Why Alberta's new COVID-19 vaccine card could lead to fakes

The Alberta government launched its COVID-19 immunization record on Sunday so vaccinated individuals can print out a card-sized copy — but it turns out getting your name on one isn't difficult.

After the site launched, many took to Twitter to exclaim that the PDF was not locked and that virtually anyone can edit the information on it if they have access to Adobe Reader.

The news comes after the province announced the restriction exemption program on Wednesday, which put the onus on some non-essential businesses to implement a vaccination system for patrons or be subject to additional rules.

Aside from the printable copy, the province also made a digital version available on the MyHealthRecords smart phone app but many have been warned of long wait times to access the website and app.

So, for those who need to show vaccination proof, it seems the print-out is the easiest option — but experts say it's also too easy for unvaccinated individuals to modify.

Cybersecurity expert Ritesh Kotak says aside from editing the PDF, applications like Photoshop can also easily be used to manipulate the card and that at the end of the day, it operates on the honour system.

"We hope that people don't abuse the system. But again, you're kind of leaving it to the public, to self-governance and self regulate," he said.

"There's no security measures really in place to prevent fraud from happening."

 According to a statement by the Government of Alberta, the printable cards are an easy and convenient way to directly access vaccine records.

"The PDF is now as secure as it can be; however a motivated individual can edit the document to create a new record," read the statement.

Cards are illegal to edit

Falsifying these health records is also an offence under the Health Information Act, said the province.

"That said, we know the vast majority of Albertans will use the system properly and adhere to the legal requirements set out in the current public health orders."

Kotak said the government has had more than a year to come up with a better method for proof of vaccination and that this seems like a "band-aid solution" to fix the problem.

In many provinces, a QR code has been included to prove vaccination, which the Alberta government said will be available in the coming weeks.

Manitoba, for example, has plastic immunization cards with a scannable QR code on the back.

And British Columbia offers a printable paper copy similar to Alberta's; however it also includes the QR code.

"QR codes is a solution where the information is embedded, it is encrypted in some cases and you need a companion app to scan it and verify it. So it minimizes potential fraud and manipulation of these types of documents," said Kotak.

He said while QR codes may be the best method to verify vaccination and a person's identity, there still needs to be a hybrid solution in place.

"When it comes to this type of technology … access to technology is really important as well. So you might have areas that have kind of connectivity issues. Individuals might not actually own smart phones. There is a segment of the population that that would prefer paper-based," he said.

He believes a national strategy should also be put in place.

"People are going to travel, they're going to go from province to province," he says.

"We need something federal, but because it's been broken up in every province has come out with their own, and some haven't even come out with anything, it's going to create a real challenge."