Vaccine passport disaster in Scotland

[takno]

Quality internet discussion there.

I made a valid point based upon anecdotal evidence from my son who lives in Glasgow. You don't even consider that point.

Still, I guess that this isn't a place that values discussion ... as evidenced by the thread title. Is it a disaster ? Of course, it's a disaster - no discussion necessary. Let's have a few hundred posts in support of that view.

You made a wholly irrelevant point in an attempt to divert attention from the thing being discussed by angrily mentioning something else very important and suggesting that we should be worrying about that instead.

On the topic of spiking, it's abundantly clear at the moment that we are chronically short of high-quality door staff (as a result of Brexit, and licenses being allowed to lapse during the pandemic). The more time the remaining door staff have to waste checking vaccine passports and arguing wholly pointless entry criteria with people, the less time they have to check people for date rape drugs, manage the inside of the club generally, and watch outside the club for victims being abucted or abused.

 

[nlogax]

I wouldn't count on it. The US proof of vaccine is the handwritten appointment card.

In additional to the CDC card there are also QR codes available for residents of certain states, NY's Excelsior Pass being one example. Of course they won't be readable in the UK but the additional onscreen info may be enough to avoid whipping out a flimsy piece of cardboard for every occasion.

 

[Kez]

You made a wholly irrelevant point in an attempt to divert attention from the thing being discussed by angrily mentioning something else very important and suggesting that we should be worrying about that instead.

I made a point wholly relevant to a possible drop in footfall at night clubs.

Apparently I am not permitted to do so because I am 'diverting attention' from the failure of the vaccine passport scheme which has been running for about 2 minutes and 'people' have already generally concluded is an absolute disaster ... based on scant anecdotal evidence by a trade lobby group with a vested interest.

I don't make points in anger ; I don't know why you think I do. I apologise for bringing in a modicum of objectivity where it is clearly not wanted.

 

[farleigh]

I made a point wholly relevant to a possible drop in footfall at night clubs.

If people do not go to nightclubs when infections are running high, then why is there a need for vaccine passports?

Apparently I am not permitted to do so because I am 'diverting attention' from the failure of the vaccine passport scheme which has been running for about 2 minutes and 'people' have already generally concluded is an absolute disaster ... based on scant anecdotal evidence by a trade lobby group with a vested interest.

It will be interesting to see if you are right and the passport scheme proves to be a huge success in achieving its goals.

 

[Kez]

It will be interesting to see if you are right and the passport scheme proves to be a huge success in achieving its goals.

Have I said I believe it will be success or otherwise ? Why don't we wait and see ?

I'm wondering where these night clubs are where there are queues of disgruntled rail enthusiasts outside grumbling about having to have their vaccine passports at the ready.

 

[takno]

I made a point wholly relevant to a possible drop in footfall at night clubs.

Apparently I am not permitted to do so because I am 'diverting attention' from the failure of the vaccine passport scheme which has been running for about 2 minutes and 'people' have already generally concluded is an absolute disaster ... based on scant anecdotal evidence by a trade lobby group with a vested interest.

I don't make points in anger ; I don't know why you think I do. I apologise for bringing in a modicum of objectivity where it is clearly not wanted.

If that's what you intended then I apologise. Even on a re-reading though, the tone of your original post came across as to me as a pure and simple attack on the trade organization, trying to divert from they were saying onto an unrelated topic with no evidence provided. That doesn't strike me as "bringing objectivity" to the debate.

I don't actually know anything about the NTIA, and it wouldn't greatly surprise me if they were rather unrepresentative, but they aren't the only people describing difficulties with the passports. I'm not really sure what the problem with "vested interests" more generally is supposed to be, and I can't really see how you can form a meaningful impression of anything without listening to them.

 

[NorthKent1989]

I made a point wholly relevant to a possible drop in footfall at night clubs.

Apparently I am not permitted to do so because I am 'diverting attention' from the failure of the vaccine passport scheme which has been running for about 2 minutes and 'people' have already generally concluded is an absolute disaster ... based on scant anecdotal evidence by a trade lobby group with a vested interest.

I don't make points in anger ; I don't know why you think I do. I apologise for bringing in a modicum of objectivity where it is clearly not wanted.

Of course they’d have a vested interest, the last 18 months the hospitality industry has taken a battering and vaccine passports are hardly the way to save businesses, especially since vaccine passports have zero health benefits and do nothing to stop the spread.

 

[David M]

...or to put it another way, previously you were freely allowed to go to nightclubs, whereas now you are legally required to show that the government has given you permission to do so.

Oddly enough, some people are rather unhappy at such an unprecedented and massive change in the relationship between the individual and the state.

Or to put it another way, you might have been asked for proof of age like a passport and forced to display proof of sobriety. Little difference.
Don't like the rule? Don't visit a nightclub.

What about those of us with medical exemptions? There is allegedly, and I stress allegedly as it seems the Willy Wonka golden ticket is easier to get, a certificate we can get to prove this. In order to get this, I have to phone a helpline that doesn’t appear to have a human operator and simply tells me to get the information online. Online tells me to phone the helpline. The loop is infinite in that respect.

Simple you say. I find it exceptionally difficult if near impossible. But as you say it’s simple, can you please advise on the solution?

Given that you are at greater risk due to your medical exemption of becoming seriously ill with Covid or spreading the virus to others, perhaps better you keep yourself safe and don't visit a crowded nightclub.

 

[MikeWM]

Or to put it another way, you might have been asked for proof of age like a passport and forced to display proof of sobriety. Little difference.

If you don't see the difference between a venue having their own conditions of entry, and the government *requiring* conditions of entry whether the venue wants them or not, then you're not looking hard enough.

And yes, there are of course minimum requirements that the government does impose on establishments. But are you seriously trying to compare a simple age check with a 'medical procedure' check?

Don't like the rule? Don't visit a nightclub.

I'm quite sure this kind of argument has been used in the past about other things, and it rarely ends well. Do we really want to go down this path?

Given that you are at greater risk due to your medical exemption of becoming seriously ill with Covid or spreading the virus to others, perhaps better you keep yourself safe and don't visit a crowded nightclub.

Perhaps that should be up to them to decide, not you, me, or the Government?

 

[Darandio]

Or to put it another way, you might have been asked for proof of age like a passport and forced to display proof of sobriety. Little difference.
Don't like the rule? Don't visit a nightclub.

If you cannot see that there is an enormous difference then there is something seriously wrong.

 

[takno]

Or to put it another way, you might have been asked for proof of age like a passport and forced to display proof of sobriety. Little difference.
Don't like the rule? Don't visit a nightclub.

Given that you are at greater risk due to your medical exemption of becoming seriously ill with Covid or spreading the virus to others, perhaps better you keep yourself safe and don't visit a crowded nightclub.

In general I haven't been asked to prove my age at a nightclub for a while now, and rarely visit them in circumstances where I could prove my sobriety. There are a few clubs where that might be an issue, but no great stress because there are other clubs. Under vaccine passports every single club, from a night full of 18 year olds to a night with broadly over-40s, is blocked off to anybody who hasn't both undergone a largely irrelevant medical procedure, and arranged to obtain and carry proof of having done so.

 

[NorthKent1989]

Or to put it another way, you might have been asked for proof of age like a passport and forced to display proof of sobriety. Little difference.
Don't like the rule? Don't visit a nightclub.

Given that you are at greater risk due to your medical exemption of becoming seriously ill with Covid or spreading the virus to others, perhaps better you keep yourself safe and don't visit a crowded nightclub.

The old Proof of age and vaccine passport false comparison.

Nobody has ever advocated 14/15 year olds going to a nightclub was against their civil liberties, vaccine passports are an invasive form of control never before seen in this nation, it’s coercion.

Also I believe that’s up to the person who is vulnerable to decide if they want to visit a place or not, you remember individual freedoms don’t you? We had that until 2020.

Covid has given the government’s globally an excuse to exercise a gross amount of control over their respective citizens, it’s worrying people won’t see this but they soon will when they themselves inconvenienced by some authoritarian rule

 

[35B]

I believe and I could be wrong but it stated at sign up that no data was shared (with anyone), even if that was true don’t you think then the Government is breaching data protection? So it’s still ok to hand over my data to those companies?? Maybe and this isn’t at governments level but all governments businesses need to be more open and honest here?

Found this https://www.nhsinform.scot/covid-status-privacy



Back a bit they say they comply: https://www.nhsinform.scot/nhs-scot...s/covid-status-using-the-app-common-questions


So they comply with regulations but on another seems otherwise?
https://www.nhsinform.scot/covid-status-privacy

That's why the detail matters. If the NHS app uses those services - which is quite likely - then the declaration is a statement that your personal data is shared with those providers. Not for them to do anything with (hence the line about not all of those firms accessing the data), but because that's how the app works. That's not sharing with those companies in a marketing kind of way, but because they provide parts of the service that the app relies on to work. And for any service that links you as a user to a database somewhere, you will find some of this going on; the only question is whether the company hosts it's own database, or buys in that hosting from someone else.

The privacy policy and Covid status privacy statement look like they are entirely consistent with each other. For completeness, you also need to have quoted the "Key things to know" section from the Covid Status Privacy:

Your data is always encrypted, held by NHS Scotland and only temporarily shared with the trusted parties required to deliver this service.

The app only uses secure infrastructure and services provided by security accredited organisations.

You decide who you want to share your COVID Status with.

The privacy statement you quote is then absolutely consistent with that statement. Someone holding your data is allowed to hire a company to run the system that processes that data, subject to the right safeguards being in place, and those statements are absolutely clear that this is what's happening. Amazon, Microsoft and ServiceNow all do a lot of business with government, plenty of which will require higher grade security than the app needs. The Royal Mail bit puzzles me, but if the app includes the ability to order a test kit, then your data has to be shared with Royal Mail to allow them to deliver to you.

If anything, I suspect the problem may be that the Scottish Government have been unusually transparent in what they've declared, and that things that lurk below the surface in many services have been openly and honestly declared here.

 

[danm14]

A quick check confirms my English and Irish issued vaccine passes are both accepted by the app.

That's great to see. My Irish one didn't work the last time I checked, but it does now, so clearly the Scottish app has been updated to recognise EU (or at least Irish) proof of vaccination.

Unfortunately, the NHS Covid Pass Verifier (for England and Wales) still doesn't accept Irish proof of vaccination at all, and still only accepts Northern Ireland proof of vaccination in International mode - use of which is a breach of the terms of use (but still possible) if you aren't an approved travel provider.

 

[kez19]

That's why the detail matters. If the NHS app uses those services - which is quite likely - then the declaration is a statement that your personal data is shared with those providers. Not for them to do anything with (hence the line about not all of those firms accessing the data), but because that's how the app works. That's not sharing with those companies in a marketing kind of way, but because they provide parts of the service that the app relies on to work. And for any service that links you as a user to a database somewhere, you will find some of this going on; the only question is whether the company hosts it's own database, or buys in that hosting from someone else.

The privacy policy and Covid status privacy statement look like they are entirely consistent with each other. For completeness, you also need to have quoted the "Key things to know" section from the Covid Status Privacy:

The privacy statement you quote is then absolutely consistent with that statement. Someone holding your data is allowed to hire a company to run the system that processes that data, subject to the right safeguards being in place, and those statements are absolutely clear that this is what's happening. Amazon, Microsoft and ServiceNow all do a lot of business with government, plenty of which will require higher grade security than the app needs. The Royal Mail bit puzzles me, but if the app includes the ability to order a test kit, then your data has to be shared with Royal Mail to allow them to deliver to you.

If anything, I suspect the problem may be that the Scottish Government have been unusually transparent in what they've declared, and that things that lurk below the surface in many services have been openly and honestly declared here.

The app does not include anywhere I can order a track kit from the Royal Mail (we can rule that out immediately).

I was aware of the Amazon servers but unaware of who ran Jumio/service now but maybe they are backend Microsoft leads? The point for me is why not be upfront with it than hide these companies? Governments and who they use for our safety have usually been breached many times afore but do they learn? Of course not!

I am also assuming you were aware that people were able to download their COVID certificates to PDF and alter them? As per BBC investigation? (if not may I suggest you look), yet that shouldn’t have happened in first place so why should we trust what they say regardless of our privacy and data? (fair enough this thread speaks for the Scottish Government side but the UK Government is just as bad but sure let breaches happen, they say they learn - it’s an excuse cycle)

 

[danm14]

I am also assuming you were aware that people were able to download their COVID certificates to PDF and alter them? As per BBC investigation? (if not may I suggest you look), yet that shouldn’t have happened in first place so why should we trust what they say regardless of our privacy and data?

That's forgery, not a data breach.

If I download my bank statement and alter it to contain your name and address, the bank haven't suffered a data breach.

 

[D6130]

I've just heard from the Italian media that hackers have broken into the EU Covid "Green Pass" system and stolen the codes with which it operates, with threats to invalidate all the passes unless certain conditions are met. I'm not tremendously IT savvy, so others on here will probably be able to correct me and explain more fully what has happened. The latest I've heard is that at least Italy and Poland have been affected, but not France.

 

[danm14]

I've just heard from the Italian media that hackers have broken into the EU Covid "Green Pass" system and stolen the codes with which it operates, with threats to invalidate all the passes unless certain conditions are met. I'm not tremendously IT savvy, so others on here will probably be able to correct me and explain more fully what has happened. The latest I've heard is that at least Italy and Poland have been affected, but not France.

I don't believe they can be invalidated in the literal sense of the word (in that they won't scan as valid), but they could publicise the keys and a method by which one could create a valid false one - making them untrustworthy and necessitating their eventual reissue with new keys and ceasing to accept those with the old key.

 

[Darandio]

I've just heard from the Italian media that hackers have broken into the EU Covid "Green Pass" system and stolen the codes with which it operates, with threats to invalidate all the passes unless certain conditions are met. I'm not tremendously IT savvy, so others on here will probably be able to correct me and explain more fully what has happened. The latest I've heard is that at least Italy and Poland have been affected, but not France.

Seems when many users were scanned for verification today they had a certificate attributed to Adolf Hitler. Interesting development.

 

[Busaholic]

Seems when many users were scanned for verification today they had a certificate attributed to Adolf Hitler. Interesting development.

We live in interesting times, which phrase may or may not have originated from a Chinese curse. Perhaps it originated in Wuhan?

 

[Ediswan]

I've just heard from the Italian media that hackers have broken into the EU Covid "Green Pass" system and stolen the codes with which it operates, with threats to invalidate all the passes unless certain conditions are met. I'm not tremendously IT savvy, so others on here will probably be able to correct me and explain more fully what has happened. The latest I've heard is that at least Italy and Poland have been affected, but not France.

https://www.wionews.com/world/eus-g...certificate-doing-rounds-online-report-424736

Reading between the lines: Hackers got hold of the certficate used to sign some covid passes. This allows forged, but apparently legitimate passes to be generated. The stolen certificate was revoked, invalidating all passes signed using it. No indication of the number of people affected, or how easy it will be for them to get a new pass.

 

[danm14]

I don't believe they can be invalidated in the literal sense of the word (in that they won't scan as valid), but they could publicise the keys and a method by which one could create a valid false one - making them untrustworthy and necessitating their eventual reissue with new keys and ceasing to accept those with the old key.

And indeed, this is what has happened.

Any vaccine passport which was issued using the stolen key is now invalid, so will no longer scan as valid on an up-to-date validation app.

Presumably this will include some legitimate passes, which will be fun for anyone holding one that's planning on participating in society in the immediate future - as they're effectively unvaccinated until they get a new one.

 

[kez19]

That's forgery, not a data breach.

If I download my bank statement and alter it to contain your name and address, the bank haven't suffered a data breach.

Well you still would think they be some level of protection to prevent that from happening? In a way they should have seen this coming before implementing?

 

[Ediswan]

In a way they should have seen this coming before implementing?

It looks like they did, they implemented certificate revocation.

Any vaccine passport which was issued using the stolen key is now invalid, so will no longer scan as valid on an up-to-date validation app.

Presumably this will include some legitimate passes, which will be fun for anyone holding one that's planning on participating in society in the immediate future - as they're effectively unvaccinated until they get a new one.

This is the bit which is impossible to predict without knowing the details of the implementation. The online app might quietly re-issue a new valid pass. Acceptance of offline passes (printed/downloaded) will depend on how thorough a check the venue uses.

 

[Bantamzen]

I've just heard from the Italian media that hackers have broken into the EU Covid "Green Pass" system and stolen the codes with which it operates, with threats to invalidate all the passes unless certain conditions are met. I'm not tremendously IT savvy, so others on here will probably be able to correct me and explain more fully what has happened. The latest I've heard is that at least Italy and Poland have been affected, but not France.

It seems like it is the second time the passes have been hacked, there was an attack back in August. This should not be a surprise in a world where an electronic certificate is starting to become compulsory, hackers are usually many steps ahead of the devs. Indeed sometimes the devs even get paid off by the hackers.

Just a thought to both people worried about data sharing, and people banging on about having them made mandatory here. Your data is worth money to someone...

 

[35B]

The app does not include anywhere I can order a track kit from the Royal Mail (we can rule that out immediately).

I was aware of the Amazon servers but unaware of who ran Jumio/service now but maybe they are backend Microsoft leads? The point for me is why not be upfront with it than hide these companies? Governments and who they use for our safety have usually been breached many times afore but do they learn? Of course not!

I am also assuming you were aware that people were able to download their COVID certificates to PDF and alter them? As per BBC investigation? (if not may I suggest you look), yet that shouldn’t have happened in first place so why should we trust what they say regardless of our privacy and data? (fair enough this thread speaks for the Scottish Government side but the UK Government is just as bad but sure let breaches happen, they say they learn - it’s an excuse cycle)

So two things there. One is about the data sharing - it’s like many other services where we engage with one provider and don’t have visibility of all the moving parts that make it up. I’m looking at what the story says and what the data protection statement has, and not concerned about that.

The other bit is about the data security. Others have commented on the keys, and I’ve nothing to add to that. From experience of working on public facing services, plenty of thought, time and effort will be going into the security of what’s there. But PDF files can easily be amended - i can easily imagine how I could alter one with a minimum of effort. If you want to prevent that, you need to go all electronic - which will raise other issues.

 

[gallafent]

i can easily imagine how I could alter one with a minimum of effort.

… but you can't easily modify a PDF to include a QR code containing data that is signed using a private key that you don't have. Obviously you can change the text, if you like, but you can't change the data (without making it invalid in the eyes of a checker app …).

 

[yorkie]

The so-called body representing Scottish hospitality is nothing of the sort, it was set up by prominent anti-Independence supporter Stephen Montgomery who owns The Townhead Hotel in Lockerbie and is friendly with David and Oliver Mundell. It uses his own hotel website as an online presence and his 'group' represents less than 3% of Scottish hospitality workers. He has a political rather than a public health agenda.
Short story is that an app was introduced to allow entrance into night-clubs (amongst other things) and bouncers refused entry to people who hadn't bothered to get the app or who hadn't been jagged.
In that respect, it worked exactly as intended.
Not jagged? Don't go to a night club. Not got the app? Get it before you go to a night club.
Simple - I have it beside me as I type.
A similar style vaccine passport will be introduced in England shortly, it is inevitable.

If you're able to answer the questions posed by @Red Onion and @Cdd89 , I would be interested to see the answers; until then I am not convinced by your argument.

Still, I guess that this isn't a place that values discussion ... as evidenced by the thread title. Is it a disaster ? Of course, it's a disaster - no discussion necessary. Let's have a few hundred posts in support of that view.

The thread title reflects the fact this thread was created to discuss an article which said exactly that. If you make a successful appeal to the BBC to get their headline changed, please do let me know and I would be happy to change the title to reflect the new headline.

I'm wondering where these night clubs are where there are queues of disgruntled rail enthusiasts outside grumbling about having to have their vaccine passports at the ready.

Very amusing but I was hoping for some sensible discussion!

 

[35B]

… but you can't easily modify a PDF to include a QR code containing data that is signed using a private key that you don't have. Obviously you can change the text, if you like, but you can't change the data (without making it invalid in the eyes of a checker app …).

Indeed - which I addressed with reference to keys. But @kez19 seemed to be querying the ability to edit output files at all, which is beyond the ability of an app to outright prevent.

 

[kez19]

Indeed - which I addressed with reference to keys. But @kez19 seemed to be querying the ability to edit output files at all, which is beyond the ability of an app to outright prevent.

I dont know how someone could alter a QR code but when I read on that BBC article that people were able to alter their file ie PDF