Cyber experts warn Jamaica does not own Support Jamaica hurricane donation site

Cybersecurity specialists are warning that the Jamaican government does not own the Support Jamaica website used to gather donations for Hurricane Melissa survivors, after testimony from the Office of Disaster Preparedness and Emergency Management (ODPEM) sparked fresh questions over who controls donor information.

As of February 2026, roughly $1.4 billion had been raised through the platform. People who give online are asked for their names, email addresses, telephone numbers and card details. The site states that it was built and donated by the Amber Group.

Pressed on ownership during Parliament’s Public Accounts Committee, ODPEM Director General Commander Alvin Gayle said a private developer still holds the website. The firm built the platform and supplies it as a service, including one year of free use. He confirmed a formal agreement is now in place, but said no such pact existed in the early rush to develop and launch the site; ODPEM later insisted that a signed agreement covering the website and how it works be put in place.

One cybersecurity expert called the arrangement “a clear breach of best practice,” arguing the site “should have been handed over to the government” because it forms part of “the national infrastructure collecting money on behalf of the government.” From a security standpoint, the expert said, “it makes logical sense.”

A second specialist, while not claiming knowledge of the Amber Group contract, said the preferred model would see government developers build the application, run security tests to protect privacy, host it on the government’s private cloud or internal systems, and only then expose it publicly. That approach, the expert said, would mean “all security, all data, all hosting arrangements would be owned and managed by government.”

Commander Gayle told the committee that, under the privacy statement, both the developer and ODPEM can access the data. He said the data-protection agreement sets out how information must be scrubbed once the platform is no longer in use, with assurances that it will then be beyond the developer’s reach. There is, however, no automatic alert when the developer looks at the data. He added that an authorised ODPEM officer ought to be able to audit the site to see who viewed specific records.