decides to roll out its vaccine passport, Levy believes there will likely be glitches in the process. What matters is that we learn from those glitches and apply that information going forward.

“We should also treat QR codes like we treat our signatures, our passwords and our usernames. We should not be sharing them or taking pictures on social media. We shouldn’t be telling people where we got vaccinated and what we got vaccinated with. All of this information in the hands of a hacker, could potentially be used against us,” added Levy.