Private proof-of-vaccine app Portpass continues to expose personal data even after relaunch and updates

Personal information belonging to more than 17,000 users of the private proof-of-vaccination app Portpass is still unsecured and visible online — including, in some cases, photos of drivers' licences and passports — despite assurances from the company that its data-security problems have been fixed.

The Calgary-based smartphone app was temporarily taken offline in late September after CBC News initially reported that users' data was unsecured and accessible on the internet to anyone who knew where to look.

The app relaunched in October and the Portpass website assured users that it protects their "health privacy and data security at the highest level" and that "your data and information is kept secure at all times." 

But several experts in software development have since reached out to CBC News with concerns that users' data was still accessible.

CBC News was able to independently confirm that the records of more than 17,000 users were still unsecured after the relaunch. The confirmation was done by using an automated script to scan the information that was accessible online without storing all of the users' personal information.

By examining a sample of those records, CBC News was able to view text-based data showing users' names, phone numbers, email addresses, dates of birth, vaccination status and, in some cases, Alberta health-care numbers.

Some records also included photos of users and their personal identification documents. Among the images were drivers' licences from British Columbia, Alberta, Saskatchewan and Ontario, as well as a Canadian passport, a U.S. passport and a federal Indian status card.

CBC News was able to view at least a dozen different photo IDs in the past week, some of which were accessible for days at a time. (The original images were temporarily stored by CBC News and then deleted; only blurred versions with identifying details obscured were kept.)

The Calgary-based app, which invites users to upload personal information so it can act as a proof-of-vaccination system for people who want to go to restaurants, concerts and other events that require attendees to be immunized against COVID-19, launched before governments in Alberta and Ontario created their own apps.

Portpass was widely used before it was temporarily taken down in late September amid the initial flurry of privacy concerns.

The Calgary Flames briefly promoted the app as the "preferred and fastest" method for fans attending games at the Saddledome to prove their vaccination status, but removed that recommendation after security flaws came to light.

CBC News contacted Portpass CEO Zak Hussein on Monday about the unsecured data. He agreed to an interview on Tuesday evening, in which he said he had no idea the users' records were still accessible.

"I was unaware of that," Hussein said. "That's crazy."

At that point, Hussein said he was considering pulling the plug on Portpass, especially considering Alberta and Ontario have since launched their own apps.