Covid in Scotland: Vaccination certificates still have security glitch

A security flaw which allows people to edit Covid vaccination status certificates has not been fixed - three months after it was first identified.

BBC Scotland reported in May how vaccination status details could be altered using popular computer software programmes.

A fix was implemented which meant people could only request the document be sent to them by post.

The certificates are available to download again and are still editable.

The development comes on the first day people can download a QR code showing their Covid vaccination status.

The Scottish government said that while the document can be changed, the security contained within the QR codes in the certificate cannot be edited.

BBC Scotland was able to download a certificate and edit it to include a false name, date of birth and the address of the BBC's Glasgow headquarters.

On Wednesday, Nicola Sturgeon announced plans for vaccine passports to be required for entry to nightclubs and many large events in Scotland from the end of September.

The plans, which go before MSPs next week, would apply to indoor and outdoor events and would require people to present the QR code from their vaccine certificate.

The full details of how the plan will work have still to be announced.

A Scottish government spokesman said: "While the PDFs can be changed, the security contained within the QR codes cannot be edited and can only be scanned by recognised verifier apps that have been developed in line with the EU's Covid Green Pass scheme.

"The PDFs are designed for international travel purposes and are meant to be accompanied by your passport - border control will check the data on the QR code matches that of your passport, and will quickly identify those who have attempted to fraudulently claim a certificate as theirs when it is not."

The Scottish Conservatives said the fact the glitch remained three months after it was first spotted "casts further doubt on this government's ability to competently manage the vaccine passport scheme".

The party's Murdo Fraser said: "Not only is our system currently open to abuse, but these security issues have some very worrying implications for how the scheme will be applied in practice.

"Once again, the SNP government is pressing ahead with confusing and half-baked measures that do not work for the Scottish people.

"If the SNP cannot fix a technical flaw that they have known about for three months, how are we to trust that they will be able to roll out a functioning vaccine passport scheme in three weeks?"

A vaccination status record is a document showing proof of vaccination, but it is not yet legally required to gain access to venues within Scotland.

It is, however, already required for travel to some countries. Within the UK, it can be used to show Covid-19 status instead of providing a negative PCR or lateral flow test to enter some venues such as theatres.

Whereas in England and Wales people have been able to use the NHS app to show their vaccination status, those in Scotland have to request a record of vaccination online or by phone. This can be sent in the post or downloaded as a PDF to be printed out or shown on a smartphone.

Old copies of vaccination status records will still be valid at this stage unless they are to be used in a country that requires the QR codes.

The documents can be obtained by anyone over the age of 12 who has been vaccinated in Scotland, although under-16s cannot apply online.

Scottish residents who were vaccinated in other parts of the UK Common Travel area (including the Channel Islands and Ireland), will also be able to request the document.

Those who moved to or from Scotland between doses will need to request proof of the other dose from the country they were vaccinated in, as they would if they had received two doses in another country.