Government Operations Committee on Nov. 14th, 2022

[The Chair, Conservative, Kelly McCauley]

I'm afraid that's your time, Mr. Housefather. We'll have to get to that in your next round.

Go ahead, Mrs. Vignola, please.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Thank you very much, Mr. Chair.

Ms. O'Gorman, you responded to my colleague that you didn't have any information about the subcontractors who worked on ArriveCAN. The government has refused to identify the subcontractors for the media, citing security concerns.

If you don't know who these subcontractors are, how could you possibly ensure that they met all the security criteria required to work on an app like ArriveCAN, which collects a lot of personal information?

[Erin O'Gorman]

I will defer to my colleague from PSPC, who would have the details of those contracts in terms of the work that they performed.

[Michael Mills]

Mr. Chair, I would like to start by making a distinguishment between subcontracts and the professional services firm. In most cases, these were professional IT services firms. The subcontracts in this case are—

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

I'm sorry to interrupt you, Mr. Mills.

The volume of the interpretation is exceedingly low. I will turn up the volume to the max and turn it down later.

Please continue.

[Michael Mills]

I'll start over.

I would like to distinguish between a case with a subcontractor and a professional services firm. These were professional services firms that we are talking about, subcontractor resources who are essentially employees. Therefore, the information that we have is personal information around the employees that JDC Strategies and other companies engaged to provide the IT resources for the project.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

I'm not sure—

[Michael Mills]

The relationship contractually is with the company. We maintain that relation, but the relation on the resources is maintained with the company.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

My question remains.

You know the company that hired the subcontractors, but you don't know the subcontractors. However, they are developing an app that includes exceedingly personal information not only about Canadians, but also about people abroad.

How do you ensure that these individuals have the security clearance to do that when you don't know who they are?

[Michael Mills]

Mr. Chair, I'll turn to my colleague, Ron Cormier, to talk about the security checks we do on the employees who work for these firms.

[Ron Cormier, Director General, Business and Technology Solutions Sector, Department of Public Works and Government Services]

Thanks, Mr. Chair.

PSPC is familiar with all of the contractors that we have arrangements with. For confidentiality reasons, the Government of Canada doesn't disclose the names of companies that have worked as subcontractors for one of its suppliers, as it is considered third party information. Within the IT industry, it's customary for firms to subcontract work or if Canada doesn't have a direct contract relationship with those subcontractors.

For an IT professional services contract with personal security requirements, Canada does verify the security clearance of all individual resources proposed by the contractor. Each of them gets an individual security clearance check, no different from any other employee or contractor working on a government priority.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Thank you.

With respect to the ArriveCAN app, then, I understand that the departments did not necessarily talk to each other about the subcontractors.

Kristina Casey of Shared Services Canada, the app had some significant failures that required almost constant adjustments. One of the failures was forcing people into quarantine when they met all the conditions to not be quarantined.

In your opinion, how much did these errors cost Quebec's and Canada's economy and productivity? I'm thinking in particular of the tourists who were unable to spend their money where they wanted to spend it, and of all those who were unable to go to work. Did you include those losses when calculating the real cost of the app?

[Kristina Casey]

Thank you for your question.

Unfortunately, I can't comment on the impact on the economy, or issues related to the app, because those are the department's responsibilities. I will therefore ask my colleagues from the Canada Border Services Agency to respond.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

All right. Thank you.

[Ted Gallivan, Executive Vice-President, Canada Border Services Agency]

The agency didn't detect the error because it didn't test the product. It took us a few days to find the error, and then we rectified the situation.

That doesn't erase the harm done to the 10,000 Canadians affected, which is completely unacceptable. However, given that 30 million travellers have used the app, those affected by the error are an exception.

This doesn't preclude the fact that it was completely unacceptable that the agency did not find this error before the app was used by the public.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

In terms of productivity, approximately how much did that exception cost?

[Ted Gallivan]

Of the 30 million people who used the app, 10,000 individuals were mistakenly asked to remain in quarantine.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Ms. Casey, Amanda Clarke of Carleton University sent us a brief entitled A Guide to Reforming Information Technology Procurement in the Government of Canada. Did you receive it?

[Kristina Casey]

No.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

That's unfortunate.

The brief issues several very worthwhile recommendations, based in part on experiences with information technology procurement abroad. One of the recommendations is to remove the bilingualism requirement for IT staff, to expand the available talent pool.

I'd like to hear your thoughts on that recommendation. Would you support it? Also, what would acting on a recommendation like this mean for francophones?

[Kristina Casey]

I will respond in English.

[The Chair, Conservative, Kelly McCauley]

I'm afraid I have to interrupt because we're out of time. I gave you a bit of extra time for the translation, Mrs. Vignola.

Perhaps you could provide that to the committee in writing.

We have Mr. Johns for six minutes, please.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Thank you.

First, I want to start by thanking you for attending and for your important work as Canada navigated the pandemic. It's greatly appreciated.

The point is to get to transparency here so that processes can be improved.

I'll start with Ms. O'Gorman. Perhaps you can help me. We heard at an earlier meeting with the national president of the Customs and Immigration Union that frontline officers were never consulted on the development of the app or any of its more than 70 updates. We also heard that because of the app, officers had to act as de facto “IT consultants”. This added to the strain of officers who were already experiencing understaffing due to previous cuts from previous governments.

Can you explain why officers working on the front line weren't consulted at any stage?

[Erin O'Gorman]

When ArriveCAN was created, it was done within a month. Regrettably, there was no consultation, and that is not how we would typically roll out something new—new technology in the agency. That's not how we would typically operate.

I will say that BSOs, as they used ArriveCAN, did provide feedback on how it was working. That feedback was taken into account as updates were done and to our operational guidance. Absolutely, the feedback that we received from individual BSOs was much appreciated and highly valued. And—

[Gord Johns, NDP, Courtenay—Alberni, BC]

We're just not hearing that from the union. We're hearing that their workers weren't consulted. They're on the front line dealing with that every day.