Businesses warned that Australia’s vaccine passports ‘easily forged’

Sydney has opened up again, but the system that is supposed to be keeping unvaccinated residents out, has one very major flaw.

While NSW businesses threw open their doors and entered the brave world of trying to police people’s vaccination status on Monday, one expert said it didn’t matter as the current vaccine passports in Australia are “easily forged”.

Business owners had warned things could “get ugly” at shops and restaurants with the responsibility falling on them to confirm whether people are vaccinated.

Yet the NSW government’s digital vaccine passport, VaxPass, is unavailable to the public, meaning vaccine enforcement comes down to an honour system.

Once it goes public, it will allow people to simultaneously check in to a venue and confirm their vaccination status but it isn’t expected to go live before October 18.

It’s currently being trialled by around 500 people in Wagga Wagga, Lismore, Tamworth and Port Macquarie.

Publican Ian Urquhart shows his double vaccination status at the Avoca Hotel which is part of the state government's ‘vaccine economy’ trial. Picture: Rob Leeson

Despite still being in lockdown, Victoria’s vaccine passport was launched on Monday allowing 200,000 people to link their Medicare vaccine certificate to their Service Victoria app.

It gives them the ability to prove their vaccination status to businesses using the state’s QR code system and is expected to be rolled out once the state hits 80 per cent of the population double jabbed on November 5.

But security expert Vanessa Teague, from the Australian National University, said both the NSW and Victoria vaccine passports and Medicare certificates “don’t prove anything”, which makes it hard to “justify checking them when they are easily fabricated”.

“There are not really meaningful security features in any versions we have seen in Australia, with possibly the exception being for international travel,” she told news.com.au.

“Otherwise they have nothing to verify that the vaccine passport or certificate is authentic.”

According Dr Teague, the Victorian vaccine passport includes a cutesy little animation, which could easily be copied even with a simple video screenshot.

“I think if the technology isn’t improved the important thing for everyone else to understand is that the certificates in their current form really can’t be relied upon,” she said.

“So if you are running a service or a health service that really relies on checking that person is vaccinated, you need to understand that the certificate is really easily forged.”

Dr Vanessa Teague has warned the current technology for vaccine passports and certificates is easily forged. Picture: Stuart McEvoy/The Australian.

She said there was an easy and free solution that could fix the security issues, which is currently being used across the European Union.

It attaches a digital signature to the vaccine passport or certificate, which is not only hard to forge, but doesn’t require someone to go back to an authority as it can be verified online, she explained.

“It’s absolutely free, there is literally open source code on the web for the European standards, so it costs almost nothing to download or copy it,” she added.

“There is really no rational reason at all why it shouldn’t done. You could get the Australian Immunisation Register or some state authorities to put the digital signature on the vaccine certificate and put it on a plain PDF that is downloaded from Medicare. It works on a QR code or the digital signature can even work on a print out.”

In further controversy, vaccine passports will largely be unnecessary come December 1 in NSW as the unvaccinated are afforded more freedoms, but there is no end date for their use in Victoria.

Melbourne city bar owner Maz Salt was fearful the vaccine passport system would be a permanent feature and would make life difficult for hospitality owners, as staff were already being abused by customers over face masks.

“What are we going to do when they don’t have a phone on them?” he told The Age.

“Will we refuse to serve them because they haven’t updated their app? It’s going to blow back onto staff and the operator in a really serious fashion.”

14 regional businesses and events will trial the vaccine passport system. Picture: Nicole Cleary

‘Highly doubt the efficacy of a honour system’

There was mixed feedback on social media about the level of enforcement coming from businesses in Sydney on Monday.

“Can report from Sydney that neither of the 1 hospitality and 1 retail businesses I have been into today are checking vaccine status (also I don’t think this should be the responsibility of small businesses but I highly doubt the efficacy of a honour system),” wrote one woman.

“Went out to see how things are now that NSW has been ripped open. No businesses checked my vax status, next to no masks indoors, no one checking in,” another said.

“Enjoyed a freedom haircut, went to a clothing store and had a drink inside a cafe. Some insisting QR check ins but noone is checking vax status,” a man tweeted.

One woman said on Facebook that “each and every shop” at her local plaza did not check her vaccinattion status, depsite it being in “one of the hotspots”. Another said the chemist and kids play area inside the shopping centre did not ask to see her vax status.

But others said major retailers were enforcing the rules, where only the vaccinated can enjoy new freedoms such as eating out, shopping and going to the gym in NSW until December 1.

“Can confirm Myer and JB Hi-fi are checking vaccine status in Sydney,” tweeted one man.

There were reports Kmart stores were also using security guards to check on customer’s vaccination status.

Sydney-siders enjoy a drink at the Fortune of War Hotel in The Rocks on Monday as Covid restriction are eased in NSW. Picture: NCA NewsWire / Jeremy Piper

Sydneysiders enjoy a drink at the Mercantile Hotel in The Rocks on Monday as Covid restriction are eased in NSW. Picture: NCA NewsWire / Jeremy Piper

‘We’re not the police’

Many business owners are furious they have been put in the impossible situation.

Prior to ‘freedom day’, Jade Pham, who owns a popular nail salon called CJ Artistry in Sydney’s west had been preparing her staff by simulating role plays before opening.

But she was also preparing for the “worst case scenario” of dealing with verbally or physical abusive customers forcing her to call the police.

Businesses such as Cremorne’s Best Bagel Co. have refused to reopen fully until all customers are afforded equal freedoms.

Speaking to the SMH, owner Sarah O’Brien, who is pro-vaccination, said the business would operate as takeaway-only and spoke out against the obvious difficulties of self-policing the vaccination status of every customer and worker that passes through the front door.

“I’m quite concerned there could be a blow-up in the store from a customer who thinks we haven’t checked someone’s vaccine credentials,” she said.

“We’re not the police. We’re busy cafe owners three months into our business, with a lean team. It will be difficult to enforce this.”

Security outside Myer checks QR and vaccine confirmation. Picture: Sam Ruttyn

On Monday, NSW Premier Dominic Perrottet told a media conference that opening up would depend on “everyone doing the right thing”.

“I accept there will be challenges and issues along the way,” he said. “I ask businesses: Where you can, check that data is correct.”

While Victorians await their own ‘freedom day’, business owners were also anxious.

“As a small business owner in VIC, it’s hard enough getting people to check in with the QR code. I’m so angry the government will fine ME for not checking someone’s vaccine status and put us in danger after offering NO support through the current lockdown,” one person said on Twitter.