Adolf Hitler was vaccinated with Biontech and received the second dose on October 1st.

And he has a valid vaccination certificate signed by the French government.

Sounds like nonsense, it's nonsense too - but possibly more dangerous.

Because with the vaccination certificate, which is circulating in several Internet forums and Telegram groups, a forger advertises his services.

And this forger may have access to a top secret key that is used to generate the QR codes issued by every EU country.

Then all vaccination records that were created with it would have to be reissued.

This has not been proven, there are other explanations as well.

The case in the Netherlands caused a sensation, where the RTL news program reported on Wednesday.

Thomas Gutschker

Political correspondent for the European Union, NATO and the Benelux countries based in Brussels.

  • Follow I follow

The television station claimed to have contacted the forger.

He offered to issue a valid individual vaccination certificate, of Polish or French origin, for 300 euros.

Since the certificates are standardized across the EU, they are recognized in all other EU member states.

According to the report, the Dutch Ministry of Health has started an investigation into the case.

It also investigates the suspicion that a key may have been stolen.

Another possibility is that the forger works with people who are authorized to issue vaccination certificates themselves.

This circle is different in size in each country.

While pharmacists are one of them in Germany, in France only the statutory health insurance company is allowed to issue such certificates.

Certificates for Mickey Mouse and Spongebob

In the forum of the Internet service GitHub, several valid QR codes issued in the name of Adolf Hitler were circulating on Thursday. Among them was the one from France with the fictitious date of birth January 1, 1900, issued on October 25, as well as one with the year of birth 1930 from Poland (from October 24) and one with the year of birth 1989 from Macedonia (October 27). Other fake codes were issued to the names Mickey Mouse and Spongebob. The data analyst Denys Vitali, who works for Swisscom, wrote in an initial analysis there that the probability that a key was stolen was rather low. As a rule, security modules are used that hide the key from administrators as well.

It is more plausible that an authorized creator of certificates has been hacked or is cooperating with forgers. In order to provide proof of a stolen key, according to Vitali, a vaccination certificate would have to be dated to an appointment before the start of the pandemic - because the systems would normally not allow this. Such a certificate has not yet emerged.

The EU set the legal framework for electronic vaccination records in the spring. The focus was on “maximum data protection”, as the EU Commission emphasizes. The certificates only contain information about the name of the person vaccinated, their date of birth, the vaccine, the date of the vaccination and the country where it was given. The QR code contains a digital signature that shows who generated it. When the code is scanned, it is only checked whether this signature is authentic. To this end, the EU has set up an interface through which all member states are networked with one another.

Individual forged certificates can be revoked. According to a report by the ANSA news agency, the Italian authorities have already arranged this for Hitler's passports. However, should a forger actually have a secret key with which he can create authentic digital signatures, all vaccination records that were created with it would have to be reissued. Otherwise, other EU countries could refuse to recognize certificates from the country in question.

Investigations into fraud involving Covid certificates are already underway in several European countries.

On the one hand, these are real certificates that are in a different name.

Since organizers or restaurant operators almost never check the identity of a person who shows a QR code, that is enough to give another person access.

In some cases, however, investigations are also directed against people who work in the healthcare sector themselves and who can generate vaccination certificates.

In the Netherlands, for example, several employees of the municipal health service were suspended in mid-September, and one person from Alphen am Rhein was taken into custody.