Private proof-of-vaccine app Portpass continues to expose personal data even after relaunch and updates
CBC
Personal information belonging to more than 17,000 users of the private proof-of-vaccination app Portpass is still unsecured and visible online — including, in some cases, photos of drivers' licences and passports — despite assurances from the company that its data-security problems have been fixed.
The Calgary-based smartphone app was temporarily taken offline in late September after CBC News initially reported that users' data was unsecured and accessible on the internet to anyone who knew where to look.
The app relaunched in October and the Portpass website assured users that it protects their "health privacy and data security at the highest level" and that "your data and information is kept secure at all times."
But several experts in software development have since reached out to CBC News with concerns that users' data was still accessible.
CBC News was able to independently confirm that the records of more than 17,000 users were still unsecured after the relaunch. The confirmation was done by using an automated script to scan the information that was accessible online without storing all of the users' personal information.
By examining a sample of those records, CBC News was able to view text-based data showing users' names, phone numbers, email addresses, dates of birth, vaccination status and, in some cases, Alberta health-care numbers.
Some records also included photos of users and their personal identification documents. Among the images were drivers' licences from British Columbia, Alberta, Saskatchewan and Ontario, as well as a Canadian passport, a U.S. passport and a federal Indian status card.
CBC News was able to view at least a dozen different photo IDs in the past week, some of which were accessible for days at a time. (The original images were temporarily stored by CBC News and then deleted; only blurred versions with identifying details obscured were kept.)
The Calgary-based app, which invites users to upload personal information so it can act as a proof-of-vaccination system for people who want to go to restaurants, concerts and other events that require attendees to be immunized against COVID-19, launched before governments in Alberta and Ontario created their own apps.
Portpass was widely used before it was temporarily taken down in late September amid the initial flurry of privacy concerns.
The Calgary Flames briefly promoted the app as the "preferred and fastest" method for fans attending games at the Saddledome to prove their vaccination status, but removed that recommendation after security flaws came to light.
CBC News contacted Portpass CEO Zak Hussein on Monday about the unsecured data. He agreed to an interview on Tuesday evening, in which he said he had no idea the users' records were still accessible.
"I was unaware of that," Hussein said. "That's crazy."
At that point, Hussein said he was considering pulling the plug on Portpass, especially considering Alberta and Ontario have since launched their own apps.
Run 3 Space | Play Space Running Game
Traffic Jam 3D | Online Racing Game
Duck Hunt | Play Old Classic Game
Yellowknife's hospital will staff its emergency room with a virtual doctor, and will regularly schedule doctors to work 12-hour shifts this summer to deal with a personnel shortage, according to three health-care organizations in the territory that have decried the situation as dangerous.
U.S. President Donald Trump said Friday he's terminating all trade discussions with Canada effective immediately.
The province's Chief Public Health Office has identified between four and eight infants who require medication to protect them against measles.
It's turtle nesting season in Ontario and conservationists are working to protect endangered species and their nests.
Both Ontario's privacy commissioner and Ontario Health are investigating a reported data breach affecting Ontario Health atHome, the province's home-care coordination service.
During a Thursday afternoon meeting earlier this month in Brooks, Alta., Justice Dallas Miller, chair of Alberta's new electoral boundaries commission, outlined the central challenge facing the panel.
Five doctors at a St. John's hospital have tendered a joint notice of resignation, saying their work environment has become "unsafe for both patient care and provider well-being," CBC Investigates has learned.
Adeb Arianson fled his home in Kabul just days before the capital of Afghanistan fell to the Taliban in 2021, as Western nations were evacuating their citizens and panic seized the city.
New Brunswick's two regional health authorities say the transition of primary care to family health teams has opened up access for tens of thousands of doctorless patients, with more to come.
The Toronto Raptors are parting ways with team president Masai Ujiri, according to ESPN and Sportsnet.
After at least 22 drownings in Quebec since the start of the year — including two at Montreal's Verdun Beach in recent weeks — the Quebec Lifesaving Society is renewing its calls for caution.
Winnipeg's Portage and Main intersection is embedded in the story of Canada — the crossroads of the country and one of its windiest corners — and it's held that lore despite being inaccessible to pedestrians for 46 years.
Saskatchewan's Opposition NDP is calling on the provincial government to drop the requirement for used vehicles bought outside of the province to be inspected before they can be registered.