The European Commission has adopted an EU mechanism that allows revoking fraudulent or erroneous EU Digital COVID Certificates (EUDCCs).

With this measure, once a certificate is revoked in one member state, it will also show as invalid in all other member states.

WHY IT MATTERS

Since the EUDCC system started in July 2021, more than 1.7 billion certificates have been issued. In addition to the 27 EU member states, another 35 non-EU countries and territories have joined the scheme, including the UK and the non-EU Schengen members – Iceland, Lichtenstein, Norway, and Switzerland.

Due to its successful role in helping to lift travel restrictions, EU certificates have sometimes become a target for fraudsters. The new feature means that when fraud or mistakes are detected, the concerned certificates can be revoked in all member states.

However, the Commission says the overall number of fraudulently or mistakenly issued certificates “remains very low”.

THE LARGER CONTEXT

Last year Italian police said they had uncovered several online schemes offering to sell fake EUDCCs. The cybercrime prosecutor team in Milan led the investigation, which showed that thousands of people were ready to pay for false certificates. Instances of fake certificates for sale have also been reported in Austria, Germany and Ireland.

Meanwhile, cybersecurity concerns have been raised by software developers regarding the EUDCC’s use of unencrypted barcodes, which could potentially make them vulnerable to cybercrime and abuse.  

There have also been fears that the NHS COVID certificate scheme could be open to fraud due to a glitch in the online system which allows users to obtain a certificate by entering a false negative test result.

Earlier this month, the Council of the EU approved the extension of the EUDCC scheme for an additional year until 30 June 2023. The current regulation establishing the certificates was adopted in June 2021 and expires on 30 June 2022. For the extension to be adopted in time before the expiry date, the Council and the European Parliament must reach an agreement under the ordinary legislative procedure before that date.

In December the Commission reduced the validity period of the certificates to nine months to encourage people to have boosters, based on the European Centre for Disease Prevention and Control’s recommendation that the third jab should be given within six months.

ON THE RECORD

A European Commission press release states: “While several member states have already deployed revocation systems at national level, the new system at EU level will allow the secure and efficient revocation cross-border via the EU Gateway. This improvement should further strengthen the trust and confidence in the EU Digital COVID Certificate system.”