Government Operations Committee on Nov. 14th, 2022

[Erin O'Gorman]

I was just going to note that BSOs did help individual travellers fill out ArriveCAN, and that was greatly appreciated. Many of the 30 million users didn't need assistance from BSOs, but certainly I want to acknowledge that they did help travellers coming in by both land and the air.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Can you provide details of any estimates for developing, updating, maintaining and promoting the ArriveCAN app that were prepared using the Treasury Board's guide to cost estimating?

[Erin O'Gorman]

I missed the first part of that question.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Can you provide any details of any estimates for developing, updating, maintaining and promoting the ArriveCAN app that were prepared using the Treasury Board's guide to cost estimating? If you don't have any precise information readily available, would you say the cumulative costs of the app have exceeded what was estimated?

[Erin O'Gorman]

The ArriveCAN app wasn't undertaken as a project. It was developed quite quickly, and changes were made over the course of the pandemic as the health measures changed. There is a budget of $54 million until the end of this fiscal year, of which $41 million have been spent.

With regard to Treasury Board guidance on costing, it does relate to projects, but I will invite our CFO to talk about his costing approach for the ArriveCAN app.

[Jonathan Moor]

Thanks very much.

Initially, the ArriveCAN app was managed by the Public Health Agency, and they provided us $12.37 million in 2021-22 as part of a supplementary estimates (B) budget transfer. That was based on our forecasts for expenditure in 2021-22.

We received an additional $12.4 million via an IRCC-Treasury Board submission, which was given in supplementary estimates (C), and that was particularly around the PVC, the proof of vaccination certificate.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Mr. Allison, do you want to respond to that as well?

[Christopher Allison]

Certainly.

Overall, the Government of Canada spent $2.2 million in advertising to promote COVID-19 travel-related requirements.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Can you directly relate this answer to the Treasury Board's guide to cost estimating?

[Christopher Allison]

I'm not aware of exactly what was gone through with that.

[Erin O'Gorman]

I would say the costing of ArriveCAN was consistent with Treasury Board policies and guidance.

[Gord Johns, NDP, Courtenay—Alberni, BC]

What's the long-term plan with the ArriveCAN app? Can you talk about how much the app is expected to cost on an annual basis? You talked about it wrapping up at the end of the year. What analysis has been done to assess whether Canadians will be getting adequate value for money now that the app is voluntary?

[Erin O'Gorman]

We have moved from a mandatory app to a voluntary app. We have called for an advance declaration, which was formerly the paper E311, which people can now fill out voluntarily in advance of landing at, I think, up to five airports now. We're rolling it out across the country one airport at a time, with a view to eventually expanding it to the land border. Early reports are that it's the difference between taking 120 seconds at a kiosk and taking 80 seconds. We're tracking that time and usage.

We are currently spending $1.5 million in non-salary dollars to maintain the advance declaration portion, but I don't have the long-term budget for that. As we roll it out and as we take the lessons learned and work with our contractors, we're looking at doing a knowledge transfer to our employees to be able to maintain the app.

[The Chair, Conservative, Kelly McCauley]

Thanks, Mr. Johns.

We'll now go back to Mr. Barrett for five minutes.

Go ahead, please.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Thanks, Mr. Chair.

What level of security clearance is required for subcontractors to work on ArriveCAN?

[Ron Cormier]

Mr. Chair, that would depend on the nature of the work specified and the task authorization in the contract. It would vary from contract to contract, but it could be anywhere from “enhanced reliability” up to “secret”.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Would any of those requirements have been waived before subcontractors were allowed to work on the app?

[Ron Cormier]

Not to my knowledge.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Okay. So it would surprise you to know that an amendment was made to one of the RFPs—number 47419-198132—whereby the department said that subcontractors could work without security clearance in place.

[Ron Cormier]

Could you repeat that number, please?

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

It's 47419-198132. It was a response to a question with respect to security clearance. It indicated that work could commence and the subcontractor could start to work without security clearance in place.

Is that unusual for a subcontractor who's dealing with Canadians' personal information, private health information and biometric information?

[Ron Cormier]

Thanks for the question, Mr. Chair.

In effect, the waiving of the individual security clearance would be highly situationally dependent. Without the details of that particular task authorization, I can't speak to the specifics of why that might have been the case.

Generally speaking, how these professional services contacts are used and how the resources in them are employed is a business requirement that's established by the client departments we work with. I'm assuming this was a CBSA contract, but the specifics of why waiving that might be appropriate in a unique case would be operationally dependent and they would have to speak to that.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

It would be helpful for this committee to know why someone wanting to be a network analyst with what would normally require secret security clearance would then be able to work on information systems specifically with access to Canadians' personal information, private health information and biometric data, especially at a time when we're becoming increasingly aware of cyber-threats to our country.

I would look to the witness panel, if they can't provide us a fulsome answer today, to perhaps provide in writing or return to the committee with information on the frequency with which this is permitted and the potential risk that Canadians were exposed to as a result of this. As well, ultimately, who is the signing authority that can waive security clearance requirements?

[Kelly Belanger]

Mr. Chair, I'd like to clarify one thing.

I can't speak specifically to this case, but the contractors and consultants we used did not access the personal information. Only employees had access to the databases with any personal information. Those employees would have had the proper security clearance to do so.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Mr. Chair, my concern is that people who are developing it and have access to our systems can develop ways to access them after the time that their work is completed, particularly someone who doesn't have reliability status, secret clearance, top-secret clearance or any enhanced top-secret clearance and is dealing with the most sensitive information.

We don't know. We're hearing a lot about state actors from other countries who are interfering in our democracy here. We have people who are potentially working on our information management systems to develop an app that's specifically collecting Canadians' personal information and we don't know who they are. We don't know that they would ever receive security clearance, even if their application was in progress.

I can make an application and it could never be approved. If the only requirement to get workers is that you file the paperwork, I think the exposure for Canadians is quite serious.

Mr. Chair, how much time do I have left?