Despite the United States’ widespread problems with falsified vaccination cards, the Centers for Disease Control and Prevention makes a high-resolution, blank version of the card design available for download on its website.
It’s a head-scratching choice for the CDC. In early 2021, the agency said it had repeatedly warned state governments against doing the same thing — for fear it would aid fraudsters looking to replicate the flimsy paper credential.
“CDC has consistently advised states not to post the vaccine card template publicly,” CDC spokesperson Kate Grusich told NBC News last April.
Despite multiple inquiries to the agency about the site over the past two weeks, it has not responded with explanation or comment. As of Monday, the CDC’s website continues to offer a high-quality PDF copy of the document on its website — complete with a notice that the file is not copyrighted and is free for public use. The document has no watermark to deter people from simply printing it out and filling in false information.
A Grid investigation last month found the U.S. government’s reliance on the crude paper cards as official proof of Americans’ covid vaccination status has allowed a global marketplace of fraud to flourish. Thousands of online sellers offer fake vaccine credentials on major social media platforms, commonly using cryptocurrency and private online conversations to complete sales.
Platforms cracked down
Major tech firms took action in response to Grid’s earlier findings: Twitter and Facebook removed dozens of accounts advertising the cards for sale, and both Google and Apple said they communicated with Telegram about the vaccination card material.
But even perfect enforcement by tech giants could not stop fraudulent cards from being produced off the CDC’s own website.
“It’s pretty shocking,” said Sharona Hoffman, professor of law and bioethics at Case Western Reserve University. “I think it’s probably just the right hand doesn’t know what the left hand is doing over there.”
“I think it’s silly that the CDC advises states not to put high-quality PDFs on their websites, when the CDC itself has one that’s easily accessible and downloadable,” said Amesh Adalja, an infectious disease physician and senior scholar at the Johns Hopkins University Center for Health Security. “It couldn’t be expected to be an impactful recommendation to the states if the CDC is an easy source to download a document to make a fraudulent card from.”
The blank CDC design is not a secret online. Websites frequented by vaccination opponents and skeptics are rife with users exploring ways to buy fake cards or make their own using government templates.
In late 2021, users on the message board patriots.win — an online sanctuary for supporters of former president Donald Trump — discussed how to produce fraudulent vaccination cards. “If anyone could get me a link for those [blank designs], need to mock ones up to protect my family just in case,” one user posted.
Another user chimed in with an answer: “The blank cards are literally on the cdc website. I’m not lying or pretending to comply, but you do you and survive how you see fit.”
One forum user noted a very small typographical difference between the PDF on the CDC site and a legitimate card. The difference was confirmed by Grid’s review of several legitimate CDC cards. Grid could find no indication that the typographical difference has been identified by health officials as a method for spotting fraudulent credentials.
Before the CDC issued its warnings to states, several reportedly had high-resolution PDFs available for download from state health sites, and links to those files were shared on online conspiracy and anti-government discussion forums. Those states reportedly removed the vaccine card PDFs following the CDC’s warnings.
Law enforcement continues to make cases against fake vaccine card peddlers. The owner of a New York pediatric center and two of her employees were charged last month with felonies after an undercover operation where a detective was sold a fake vaccine card. In a raid of the facility by state and federal officials, over $800,000 in cash was found along with a ledger showing over $1.5 million in revenue from the illicit business. The three are also accused of entering the false information into the New York State Immunization Information System database.
Adalja, of Johns Hopkins University, said the vaccine card system “was a failure from the very beginning.”
“They knew that there was going to be a need for people to verify their vaccination status,” he said. “So the government could have come up with standards or certain types of apps, or certain ways to make it more secure early on. And they chose not to do that.”
A “chaotic and ineffective” approach
In March 2021, officials from the CDC and other federal agencies discussed a national credentialing system to electronically verify Americans’ vaccination status, the New York Times reported. A paper prepared for the call reportedly noted the dangers of the present system: “A chaotic and ineffective vaccine credential approach could hamper our pandemic response by undercutting health safety measures, slowing economic recovery and undermining public trust and confidence.”
But President Joe Biden and his advisers were concerned Republican politicians who opposed vaccine mandates would make political hay out of a national credential system, the Times found. “The policy is no policy” was the unofficial word from the White House, one official told the paper.
By April, the White House position was firm and made public. “The government is not now, nor will we be supporting a system that requires Americans to carry a credential. There’ll be no federal vaccination database, no federal mandate requiring everyone to obtain a single vaccination credential,” White House press secretary Jen Psaki told reporters.
The CDC website indicates the PDF of the vaccination card was posted August 2020. The file’s metadata suggests it may have been adopted from preexisting documentation. Its title reads, “Influenza Planning and Response,” and the subject field states: “Influenza poses one of the world’s greatest infectious disease challenges. CDC programs protect the U.S. from seasonal influenza and pandemic influenza — when a new flu virus emerges that can infect people and spread globally.”
The CDC and the Health and Human Services Department did not respond to questions about why the PDF’s metadata discusses the seasonal flu.
Emails between CDC officials from the period of August 2020 obtained by the Verge show a rushed, confused process for designing the credential.
“I am thinking even on a fast-track we are looking at a minimum of 10 days, and that assumes I can get a lot of people to drop everything to make it happen,” CDC Immunization Services Division Communications Team Lead Valerie Morelli wrote to other officials working on designing the cards in an Aug. 11, 2020, email with the subject line “COVID-19 Vaccination Card — RUSH.”
The next day, Morelli followed up in an email to colleagues expressing that “we are trying to overthink what we are trying to get the card to say and/or do.” The email continues: “It is simple with very little information on it. It goes back to the purpose of the card. The purpose of the card is to give the person being vaccinated documentation that they have received the vaccine and to remind them of a 2nd appointment if needed.”
Days later, on Aug. 16, CDC Vaccine Planning Unit Communications Co-Deputy Alison P. Albert noted “the urgency” with which the Trump administration’s covid-19 response leaders needed the Spanish translation on the back of the cards to be finalized.
“The Vaccine Planning Unit (VPU) has an urgent, last-minute request coming from Operation Warp Speed and General Perna to have the COVID-19 Vaccination Card template sent to them by COB Monday, August 17, including a Spanish version,” Albert wrote. Since-retired Army Gen. Gustave Perna led the Trump administration’s Operation Warp Speed effort to develop and distribute a vaccine.
Grid has made several attempts to ask the CDC and its parent agency, HHS, about the cards, the design process, the lack of security measures and the choice to post a blank version online for public use. They have not responded.