Public Accounts Committee on April 3rd, 2024

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Are you able to furnish the committee with the list of those contractors?

[Andrew Hayes]

We do have a list of those names, and we can provide it to the committee.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Thank you very much. I appreciate the work of the Auditor General's office.

[The Chair, Conservative, John Williamson]

Thank you, Mr. Barrett. That is your time.

Ms. Yip, you have the floor for five minutes.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

Thank you.

Mr. Moor, you weren't given an opportunity to finish answering Mr. Barrett's question. Would you like to take this opportunity to provide an answer?

[Jonathan Moor]

Yes. Thank you very much.

As I've said before, it would be totally unacceptable for a contractor to be involved in drafting a request for proposals for a contract that they then bid for. Under the procurement rules, you can use a contractor for technical reasons, but they then have to exclude themselves from making a bid for that contract, and it has to be disclosed.

My answer to the question is I do not know, because I've not been involved in any of those internal investigations, and I'm certainly not involved in the RCMP investigation. If wrongdoing is found in any case, with any of these contracting approaches, then action will be taken. That's what I'm assuring, but I can't say at this moment a name because I do not know a name.

What Mr. Hayes helped me with was just to remind me of the chronology around who was involved in the border technologies and innovation directorate, and I do accept that chronology.

I apologize to Mr. MacDonald for mentioning him when clearly we know he was not there at that time.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

Then you have not been approached by the RCMP.

[Jonathan Moor]

I have not been approached by the RCMP at all.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

Is there anything you can tell us about the progress of the ongoing internal reviews at the CBSA?

[Jonathan Moor]

What I can say is that normally our service level indicator is to do a complex review within 120 working days. This review started in November 2022, following the Botler allegations. A discussion was held in December 2022 with the RCMP. The RCMP felt that interviewing witnesses could impact their own investigation, and they therefore asked the CBSA not to step down their investigation but not to pursue all avenues.

In October 2023, the RCMP informed the CBSA that those investigations could now continue, and the CBSA internal investigation proceeded. It came out with a preliminary statement of facts, which I'm not aware of. I have not seen that, but my understanding is that it was shared with the OGGO committee.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

Do you believe any changes need to be made to the code of conduct for CBSA employees?

[Jonathan Moor]

I think we're always looking at how to modernize and improve the code of conduct. There is a review being undertaken at the moment around the code of conduct. The aim is always to make sure that it is relevant. For example, if social media changes, then adjustments need to be made to the code of conduct.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

Do you think the CBSA has done enough to ensure that appropriate oversight is being done in managing relationships between employees and prospective contractors?

[Jonathan Moor]

As I said, I think the procurement improvement plan, which I've been working very hard on over the last nine months, has taken a number of actions in that respect, in particular around the conflicts of interest and in particular around the disclosure of relationships or within interactions with vendors or potential vendors.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

Is there anything else you would like the committee and Canadians to know?

[Jonathan Moor]

My belief is that ArriveCAN did provide value for money, but it didn't provide the best value for money. I know that not necessarily everyone agrees with that approach, but we had to do this at a time of national emergency.

We had to get the paper-based system out of the approach and get into a digital system. That was done within six weeks, and it was very important for our officers not to fear touching pieces of paper from people crossing the border.

I think it's a really important sort of thing to recognize that we did not do everything right with ArriveCAN. We recognize that, and we accept the recommendations made and are doing something about it. Overall, we did a very difficult job in very difficult times, and I'm proud of what we did, but we did make some mistakes and will learn from those mistakes.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

Thank you.

[The Chair, Conservative, John Williamson]

That's it, Ms. Yip. Thank you very much.

We now go to Ms. Sinclair‑Desgagné for two and a half minutes.

[Nathalie Sinclair-Desgagné, Bloc, Terrebonne, QC]

Thank you, Mr. Chair.

I want to follow up on some questions I asked Mr. Vleeming.

You confirmed that Aurora Cannabis was hacked when you were working there as chief information officer. According to an article by Yahoo Finance Canada, hackers stole all the computer data that Aurora Cannabis had, including copies of passports, copies of driver's licences and other highly confidential documents. When they tried to sell that data in an online marketplace, they posted, as proof of those documents, a photocopy of your passport, Mr. Vleeming.

Can you explain how you experienced these events, as chief information officer? Were you the victim of blackmail directed at you personally or at Aurora Cannabis as a result of this data breach?

[Darryl Vleeming]

The data breach actually got a very small amount of data from Aurora, and we were subjected to blackmail. Basically, they tried to force us to pay to not release it, but the amount of information they stole was extremely limited, so we made a decision as an organization not to pay.

[Nathalie Sinclair-Desgagné, Bloc, Terrebonne, QC]

Did that disrupt your career in any way, given that you were presumably responsible for ensuring the cybersecurity of the company?

How can you say that you've learned from this extremely unfortunate incident and that you're going to protect the data of Quebeckers and Canadians within the Canada Border Services Agency?

[Darryl Vleeming]

It didn't. The reality is that anybody can read any of the news. Cyber-attacks are increasing. As we've seen with the Government of Canada in the last year, since I've been here, a number of cyber-attacks have disrupted services. Every organization is under attack. The vast majority of organizations have been subjected to successful attacks, so it's not uncommon at all.

The thing that worked well when I was at Aurora was the design of our cybersecurity. While the hacker was able to get in, they were only able to get a very small amount of data, so our protection actually worked very well. A cyber-attack that's successful is never ideal, but every CIO is prepared for that.

[Nathalie Sinclair-Desgagné, Bloc, Terrebonne, QC]

So you feel that you were prepared for that eventuality. However, these hackers have managed to obtain highly confidential data, such as copies of passports and driver's licences.

[Darryl Vleeming]

You're never as prepared as you could be, but the reality is that cyber-attacks continue to increase worldwide. You just have to google the number of companies that get hacked on a daily basis. It is expected. What you have to do is limit the damage, and in this case the damage was extremely minimal.

[The Chair, Conservative, John Williamson]

Thank you very much.

Next up is Mr. Desjarlais.

You have the floor for two and a half minutes.