Thank you for the opportunity to testify today as part of your study on the Auditor General's report and to assist you in understanding Amazon Web Services' role as a contractor on ArriveCAN.
My name is Nicole Foster and I am the Canada public policy lead as well as director of global AI public policy at AWS.
I'm joined here today by my colleague, Nick Markou, who is the head of our advisory services for our public sector business in Canada.
AWS is the world's most comprehensive and broadly adopted cloud service provider. Millions of customers, including the fastest growing start-ups, the largest enterprises and leading government agencies, are using our services to lower costs, become more agile and innovate faster.
AWS is architected to offer the most secure cloud computing services available today. We support more security standards and compliance certifications than any other cloud provider, thereby helping satisfy security and compliance requirements for virtually every regulatory agency around the globe.
Here in Canada, the Canadian Centre for Cyber Security and the Department of Public Services and Procurement assess our security protocols annually. These agencies have assessed 150 of our services, which have all been deemed compliant as meeting their security requirements.
Mr. Chair, in 2020, AWS was contracted by the Government of Canada through established Shared Services Canada procurement channels to work with the Canada Border Services Agency and the Public Health Agency of Canada.
The objective was to help launch an application that would allow travellers to provide customs information electronically. Given the national emergency created by the pandemic, CBSA and PHAC chose to host the application on the cloud because of its well-known ability to quickly enable innovation at scale.
Our work was focused on the back-end architecture of the system; we did not develop the consumer-facing app. In terms of specifics, AWS's work was confined to the two following areas.
In the first component, AWS provided cloud services to the ArriveCAN program, including data storage, analytics and security services. This also included a variety of off-the-shelf services that we offer, such as translation, as well as text-to-speech technology. The benefits of using cloud for ArriveCAN was speed of innovation, the ability to meet fluctuating demands and only paying for capacity that was used.
In the second component, AWS provided expert advisory services and training to CBSA to establish the cloud environment for the ArriveCAN program. Specifically, we advised and assisted CBSA in leveraging AWS services and security architecture, including design recommendations and code to meet Canada's security requirements. Some specific examples include evidence reports for CBSA audits and compliance with Shared Services Canada guardrails and controls, as well as helping to create data storage architecture for pandemic cross-border traffic.
We also provided architecture design advice and assistance for ensuring the AWS cloud environment could integrate with other components of the project. This actually required quite a bit of complexity. For example, ArriveCAN needed to integrate with the government's firewall configurations and other related security integrations between CBSA and PHAC.
Much of this foundational work to enable digital services at CBSA is considered to be reusable assets and provides the groundwork for other highly secure workloads.
I'd like to reiterate that our commitment to privacy and security is one of the reasons customers choose AWS. Our extensive security technologies, 24-7 monitoring and alerting, and rigorous attention to all aspects of securing AWS infrastructure are designed to ensure that customers' data can be used only by them.
To be clear, AWS did not develop the ArriveCAN app itself and at no point did AWS have access to any personal data from Canadians while working on ArriveCAN.
All of the AWS employees who have worked on ArriveCAN are Canadian citizens and have the necessary security clearance, which is governed by the Treasury Board standard on security screening.
Thank you for this opportunity to speak with you today. Mr. Markou and I will endeavour to answer your questions to the best of our abilities.
Thank you.