Government Operations committee  No, it is not.

Government Operations committee  There were, as you mentioned, over 70 functionality changes. We had exemptions for essential workers we had to include the business rules for: for the truckers, the nurses, the cross-border workers. We had to ensure that the free flow of goods and services into the country continued.

Government Operations committee  I'll take that one. There are a number of features and a number of things we do need to do in order to ensure that an app like this is supported. We need to make sure that we meet the Government of Canada's standards on cybersecurity; integrate the app with the rest of the CBSA ecosystem and also the Public Health Agency ecosystem; ensure that those apps are accessible to users; introduce the new functionality throughout the two and a half years; and then monitor the integrity of the data and operations.

Government Operations committee  Yes. Thank you. I will take that. We did dedicate IT security expertise. We looked at it as a “security by design” approach. When we developed and implemented ArriveCAN, we needed security assessment and authorization as per the government processes that Ms. O'Gorman mentioned earlier.

Government Operations committee  The original concept for the app itself was to digitize the intake of the contact trace form that PHAC did have prior to the pandemic. My understanding—and I'll turn it to Jennifer as well—is that it was the standard form that was used. We were asked to digitize that form. We did anticipate, though, that there would be additional needs, such as integrating it with our systems and integrating it with the PHAC systems, and the contracts that were created did include room for that additional work as well.

Government Operations committee  With respect to the MGIS contract, that was used for numerous items, such as project management, across CBSA prior to COVID. We did have other contracts as well that we did leverage throughout COVID for things like cybersecurity and some mobile app development, as well as for our back end and cloud.

Government Operations committee  Above and beyond what Ms. O'Gorman noted, there was additional work required around cloud expertise, back-end systems and, as noted, cybersecurity and accessibility, which were the core pieces to keeping the application running.

Government Operations committee  Mr. Chair, I'd like to clarify one thing. I can't speak specifically to this case, but the contractors and consultants we used did not access the personal information. Only employees had access to the databases with any personal information. Those employees would have had the proper security clearance to do so.

Government Operations committee  The amount paid to IBISKA was what was noted in the footnote: $110,175. The amount of $8 million was the full contract amount for IBISKA, and it was a different—

Government Operations committee  That was the amount paid to IBISKA up until March 31, 2022.

Government Operations committee  For ArriveCAN.

Government Operations committee  That's correct.