Thread by @zackwhittaker

New: In the latest #JamCOVID development, the Amber Group broke its silence to say absolutely nothing of value, and the Jamaican government continues to point fingers at everyone other than itself.

A thread. (1/)

https://twitter.com/JamaicaGleaner/status/1363520712091312129

A quick refresher: Amber Group runs Jamaica's JamCOVID website and app, but it left thousands of travelers' private data on an unprotected and exposed cloud server. Then the government lied about when it first knew about the security lapse. (2/)

https://twitter.com/zackwhittaker/status/1362483576160350215

Amber Group's @dushyant108 (whose tweets are now protected — unlike the cloud server, which wasn't) said:

"We are working together with the Government of Jamaica and independent entities to investigate the cause of this occurrence." (3/)

Amber Group still hasn't named the "independent entities" it claims to be working with. As such, we (nor can anyone else) can't confirm if this is accurate or truthful. Amber still won't say how this data exposure happened, and hasn't answered any of @jovanthony's questions. (4/)

The Jamaican government has also launched a criminal investigation into the incident. Instead of restoring trust and being transparent, the inquiry now appears to be on me, the journalist who reported the security lapse to the Jamaican authorities in the first place. (5/)

Per @matthewsamuda: "Having gone through the initial vulnerability, he would have seen metadata. If he wants to classify that as personal data that’s up to him. If he went further than that, then, that would [be] a breach of the Cybercrimes Act." (6/)

Here's a screenshot proving the data was exposed and public, and not breached through a vulnerability. Trend Micro "strongly recommends against using all these permissions" as this leaves your data wide open for everyone. (7/)

cloudconformity.com/knowledge-base…

Open S3 buckets are also accessible from the web browser. Literally from the address bar. By its logic, the Jamaican government would have to prosecute every person for accessing any public website, since that's... you know... how the World Wide Web works. (8/)

This comment from @matthewsamuda is troubling as it portrays Jamaica as hostile to journalists, and good-faith hackers and security researchers, whose jobs it is to find and help get security issues fixed. (9/)

If the Jamaican government prosecutes someone for accessing *public* data, you can't expect good-faith hackers, security researchers, or cybersecurity professionals to ever report a security issue or breach ever again. You can't have it both ways, @matthewsamuda.