Pictures of cats, Mickey Mouse, even a takeout menu from a BBQ restaurant: Users of New York City’s COVID SAFE app have discovered they can upload just about any photo into the new vaccine verification software.
Though the app only debuted this week, its vulnerabilities have come under scrutiny as the city announced a new policy to require proof of at least one dose of a COVID-19 vaccine for entry to indoor dining, gyms and entertainment performances.
“The New York City app is nothing more than a glorified photo storage app,” said Brian Linder of cybersecurity research company Check Point. He added, “When someone shows a picture of a card in this app, it's believed that it's real, but there's absolutely no verification of it whatsoever.”
City officials said it’s up to the staff at restaurants, gyms and event spaces to verify the authenticity of the pictures in the app--no different than bouncers checking drivers’ licenses at bars.
“The NYC COVID Safe App was designed with privacy at the top of mind, and allows someone to digitally store their CDC card and identification,” Laura Feyer, spokesperson for Mayor Bill de Blasio, said in an emailed statement. “Someone checking vaccination cards at the door to a restaurant or venue would see that those examples are not proper vaccine cards and act accordingly.”
But the COVID SAFE app creates an opening for a black market based on fake vaccine cards. While a bill criminalizing the falsification of vaccine records under state law is now awaiting Governor Andrew Cuomo’s signature, the opportunity for fraud is rampant on many levels.