Alexandra Wong and Neoclis Soteriou, NORTHCOM
Week of Monday, May 17, 2021
CDC-Issued COVID-19 Vaccination Record Card[1]
Summary
As the United States (US) moves towards recovery and reopening following the COVID-19 pandemic, several threats are highly likely to disrupt vaccination efforts and slow overall public health recovery. On Thursday, May 13, 2021, the US Centers for Disease Control and Prevention (CDC) announced that people fully vaccinated against COVID-19 do not need to wear masks or practice social distancing, either indoors or outdoors.[2] As of May 20, the CDC reported that 38.1% of the total US population has been fully vaccinated.[3] However, anti-vaccination rhetoric persists, including the distribution of falsified CDC vaccination cards, and disruptions to the vaccine supply chain may further impede recovery efforts. The Counterterrorism Group (CTG) assesses that:
Anti-vaccination rhetoric and protests are likely to encourage vaccine hesitancy among undecided populations. Protests against vaccine requirements at colleges, universities, and workplaces are likely to temporarily disrupt reopening efforts.
Anti-vaccination rhetoric and protests are highly likely to encourage continued anti-government conspiracy theories and disinformation about the COVID-19 vaccine, particularly among the far right.
Increased distribution of forged CDC COVID-19 vaccination cards is highly likely to undermine reopening efforts, as the cards contain no anti-forgery features and are the primary verification method to determine an individual’s vaccination status.
Quality-control issues at the Emergent BioSolutions plant in Baltimore, MD producing doses of the Johnson & Johnson COVID-19 vaccine have almost certainly impacted the rate of vaccinations both within the US and abroad.
Hackers targeting the COVID-19 vaccine supply chain — possibly carried out by state actors, rather than terrorist groups or criminal organizations — may cause small disruptions, but are unlikely to significantly disrupt efforts.
Alternatively, the US vaccine rollout has been largely successful and it is possible that these disruptions will not affect long-term vaccination efforts. However, these issues will likely continue to cause and exacerbate anti-vaccination protests and misinformation leading to possible security threats, and slowing the US’ recovery.
Assessments
Anti-Vaccination Rhetoric, Disinformation, and Protests
There have been several anti-vaccination protests throughout the country since the start of the COVID-19 vaccine rollout, which in some cases have led to disruption or delay of vaccine administration. Most notably an anti-vaccination protest in January in Los Angeles, California, caused the temporary closure of Dodger Stadium, a mass vaccination site. Protestors at the incident were accused of intimidating individuals going to get vaccinated, in some cases blocking the entrance, and some of the protestors allegedly had links to far-right groups.[4] Other, mostly peaceful, protests have also taken place outside of Dodger Stadium in Los Angeles, as well as elsewhere in California and other states such as New York, Colorado, and Texas since the start of the pandemic.[5] Similar anti-vaccination protests are likely to continue in some locations throughout the country, so long as the pandemic, and subsequently, the vaccine rollout remains in place. Additionally, these anti-vaccination protests will likely serve to legitimize anti-vaccination groups and conspiracies and encourage vaccine hesitancy among at least a portion of the population, thus having a negative impact on the vaccine rollout and pandemic recovery initiatives.
There have also been several anti-vaccination incidents involving university students as an increasing number of colleges and universities are requiring vaccinations to attend the Fall 2021 semester. Among these incidents includes Jackie Gale, a student at the University of Alabama-Birmingham who has demanded a religious exemption to the vaccination. Gale had received a religious exemption from the university during the 2020-2021 school year, however, the university has decided that it will not apply the same exemption for the upcoming year. The First Liberty Institute has threatened a lawsuit against the university if it does not exempt Galeeven though, even though the University of Alabama-Birmingham does require students to provide proof of immunization against COVID-19.[6] Rutgers University, in New Jersey, has stated that it will mandate Covid vaccinations for its 71,000 students, and require students to provide proof of immunization. However this has also been challenged by a student, Sara Razi, who claims not to be “anti-vax” however believed that it is a personal choice on whether or not an individual gets vaccinated, not the choice of the university.[7] Similar anti-vaccination incidents are likely to continue on college and university campuses throughout the country as more institutions require immunization as a condition for attendance. Additionally, it is likely that accommodations, such as religious exceptions will be made, at least in some cases, which would likely have a negative impact on vaccination rates and recovery initiatives.
Additionally, there is the risk of anti-vaccination incidents involving employees in workplaces that may require immunization. According to the US Equal Employment Opportunity Commission, employers can require employees to receive vaccinations against diseases that are recognized as pandemics, such as COVID-19.[8] As well, under the Americans with Disabilities Act, it is legal to require the vaccine as long as employers are not requesting information from an employee.[9] However, bills have also been introduced in 20 states that are meant to prevent employment discrimination against those who refuse a vaccine.[10] This is likely to lead to several lawsuits challenging the legality of employers being able to require their employees to be immunized against COVID-19, which may result in employers not being able to do so. Should this happen, it would likely lead to a negative impact on the vaccine rollout and pandemic recovery initiatives, and encourage vaccine hesitancy among at least a portion of the population.
Since the beginning of the COVID-19 pandemic in the US, social media platforms such as Facebook and Twitter have been flooded with misinformation, conspiracy theories, and other anti-vaccine sentiments. Much of this online misinformation and vaccine-hesitancy is from individuals who are not affiliated with extremist or conspiratorial ideologies and are unknowingly spreading misinformation. However, much of the misinformation, conspiracy theories, and other anti-vaccine sentiments online have been posted by individuals or accounts associated with fringe, conspiratorial or extremist views, such as anti-vaccination groups. Anti-vax groups have been active both online and elsewhere for decades before the COVID-19 pandemic, however, this pandemic has allowed for many of their views to enter into mainstream discourse and gain traction among the population.
Additionally, far-right groups such as QAnon have also used the pandemic as an opportunity to spread misinformation and fear about vaccinations and the prospects of an excessively powerful government taking away individual civil liberties.[11] Among far-right groups, there is a common conspiracy that the pandemic, whether or not internationally released upon the population, was used as a precedent for the government to expand its control over the population and erode civil liberties without large-scale backlash. Additionally, those who believe this conspiracy is likely to be disposed to the notion that the vaccine is part of the government's agenda to increase its power and control. Such as the conspiracy that the vaccines are used to administer microchips which may then be used for several purposes such as tracking, monitoring or even killing people. This increase in online misinformation is highly likely to mainstream fringe, far-right, and anti-vax groups and conspiracies, and encourage vaccine hesitancy among at least a portion of the US population. Therefore, having negative implications for the vaccine rollout and overall social and economic recovery from the pandemic.
Fraudulent CDC COVID-19 Vaccination Cards
Due to privacy concerns, there is no federal database to record COVID-19 immunizations. Vaccine providers in the US complete a CDC-issued vaccination record card for each recipient, containing information including the vaccine manufacturer, lot number, and date(s) of administration. Vaccine administrations are also recorded with state immunization registries.[12] However, physical vaccine cards are easy to forge: they are printed on white paper, are marked by hand, and images of the card templates are widely available, with no anti-forgery features.[13] New York has introduced an “Excelsior Pass” to present digital proof of vaccination, verified against state records, but most areas in the US have not established similar systems.[14] Private entities requiring vaccinations as part of reopening efforts must therefore depend on the physical cards as the primary proof of vaccination, rather than a more secure digital system. Companies including Salesforce and United Airlines have announced they will require employees to show their cards; several universities with vaccine requirements for students in the fall have stated that vaccine verification will consist of uploading a picture of the card.[15] Under this system, likely, unvaccinated or anti-vax individuals will falsely report their vaccine status, risking public health within their workplaces or organizations.
Fake cards have been widely distributed both in-person and online. As the issue is so widespread and cross-jurisdictional, it is highly likely that distribution will persist as long as physical cards are used to verify vaccination status. In an April 2021 anti-vaccine rally in Hartford, Connecticut with 4,000 participants, Connecticut Capitol Police seized a box containing dozens of fake cards (Annex A).[16] In New York, a 21-year-old employee at pharmacy chain CVS was arrested for allegedly stealing cards, possibly with the intent to give them to family or friends to allow them to go into venues or schools.[17] Listings for fraudulent cards have appeared on sites including eBay, Craigslist, OfferUp, and on social media platforms such as Instagram or Twitter.[18] Following crackdown efforts by law enforcement, some sales have moved to Telegram, an encrypted social media app that provides a sense of anonymity for users and has been used as a method of communication by far-right and extremist groups. Sellers on Telegram, several of whom claim to be legitimate doctors or pharmacies, often play on vaccine disinformation rhetoric that the vaccine is unsafe (Annex B).[19]
Far-right online groups are almost certainly enabling card forgery, further promoting anti-vax sentiment within those communities. Detailed instructions for creating forged cards have appeared on pro-Trump forums including Patriots.Win (formerly TheDonald.win), QAnon forums, and 4chan.[20] Instructions frequently reference templates of vaccination cards posted to state websites, which have since been taken down, reflecting the ease of producing false cards. As studies have shown that vaccine hesitancy is greatest among Republican men, the prevalence of easily-followed instructions to forge cards on far-right websites is highly likely to impede vaccination efforts.
Loosened restrictions on wearing masks for vaccinated individuals have almost certainly contributed to a rise in the distribution of fraudulent cards. On May 13, 2021, the CDC updated its guidance to reflect that vaccinated individuals no longer need to wear masks indoors or outdoors.[21] Google searches for terms such as “fake vaccine card” spiked following the announcement (Annex C). Consequently, as reopening efforts continue, unvaccinated individuals with false cards may choose not to wear masks, contributing to the continued spread of the COVID-19 virus.
Disruptions in the COVID-19 Vaccine Supply Chain
Manufacturing issues at the Emergent BioSolutions plant in Baltimore, Maryland producing doses of the Johnson & Johnson COVID-19 vaccine almost certainly impacted the rate of vaccinations, both domestically and abroad. On March 31, 2021, sources reported that the plant ruined up to 15 million doses of the vaccine, mixing up ingredients between the Johnson & Johnson vaccine and the AstraZeneca COVID-19 vaccine, which is not available in the US; a week later, it was reported than an additional 62 million doses would have to be checked.[22] On May 19, 2021, Emergent BioSolutions Robert G. Kramer stated in a hearing before the US House of Representatives that 100 million doses were on hold because of possible contamination issues.[23]
Previously, Johnson & Johnson doses were produced in the Netherlands; the Emergent BioSolutions plant was set to take over production for the US, but the FDA halted production on April 16. As a result of these supply issues, Politico reported that states did not receive any Johnson & Johnson doses during the week of May 17.[24] Groups such as rural communities, student populations, or the elderly — to whom the single-dose Johnson & Johnson vaccines were specially allocated — may be disproportionately affected by the continued issues with production. In addition, other countries receiving the Johnson & Johnson vaccine, including Canada, South Africa, and EU countries, have been significantly affected.[25] While the US has been able to fall back on its supplies of the two-dose Pfizer-BioNTech and Moderna vaccines, Canada and South Africa face more significant supply issues and are holding back doses produced in Baltimore.
This mix-up in the vaccine formulation is also likely to encourage vaccine hesitancy. Much of anti-vax rhetoric and disinformation centers around the idea that the COVID-19 vaccine is not safe. In April 2021, the Johnson & Johnson vaccine was briefly suspended over reports of thrombosis, a rare type of blood clot.[26] Increased media coverage of possible (but rare) side effects and manufacturing issues may further fears or confirm biases that COVID-19 vaccines are rushed or unsafe, leading to further reluctance to be vaccinated.
There is also the security risk associated with hacking incidents, targeting companies that have been tasked with distributing the COVID-19 vaccine. According to IBM Security, hackers have attempted to access sensitive information about the vaccine's ‘cold chain’ distribution system starting last year, with phishing attacks targeting 44 companies in 14 countries across Europe, North and South America, and Asia.[27] Hacking victims have included high-ranking executives at a petrochemical company, a solar energy manufacturer, several IT companies, and a department at the European Commission. It is currently unclear whether or not these hacking attempts were successful at breaching systems and accessing sensitive information. Additionally, it is currently unknown who the actor behind the attack was, however, IBM had originally stated that the precision of the operation signaled "the potential hallmarks of nation-state tradecraft", suggesting that the attack may have been orchestrated by a state actor.[28] Although it is unlikely that these previous incidents were successful in their attempts at accessing sensitive information or disrupting vaccine distribution, it is also likely that such incidents will continue to occur which may result in hackers being able to access sensitive information or disrupting vaccine distribution.
Alternative Assessment
There is also ample evidence to suggest that the vaccine rollout has so far been largely successful throughout the US and that incidents such as disinformation campaigns, fake vaccination cards, and hacking have not yet had any significant impact. According to the US Coronavirus vaccine tracker, at least 49% of the population has received at least one dose of the vaccine, while 38% of the population has been fully vaccinated as of May 21, 2021.[29] This is a much higher percentage of the population than most other countries, including many other developed countries. The Kaiser Family Foundation has noted that people from all demographics and regions of the US are looking to get vaccinated as soon as possible, with reported public intention to get vaccinated consistently increasing, rising to 61 percent in March from 55 percent in February.[30] Additionally, nearly 88% of college students have reported that they plan to get the COVID-19 vaccine as soon as they are able, and over 7 in 10 students said they think that the vaccine should be required for college students.[31] Because of this, there are strong indications that there may be an overdemand for vaccines that will not be met by the current supply, which may indirectly have a negative impact on the vaccine rollout and challenge the country's ability to reach herd immunity. Therefore, in this scenario, a portion of the population choosing not to get vaccinated may alleviate the overdemand for vaccines, which will help to allow supply to keep pace and ultimately allow the US to reach herd immunity more quickly than it otherwise may have.
Future Implications
There are several future security implications regarding the US vaccine rollout and pandemic recovery initiatives that are likely to emerge as a result of the aforementioned issues. This includes the likelihood of future anti-vaccination protests that may disrupt vaccine administration, serve to legitimize anti-vax groups and conspiracies, and encourage vaccine hesitancy among the population. As well as the likelihood of lawsuits directed at universities and workplaces that require vaccinations, questioning the legality of private institutions mandating vaccines may also have a negative impact on the vaccine rollout. Online misinformation, conspiracy theories, and other anti-vaccine sentiments posted by fringe anti-vax groups or far-right groups such as QAnon are also very likely to continue and to affect public perception of the vaccine. These threats are likely to require responses from local, state, and federal government in order to protect vaccination sites, and support universities and businesses that enforce mandatory vaccinations for students and employees.
Additionally, forged vaccinated cards, disruption to the vaccine supply chain, and incidents of hacking are all likely to lead to implications regarding the US vaccine rollout and pandemic recovery initiatives. The distribution of fake vaccination cards, especially as authorities lift masking requirements, is highly likely to persist and slow recovery efforts. Disruptions to the vaccine supply chain, especially the Johnson & Johnson single-dose vaccine, have almost certainly affected the rate of vaccinations both in the US and abroad, and negative media coverage is likely to encourage vaccine hesitancy. Hacking attempts are likely to continue throughout the vaccine rollout, and may have negative impacts such as leaking of sensitive information on vaccine distribution. These hacking attempts are at least somewhat likely to have been orchestrated by a state actor, most likely an adversary state to the US such as Russia, China, or Iran. This is likely to lead to the federal government increasing its cybersecurity apparatus regarding COVID-19 vaccine distribution to prevent such incidents from occurring.
CTG Efforts
The NORTHCOM Team at the Counterterrorism Group (CTG) is working continually to detect and monitor any emerging threat or ongoing developments related to the national distribution of vaccines and pandemic recovery initiatives. Our team is also working to develop relevant analysis on the nature of the threats posed to the national distribution of vaccines and pandemic recovery initiatives. Additionally, the NORTHCOM Team is working to develop relevant analysis on strategies that can be employed to deter and ultimately defeat the threats posed to the national distribution of vaccines and pandemic recovery initiatives. In doing so, our team is prepared to work with other CTG Teams or outside sources to formulate relevant and well-informed analyses.
Annex A-C
A.
Forged COVID-19 vaccination cards distributed at an anti-vax rally in Hartford, CT[32]
B.
Screenshots from Telegram of fake COVID-19 vaccination card sellers[33]
C.
Google Trends analytics for search terms “fake vaccine card” (blue), “fake covid card” (red), “fake covid vaccine card” (red), peaking on May 13, 2021[34]
________________________________________________________________________ The Counterterrorism Group (CTG)
[1] CDC COVID-19 Vaccination Card indicating first of two injections from Sumter County, Florida by Whoisjohngalt licensed under Creative Commons
[2] Interim Public Health Recommendations for Fully Vaccinated People, CDC, May 2021, https://www.cdc.gov/coronavirus/2019-ncov/vaccines/fully-vaccinated-guidance.html
[3] COVID-19 Vaccinations in the United States, CDC, May 2021, https://covid.cdc.gov/covid-data-tracker/#vaccinations
[4] Small crowd protests outside Dodger Stadium vaccination site, Los Angeles Times, February 2021, https://www.latimes.com/california/story/2021-02-27/anti-vaccination-protest-dodger-stadium
[5] Anti-vaccination activists a growing force at US coronavirus protests, Independent, May 2020, https://www.independent.co.uk/news/world/americas/coronavirus-us-anti-vaccination-activists-protests-a9496376.html
[6] Students protest mandatory Covid vaccinations at colleges, CNBC, May 2021, https://www.cnbc.com/2021/05/19/students-protest-mandatory-covid-vaccinations-at-colleges.html
[7] Ibid.
[8] Can Employers Legally Mandate The COVID Vaccine To Return To Work?, Forbes, March 2021, https://www.forbes.com/sites/quora/2021/03/22/can-employers-legally-mandate-the-covid-vaccine-to-return-to-work/?sh=177fdd5e42d1
[9] Employers grapple with tough new question: Can they demand workers get a COVID-19 vaccine?, ABC News, March 2021 https://abcnews.go.com/US/employers-grapple-tough-question-demand-workers-covid-19/story?id=76282417
[10] Can Employers Legally Mandate The COVID Vaccine To Return To Work?, Forbes, March 2021, https://www.forbes.com/sites/quora/2021/03/22/can-employers-legally-mandate-the-covid-vaccine-to-return-to-work/?sh=177fdd5e42d1
[11] Far-Right Extremists Move From ‘Stop the Steal’ to Stop the Vaccine, New York Times, March 2021, https://www.nytimes.com/2021/03/26/us/far-right-extremism-anti-vaccine.html
[12] You’ve been vaccinated. So what should you do with your vaccine card?, CBS News, April 2021, https://www.cbsnews.com/news/covid-19-vaccine-record-card-cdc-2021-04-21/
[13] Pro-Trump web forums are abuzz with directions to forge Covid vaccine cards, NBC News, April 2021, https://www.nbcnews.com/tech/tech-news/covid-vaccination-card-fraud-prompts-cdc-action-rcna802
[14] Excelsior Pass, New York State, May 2021, https://covid19vaccine.health.ny.gov/excelsior-pass
[15] Pro-Trump web forums are abuzz with directions to forge Covid vaccine cards, NBC News, April 2021, https://www.nbcnews.com/tech/tech-news/covid-vaccination-card-fraud-prompts-cdc-action-rcna802
[16] State Capitol police seize fake COVID vaccine cards at anti-vaccine rally, The Connecticut Post, April 2021, https://www.ctpost.com/news/article/CT-state-capitol-police-seize-fake-COVID-vaccine-16133426.php
[17] Fake Vaccine Cards: Warnings Issued as CDC Guidelines Change, NBC 5 Chicago, May 2021, https://www.nbcchicago.com/news/local/fake-vaccine-cards-warnings-issued-as-cdc-guidelines-change/2516087/
[18] Ibid.
[19] Ibid.
[20] Pro-Trump web forums are abuzz with directions to forge Covid vaccine cards, NBC News, April 2021, https://www.nbcnews.com/tech/tech-news/covid-vaccination-card-fraud-prompts-cdc-action-rcna802
[21] Interim Public Health Recommendations for Fully Vaccinated People, CDC, May 2021, https://www.cdc.gov/coronavirus/2019-ncov/vaccines/fully-vaccinated-guidance.html
[22] U.S. Bet Big on Covid Vaccine Manufacturer Even as Problems Mounted, New York Times, April 2021, https://www.nytimes.com/2021/04/06/us/covid-vaccines-emergent-biosolutions.html
[23] 100 million doses of Johnson & Johnson’s vaccine need to be checked for contamination and may need to be thrown out, Business Insider, May 2021, https://www.businessinsider.com/jj-doses-from-baltimore-plant-need-checked-for-contamination-2021-5
[24] States won’t get Johnson & Johnson vaccines next week, Politico, May 2021, https://www.politico.com/news/2021/05/11/states-johnson-johnson-vaccine-487070
[25] Baltimore Vaccine Plant’s Troubles Ripple Across 3 Continents, New York Times, May 2021, https://www.nytimes.com/2021/05/06/world/baltimore-vaccine-countries.html
[26] FDA and CDC Lift Recommended Pause on Johnson & Johnson (Janssen) COVID-19 Vaccine Use Following Thorough Safety Review, FDA, April 2021, https://www.fda.gov/news-events/press-announcements/fda-and-cdc-lift-recommended-pause-johnson-johnson-janssen-covid-19-vaccine-use-following-thorough
[27] Hackers are attacking the COVID-19 vaccine supply chain, CBS News, April 2021, https://www.cbsnews.com/news/covid-19-vaccine-hackers-supply-chain/
[28] Hackers Targeting COVID-19 Vaccine Supply Chain, IBM Warns, IndustryWeek, December 2020, https://www.industryweek.com/covid19/article/21149492/hackers-targeting-covid19-vaccine-supply-chain-ibm-warns
[29] What's the nation's progress on vaccinations?, USA Facts, May 2021, https://usafacts.org/visualizations/covid-vaccine-tracker-states/
[30] Experts warn US may soon reach 'tipping point' on vaccine demand, The Hill, April 2021, https://thehill.com/changing-america/549670-experts-warn-us-may-soon-reach-tipping-point-on-vaccine-demand
[31] College Students on the COVID-19 Vaccines, College Finance, April 2021, https://collegefinance.com/covid-19/college-students-on-the-covid-19-vaccine
[32] “Fake vax cards on east side of Capitol amid smattering of religious and personal freedom signs.”, Julia Bergman on Twitter, April 2021, https://twitter.com/JuliaSBergman/status/1387118868171272192
[33] I-Team: Black Market for Fake Vaccine Cards Migrates to Encrypted Social Media, NBC 4 New York, May 2021, https://www.nbcnewyork.com/investigations/i-team-black-market-for-fake-vaccine-cards-migrates-to-encrypted-social-media/3036956/
[34] Data Source: Google Trends, Google, May 2021, https://www.google.com/trends