Government Operations Committee on Dec. 8th, 2022

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Thank you.

[The Chair, Conservative, Kelly McCauley]

Thanks, Mr. Hutton.

I apologize again, Ms. Kusie. My brain was stuck on five-minute times.

Mr. Kusmierczyk, go ahead for six minutes.

[Irek Kusmierczyk, Liberal, Windsor—Tecumseh, ON]

Thank you, Mr. Chair.

Thank you, Mr. Hutton and Mr. Croll, for your time with us here this afternoon.

Mr. Croll, I really welcome your suggestion about how to bring our government even further into the digital age and be a leader in terms of digital government.

Before we talk about that, I really appreciated the article that you published a couple of weeks ago, entitled “ArriveCAN hot takes miss the point”. I thought it was really illuminating. There was a part in the article under the heading “What it takes to build an app in government”. I think a lot of folks at home may not understand the differences between an app built by a private sector company for the private sector and what a government is responsible for when it's building an app. There are obligations and things a government app needs to make sure are working and cross-referenced. The apps aren't the same. There's a private sector app and then there's a government app.

Can you talk about the differences in terms of some of the obligations and responsibilities that a government-built app has to tick off?

[Alistair Croll]

Absolutely.

The first thing you have to do with any application is design it.

In 2020, there was no COVID border app to copy, so ArriveCAN had to be invented. The design process itself is difficult because you have many stakeholders. You have to understand how they are going to use the application and make sure that you've met their needs.

There's governance. You have to respect users' rights. Ironically, many of the most vocal critics of ArriveCAN are also vocal critics of government overreach and invasions of privacy. They should be happy that we are spending so much time protecting their rights, particularly with medical data, passport data and travel data—some of the most precious data there is.

We have to train people on how to use software. It's not magic. Everybody here had to learn how to use Teams in six weeks. Learning ArriveCAN had to happen across thousands of employees in real time, during a global pandemic. They had to be trained with each new version of that software.

Private companies don't necessarily have to do that. They're also not trying to use those applications in degraded conditions. By definition, every user of ArriveCAN was going to use the app and then turn on airplane mode. It's call “airplane mode” for a reason, so your app is naturally going to disconnect. The testing and the edge cases are very difficult, and so far, that's true for public and for private companies, but hen you get into government, you get into much more governance, in part because of accessibility requirements. If you call up TribalScale or Lazer and say that you want an app and, by the way, you would like it to be accessible, they are going to add a line item. Do you want it to work with screen readers? That's going to cost you more. Do you want it to work with other phones and all these different platforms for accessibility?

Government doesn't have the luxury of targeting the lucrative middle. Government applications are for everyone. That's a much wider range of development, testing and coverage.

There are also issues of interoperability in working across jurisdictions. There's even language. I'm not just talking about translation; if one misplaced pronoun gets somebody upset, then a member of Parliament is going to get yelled at and a public servant is going to get thrown under the bus. Every word has to be scrutinized, when in fact it should just be a matter of fixing it in the next release.

Government is under this sort of scrutiny. Perfect may be the enemy of good enough, but government doesn't have the option of good enough.

Obviously we talked a lot about procurement, meaning the outsourcing and the markups and so on. Those are legitimate issues. The lesson here should not be that government should outsource more efficiently; it should be that governments should know how to build apps. We should be in charge of our own future. If you just look at the markups that we're paying by not having a robust public sector that's technology-smart, that explains a significant portion of these costs.

Finally, I think there are deployments and backups. When you're building a software application, you have to build a sandbox to build the next version. You have to build a system that can be replicated. You need a backup plan. If this stops working, there are literally thousands of people in transit who can't arrive in the country. A private company that delivers an app doesn't have to deal with 10,000 people lined up at the Dorval airport who are wondering how to get into the country.

I think it's disingenuous to try to compare the two.

[Irek Kusmierczyk, Liberal, Windsor—Tecumseh, ON]

I very much appreciate that. It's a much more complicated task.

If we were to compare, let's say, what you just said about building a government app like ArriveCAN to a decathlon in the Olympics, where you have to be good at multiple sports, what would you compare a weekend hackathon to—like the one our Conservative colleagues would actually prefer us to build?

[Alistair Croll]

I noticed one of the members of the committee mentioned mass wrongdoings, such as the ArriveCAN app.

As a citizen who has been studying this carefully, I don't think we've arrived at the point that there are mass wrongdoings of any measure. I think that in fact the leaders of both Lazer and TribalScale agreed with my assessment in no uncertain terms very publicly when I published it. I think it is fair to say that you can copy the plans and clone an app, but that doesn't mean you can run a border.

[Irek Kusmierczyk, Liberal, Windsor—Tecumseh, ON]

I'm going to ask you one last question.

You described the complexity of building a government app. There's the fact that the government was able to do that in a month with 98% effectiveness. There were only 2% glitches.

How would you describe that accomplishment?

[Alistair Croll]

I can't speak to—

[The Chair, Conservative, Kelly McCauley]

You are going to have to describe it in the next round, perhaps, or in writing to us. We are at our six minutes. Thanks, though.

We'll go to Ms. Vignola for six minutes, please.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Thank you very much.

I'd like to thank both of you for being here.

Mr. Hutton, in your opening remarks, you indicated that the consulting firm you headed had done extensive audits—

[David Hutton]

I'm sorry. I'm only hearing French.

Try again. I'm sorry.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

In your opening remarks, you said that the consulting firm you headed had conducted extensive audits of the management systems of more than 100 organizations around the world.

To your knowledge, does Canada have an extensive independent audit process for management systems similar to the audits you were doing?

[David Hutton]

You're asking about my experience in auditing these companies or auditing these organizations.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

I'm asking if Canada has a similar process.

[David Hutton]

Yes.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Okay. What are the benefits of these audits?

[David Hutton]

We may be a bit off topic here, but it was basically to look at how organizations' management systems function in a system fashion, as an engineer would do—

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Can my colleagues turn their microphones off? I'll do the same, because we can't hear each other because of our microphones. I'm sorry.

[David Hutton]

I was looking at how an organization is managed in a very systematic fashion, looking at leadership, how it interrelates with customers and so on. That would give the organization a very detailed understanding of exactly where they were going wrong from a management system point of view. That provides them with golden nuggets of areas that they can improve on. That's the type of work that I used to do.

Does that answer your question?

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Yes, thank you.

In my humble opinion, this type of audit should be done more often in Canada and the recommendations of the committees should be implemented, but hey.

In your opening remarks, you talked about ArriveCAN and the fear that contractors and public servants have of disclosing information.

Is there any evidence that public servants or contractors currently have information, but are unwilling or unable to provide it for fear of losing jobs or potential contracts?

[David Hutton]

No. I don't have any information like that. I don't have any inside information. The only way I would know is if someone had decided to come to us and try to disclose something.

There are other avenues. If they were public servants, they'd need to go to the Public Sector Integrity Commissioner. They probably won't do that if they study the track record of this law.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

In the case of the Phoenix system, you have established secure communication channels to get information.

Does the Public Servants Disclosure Protection Act provide for such secure channels? If not, should it?

[David Hutton]

The safe channel that we provided was for people to get in touch with us and share information. That's just the first step. People had to trust us and trust that we would not do anything with it that would be damaging.

The problem with the Public Sector Integrity Commissioner is not getting information to them safely; it's what they do with it. Basically, the pattern is that if allegations are mostly ignored and not even investigated, and when you go to the office, they become secret forever—beyond access to information not just for 10, 15 or 25 years, but forever—the whistle-blower really has no chance of any remedy for reprisals.

As I said, in 17 years with about 500 whistle-blowers having complained of reprisals, not a single one has been compensated.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Let's say that a public servant or a contractor has complied with the Public Servants Disclosure Protection Act and has followed each of the steps set out in that act regarding information about ArriveCAN. Neither you, nor I, nor any member of the public would know that unless the discloser spoke out in the media.

Is that right?

[David Hutton]

The typical process would be that they go to the integrity commissioner with a disclosure. There's then a lengthy process that could take over a year before it's even assessed to decide whether they're going to investigate. Investigations often take more than a year. At the end of the investigation, there's often a conclusion that there's no wrongdoing. At that stage, there would be a report to Parliament.

That's a process that takes years. It very rarely works. We've had only 18 cases of founded wrongdoings in 17 years, out of 1,500 disclosures of wrongdoing.

It's a very slow process that rarely ever works, and the wrongdoing that has been reported is mostly really minor compared with other stuff that we've seen going on in the public service.