Evidence of meeting #38 for Government Operations and Estimates in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was app.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Erin O'Gorman  President, Canada Border Services Agency
Michael Mills  Assistant Deputy Minister, Procurement Branch, Department of Public Works and Government Services
Jennifer Lutfallah  Vice-President, Health Security and Regional Operations Branch, Public Health Agency of Canada
Kristina Casey  Assistant Deputy Minister, Citizen and Business Branch, Shared Services Canada
Christopher Allison  Director General, Data Management, Analysis And Innovation,Public Health Agency of Canada
Kelly Belanger  Deputy Chief Information Officer, Canada Border Services Agency
Jonathan Moor  Vice-President and Chief Financial Officer, Canada Border Services Agency
Ron Cormier  Director General, Business and Technology Solutions Sector, Department of Public Works and Government Services
Ted Gallivan  Executive Vice-President, Canada Border Services Agency

11:30 a.m.

President, Canada Border Services Agency

Erin O'Gorman

I was just going to note that BSOs did help individual travellers fill out ArriveCAN, and that was greatly appreciated. Many of the 30 million users didn't need assistance from BSOs, but certainly I want to acknowledge that they did help travellers coming in by both land and the air.

11:30 a.m.

NDP

Gord Johns NDP Courtenay—Alberni, BC

Can you provide details of any estimates for developing, updating, maintaining and promoting the ArriveCAN app that were prepared using the Treasury Board's guide to cost estimating?

11:30 a.m.

President, Canada Border Services Agency

Erin O'Gorman

I missed the first part of that question.

11:30 a.m.

NDP

Gord Johns NDP Courtenay—Alberni, BC

Can you provide any details of any estimates for developing, updating, maintaining and promoting the ArriveCAN app that were prepared using the Treasury Board's guide to cost estimating? If you don't have any precise information readily available, would you say the cumulative costs of the app have exceeded what was estimated?

11:30 a.m.

President, Canada Border Services Agency

Erin O'Gorman

The ArriveCAN app wasn't undertaken as a project. It was developed quite quickly, and changes were made over the course of the pandemic as the health measures changed. There is a budget of $54 million until the end of this fiscal year, of which $41 million have been spent.

With regard to Treasury Board guidance on costing, it does relate to projects, but I will invite our CFO to talk about his costing approach for the ArriveCAN app.

11:30 a.m.

Vice-President and Chief Financial Officer, Canada Border Services Agency

Jonathan Moor

Thanks very much.

Initially, the ArriveCAN app was managed by the Public Health Agency, and they provided us $12.37 million in 2021-22 as part of a supplementary estimates (B) budget transfer. That was based on our forecasts for expenditure in 2021-22.

We received an additional $12.4 million via an IRCC-Treasury Board submission, which was given in supplementary estimates (C), and that was particularly around the PVC, the proof of vaccination certificate.

11:30 a.m.

NDP

Gord Johns NDP Courtenay—Alberni, BC

Mr. Allison, do you want to respond to that as well?

11:30 a.m.

Director General, Data Management, Analysis And Innovation,Public Health Agency of Canada

Christopher Allison

Certainly.

Overall, the Government of Canada spent $2.2 million in advertising to promote COVID-19 travel-related requirements.

11:30 a.m.

NDP

Gord Johns NDP Courtenay—Alberni, BC

Can you directly relate this answer to the Treasury Board's guide to cost estimating?

11:30 a.m.

Director General, Data Management, Analysis And Innovation,Public Health Agency of Canada

Christopher Allison

I'm not aware of exactly what was gone through with that.

11:30 a.m.

President, Canada Border Services Agency

Erin O'Gorman

I would say the costing of ArriveCAN was consistent with Treasury Board policies and guidance.

11:30 a.m.

NDP

Gord Johns NDP Courtenay—Alberni, BC

What's the long-term plan with the ArriveCAN app? Can you talk about how much the app is expected to cost on an annual basis? You talked about it wrapping up at the end of the year. What analysis has been done to assess whether Canadians will be getting adequate value for money now that the app is voluntary?

11:30 a.m.

President, Canada Border Services Agency

Erin O'Gorman

We have moved from a mandatory app to a voluntary app. We have called for an advance declaration, which was formerly the paper E311, which people can now fill out voluntarily in advance of landing at, I think, up to five airports now. We're rolling it out across the country one airport at a time, with a view to eventually expanding it to the land border. Early reports are that it's the difference between taking 120 seconds at a kiosk and taking 80 seconds. We're tracking that time and usage.

We are currently spending $1.5 million in non-salary dollars to maintain the advance declaration portion, but I don't have the long-term budget for that. As we roll it out and as we take the lessons learned and work with our contractors, we're looking at doing a knowledge transfer to our employees to be able to maintain the app.

11:35 a.m.

Conservative

The Chair Conservative Kelly McCauley

Thanks, Mr. Johns.

We'll now go back to Mr. Barrett for five minutes.

Go ahead, please.

11:35 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

Thanks, Mr. Chair.

What level of security clearance is required for subcontractors to work on ArriveCAN?

11:35 a.m.

Director General, Business and Technology Solutions Sector, Department of Public Works and Government Services

Ron Cormier

Mr. Chair, that would depend on the nature of the work specified and the task authorization in the contract. It would vary from contract to contract, but it could be anywhere from “enhanced reliability” up to “secret”.

11:35 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

Would any of those requirements have been waived before subcontractors were allowed to work on the app?

November 14th, 2022 / 11:35 a.m.

Director General, Business and Technology Solutions Sector, Department of Public Works and Government Services

Ron Cormier

Not to my knowledge.

11:35 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

Okay. So it would surprise you to know that an amendment was made to one of the RFPs—number 47419-198132—whereby the department said that subcontractors could work without security clearance in place.

11:35 a.m.

Director General, Business and Technology Solutions Sector, Department of Public Works and Government Services

Ron Cormier

Could you repeat that number, please?

11:35 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

It's 47419-198132. It was a response to a question with respect to security clearance. It indicated that work could commence and the subcontractor could start to work without security clearance in place.

Is that unusual for a subcontractor who's dealing with Canadians' personal information, private health information and biometric information?

11:35 a.m.

Director General, Business and Technology Solutions Sector, Department of Public Works and Government Services

Ron Cormier

Thanks for the question, Mr. Chair.

In effect, the waiving of the individual security clearance would be highly situationally dependent. Without the details of that particular task authorization, I can't speak to the specifics of why that might have been the case.

Generally speaking, how these professional services contacts are used and how the resources in them are employed is a business requirement that's established by the client departments we work with. I'm assuming this was a CBSA contract, but the specifics of why waiving that might be appropriate in a unique case would be operationally dependent and they would have to speak to that.

11:35 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

It would be helpful for this committee to know why someone wanting to be a network analyst with what would normally require secret security clearance would then be able to work on information systems specifically with access to Canadians' personal information, private health information and biometric data, especially at a time when we're becoming increasingly aware of cyber-threats to our country.

I would look to the witness panel, if they can't provide us a fulsome answer today, to perhaps provide in writing or return to the committee with information on the frequency with which this is permitted and the potential risk that Canadians were exposed to as a result of this. As well, ultimately, who is the signing authority that can waive security clearance requirements?

11:35 a.m.

Deputy Chief Information Officer, Canada Border Services Agency

Kelly Belanger

Mr. Chair, I'd like to clarify one thing.

I can't speak specifically to this case, but the contractors and consultants we used did not access the personal information. Only employees had access to the databases with any personal information. Those employees would have had the proper security clearance to do so.

11:35 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

Mr. Chair, my concern is that people who are developing it and have access to our systems can develop ways to access them after the time that their work is completed, particularly someone who doesn't have reliability status, secret clearance, top-secret clearance or any enhanced top-secret clearance and is dealing with the most sensitive information.

We don't know. We're hearing a lot about state actors from other countries who are interfering in our democracy here. We have people who are potentially working on our information management systems to develop an app that's specifically collecting Canadians' personal information and we don't know who they are. We don't know that they would ever receive security clearance, even if their application was in progress.

I can make an application and it could never be approved. If the only requirement to get workers is that you file the paperwork, I think the exposure for Canadians is quite serious.

Mr. Chair, how much time do I have left?