Kiwis keen on vaccination records trigger DDoS defences

Visitors keen to access the New Zealand My Vaccine Pass may have been frustrated in their attempt to download a record of their Covid-19 inoculations online due to automated denial of service attack mitigations.

My Vaccine Pass went live at 9am NZ time yesterday, with users almost immediately complaining that the site could not fulfil requests for records.

Speaking to the New Zealand Herald, the government's national digital services manager at the Ministry of Health, Michael Dreyer, said the onslaught of users wanting vaccination passes triggered DDoS defence mechanisms for the My Covid Record website.

My Covid Record, from which Kiwis can request My Vaccine Pass, runs on a mix of AWS and Microsoft Azure services, Dreyer said, adding that the site is now working well, and had processed some 200,000 My Vaccine passes.

In iTnews' testing today, the website still displayed the "too many requests" error message, however.

Users can request the My Vaccine Pass for use within New Zealand, an international travel vaccination certificate, and also view their Covid-19 shots on the site.

The pass can be added to Apple's iOS mobile Wallet, or Google Pay, and has a digitally signed QR code that can be scanned upon entry to venues.

My Vaccine Pass was developed by Spark New Zealand subsidiary Mattr, which will also build a verifier for the record.

The technical specifications for My Vaccines Pass are published on Github.

Businesses may require people to display their vaccination passes at sports, hospitality, arts and other events.