Skip links

Indonesian President’s COVID jab cert leaks – authorities argue that’s perfectly reasonable

Indonesian authorities have admitted that the COVID-19 vaccination certificate of the nation’s President has circulated online and tried to explain that it’s an indication of admirable transparency, rather than lamentable security.

That President Joko Widodo’s vaccination certificate was made public late last week is not in dispute.

The reasons why it circulated are contested.

In one camp are those who argue that the document’s unplanned public debut is more evidence that Indonesia’s government is bad at securing information. Evidence to support that argument is easy to find: The Register alone has chronicled the leak of personal information from Indonesia’s COVID quarantine management app, and another at the national health insurance scheme. Indonesia has also urged citizens to stop posting their own vaccination certificates on social media as they contain other personal data.

The appearance of President Widodo’s vaccination records – complete with the date and time at which he was inoculated – has been criticised as undermining public confidence in not just the vaccination process, but government digital services in general.

Which is not what Indonesia needs. The nation is the world’s sixteenth-largest nation when measured by GDP, and the fourth-largest by population, and while it is on a trajectory to become an economic powerhouse its government services are neither well-distributed nor sophisticated.

Hence the issuance of a joint statement from the nation’s Ministry of Health, National Cyber and Crypto Agency, and Ministry of Communication and Information, which together offer a perfectly innocent explanation for the leak.

The statement points out that online services allow retrieval of vaccination certificates for verification purposes, with the citizen’s name, national ID number, date of birth, date of vaccine, and type of vaccine all required.

The agencies stated that news reports offer ample evidence of when the President was jabbed. National identity numbers, they add, are required to be made public by Indonesia’s Elections Commission web site, so Widodo’s number is not hard to find. Nor is his birthday a secret.

Vaccine type is a little trickier to divine, as Indonesia appears to have used at least four and perhaps as many as ten different types of jabs! But with four of the five required data points known, guessing the jab Widodo received would not require much, if any, technical skill.

The agencies also argue that they recently enhanced privacy by removing the option to use mobile phone numbers to look up vaccination status. So, security is just fine, thank you very much. Unless you’re the President or another prominent figure whose personal information is by necessity in the public domain. ®