Israel may be leading the world in terms of vaccinating its citizens, but the Health Ministry website and app that allow people to obtain a vaccination certificate is off to a rough start. The so-called “green passport” officially went online this weekend.
The pass is a certificate verifying that people have either been vaccinated against or recovered from the coronavirus. Having one is a requirement for entering certain businesses and events.
Predictably, however, the launch of the Ramzor (“Traffic Light”) app and website was marred by problems and crashes. Many users were unable to get their green passes from either the app or the website, and many others experienced sudden crashes on their phones.
There were also complaints about the fact that the app is only available from Israeli app stores, so people who live in Israel but whose phones are registered with overseas can’t download it.
“As of yesterday evening, 150,000 green passports had been issued, and today, the number has increased,” said Rona Kaiser, who heads the Health Ministry’s information systems and technology department. “We had thousands on the website and tens of thousands on the app simultaneously. We’re working to improve the infrastructure and fix the problems.
“From the start, we asked to launch knowing we’d need the first few weeks to fix the bugs, because when a new service goes online, everybody wants to sign up, and there’s a buzz,” she added. “So it was clear that the beginning would be faltering and we’d need time to stabilize. I’m certain there will be additional improvements this week and the service will stabilize.”
In response to complaints that the ministry didn’t prepare properly for the high number of users and launched an app that wasn’t yet ready to go, Kaiser pleaded that the timetable for developing and launching the app was very short. Just two months have passed since the vaccination campaign began.
- Despite warnings, anyone can still fake Israel’s coronavirus vaccination certification
- Anyone can fake Israel’s vaccination certificate - here’s how easy it is
- Coronavirus Israel live: Cabinet set to debate overnight curfew over Purim Holiday
“We had very little time to prepare,” she said. “This is a complex operation – putting up a website and app with hundreds of sources of information and many processing steps.”
Verification and animation
Aside from the problems with the launch, cyber and network security professionals also raised questions about the system’s verification mechanisms.
On the app, the green passport is essentially an animation that shows a family walking with suitcases against a green background. It also displays the user’s identity card number. When someone arrives at a business that requires the pass, they must show their smartphone screen with the animation, along with their ID card.
The idea is that the animation itself is a form of verification, since users won’t be able to fake a single screenshot. Only an active app with the animation running, plus an ID card, will enable entry.
In contrast, the green pass issued by the Ramzor website is a single document with a secure QR code and the user’s ID number. When someone takes this document to a business that requires a green pass, the owner can scan the QR code via their own app.
One concern is that having two different kinds of verification will cause confusion for both users and businesses. Moreover, many criticized the use of a simple animation as a verification system. A QR code is considered more secure, as well as being the more standard method. As Haaretz reported in recent weeks, an initial version of the QR code was also exposed to forgery.
Kaiser said the decision to use animation on the app stemmed from the need to strike a balance between security and ease of use. The ministry feared that if everyone had to scan a QR code to enter a business, this would create long lines and unnecessary crowding. Therefore, it opted for a simpler, quicker method.
“It’s true that if someone wants to go and create a fake app, he can,” she said. “But in principle, it’s harder to forge a screen that displays an animation and an ID number. Still, if someone decides to forge it, that’s their choice. They’re endangering the public, and ultimately, there will also be police and enforcement against such people.”
“We aren’t fixated on this solution,” she added. “We’ll monitor this, and if we see that it’s necessary and right to put a QR code into the app as well, we’ll do so. The goal is to open the economy, and we hope that with this level of technology, we’re providing a good enough solution.”
‘We’re aware of the risks’
The ministry said that during the running-in period for the green passport – that is, the next two weeks – it will also be okay to show businesses existing vaccination or recovery certificates, which have already been issued to most of those who have been inoculated or are eligible. But as many security experts have discovered in recent weeks, the existing vaccination certificates contain a simple QR code that’s very easy to forge.
“We’re aware of the risks, and therefore, the police are also involved,” Kaiser said.
These certificates, she noted, are only temporary; soon, all Israelis will use the more secure green passport. In the future, vaccination and recovery certificates may also need to be presented by people who travel overseas, so the ministry is currently working with several other countries and the World Health Organization to create a secure international standard for a green pass.
“This is supposed to happen in the coming weeks,” she said. “And once an international standard comes out, we’ll ask everyone to issue new vaccination and recovery certificates.”