Government Operations Committee on Nov. 14th, 2022

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Thanks, Chair.

I want to clarify that, while I appreciate that the CBSA has undertaken to provide information about what assurances were taken with respect to the waiving of security clearances, I'd like to know if a single minister would have the signing authority or be the one to authorize that kind of action?

[Erin O'Gorman]

No.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Would the minister be aware? Would it be done through order in council?

[Erin O'Gorman]

It would not be done through order in council, and it would not be a decision at the ministerial level.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Would it be done at the director or deputy director level?

[Erin O'Gorman]

We'll have to get back on the process for signing off on that.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Okay. It's concerning. I'm revisiting it because we know that a passport in progress doesn't get you on the plane, but a security clearance in progress might get you access to the biometric, personal and health information of the more than 8,000,000 people who downloaded the app.

For example, I downloaded the app and put in the passport and personal information for my family, so there are more than just 8,000,000 people. We're talking about tens of millions of folks whose information is jeopardized by this type of thing.

On process, PSPC would not be the department responsible for the waiving of the security clearance. Is that correct?

[Ron Cormier]

That's correct.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Okay, but previously the CBSA said that they don't know who the subcontractors are. If PSPC is responsible for knowing who the subcontractors are, how could the CBSA waive the security clearances for companies that they don't know are doing work or are prospectively going to do work?

[Ted Gallivan]

The first point, as Ms. Belanger said previously, is that those contracted resources didn't have access to the data, full stop. I appreciate the concern with clearances.

The second point I would make is that it sounds like this is a scenario where somebody was allowed to begin work pending the review. I think, as we get back to you with information, that it could have a period of days. We should know now whether or not they passed the security check.

The first thing that should set your mind at ease is that these contracted resources did not have access to the data, full stop. They built the tool. Second, what was the period of time for this pending...or waiver? It could be days or weeks, and we would have known the answer by now, whether or not they passed the clearance.

I think that coming back to the committee with that information should address the concern.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

With all due respect, having the opportunity to do work on it versus intentionally being given access to the personal information of Canadians are two separate things. A bad actor who has not been cleared by our intelligence services could build in future access. That's why it's so important that we have assurances about what risk mitigation was done and whether there have been any breaches. This is really important.

My mind is very much not at ease. We don't know how many times security clearance was waived. We don't know for whom security clearance was waived and we don't know if those folks who had it waived were ever even approved.

There are a lot of ways that foreign state actors can test our systems and our processes, and this looks like a great opportunity for them to do that. It's important to note that this information is not information that was exchanged between government officials. It was disclosed to a public individual—not a member of government—that they could work on our information management systems without having the clearance.

I'm not sure if you want to comment on that with my remaining time. My mind is very much not at ease because although not intentional, I think we're open to a lot of risk. The risk can't be overstated.

[Ted Gallivan]

I think our goal is to provide factual information. I think the concern that Canadians would have, which you're verbalizing here today, is really an important one.

There are overlapping controls, though. I mentioned the fact that developing the tool is different from having access to CBSA systems or people's data. Also, the fact is that this was tested by public servants—tested by an independent group who had been looking for those kinds of vulnerabilities.

Again, I think in the fullness of time, with ability to look at the specifics of the situation, we may be able to document a series of controls that would help assure Canadians that their information was protected.

Contractors building the tool didn't have access to the data. That tool was distinct from CBSA's systems, and then all products were tested before being released and put into production.

[The Chair, Conservative, Kelly McCauley]

That's time. Thank you very much.

We'll go to Mr. Jowhari, please, for five minutes.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Thank you, Mr. Chair, and thank you to all the witnesses.

I'm going to start with Ms. O'Gorman.

During this testimony, we heard about two purposes, at least, for ArriveCAN. We heard about advance declaration and we also heard about a public health tool. Can you give us an idea which one of these purposes came first and what the driver was for them?

[Erin O'Gorman]

The public health measures at the beginning of the pandemic were the absolute driver. It was the fact that the Public Health Agency was collecting the information it needed from incoming travellers in paper and was not able to process that paper in a timely way to get provinces and territories the information they needed. It was for enforcement and compliance to be undertaken by the Public Health Agency.

This was very quickly discovered, which is why, the same month that the pandemic was declared, the request came to CBSA to develop an application that could digitize those forms.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Thank you.

There was no base ever for some sort of ArriveCAN before. It came in March and CBSA said, “Let's launch ArriveCAN.”

[Erin O'Gorman]

That's correct.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Okay. That's fair enough.

I'll go quickly to Mr. Moor.

I know my colleagues have confirmed this about a hundred times by now. The total cost of the initial application was $80,000. The subsequent cost was $8.8 million for development of nearly 70 updates, which relate to the 80 OICs. Is that correct?

[Jonathan Moor]

That is correct.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Okay.

Let's quickly go to Mr. Allison.

We talked about 80 OICs. For Canadians who might not be aware of what “OIC” stands for, can you tell us what it stands for and quickly give us an example of an OIC? We hear about 80 OICs and 70 requirements. Can you quickly give us a sense of what it is?

[Jennifer Lutfallah]

I'll take that question.

“OIC” stands for “order in council”. It was the instrument that was used to put in place the proper authorities or requirements for the public health measures.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Those are basically public health requirements that were sent as the functionality that needed to be developed in ArriveCAN.

[Jennifer Lutfallah]

That's correct.

[Majid Jowhari, Liberal, Richmond Hill, ON]

That translated into about 70 changes.

[Jennifer Lutfallah]

Yes, it was 70 packages.