Information & Ethics Committee on Dec. 14th, 2022

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

You offer advisory services. Can you give me a very brief, 15-second example of what one of those advisory services might be?

[Nicole Foster]

I can try to give you a better characterization of how that work happens. Our proserve team, to use our internal language, never has hands on keyboards. We don't do the kind of IT management services that perhaps might be more common with other types of consultants. The advisory services are really around specific architecting of AWS services within the AWS cloud environment. Those are built in a development environment. Then the implementation or the operationalization of that is done directly by the customer.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

I have the same question about the number of advisory or proserve services AWS provides for the Government of Canada as a whole. You have given an indication of what that answer might look like.

I have a few more questions. I'd like to circle back to them in my next round. I have about 55 seconds left.

There's a figure—you said $4.29 million. Would cloud services, advisory services or proserve, contact centres and all the work done through those different lines of business equal a number equal to or greater than the $4.29 million?

[Nicole Foster]

Do you mean on ArriveCAN?

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Yes, I mean on ArriveCAN.

[Nicole Foster]

I don't know about the contact centre. I don't believe it would include any contact centre services related to.... I'm not even sure we did contact centre.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

I have 10 seconds left. It's possible that if there were contact centre services, those would not be included in the $4.29 million.

[Nicole Foster]

That's correct. Those may have been under a different statement of work. I'm not sure that we provided contact centre services for ArriveCAN.

[The Chair, Conservative, John Brassard]

Thank you, Ms. Foster, and thank you, Mr. Barrett.

I now have Ms. Khalid for six minutes.

Go ahead, Ms. Khalid.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you very much, Chair, and thank you, Ms. Foster, for being here today.

I'll start by asking something in perhaps a more contextual, broad-based sense. ArriveCAN is an app we brought in during a global pandemic when we were trying to mitigate health risks to Canadians. Can you walk us through the privacy implications for people who downloaded the app? Was any data hijacked or hacked into? What precautions were taken at AWS to mitigate against any of those privacy concerns?

[Nicole Foster]

The role AWS played was less around the privacy implications in terms of the governance of data and really more around the security of the environment. The work we did revolved around ensuring that....

We didn't actually build the app. The app is really the tip of the iceberg or the part that is really the user interface of ArriveCAN. There are a whole bunch of things that go on underneath the app that ensure not only that it operates securely but also that different systems are able to work together securely, so you have that simplicity of the user interface in the app.

The role AWS plays is really in securing the environment of the cloud. Then we provided some guidance to the Government of Canada on how to secure itself within that environment.

I have no knowledge of any breaches to our environment related to ArriveCAN.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Do you know of any breaches that may have happened with this app, with respect to you or otherwise?

[Nicole Foster]

As far as I know there were no breaches.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Tell me—I understand this, but I'm asking just for the benefit of Canadians: What is Shared Services Canada, and what are protected B documents?

[Nicole Foster]

Shared Services Canada is the central.... It's sort of a procurement agency, but not because it lives on its own within Public Services and Procurement Canada. However, it is the arm of government that is used to supply IT services to line departments, including cloud computing services.

The second part of your question was about protected B documents. Protected B or medium-security data is a data classification system. Our services, for the purposes of the cloud framework agreement, were evaluated as to whether or not they provided sufficient security guardrails for that level of classified data.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thanks for that.

We've heard a lot of rhetoric about hypothetical bad actors and potential risks to Canadians, their privacy and their reasonable expectations of privacy. What implications does that whole rhetoric have for the work you do?

[Nicole Foster]

We're here to support customers, whether they're the Government of Canada or a bank or another organization. We're here to help them protect their environment and provide security.

In terms of the governance of privacy, we help customers to make the right decisions on how they handle or control their own data. We're responsible for helping to provide the security and the environment in which to do that. We offer a number of tools and services that enable customers to do that.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

I'm sorry to put you on the spot, but given your role with AWS and understanding what the ArriveCAN app was, given the context of what it was brought in for, what are your views on how we could have done better with the ArriveCAN app? What were its shortcomings? What were the positive points of it, also?

[Nicole Foster]

Although I'm not appearing as an individual, I did travel with the app quite a bit. I have colleagues who are based in different regions around the world. We were certainly comparing notes about all the hoops we all had to jump through in order to facilitate international travel. There was some envy about the practicality of our ArriveCAN app in Canada.

As a user, I appreciated the practicality of it. I found it efficient. From that perspective, I think it was a good experience. From the perspective of what we were asked to deliver, I think the app was delivered securely and was reliable, in the sense that there was no inability for users to access it when they needed it.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Why do you think there's controversy around the use of this app?

[Nicole Foster]

I'm not sure, but I could speculate. I understand that it can be a challenge for some people to adapt to new technology and accessing technology if they're not accustomed to it. I appreciate that. I have parents, too, so I appreciate the challenge for them.

I also think it was a really stressful time to try to travel, in addition to navigating a new app, testing requirements and health concerns and anxieties. It was an anxious time.

[The Chair, Conservative, John Brassard]

You have 18 seconds left.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

I just want to thank you, then, for being here today. If there are any recommendations you would like to provide to our committee, please do so now.

[Nicole Foster]

I don't think I could be so presumptuous. Thank you.

[The Chair, Conservative, John Brassard]

Thank you, Ms. Khalid.

Go ahead, Mr. Villemure. You have six minutes.