Government Operations Committee on Dec. 8th, 2022

[Majid Jowhari, Liberal, Richmond Hill, ON]

You just mentioned five or six different activities that happened during 24 hours for seven days for each one of those iterations. The development must have been only about a day or day and a half. The rest of it was all the testing, all the verification and all that. I want to make sure that's on the record.

How many people—how many Canadians and how many travellers—did we get through that application?

[John Ossowski]

I understand that upwards of 60 million travellers went through with the ArriveCAN app.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Thank you for that.

On $8.8 million and over 60 million Canadians or 60 million uses of the application, what is the dollar per transaction?

[John Ossowski]

I'd have to do the math. I did the math earlier of 60 million into the total cost built so far of $41 million, and I think it's about 68 cents per traveller.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Thank you.

If you take the total cost of $41 million—which is to date, which is not $54 million—and you look only at the development costs of roughly about $10 million, that's going to be less than 60 cents a day.

Let's say, for 20 cents per transaction, we ensured, during the pandemic as changes were coming in, that we saved so many lives. Without these measures and vaccines and the others, we could have put more Canadians at risk.

Thank you for that.

Now I want to go into the evolution of the sophistication of the application during those 18 months. Can you give us some idea of where we started to where we ended up, based on those 70 requirements? What level of sophistication did you see?

[John Ossowski]

I think that's an excellent question.

As I mentioned, at the beginning it was simply contact tracing and the ability to get basic traveller information to the provinces. Eventually we added the capture of pre-arrival testing—PCR, rapid testing or whatever it was at the time. We put that in, and eventually the vaccine certificates.

Every country did it completely differently. For some countries, it was very basic optical character recognition. It would be uploaded, and we would capture that it was, for example, a Moderna vaccine. There was some basic information there for us. Others were much more sophisticated.

As I said earlier, because of the QR code that we had with provincial health care authorities in Canada, we had a very high degree of confidence in that information, and many Canadians came across the border and were never asked for—

[The Chair, Conservative, Kelly McCauley]

I'm afraid I have to cut you off again, Mr. Ossowski. We are out of time.

We are going to suspend very briefly as we switch our witnesses.

Mr. Ossowski and Mr. Manji, thanks for joining us today.

[The Chair, Conservative, Kelly McCauley]

We are back for our second hour.

We will start with opening statements. Again, we are short on time, so I'll ask you to stick to five minutes.

We'll start with you, Mr. Croll.

[Alistair Croll, Author and entrepreneur, As an Individual]

Thank you very much.

I'd like to begin by thanking the committee for inviting me to discuss the ArriveCAN application.

ArriveCAN cost too much to build. Canadians should be angry, not because of the cost, but because of what our inability to deliver good technology quickly means for the future of our society.

This Thanksgiving, a couple of tech firms cloned the ArriveCAN app’s front end to show that its development was too expensive. As it has been pointed out, this PR stunt doesn't prove much about the cost of the program, because it takes more than copying a few screens to run a border.

ArriveCAN had to be invented in the first place, and deployed, hosted and backed up. As we have heard, just the hosting fees for running it for a year and a half cost $4 million. It had to be updated constantly during that time. It needed to connect to passport, medical and travel databases. Thousands of people from coast to coast to coast had to be trained in the middle of a global public health crisis.

ArriveCAN teams faced so many bureaucratic hurdles, outdated rules and legacy systems—en deux langues—that it’s amazing the app was built at all, let alone in a month. Few people are comparing the cost to the alternatives—face-to-face manual processes during a pandemic, or shutting down the border entirely—but it was still much too expensive.

ArriveCAN cost so much because we do not have a digital government. While some of the ArriveCAN criticism may be a thinly veiled protest about vaccine mandates or public health measures, most of it is warranted, because our public sector is falling behind in its ability to deliver reliable and accessible technology on time and on budget.

Each year, the UN publishes an assessment of digital government across its 193 member nations. In 2010, Canada ranked third in the world. This year, we’re 32nd. We should be angry because our government is unable to deliver superb information technology quickly and affordably.

Canadians already spend nearly eight hours a day online. We are fluent in apps, living on the web and connected in our classrooms and our cars. We sleep by our phones. They’re the first thing we check every morning. We are always connected, with a screen in every pocket, just 15 years after the iPhone was introduced. We are quickly becoming, at least partly, a digital species. In the next century, we will fundamentally rethink everything about government, from how residents interact with public services to how we choose our leaders. A hundred years from now, our government will be as unrecognizable to us as modern democracy is to the monarchy. We are changing, and the government is not adapting alongside us.

While on the outside, the government looks like the thing that builds roads, tests cars, checks crops, staffs service desks, protects coastlines and, yes, chairs committees, at its core the government deals in information. The government ushered in the mainframe, the Internet and satellites. The government is information technology.

As chair of the world’s leading conference on digital government and public sector modernization, I have had the chance to speak with the national CIOs from dozens of countries, including many that now outrank us on the UN’s digital government assessment. In those countries, people brag about the amazing apps they’re building for their fellow citizens. Innovation and experimentation are celebrated. New graduates want to work in government technology. However, here in Canada, we are stumbling into the digital age.

The answer is not more outsourcing. There’s plenty of room for public-private sector collaboration on the utility parts of computing and technology, such as cloud computing, broadband or off-the-shelf software. I don’t want a government to be a hollowed-out shell of policy-makers and bureaucrats, completely dependent on the private sector for its operation. We cannot abdicate the reinvention of our society to others. The government must code.

Fixing this problem will take real, meaningful changes in compensation, culture, training and, yes, the replacement of those who can’t or won’t adapt. Many of these changes are politically unappealing, but they are also necessary.

The hard truth is that we live in a digital society and we deserve a digital government. ArriveCAN is a canary in the digital coal mine, warning us that we are unprepared, unwilling or unable to adapt to that new reality.

Mr. Chair, my objective with these remarks is to not to give you an exhaustive explanation of why ArriveCAN cost so much, but to frame this conversation in a broader context.

I was invited here because of my background in technology start-ups and my role as the founder of a digital government conference.

I will be pleased to answer any questions from the committee members.

Thank you.

[The Chair, Conservative, Kelly McCauley]

Thank you, Mr. Croll.

Mr. Hutton, welcome back. We'll give you five minutes.

Before we do, I just want to point out for those who have not been with us before that Mr. Hutton is a great friend of OGGO and a big part of what I think was a groundbreaking report on whistle-blower protection.

It's great to have you back with us, Mr. Hutton.

[David Hutton, Senior Fellow, Centre for Free Expression, Toronto Municipal University, As an Individual]

Thank you.

My name's David Hutton and I'm a senior fellow with the Centre for Free Expression at Toronto Metropolitan University. I offered myself as a witness because I felt that my particular experience might enable me to offer a useful perspective.

As a young engineer, I led the quality assurance of large, complex computer systems by monitoring the development process, conducting independent testing and approving a final release. Later, as a management consultant, I led my own consulting practice for 20 years, conducting in-depth audits of the management systems of over 100 organizations around the world. For the past 17 years, I've been assisting public interest whistle-blowers and advocating better protection for them. Typically, these are honest employees who speak up about wrongdoing and are punished for doing so.

These three apparently quite different careers have something in common: a quest for truth and integrity so that organizations can deal with facts and reality, making them more successful and also serving the public interest.

I think one of the central questions facing this committee is what happened with respect to ArriveCAN, on a spectrum ranging from a reasonable outcome and value for money, given a fast-changing emergency situation, through contractors taking advantage of a difficult situation opportunistically but perhaps entirely legally, to, at the far end, corruption or collusion through which laws or codes of conduct were violated.

This is difficult to find out, especially if there are wrongdoers who will do their utmost to hide their misdeeds. Based on my experience and research, if we had even half-decent whistle-blower protection in this country, this committee would very likely soon have the answers.

Let me explain.

Given the cost of this project, hundreds of people must have been involved as public servants and contractors. If there was any wrongdoing, then some of them would certainly know. However, they have no safe way to provide this information to the committee or to the public, as there's no protection from career-ending reprisals for speaking up.

That's because Canada has literally the worst protection law in the world. It is supposed to protect about 400,000 public servants, but in 15 years of operation at a cost of more than $100 million, not a single whistle-blower has ever been protected.

This system also completely failed to detect the impending Phoenix pay disaster, even though hundreds of people knew about the problems. Let me share some relevant information about Phoenix as an instructive example.

With my background, you can understand that I was absolutely rivetted by that project. How was it possible that such bad software could be written and released, untested and without any fallback, into a mission-critical role where it would dispense billions of dollars and directly impact the lives of hundreds of thousands of employees?

I read the detailed reports that were available from many sources, but ended up with more questions than answers. I decided to conduct my own investigation, assisted by the Centre for Free Expression.

We set up secure channels of communication and called for insiders to share their experiences confidentially. A few responded, and now I have my answers, which I hope to publish in due course, though I need more sources to corroborate what I learned. This is difficult, because people are terrified to say anything, even those who are retired, years after the event.

My story illustrates two things. Number one, whistle-blowers are by far the best source of information to uncover any wrongdoing that may exist in an organization. Decades of research confirm this. Number two, without protection, very few people will dare to come forward with vital information. That's the situation that the committee finds itself in today.

This is a long-standing problem that affects the work of this committee and all oversight bodies. One obvious solution is to implement proper federal whistle-blower protection, as this committee unanimously recommended in 2017.

Because of its track record and mandate, this committee is uniquely placed to help solve this problem. If you succeed, this will help clarify the true status of many projects, from Phoenix to ArriveCAN.

Thank you.

[The Chair, Conservative, Kelly McCauley]

Thank you, Mr. Hutton.

We have Ms. Kusie for six minutes, please.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Thank you, Chair.

Thank you to both of our witnesses for being here today.

Mr. Hutton, as you're well aware, in 2017 OGGO published a report with recommendations on whistle-blower protections. Do you support these recommendations?

[David Hutton]

Absolutely.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

I hope so. Excellent.

Do you think if these recommendations in the report were implemented, public servants would have been more comfortable coming forward in cases of wrongdoing?

[David Hutton]

That's undoubtedly the case.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Excellent.

Do you believe that if the recommendations in the 2017 OGGO report were put in place prior to the pandemic, public servants would have been more likely to come forward with concerns around the ArriveCAN app?

[David Hutton]

If there was wrongdoing, of course they would, yes.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Excellent.

Why do you think the current government has ignored the recommendations in the 2017 report for the last five years?

[David Hutton]

Well, that's a good question. I don't actually see this as a partisan issue. I think successive governments have behaved in this very similar fashion. What I take from this is that governments in power find it very convenient to not have this avenue of disclosure, while people in opposition would like to have it. Of course, the public would like to have it.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Certainly. I guess, coming from the Conservative side, we did introduce accountability 1.0, and the 2017 report did come out under the Trudeau government. I struggle with your point, but I understand.

Do you think the Liberal government will continue delaying reforms for whistle-blower protections?

[David Hutton]

I hope not, but I can't speak to the future.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

I'm sure you're well aware that a Bloc Québécois member put forward the private member's bill, Bill C-290, to implement more whistle-blower protections, and I can only assume the absence of Liberal action, since this report had been available for five years.

Do you think the government should be supporting this bill?

[David Hutton]

I think they should bring it to committee and debate it and make sure it's up to par. I think it's a very good start.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

It should be with the least delay possible.