Enlarge image
QR code from "Maximilian Mustermann": Who will check the ID?
Photo: Christoph Dernbach / dpa
Does the digital vaccination certificate, which more than a hundred thousand citizens had already issued in pharmacies on Monday, possibly need copy protection? As various experiments show, the QR code of the vaccination certificate can be scanned several times. On the one hand, this makes sense because vaccinated people want to save their evidence on private and work cell phones, for example, or at some point they will get a new smartphone. On the other hand, attempting fraud is therefore technically simple, and for some it may be temptingly simple.
If you want, you can scan the QR code printed out in the pharmacies into three different apps: the Corona warning app, the CovPass app or the Luca app. However, the QR codes are not used up. Other users can also play them on their mobile phones, at least with the Corona Warning app or the CovPass app, this is easy. Alternatively, it is sufficient to scan the photo of a QR code if, for example, it has been published on the Internet - intentionally or unintentionally. Even slightly alienated or blurred screenshots are sometimes accepted as valid by the apps.
This is well known in the Federal Ministry of Health.
"The QR code can be scanned again," confirmed a spokesman for SPIEGEL.
"However, it should be noted that when checking the vaccination certificate - as in the analogue world - a photo ID must also be presented."
Counterfeit security relates to a different scenario
Developers would say: "It's not a bug, it's a feature". Copying is wanted. The protection against forgery of the digital vaccination certificate covers a different scenario: only a digital vaccination certificate issued by an authorized body - vaccination center, pharmacy, doctor's office - is electronically signed; this is checked in each case during a check. A self-made proof of vaccination would attract attention immediately. A copied digital vaccination certificate is still signed and therefore apparently valid. The fact that the presenting person is not the one noted in the copied vaccination certificate is only noticeable in the ideal case: during the simultaneous identity check.
How realistic the idea is that every innkeeper and organizer carries out this or has it carried out at the entrance is at least questionable. Only in a few cases, such as at the airport, will nobody get around it. The temptation to fake a full vaccination with a copied QR code in everyday life in order to be able to take part in social life without any problems could therefore be great for some.
Anyone caught must expect punishment: The ministry refers to the second law amending the Infection Protection Act. In paragraph 74 and 75 it says: "A prison sentence of up to two years or a fine is punished who [...] knowingly does not properly document a vaccination against the coronavirus SARS-CoV-2 to deceive legal transactions" and " Anyone who knowingly 1. uses incorrect documentation or 2. uses an incorrect certificate [...] to deceive in legal dealings is punished with imprisonment of up to one year or a fine. But which innkeeper would detain and report a person if he catches them with a copied vaccination certificate but no ID?
How problematic the supposed weak point in the system really is remains to be speculated. Attempts at deception are likely to be the exception rather than the rule. Very few vaccination certificate holders will intentionally make their QR code available to others. Of course, you shouldn't distribute your own QR code as a photo on social media just because you're so happy about it. In the coming weeks and months, the number of those who have been vaccinated and who are actually eligible will continue to rise anyway. At the same time, the fraudsters who may still exist will become less dangerous for the general public in terms of infection protection.
