Thread by @jeffgilchrist

COVID-19: Ontario enhanced vaccine passport QR code technology

Ontario has now launched their enhanced vaccine passport which use QR codes and I will talk about the underlying technology and privacy implications ( news.ontario.ca/en/release/100… ). @SabiVM @DFisman @imgrund @EdTubb 🧵1/

Everyone can now go to this portal to download their secure QR code ( covid19.ontariohealth.ca ) which comes out as a PDF file which you can save on your mobile device, print out, or just save the QR code image itself on your phone. 2/

More information on how to get this is available here ( covid-19.ontario.ca/vaccine-proof-… ). When you show up at a location that requires proof of full vaccination to enter, you can show the QR code along with a piece of ID to gain entrance. 3/

Businesses and citizens can now download the Verify Ontario app for iPhone and Android devices to be able to verify the QR codes ( covid-19.ontario.ca/verify ). Anyone can actually download the app and use it as I did to verify my own QR code. 4/

I'm not sure if I have actually said this since the start of the pandemic but I'm actually pretty impressed with how the Ontario government is handling the technology side of the QR code implementation. 5/

The verify app does *not* allow the Ontario government or businesses to track or save personally identifiable information. It does not store any information that links specific locations, visitors, or businesses to each other. 6/

It does not share more information than what is needed for entry. How can we trust it is actually doing that? The government has made the source code of the app available for everyone to go through and verify themselves if they wish ( github.com/ongov/OpenVeri… ). 7/

The app does not need to be online or connected to the Internet to verify QR codes so provides many flexible options for use. You do need to connect the app to the Internet once a week to download the latest rules that specify current entry requirements. 8/

This way the government can update restrictions as required without needing everyone to download and install a new app. 9/

When you present your QR code to a business with the Verify Ontario app, what do they see? Assuming you have a valid QR code and it has been more than 14 days since your second dose, it will show a green bar with white checkmark saying "Verified"... 10/

...with your full name and birthdate so the business can then look at your ID to confirm that is you (see image). 11/

The business does not see which vaccines you got in the app or any dates, just that the combination is acceptable by the Ontario government for entry. What happens if someone copies your QR code and then tries to change your name and birthdate with theirs? 12/

Ontario is using the Smart Health Cards protocol which uses a digital token that prevents forgery ( spec.smarthealth.cards ). Changing even one character in the QR code causes the authentication to fail so people can't just make their own proof of vaccination QR codes. 13/

The Verify app will then look like either the yellow image "There is a problem" or the red image "Invalid certificate". 14/

The verify app also works with QR codes from British Columbia, Quebec, and the Yukon who have adopted the same standard. Support for other provinces will be added as well. 15/

It seems that Saskatchewan, Alberta, Newfoundland and Labrador, Nova Scotia, and Northwest Territories are also implementing QR codes using the same standard. 16/

QR codes store information. Usually they are a web link so people can scan them with their phone and go to the website you are interested in getting more information about. What is actually stored in the vaccine passport QR code? 17/

Anyone who is more technical and would like to extract the data from their QR code can use this handy extractor tool ( github.com/obrassard/shc-… ). They also provide a web interface to check if you don't want to install and run the tool yourself ( shc.obrassard.ca ). 18/

I extracted my own QR code to see what was there. It is basically a compressed and encoded text file in JSON format that contains the following:
- Last name
- First & Middle names
- Birthdate

19/

- Vaccine dose information (shots 1, 2, etc..)
-> Manufacturer
-> Vaccine
-> Date of vaccine
-> Lot #
-> Province of vaccination

20/

While the Verify Ontario app does not show the vaccine dose information, the data is encoded in the QR code for all the doses you have received. The image shows what my dose #1 data looks like in the QR code (modified to change date & lot number for privacy). 21/

You can see the section is of type "Immunization", the status was "completed" and the manufacturer was "PFR" which is the code for Pfizer. The actual vaccine itself was 28581000087106 which is the SNOMED clinical terminology code for the Pfizer COVID-19 vaccine. 22/

You can look up your code here in the Canadian Vaccine Catalogue ( cvc.canimmunize.ca/en/explore#/tr… ). 23/

Ontario decided to adopt a standard being used by others all over the world, it uses cryptography to ensure QR codes cannot be modified or forged by others. The QR code can be stored in a mobile device or printed and carried on physical paper if desired. 24/

Since it uses a standard, other provinces will easily be able to verify Ontario QR codes as well. The QR code itself contains only your name, birthdate, and information about the vaccine doses you have received. 25/

The verify app only displays your name and birthdate to businesses and whether the QR code is valid or not. It does not store or track any information which can be verified by looking at the source code that was made available to everyone. 26/