Public Accounts Committee on April 9th, 2024

[The Chair, Conservative, John Williamson]

Good afternoon, everyone.

I call the meeting to order.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

I have a point of order, Chair, before we get started.

It's so good to be back with everyone here this week for an in-person meeting.

[The Chair, Conservative, John Williamson]

I'm going to ask you to get right to the point of order.

If it's meandering, I'll come back to you.

What is your point of order?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

The point of order has to do with our agenda today. We've had several amended notices of meeting, so I'd like to understand, given discussions that we had last week, why it is that KPMG is not appearing here today.

[The Chair, Conservative, John Williamson]

I was going to explain that. I will come to that in a few minutes.

Welcome to meeting number 113 of the House of Commons Standing Committee on Public Accounts.

Today's meeting is taking place in a hybrid format pursuant to the Standing Orders. Members are attending in person in the room and remotely using the Zoom application.

This is a reminder that all comments should be addressed through the chair.

Pursuant to Standing Order 108(3)(g), the committee is resuming consideration of report 1 of the 2024 reports of the Auditor General of Canada, entitled “Report 1: ArriveCAN”, referred to the committee on Monday, February 12, 2024.

Before I welcome our witnesses, I will be happy to explain the sudden agenda change.

To be efficient, I was trying to schedule as many witnesses as possible. Over the last day, some committee members requested more time, which would have taken us beyond 5:30. Members then highlighted the motion passed by this committee that required a two-hour meeting. I felt it was getting a bit crowded, so in light of the motion that was passed calling for a full two hours with KPMG—

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Chair—

[The Chair, Conservative, John Williamson]

Why don't I finish my explanation, and then I'll hear your point of order.

I decided to put it off and to also schedule a subcommittee meeting to discuss both that motion and future business. That was the decision.

Mrs. Shanahan, do you have a point of order?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Yes. You referenced a motion that was passed calling for two hours. I do not recall that happening.

[John Nater, Conservative, Perth—Wellington, ON]

We debated that for 10 minutes.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Yes, but we did not vote on it.

[John Nater, Conservative, Perth—Wellington, ON]

Yes, we did. We passed it unanimously.

[The Chair, Conservative, John Williamson]

It was passed unanimously, Mrs. Shanahan.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

...to have KPMG here for two hours?

Okay.

[The Chair, Conservative, John Williamson]

Yes.

Without further ado, let me welcome our witnesses.

From Amazon Web Services Inc., we have Nicole Foster, director, global artificial intelligence and Canada public policy; and Nick Markou, head of professional services, Canada public sector.

Welcome, and thank you for agreeing to appear today.

From BDO Canada, we have Mike Abbott, managing partner, markets and industry.

Thank you for being here.

From Microsoft Canada Inc., we have John Weigelt, chief technology officer. Thank you for being here.

I'll flag this up front: You might have experience appearing before a parliamentary committee; if you do, that's great, but if not, that's no problem.

Members will have time to ask each of you questions. In the course of those questions, they might ask for additional information. Committees do have broad powers to summon information. We don't usually go from zero to 60 that quickly. We hope witnesses will agree to provide information. Obviously, if information is sensitive or commercially confidential, we do understand that and we will work with you.

As questions come up, if you feel you're able to assist us, just acknowledge that. If there is some give-and-take, we can look at that down the road. We generally hope witnesses will get back to us within two or three weeks, at which point the analyst will reach out. We'll also keep track of what might be asked of you, so you don't need to scribble it down here. The blues will be made available for the record here.

It's meant to be helpful to the committee, so don't be caught off guard by it. As a first step, you're not expected to reveal all. Having said that, we do hope that witnesses will lean towards accountability and transparency as much as possible.

As you can see, this committee, and indeed all of Parliament, is seized by this study on ArriveCAN. It originated from a motion passed in Parliament.

If you have any questions, feel free to ask me. I do want to be sure that everyone is treated fairly.

I understand there are opening statements of up to five minutes.

Let's begin with Amazon.

[Nicole Foster, Director, Global Artificial Intelligence and Canada Public Policy, Amazon Web Services, Inc.]

Thank you for the opportunity to testify today as part of your study on the Auditor General's report and to assist you in understanding Amazon Web Services' role as a contractor on ArriveCAN.

My name is Nicole Foster and I am the Canada public policy lead as well as director of global AI public policy at AWS.

I'm joined here today by my colleague, Nick Markou, who is the head of our advisory services for our public sector business in Canada.

AWS is the world's most comprehensive and broadly adopted cloud service provider. Millions of customers, including the fastest growing start-ups, the largest enterprises and leading government agencies, are using our services to lower costs, become more agile and innovate faster.

AWS is architected to offer the most secure cloud computing services available today. We support more security standards and compliance certifications than any other cloud provider, thereby helping satisfy security and compliance requirements for virtually every regulatory agency around the globe.

Here in Canada, the Canadian Centre for Cyber Security and the Department of Public Services and Procurement assess our security protocols annually. These agencies have assessed 150 of our services, which have all been deemed compliant as meeting their security requirements.

Mr. Chair, in 2020, AWS was contracted by the Government of Canada through established Shared Services Canada procurement channels to work with the Canada Border Services Agency and the Public Health Agency of Canada.

The objective was to help launch an application that would allow travellers to provide customs information electronically. Given the national emergency created by the pandemic, CBSA and PHAC chose to host the application on the cloud because of its well-known ability to quickly enable innovation at scale.

Our work was focused on the back-end architecture of the system; we did not develop the consumer-facing app. In terms of specifics, AWS's work was confined to the two following areas.

In the first component, AWS provided cloud services to the ArriveCAN program, including data storage, analytics and security services. This also included a variety of off-the-shelf services that we offer, such as translation, as well as text-to-speech technology. The benefits of using cloud for ArriveCAN was speed of innovation, the ability to meet fluctuating demands and only paying for capacity that was used.

In the second component, AWS provided expert advisory services and training to CBSA to establish the cloud environment for the ArriveCAN program. Specifically, we advised and assisted CBSA in leveraging AWS services and security architecture, including design recommendations and code to meet Canada's security requirements. Some specific examples include evidence reports for CBSA audits and compliance with Shared Services Canada guardrails and controls, as well as helping to create data storage architecture for pandemic cross-border traffic.

We also provided architecture design advice and assistance for ensuring the AWS cloud environment could integrate with other components of the project. This actually required quite a bit of complexity. For example, ArriveCAN needed to integrate with the government's firewall configurations and other related security integrations between CBSA and PHAC.

Much of this foundational work to enable digital services at CBSA is considered to be reusable assets and provides the groundwork for other highly secure workloads.

I'd like to reiterate that our commitment to privacy and security is one of the reasons customers choose AWS. Our extensive security technologies, 24-7 monitoring and alerting, and rigorous attention to all aspects of securing AWS infrastructure are designed to ensure that customers' data can be used only by them.

To be clear, AWS did not develop the ArriveCAN app itself and at no point did AWS have access to any personal data from Canadians while working on ArriveCAN.

All of the AWS employees who have worked on ArriveCAN are Canadian citizens and have the necessary security clearance, which is governed by the Treasury Board standard on security screening.

Thank you for this opportunity to speak with you today. Mr. Markou and I will endeavour to answer your questions to the best of our abilities.

Thank you.

[The Chair, Conservative, John Williamson]

Thank you very much.

I'll go now to BDO.

Mr. Abbott, you have the floor for five minutes, please.

[Mike Abbott, Managing Partner, Markets & Industry, BDO Canada]

Good afternoon.

Let me start by thanking the chair, the clerk and all committee members for the invitation to be here today.

We at BDO Canada appreciate the importance of this issue. That's why we're happy to answer any questions you may have.

My name is Mike Abbott. I'm the managing partner of markets and industry for BDO Canada. I'm a member of our firm's executive, reporting directly to our CEO.

One of my mandates is to head up our firm's industry program, including our public sector business, and all of our federal government work. We provide a variety of services and solutions to government departments, agencies and Crown corporations, in the same manner as we do for private sector organizations. Our work with the Canada Border Services Agency is provided largely through a standing professional services contract awarded to BDO in September 2020, following a competitive procurement process. Under the terms of that contract, CBSA can call upon BDO personnel to provide services in six specific resource categories. The nature of that work includes management consulting, business architecture and design, risk management, and other advisory services for business and technology projects.

This is how we were first engaged directly at BDO to support the ArriveCAN project in November 2020. Overall, our work consisted of two narrowly defined streams. Our primary stream of work, directly for CBSA, was focused on management consulting and strategic advice, contending largely with accessibility issues of ArriveCAN. The government recognized that it needed ArriveCAN to be accessible for Canadians with visual and hearing impairments and other usage challenges. This work was technically complicated, but our team worked with dedication to achieve the requested results. This stream accounted for about 85% of our work on the project.

The second stream was conducted by our Lixar division. That was done as a subcontractor through GC Strategies, which had been contracted by CBSA. This accounted for 15% of our work on the project. This work specifically consisted of getting access to our data scientists, our programming and our application builders around optical reading and reader technology.

In total, BDO's work represented a little less than 5% of the overall total attributed to the ArriveCAN project by the Auditor General. All of this was completed in compliance with applicable terms and conditions based on statements of work and supported by time sheets and other administrative details.

The Auditor General raised no questions with respect to the value for money we provided or with respect to the completeness of our administrative practices or paperwork. It is also true that this work took place under unprecedented conditions due to the pandemic, with an incredible sense of urgency. Having worked with CBSA, we appreciated the vital importance of supporting the safe movement of people and goods in the midst of this health crisis.

We felt acutely that our work for CBSA mattered. However, none of that meant it had to come at the expense of appropriate controls, and we took steps to ensure that, for our part, it did not.

Again, we recognize the importance of this committee's work in reviewing the Auditor General's study and, in that respect, would welcome any questions you might have.

Thank you.

[The Chair, Conservative, John Williamson]

Thank you very much, Mr. Abbott.

I turn now to Microsoft Canada.

Mr. Weigelt, you have the floor for up to five minutes, please.

[John Weigelt, Chief Technology Officer, Microsoft Canada Inc.]

Thank you, Mr. Chair and committee members, for the invitation to be here before this committee today.

Microsoft is one of the world's leading public cloud providers. It is also a long-standing technology partner and trusted vendor to the Government of Canada. We are very proud of our social and economic impact in Canada over the past 40 years. Microsoft is built on trust. Integrity and accountability are part of our core company values. We don't just follow and comply with global rules and regulations applicable to us as a service provider; we believe it's our responsibility to establish and model the highest ethical and reporting standards.

We believe we are here today because you are interested in understanding our role as a contractor, as referenced in the 2024 Auditor General's Report 1 on the ArriveCAN app.

Let me be clear: Microsoft Canada was not engaged in the development, deployment or maintenance of the ArriveCAN app. In May 2021, CBSA wanted to build a mobile app for their border security officers to verify vaccination information using a QR code on a mobile phone. We referred to this app as the “BSO app”. This app is separate from the ArriveCAN app. The BSO app was intended to process travellers at primary points of entry into Canada, to display and authenticate traveller data for officers, and to connect that information to the ArriveCAN app.

Think of it this way: The BSO app was intended for border services agents. That's one island. The ArriveCAN app is citizen-facing on another island. Microsoft was contracted to help CBSA build that bridge between the two islands—or apps, in this case. CBSA licensed Microsoft cloud computing services and engaged Microsoft to provide related technical advisory services to support CBSA's development of that bridge, which is a connector between the BSO app and the ArriveCAN app.

The documentation we have regarding service orders specifically attributed to the BSO app does not align with the $3.8 million reflected in the AG's report. Our thorough review of our internal documentation estimates the service orders total approximately $1.3 million. This amount is more in line with the figures reflected in the Office of the Procurement Ombudsman report—otherwise known as the OPO report—rather than the $3.8 million identified in the Auditor General's report. Microsoft has not had access to the documents reviewed by the Auditor General to understand how this overall figure was calculated.

CBSA procured the cloud computing and related cloud advisory services directly from Microsoft using a Government of Canada cloud framework agreement. No part of this work was subcontracted.

Allow me to explain this process.

Microsoft provides limited cloud computing and cloud advisory services to the Government of Canada under a Government of Canada cloud framework agreement. We are one of eight providers that qualified through a competitive procurement process to enter into one of these agreements. Shared Services Canada is the contracting and technical authority for the cloud framework agreement. Government departments and agencies can then select from a catalogue of approved cloud computing services and related advisory services available for purchase, pursuant to a cloud provider's cloud framework agreement. To execute the purchase, the department submits a service order that specifies the quantity and scope of service chosen from the Shared Services catalogue for approval. Once approved, the order is sent to the service provider. The service provider fulfills that order according to the terms and conditions of the GC cloud framework agreement.

Microsoft followed this established process with respect to the cloud computing and related advisory services required by CBSA for the BSO app.

Regarding Government of Canada procurement processes more generally, we feel there's an opportunity to better align with market offerings and evolve alongside technological advancements, in order to deliver on-demand digital services to Canadians. Industry, including Microsoft, has been working in collaboration with Government of Canada officials in Public Services and Procurement Canada, the Treasury Board Secretariat and Shared Services Canada to help modernize procurement practices, especially where they pertain to procurement of cloud services and complex IT solutions. Shared Services Canada is currently working on maturing the GC cloud framework agreement. We are encouraged that it is progressing.

Modernizing procurement isn't just a choice. It's essential for achieving the government's digital ambition securely, as well as for being competitive and interoperable globally.

Thank you, and I welcome your questions.

[The Chair, Conservative, John Williamson]

Thank you all very much.

I will now begin the first round, which will consist of four members asking questions for six minutes each.

Mr. Brock, you have the first slot for six minutes.

[Larry Brock, Conservative, Brantford—Brant, ON]

Thank you, Chair.

Thank you to the witnesses for your attendance today. It's much appreciated.

The focus on my first round of questioning will be on relationships and, in particular, relationships with the government related to BDO and Amazon Web Services.

The question first to Amazon Web representatives, in relation to the arrive scam, as we call it on this side of the House, is I understand you billed almost $4.3 million to the PSPC. I also understand that at no time were you the actual contractor, you were the subcontractor. Is that correct?

[Nicole Foster]

No, we were not a subcontractor. We had a direct contract.

[Larry Brock, Conservative, Brantford—Brant, ON]

You had a direct contract with the Government of Canada?

[Nicole Foster]

Correct.

[Larry Brock, Conservative, Brantford—Brant, ON]

Okay. Was that with CBSA?