SNP's vaccine passport scheme in chaos as it can be 'outfoxed by a screenshot'

The rollout of Scotland's vaccine passport scheme descended into a deeper shambles on Monday after it emerged that a key security feature trumpeted by the SNP health secretary does not work.

As enforcement of the controversial scheme came into force, Humza Yousaf was warned that it was left wide open to fraud and abuse because a safeguard he claimed would protect the personal data of Scots did not exist.

The minister claimed in a major radio interview that it was impossible to take screenshots of information displayed on the passport app, which proves users had received both jabs.

The feature was supposed to stop people obtaining details of another person's vaccination records, which they could then display on their own phones to fraudulently gain access to nightclubs or large events such as sports fixtures or concerts.

However, it emerged that the £600,000 app, which was hit with major technical problems when it was launched late last month, in fact allowed users to easily take screenshots which could be sent to others instantly by email, text or on messaging services such as WhatsApp.

Businesses have been told that they are allowed to “visually” check QR codes when screening customers, meaning it would be simple for an unvaccinated person to get around the requirement if they have a friend willing to share an image, or obtain records of a vaccinated person without their consent.

Opponents said the revelation would further dent public confidence in the scheme, which has already been hit with widespread technical problems and is hated by businesses expected to implement the rules.

There was confusion within the SNP administration about the blunder on Monday night, with some suggestions that Mr Yousaf had been let down by officials who had fed him incorrect information. The Government later claimed he had been referring only to an app used to check users' details, which did not allow screenshots to be taken on Android phones only.

The health secretary is already under huge pressure because of an unprecedented crisis within the NHS, with a third Scottish health board requesting military assistance to prevent collapse.

Alex Cole-Hamilton, the leader of the Scottish LibDems, said it was clear that the system could be "outfoxed by anyone who knows how to take a screenshot" and repeated his call for it to be scrapped.

“The launch was a shambles and the IT system struggled to cope,” he said. "What's worse is that these illiberal ID cards will not even keep people safe. It will breed false confidence and allow the virus to spread under the radar.”

He added: “This whole saga has been a shameful distraction from the measures that we know can help us defeat the virus: testing, tracing and vaccinating. Covid ID cards should be abolished immediately."

Speaking to BBC Scotland on Monday morning, Mr Yousaf attempted to defend the scheme and praised “really helpful” security features built within the app.

He added: “For example, the screenshotting facility in your phone is disabled when you're using the verify app, so you can't screenshot the information that comes up.”

However, within minutes the claim had been shown to be incorrect.

Businesses also warned that many members of the public were still unaware of the scheme, with SNP ministers refusing calls to launch a large-scale marketing drive to inform the public they could be refused entry to nightclubs or large events if they do not have proof of vaccination.

Leon Thompson, director of UKHospitality Scotland, said many businesses had reported customers being unaware of the scheme since it came into force on October 1. They were expected to trial its use before enforcement began on Monday.

Mr Yousaf said that more than 700,000 people had downloaded the app, while 750,000 paper copies had been issued.

This means that at least two million double-vaccinated Scots do not yet have a vaccine passport, although the total is likely to be far higher as many people aware of the scheme will have downloaded both a digital and paper version.

The situation could lead to chaos if large numbers turn up to events which they have bought tickets to but are then turned away.

The controversy over vaccine passports came as a third health board requested military support, with the NHS under unprecedented strain.

NHS Grampian asked for army assistance, after it emerged that medics will be deployed to the Borders and Lanarkshire from Tuesday. More than 200 military personnel are already assisting the Scottish Ambulance Service.

Sandesh Gulhane, health spokesman for the Scottish Tories, said: “Humza Yousaf has completely failed to get on top of the crisis in our NHS. Staff are beyond breaking point. We are not even near the peak winter period yet we have three health boards requesting urgent military assistance.

“That is a direct result of Humza Yousaf’s delays and inaction. His flimsy NHS Recovery pamphlet and belated winter plan for our health service are simply not cutting it."

A Scottish Government spokeswoman said: “In his interview the Cabinet Secretary was clearly referring to the Covid Check Verifier App which is used by business to verify a person’s QR code. The ability to take a screenshot has been disabled from android devices.

“Furthermore under the regulations venues they are under a statutory duty to treat information in confidence and not use it for another purpose.

“We recognise that it is possible to take a screenshot of the Covid Status app but the shimmer security features built into the app mean that it should be possible to distinguish between the app and a screenshot.”