Covid vaccination certificates hit by security glitch

The Scottish government has said it is working to rectify a security flaw which could allow people to edit Covid vaccination status certificates.

People in Scotland travelling to a foreign country can download the vaccination status forms from the NHS Scotland Portal.

They show the dates of vaccinations and which jabs were given to an individual.

But a security glitch means vaccination status details can be altered using popular computer software programmes.

BBC Scotland was able to download a certificate and edit it to include a false name and the address of the BBC's Glasgow headquarters.

A Scottish government spokeswoman confirmed the security glitch, saying: "We are looking into rectifying this issue.

"This is an interim solution and records of vaccination status will be replaced by digital Covid Status Certificates in the summer, which will include vaccination and testing data to be used for outbound international travel.

"The measures are intended to ease the burden on the NHS by removing the need for people to ask their GP for a status record."

Public health officials previously said this digital scheme would mean Scotland was "ready to join" an international vaccination passport programme.

People have been advised to request the certificate if they are due to travel in the next 21 days.

Scottish Conservative health spokeswoman Annie Wells, said: "It's extremely concerning that this security flaw has been uncovered at a time when people are looking for clarity from the Scottish government around international travel.

"Instead, their safety is being put at risk by yet another glitch from the SNP government's rollout programme, this time on vaccine certifications. Vaccinations are our route back to normality and the Scottish government has a duty to ensure this is done safely and efficiently.

"This security flaw must be rectified instantly - we can't run the risk of a two-tier vaccine system."

Rory Boland, Editor of Which? Travel, described the security flaw as "alarming".

"Evidence of vaccination will be crucial to international travel this summer, and the potential ramifications of a person travelling while falsely claiming to be vaccinated are serious," he said.

"The reopening of international travel depends on mutual trust between governments that the systems they have in place are robust, trustworthy and fraud proof, so it is crucial that the issue is fixed as soon as possible."

In England, the NHS app will be available to use as a vaccine passport. This is separate to the NHS Covid-19 app, which is used for contact tracing.

People should be able to view their coronavirus vaccine records on the NHS app without there being any need to contact GPs.

The UK government previously said such a scheme could have an important role to play both domestically and internationally and was "likely to become a feature of our lives until the pandemic recedes".

Latest figures show that Scotland has recorded 370 new cases of coronavirus but no further deaths in the last 24 hours.

It means the death toll under this daily measure - of people who first tested positive for the virus within the previous 28 days - remains at 7,664.

Figures published by the Scottish government on Saturday showed the daily test positivity rate was 1.8%, down from 1.9% the previous day.

So far, 3,096,341 people have received the first dose of a Covid-19 vaccination and 1,799,956 have received their second dose.

Glasgow is the only area in Scotland to remain in level three of Scotland's coronavirus restrictions.

The city has the highest level of Covid-19 rates in Scotland at 126.7 per 100,000 people in the seven days to May 19, up from 122.6 in the week to May 18, latest available figures show.

Moray dropped down from level three to level two on Saturday while East Renfrewshire, which earlier this week had a higher seven-day average rate of cases than Glasgow, remains in level two.

Covid rates in East Renfrewshire in the seven days to May 19 were 108.9 per 100,000 people, down from 116.2 in the week to May 18.

In level two, people can hug and meet indoors - subject to restrictions - travel across the UK and overseas, and hospitality venues can open later than in level three and serve alcohol indoors.