A cybersecurity specialist in New Brunswick is cautioning that uploading personal documents online to apply for a P.E.I. Pass is placing individuals’ data at risk. The applications to get the pass, which is a document that makes going to the Island easier, opened the previous week for locals of the Atlantic provinces who at the very least are partially vaccinated against COVID-19.
P.E.I. residents no longer have to upload documents to the website starting from today; rather, they can concur to let public health officers confirm their vaccination status, and will be permitted to reveal a form of ID on arrival that shows they’re residents.
However, individuals coming from other provinces still have to upload documents like their vaccine information and driver’s license.
Reg MacWilliams, a cybersecurity expert with Secure State Cyber, states this is making a website that is prone to hackers and could put individuals in danger of identity theft.
MacWilliams said,
“You could have a website hosting driver’s licence, bank account numbers, email addresses, addresses … place of birth, place of residence, that is a whole lot of information.”
“It’s a kind of a hotspot for malicious actors.”
MacWilliams began applying for the P.E.I. Pass to visit his parents on the Island, when he claims he became perturbed about the amount of data he was required to upload to the site.
He contacted the Office of the P.E.I. Privacy Commissioner with his worries.
MacWilliams stated,
“They responded back the next morning saying that … my concerns were valid and that they would remediate the situation.“
Later on the same day, the website put forth a disclaimer telling non-Islanders wanting a pass to blackout unrequired private details before uploading the ID images.
For MacWilliams, that’s was not adequate.
He said,
“Most people aren’t technically savvy enough to understand the risk behind that.“
Denise Doiron, P.E.I. Privacy Commissioner stated she spoke to the Chief Public Health Office on making changes after getting one communication about the site’s privacy.
Doiron said,
“I’m satisfied that they are considering the privacy issues and their obligations around privacy.”
“I understand that people have a lot of sensitivity about their privacy, and that’s a good thing. But at the same time, we are in the middle of a pandemic. We do have legislation that allows the government and Chief Public Health Office to put certain restrictions in for the good of Islanders.”
Dennis King, P.E.I. Premier, said that because Islanders no longer need to upload their data to apply will make the process quicker and easier.
He told CBC News’ Compass host Louise Martin that,
“For Islanders, we have essentially said, check this box and we’ll be able to validate the information that we were asking you to upload.”
“It’s been a learning experience and we feel a lot better about it today than we did a couple of days ago.”
In the meantime, MacWilliams counsels people applying to black out the data on their photo ID that is not needed.
He states,
“We trust websites a lot more than maybe we should.”
“I don’t think the onus of putting it on the individuals uploading their information is the right approach.”
MacWilliams noted a better perspective would be to make a federal program that shows proof-of-vaccine for traveling purposes.
He said,
“But you’ve got to factor in the timeline of how fast can they build up that platform and roll it out, versus people wanting to travel.“