CDC website offers blank vaccine cards for download, despite fraud worries

Despite the United States’ widespread problems with falsified vaccination cards, the Centers for Disease Control and Prevention makes a high-resolution, blank version of the card design available for download on its website.

It’s a head-scratching choice for the CDC. In early 2021, the agency said it had repeatedly warned state governments against doing the same thing — for fear it would aid fraudsters looking to replicate the flimsy paper credential.

Despite multiple inquiries to the agency about the site over the past two weeks, it has not responded with explanation or comment. As of Monday, the CDC’s website continues to offer a high-quality PDF copy of the document on its website — complete with a notice that the file is not copyrighted and is free for public use. The document has no watermark to deter people from simply printing it out and filling in false information.

Platforms cracked down

Major tech firms took action in response to Grid’s earlier findings: Twitter and Facebook removed dozens of accounts advertising the cards for sale, and both Google and Apple said they communicated with Telegram about the vaccination card material.

But even perfect enforcement by tech giants could not stop fraudulent cards from being produced off the CDC’s own website.

“It’s pretty shocking,” said Sharona Hoffman, professor of law and bioethics at Case Western Reserve University. “I think it’s probably just the right hand doesn’t know what the left hand is doing over there.”

“I think it’s silly that the CDC advises states not to put high-quality PDFs on their websites, when the CDC itself has one that’s easily accessible and downloadable,” said Amesh Adalja, an infectious disease physician and senior scholar at the Johns Hopkins University Center for Health Security. “It couldn’t be expected to be an impactful recommendation to the states if the CDC is an easy source to download a document to make a fraudulent card from.”

The blank CDC design is not a secret online. Websites frequented by vaccination opponents and skeptics are rife with users exploring ways to buy fake cards or make their own using government templates.

Another user chimed in with an answer: “The blank cards are literally on the cdc website. I’m not lying or pretending to comply, but you do you and survive how you see fit.”

One forum user noted a very small typographical difference between the PDF on the CDC site and a legitimate card. The difference was confirmed by Grid’s review of several legitimate CDC cards. Grid could find no indication that the typographical difference has been identified by health officials as a method for spotting fraudulent credentials.

Law enforcement continues to make cases against fake vaccine card peddlers. The owner of a New York pediatric center and two of her employees were charged last month with felonies after an undercover operation where a detective was sold a fake vaccine card. In a raid of the facility by state and federal officials, over $800,000 in cash was found along with a ledger showing over $1.5 million in revenue from the illicit business. The three are also accused of entering the false information into the New York State Immunization Information System database.

Adalja, of Johns Hopkins University, said the vaccine card system “was a failure from the very beginning.”

“They knew that there was going to be a need for people to verify their vaccination status,” he said. “So the government could have come up with standards or certain types of apps, or certain ways to make it more secure early on. And they chose not to do that.”

A “chaotic and ineffective” approach

But President Joe Biden and his advisers were concerned Republican politicians who opposed vaccine mandates would make political hay out of a national credential system, the Times found. “The policy is no policy” was the unofficial word from the White House, one official told the paper.

The CDC website indicates the PDF of the vaccination card was posted August 2020. The file’s metadata suggests it may have been adopted from preexisting documentation. Its title reads, “Influenza Planning and Response,” and the subject field states: “Influenza poses one of the world’s greatest infectious disease challenges. CDC programs protect the U.S. from seasonal influenza and pandemic influenza — when a new flu virus emerges that can infect people and spread globally.”

The CDC and the Health and Human Services Department did not respond to questions about why the PDF’s metadata discusses the seasonal flu.

The next day, Morelli followed up in an email to colleagues expressing that “we are trying to overthink what we are trying to get the card to say and/or do.” The email continues: “It is simple with very little information on it. It goes back to the purpose of the card. The purpose of the card is to give the person being vaccinated documentation that they have received the vaccine and to remind them of a 2nd appointment if needed.”

Days later, on Aug. 16, CDC Vaccine Planning Unit Communications Co-Deputy Alison P. Albert noted “the urgency” with which the Trump administration’s covid-19 response leaders needed the Spanish translation on the back of the cards to be finalized.

“The Vaccine Planning Unit (VPU) has an urgent, last-minute request coming from Operation Warp Speed and General Perna to have the COVID-19 Vaccination Card template sent to them by COB Monday, August 17, including a Spanish version,” Albert wrote. Since-retired Army Gen. Gustave Perna led the Trump administration’s Operation Warp Speed effort to develop and distribute a vaccine.

Grid has made several attempts to ask the CDC and its parent agency, HHS, about the cards, the design process, the lack of security measures and the choice to post a blank version online for public use. They have not responded.