Computing, IT & AI

CoWIN vaccination platform

2021Government of IndiaCoWINPan-Indian / unspecified

2021

A national digital platform that scheduled and certified over two billion COVID-19 vaccine doses.

Dated: 2021
As scholars put it: 2021
Originator: Government of India
Source text: CoWIN
Region: Pan-Indian / unspecified
Discipline: Computing, IT & AI
Evidence: Documented
Confidence: Medium
Verification: Reference-cited

One registry for a billion arms

CoWIN was the health ministry's answer to a logistics problem with no precedent: record every COVID-19 vaccine dose given in India, book appointments for well over a billion people, and hand each person proof they had been vaccinated. People registered with a mobile number and an identity document, up to four people per number, and booked a slot at a public or private centre; the vaccinator then logged each dose against that record ⁵.

The numbers grew fast. India passed one billion doses about nine months after its drive began, and by October 2021 the platform had issued its billionth vaccination certificate ⁴.

A certificate you can check with a phone

The certificates came from DIVOC, short for Digital Infrastructure for Vaccination Open Credentialing, an open-source stack built and maintained by the Bengaluru-based eGov Foundation and released under the permissive MIT licence ³⁴. Each certificate is a W3C-style verifiable credential holding the dose details and the holder's name, date of birth and gender. The data is sent to a central authority, signed with national keys and sent back to the centre for printing, or downloaded through a link sent by SMS ³.

Because the signature travels inside the QR code, anyone with the public key can check a certificate offline without calling a government server. DIVOC was also adopted by Sri Lanka and the Philippines, and eGov said it was working with more countries ³⁴.

The digital divide in the dock

In spring 2021 the government made online registration on CoWIN compulsory for people aged 18 to 44 and barred walk-ins for that group, citing vaccine scarcity and crowding ⁵. On 31 May 2021 a Supreme Court bench led by Justice D. Y. Chandrachud said a policy relying only on a digital portal "would be unable to meet its target of universal immunization owing to such a digital divide" ⁵.

The court cited survey figures that only about 24% of Indian households, and about 15% of rural ones, had internet access in 2017-18, and asked the government to make CoWIN available in regional languages, audit it for disability access, and allow on-site registration at some centres ⁵.

The 2023 leak allegation

On 12 June 2023, the Malayalam news portal The Fourth reported that a Telegram bot would return the name, date of birth and passport or Aadhaar number of a CoWIN registrant if fed their phone number; The News Minute tested it on several public figures and found the details accurate ⁶.

The health ministry called the breach reports "without any basis and mischievous in nature" and asked CERT-In, the national cyber-security agency, to investigate. The minister of state for IT, Rajeev Chandrasekhar, said the bot appeared to draw on a database of previously stolen data rather than a direct breach of CoWIN ⁶. Where that earlier data came from was not publicly settled, which is why the caveat on this entry remains.

Background

India began vaccinating against COVID-19 in January 2021 and needed one system to book appointments, record every dose and issue proof of vaccination for well over a billion people. CoWIN, run by the health ministry, did all three, with certificates generated by DIVOC, an open-source credentialing stack built by the eGov Foundation.

Significance

It showed that a national vaccination drive could run on a single digital registry at continental scale, issuing signed, QR-verifiable certificates for every dose. Its reliance on online booking also became a test case for the digital divide, and the Supreme Court pressed the government to open walk-in and offline routes.

Fair to say

A 2023 data-leak allegation raised privacy concerns.

Path to modern innovation

Part of India's digital public infrastructure.

Builds on

2010Aadhaar and the India Stack

Transmission

Offered as open-source to other countries.

References

1MoHFW