One day in mid-September 2021, Akash Jain, a 38-year-old contractor from Uttar Pradesh, was walking home after work when he received an SMS that left him aghast. The message — from Cowin, the Indian government’s platform for Covid-19 vaccination registration — said his mother, Suman Jain, had received a vaccine that day.
But Suman had died of Covid-19 two months ago. “I was taken aback by the message … A person who is dead is getting vaccinated, how exactly?” Jain said to Rest of World.
Shivam Shrivastava, a techie from Chhattisgarh, had a similar experience when he received a message indicating that his father had received the second dose of the vaccine on December 3, 2021 — six months after his death due to Covid-19.
In addition to the vaccine alerts sent to the relatives of the deceased, Rest of World spoke to 15 Indians who had not received a vaccine shot but did receive similar alerts and fake vaccination certificates over the last year.
India’s Covid-19 vaccination program has been lauded for being the world’s largest inoculation drive. The country has administered nearly 2.2 billion doses so far, and the Indian government takes great pride in this achievement. To reach such stellar figures — second only to China — the government held events like the “Maha Abhiyan” where reportedly 25 million Indians were inoculated on September 17, 2021 — Prime Minister Narendra Modi’s birthday. But Jain and Shrivastava’s experiences raise questions about the authenticity of these figures.
Media reports have attributed fake vaccination certificates to a possible technical glitch in the system, while the government has stated that these are due to rare data-entry errors.
But experts told Rest of World that these certificates are being processed intentionally, using people’s IDs without their consent in order to boost the official vaccination figures.
“The integrity of government data has become a major issue in India, across data sets,” Shivam Singh, an independent data analyst and researcher who worked on the ruling Bharatiya Janata Party’s election campaigns until 2018, told Rest of World. “This manifested in multiple places during [Covid-19], including death figures and vaccination numbers. Sadly, this also means that the reliability of tests and certificates from India is called into question globally. This should be of concern to us.”
“The integrity of government data has become a major issue in India, across data sets.”
The only way to receive a vaccine certificate in India is through the Cowin platform. When a person goes to receive a jab, the administrators at the health care facility verify or update their details on Cowin, along with their identity details, such as the government-issued, 12-digit identification number Aadhaar or the permanent account number issued by the Income Tax Department. A certificate is then available to download from Cowin within a couple of hours. The platform sends out an SMS to the number registered with the ID, confirming that the dose has been administered.
“There could be an error because of which this is happening,” Srinivas Kodali, a researcher with the Free Software Movement of India, told Rest of World. “If the guy who is feeding the numbers for vaccination by mistake dials a digit incorrectly, the certificate goes to another number, resulting in bogus vaccination.”
The government has acknowledged the “occasional, isolated case of inadvertent data entry error by vaccinator,” but has maintained that it is not a widespread problem and is easily reversible.
Meanwhile, researcher Singh doesn’t buy the narrative that it’s a glitch. “It’s difficult to imagine how it could be a technical glitch,” he said. “Unless the names and numbers of everyone in the country were pre-seeded into the Cowin database, how would the system even know to generate names of people who’ve already passed away to issue the certificates, or how would the system get the phone numbers? There really needs to be a more thorough explanation of how exactly such a glitch could occur, especially because it has serious implications not just for the vaccination drive, but also for data security and privacy.”
The Ministry of Health and Family Welfare did not respond to queries from Rest of World.
Those who receive false certificates find themselves in a tough situation: because Cowin shows that they have already been inoculated, they cannot get a vaccine. Although there is an option to revoke a vaccination status through the “Raise An Issue” option on the Cowin portal, the people interviewed for this story have had trouble changing their status even when they tried contacting Cowin directly.
Somnath, a radiographer in a private hospital in the Nellore district of Andhra Pradesh, could not get vaccinated in January 2021 when the government opened the first drive for health care and front-line workers. He had contracted Covid-19 in August 2020, and local regulations at the time meant that he would need to wait six months after testing negative to get the jab. But, to his surprise, on January 21, 2021, he received a vaccination certificate without actually getting a shot.
“I tested positive four months back and without crossing the mark of six months, nobody can take a vaccine. Then how was I administered one when I didn’t [even] show up?” Somnath, who requested anonymity because his employer does not permit him to speak to the media, told Rest of World.
“I received a successful vaccination message for the precautionary dose but at the time, I was not even in the district.”
Somnath spent several days trying to file a complaint with the authorities by calling the Cowin helpline number and government offices, but nothing worked. On March 22, 2021, he received another SMS, stating he had received a second dose of the vaccine. But Somnath was still having difficulty getting even the first dose. “This continued for the third time as well,” he told Rest of World. “I received a successful vaccination message for the precautionary dose but at the time, I was not even in the district. I was in Vizag [Visakhapatnam].” Somnath is still unvaccinated. “I am being denied because of the status of my current report [on Cowin]. It shows [that I am] fully vaccinated,” he said.
Poonam Kaushik, a 51-year-old Delhi-based lawyer, has been struggling to get the booster dose after she was issued a false vaccination certificate on July 20. “My friend had a similar encounter … I wrote several emails to the Ministry of Health. I even posted a tweet tagging [the] authorities concerned for a clarification,” she told Rest of World. Kaushik has written to India’s health minister, Delhi’s chief minister, the Delhi chief secretary, and Delhi’s principal health secretary, but has not received any help yet.
On July 20, Kaushik shared a copy of the fake vaccine certificate on Twitter. In a separate tweet, she said that “a well-planned gang must be … taking undue advantage of [Aadhaar] card and thereby issuing fake certificate of dose administration.”
On September 18, Bengaluru-based Manav Singh, 29, who works as a product designer at an IT firm, received an SMS about a successful vaccination for someone else. “Dear Ammathayi, you have successfully been vaccinated with your 1st dose,” the SMS read. This was not the first time Singh witnessed a discrepancy in the vaccination program. His mother, who lives in Chhattisgarh’s Raipur city, had struggled to get vaccinated because Cowin showed she had already been inoculated. “The health care staff [at the hospital] said that the vaccine had already been given under my mother’s name,” Singh told Rest of World. “They said that my mother could take a vaccine using another [person’s] ID proof.” After some commotion and fuss, his mother was vaccinated under her own name.
“This incident kept me thinking about the possible data scam happening under the umbrella of ‘vaccination drive,’” Singh said. “This is the government’s incompetency and nothing else. There are so many people in my acquaintance who have received such messages. The [vaccination] numbers given by this regime seem to be a scam.”
The levity with which personal data is being collected and used for the vaccination program is a serious cause for concern, Kodali said. “Places like hotels, lounges, and [housing] societies maintain handwritten registers for their guests and run on manual entries. Just imagine how easy it would be to access data from there,” he said, explaining how easily fake IDs could be sourced to generate vaccination certificates. “It would also be very easy for a person who is protective of their data to give false information there.”
Kodali believes one reason for fake certificates being issued could be the tremendous pressure that grassroots volunteers face from state and central governments to contribute to the startling national figures. “They focus more on the numbers and less on the efficiency of the campaign,” Kodali said. “The government has a monthly target and sends messages to any and everybody just to meet their target,” Shrivastava’s mother told Rest of World. In the early months of the vaccination drive, the Indian government had set goals for how many people would be inoculated in a certain period of time. Now, however, there are no such targets known publicly.
