Editorial | ODPEM’s Hurricane Melissa-size spin

The clarification by the Office of Disaster Preparedness and Emergency Management (ODPEM) to clarify the question of ownership of, and access to, the Support Jamaica website is in need of clarification. What was presented is obfuscatory.

The real question is not about the noble intentions of the Amber Group, the website’s developer and host, who “donated” the platform to the Jamaican government. Neither has there been a claim, insofar as this newspaper is aware, that Amber has “received, held or controlled funds donated through Support Jamaica”.

The issue is whether Amber has, or had, access to people’s private information, and, if that is or was so, if the appropriate safeguards are, or were, in place to protect people’s data and, therefore, their privacy.

There is a concern, too, that it was a private company that developed, and gifted, the site to the government, rather than Support Jamaica being a product of the State’s information technology provider, eGov Jamaica.

CONFUSED

Further, assuming that he did, people are confused at how ODPEM’s Director General, Commander Alvin Gayle, got the ownership of the website so wrong during his recent appearance before Parliament’s Public Accounts Committee (PAC).

Additionally, it is perplexing that ODPEM’s board has only now directed that the process begin “immediately” to “complete the migration” of Support Jamaica from Amber’s hosting environment to direct government control. After all, concerns about Support Jamaica oversight and the integrity of information on it were flagged by a special report by the Auditor General in early May on the IT aspects of the government’s response to Hurricane Melissa last October. Even before that document was released, ODPEM would have known of the audit findings and been given an opportunity to respond to them.

As the ODPEM’s statement alluded to, an earlier iteration of the Support Jamaica website was developed by Amber for use by the government after Hurricane Beryl in 2024. When Hurricane Melissa, a Category 5 storm, struck, the site was repurposed to meet the demands of an event of Melissa’ magnitude.

“Amber provided the platform free of charge as a philanthropic contribution to national recovery, not as a paid contract, and has continued to provide hosting, software maintenance and technical support at its own cost,” Trudy Deans, ODPEM’s chair, said in last week’s statement.

That, basically, is true, but for a wee bit of context and detail provided by the auditor general, Pamela Monroe Ellis, in her report.

That report said: “The government was gifted the functionality of the website, while technical aspects of the design, coding and intellectual property to the source codes and security requirements were retained by the developer. While supportjamaica.gov.jm was launched on 2025 October 28, ODPEM’s relationship with the private developer was not formalised until two months later in December 2025, when the Deed of Agreement was signed by both parties.”

When Commander Gayle was asked about the website’s ownership at the PAC, he responded: “The private developer still owns the website. They develop the website and then offer us service.”

ACCESS TO DONOR INFORMATION

On the question of who had access to donor information, the ODPEM executive director explained that “the actual developers of the website will have access to the backend because they still own the website”.

“So, their approved staff would also have some access to the website,” he added.

That, on its face, seems a rational and reasonable assertion for the host and technical manager of a website.

But that is not the issue, or why it was allowed to persist for so long, that was specifically addressed by the ODPEM board, via Chairperson Deans. Instead, they explained that “no private company can own, register or hold a government domain” and stressed that “transactions are processed through ODPEM’s designated financial institution and payment gateway for settlement into official Government of Jamaica accounts”. It seems superfluous for ODPEM that Amber’s role as technology developer and hosting provider “does not give it access to or control over those accounts”.

Indeed, as the auditor general report noted, the platform was designed to accept “online donations and facilitate relief effort through, incident reports and the communication of a national needs list” and also the uploading of all documents that would be required by the Jamaica Customs Agency for the clearance of goods.

However, at the time of the audit, Ms Monroe Ellis’ team found significant information security gaps in the management of the site - from the absence at ODPEM of an information systems user policy to who and how access was provided to Support Jamaica, whether internally or at other government ministries, departments and agencies (MDAs).

There was also little or no compliance with Jamaica’s Data Protection Act (JDPA), either internally at ODPEM or between ODPEM and Amber, although the parties, after a two-month delay, signed a data protection agreement.

Said the auditor general: “According to the agreement the (data) processor (Amber) implemented security measures in compliance with the JDPA (seventh data protection standard), GDPR (general data protection regulation) Article 32 and SOC 2 (Systems Organisation Controls) trust services criteria. However, there is no evidence to demonstrate that verified the private developer’s compliance with these requests. ODPEM was unable to confirm that the relevant technical and organisational and security measures were in place to secure personal and health data collected subsequent to the launch of the website.”

These gaps were publicly highlighted in May. They, and any weaknesses in the control of citizens’ data held by the government, must be fixed now.