Government expected to provide more info on JAMCOVID-19 site data breach

 

At least two cabinet ministers have indicated there will be a more fulsome response later on Thursday to the security lapse on the government’s JAMCOVID-19 website.

 

National Security Minister Dr. Horace Chang and Tourism Minister Edmund Bartlett told Radio Jamaica News the information would come following today's opening of parliament for the 2021/22 Fiscal Year.

 

The website and app built by the Amber Group stored immigration records and COVID-19 test results for hundreds of thousands of travelers who visited Jamaica in the last year.

 

US online newspaper TechCrunch says the cloud storage server storing those uploaded documents was left unprotected and without a password, and was publicly spilling out files onto the open web.

 

TechCrunch says the storage server, hosted on Amazon Web Services, was set to public. 

 

The newspaper says the data was secured after it contacted Amber Group's chief executive.

 

Professor of Computer Science specialising in computer security at the University of Technology, Sean Thorpe says there must be a proper investigation into the data breach relating to the JamCovid19 website.

 

“If there was no security by design in the code itself that supported the application being posted out there, then that’s a major issue because what it means is that people’s data will be compromised and the traffic of that data could be seen by anyone, more so if it is being hosted on any public servers or hosted in an environment for which there are no security credentials as we call it,” Prof. Thorpe told Radio Jamaica News.

 

He says it must be ascertained whether there was security in place but it was breached.