Government Operations Committee on Nov. 14th, 2022

[Kelly Belanger]

The original concept for the app itself was to digitize the intake of the contact trace form that PHAC did have prior to the pandemic. My understanding—and I'll turn it to Jennifer as well—is that it was the standard form that was used. We were asked to digitize that form.

We did anticipate, though, that there would be additional needs, such as integrating it with our systems and integrating it with the PHAC systems, and the contracts that were created did include room for that additional work as well.

[Kelly Block, Conservative, Carlton Trail—Eagle Creek, SK]

Thank you very much.

I want to go back to some questions around GC Strategies. Their website states, “GC Strategies was asked to help with ongoing development and maintenance needs of the COVID Alert app”. I'm just wondering who would have contacted GC Strategies. When they appeared before the committee, they weren't able to tell us who had asked, but perhaps someone in this room knows who approached GC Strategies to help with the ongoing development.

[Erin O'Gorman]

Initially, when the request came in from the Public Health Agency, CBSA approached three companies—GC Strategies, Apple and Deloitte—to seek feedback from them on our requirements. We assessed the two responses that we did receive, and we felt that GC Strategies aligned with what we knew we would have to do in terms of security and what we anticipated in terms of some but not all of the changes that we thought might come again.

The decisions we made in 2020 didn't have the benefit of hindsight, so it wasn't clear how long we would have to maintain the app, but we felt that the staff augmentation proposal from GC Strategies and the ability to use the CBSA cloud were the most appropriate for what we knew we needed.

[Kelly Block, Conservative, Carlton Trail—Eagle Creek, SK]

Thank you.

We know there are rules around non-competitive procurement or sole-sourcing. I'm wondering if you could explain why these contracts were sole-sourced.

[Erin O'Gorman]

I'll hand it over to my colleague, but I will just go back in time to March 2020, the request we had and the fact that there was no time to issue a competitive contract to be able to have an app within the month.

In terms of the broader rules, I'll invite PSPC to add anything.

[Michael Mills]

Thank you, Mr. Chair.

With respect to sole-source contracts, there is a requirement for the department wanting the contract to provide a justification. There are a number of reasons for justification in terms of national security or an urgent emergency issue. In this case, as we were dealing with COVID in a pandemic situation, we were trying to move and act on the most urgent basis possible, so we would have had a justification for moving quickly in terms of meeting the needs of the government to respond to COVID.

[Kelly Block, Conservative, Carlton Trail—Eagle Creek, SK]

So out of 31—

[The Chair, Conservative, Kelly McCauley]

I'm sorry. I'm afraid that's time.

Ms. Thompson, it's over to you, please.

[Joanne Thompson, Liberal, St. John's East, NL]

Thank you, Mr. Chair.

Thank you to the witnesses.

Canada has two privacy acts. The first, obviously, is the Privacy Act, which covers how the federal government handles personal information. The second is the Personal Information Protection and Electronic Documents Act, which covers how businesses handle personal information.

Understanding that we have the added layer of health information in the ArriveCAN app, Ms. O'Gorman, would you speak to the challenges you and your department faced in developing support for the ArriveCAN app based on the sensitivity of health information?

[Erin O'Gorman]

We were very conscious from the outset, knowing that we would have personal information contained in the app, with regard to the handling and the security requirements. Our colleagues at PHAC did engage with the Privacy Commissioner directly, and through them we ensured that we met the requirements.

I would invite my colleagues to discuss their interactions with the Privacy Commissioner.

[Christopher Allison]

Unfortunately, I was not with the Public Health Agency when those conversations happened. I'm sure we can return in writing the details of the conversations that did happen.

[Joanne Thompson, Liberal, St. John's East, NL]

Thank you.

Ms. O'Gorman, 18 million people downloaded the ArriveCAN app. Can you tell the committee what kind of support the application needed, whether from HR, data storage or cloud service management perspective, in order to maintain an app that was used and adapted as much and as frequently as ArriveCAN?

[Kelly Belanger]

I'll take that one.

There are a number of features and a number of things we do need to do in order to ensure that an app like this is supported. We need to make sure that we meet the Government of Canada's standards on cybersecurity; integrate the app with the rest of the CBSA ecosystem and also the Public Health Agency ecosystem; ensure that those apps are accessible to users; introduce the new functionality throughout the two and a half years; and then monitor the integrity of the data and operations.

That's just an overview of what's required as part of that support moving forward.

[Joanne Thompson, Liberal, St. John's East, NL]

Thank you.

Considering the 30 million submissions, and obviously the monumental amount of data, could you talk a little more specifically about the safeguards that were built in to ensure that all privacy regulations were maintained?

This is back to the CBSA.

[Kelly Belanger]

Yes. Thank you. I will take that.

We did dedicate IT security expertise. We looked at it as a “security by design” approach. When we developed and implemented ArriveCAN, we needed security assessment and authorization as per the government processes that Ms. O'Gorman mentioned earlier. For each release, we did a review at the beginning of the release to determine the amount of functionality changes that we would have. If the functionality changes were significant and we felt that it warranted a full review, we did do full security assessment and authorization processes for those.

We did 11 of those in total across the 70 functionality releases. Those were for our major releases when we were introducing such things as pre-arrival testing and the validation and verification of the proof-of-vaccination credentials.

[Joanne Thompson, Liberal, St. John's East, NL]

Thank you.

Has there ever been a government app created on the scale of ArriveCAN?

[The Chair, Conservative, Kelly McCauley]

Answer briefly, please.

[Joanne Thompson, Liberal, St. John's East, NL]

The question is for CBSA.

[Erin O'Gorman]

Not that I am aware of, and I include in the scale the changes that were made over the course of the two and a half years that the app was in use as a public health tool.

[The Chair, Conservative, Kelly McCauley]

Thanks very much, Ms. Thompson.

We're now going to change the order a tiny bit. We'll go to Mrs. Vignola and then to the NDP for five minutes each. They will then, two rounds from now, give up their two and a half minutes—we'll just combine the two.

Mrs. Vignola, you have five minutes.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Thank you very much, Mr. Chair.

Mr. Cormier, I'm going back to my question about awarding sole-sourced contracts to GC Strategies when other businesses specialize in developing health-related apps.

Why did you specifically choose GC Strategies instead of going to other companies that specialize in this area?

[Ron Cormier]

Mr. Chair, I started answering the question a bit earlier. In effect, GC Strategies—

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Excuse me, I have no interpretation.

[The Chair, Conservative, Kelly McCauley]

We're suspending for a second. I've suspended your time.

We'll continue. Mrs. Vignola, you have four minutes and eight seconds.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Mr. Cormier, you were responding to my question about why the government didn't use the services of companies specializing in the development of health-related apps.