COVID-19: Kiwis shouldn't be sharing their vaccine certificates on social media - here's why

Vaccine certificates are now available to download, a ticket to freedom for the fully vaccinated this summer - but like any other official document, one expert is warning Kiwis to be careful about where they put their passport. 

My Vaccine Pass is an official record of a person's vaccination status, certifying the holder is fully immunised against COVID-19. The certificates, or vaccine passports, are a crucial element of the upcoming COVID-19 Protection Framework - a three-step 'traffic light' system designed for a highly vaccinated population.

The framework will come into play when 90 percent of the eligible populations under each District Health Board are fully vaccinated - however, the Government has indicated it will take a pragmatic approach and could transition to the new system early if vaccination rates are still high.

Under the framework, which will replace the current alert level system, pre-pandemic freedoms will be determined by vaccine certificates. For example, under the 'Red' setting, hospitality venues can open with up to 100 fully vaccinated customers who present their certificate upon entry - businesses that opt not to use My Vaccine Pass must continue with contactless trade. The pass will also be required to attend festivals and events and to enter other close-contact businesses.

"When you are holding the pass, it means you are legally allowed to enter premises that require a vaccine pass under the COVID Protection Framework (the traffic light system)," Dr Andrew Chen, a research fellow, at Koi Tū - Centre for Informed Futures at the University of Auckland, said ahead of the official launch on Wednesday. 

"The vaccine pass means that at the time you apply for it, you meet the requirements for being considered vaccinated, and then the pass will be valid for six months from then."

But as Kiwis descend on the site to secure their certificates - with the demand overwhelming the Ministry of Health's My COVID Record platform earlier this morning - Dr Chen is warning people to be wary of where they put their passport. 

Like any other official document, he says it's important the certificate isn't shared with others - particularly as an nvaccinated individuals may try to assume another person's identity in a bid to have the same freedoms. 

"Crucially, once you have a vaccine pass, please don't share it via social media. While the risk is very low, there is the possibility that someone with the same or similar name to you could try to use your pass at venues that don't check ID," Dr Chen said.

"It also makes it more likely that those who are very motivated to defraud the system (e.g. anti-vaxxers) may use your information to circumvent the system."

When entering a restricted venue, a staffer should be asking people to show their pass and some form of ID upon entry. Once a 'verifier' app has scanned the QR code on the pass to confirm it's legitimate, the staffer should then check the person's ID to verify the details on the pass match those on their identification. 

But Dr Chen warns not all venues will be scrupulous with ID checks, which could allow people to pose as someone else in order to gain entry.

"Not all venues will do ID checks though, which is the same as driving around with someone else's driver's licence - you might get away with it, but you might not," he said.

The Government's official verification app is not yet available, but is expected in the next week or two - however, some people have already built third-party verifier apps.

"The vaccine pass has your name, date of birth, and a date upon which the vaccine pass expires printed on it. It also has a QR code, which has the same information encrypted with a private key held by the Ministry of Health. This allows the Ministry of Health to prove that they generated the QR code, and prevents anyone else from being able to generate a valid QR code, which mitigates fraud and fake passes," Dr Chen said.

"We are still waiting for further details about how the passes are expected to be used under the COVID Protection Framework, as the accompanying legislation has not yet been released, which is also where the vast majority of the ethical concerns might be. But we are reasonably confident that the technology side works and is safe to use."

To download My Vaccine Pass, head to the Ministry of Health's My COVID Record website and create an account if you don't have one already. If you are fully vaccinated, your records should be available to view. You can then request your vaccine certificate, which will be sent to you in a digital format to add to your phone. You can also create a physical copy to print.