Overview: Standing Committee on Government Operations and Estimates—Study on the ArriveCAN Application (November 14, 2022)

Opening remarks

Good morning.

I’m Erin O’Gorman, President of the Canada Border Services Agency.

I would like to speak briefly about the context in which ArriveCAN was developed and deployed.

The need for the ArriveCAN app arose when it became impractical for the Public Health Agency to manage a manual, paper-based process to pass information to provinces and territories and carry out compliance and enforcement activities in a timely way.

And this was when travel volumes were at 58% of historical levels.

In March 2020, the Public Health Agency asked CBSA to develop the app on an emergency basis, which it did, with the first version released in April 2020.

ArriveCAN then became the tool to manage the border throughout the pandemic.

Because most people never had to provide the pieces of information required under the Orders in Council verbally to a CBSA officer, the time saved by submitting them via ArriveCAN may not have been well understood.

Because the app was linked to passports, provincial vaccination credentials and to CBSA’s systems in real time, many travellers were never asked any questions about ArriveCAN or their health status.

Instead, for the majority of the approximately 30 million submissions, a green check mark appeared on the Border Service Officer’s screen advising them that all border health requirements had been met because the app had provided and validated all of the information.

On the commercial side, imports at the land border remained constant during the pandemic. This was because ArriveCAN allowed people and trucks to flow more quickly and avoid the friction that would have resulted from manually processing the information.

The cumulative budget approved and allocated for ArriveCAN through Main and Supplementary Estimates was $54 million to March 31, 2023. As of October 31, CBSA has spent $41.3 million.

CBSA has published a breakdown of this budget.

ArriveCAN could not have been managed using CBSA’s project management framework. A project in normal times would have a clear scope, milestones, business requirements and a procurement plan.

At the beginning of the pandemic and the subsequent months of changing requirements, there was no time to develop these artefacts.

The CBSA was able to rely on its Pandemic Emergency Response plan to deal with aspects of the pandemic, but had no such plans in place for border health measures of this magnitude requiring digital services.

I would like to address the error that was contained in CBSA’s response to OPQ-597. ThinkOn was wrongly listed as contractor when it should have been Microsoft. This was caused by a human error that resulted from a one digit keying mistake which led to the reporting discrepancy.

I apologize that this happened and can confirm that our Chief Financial Officer (CFO) has double checked and is satisfied that there are no other errors contained in this OPQ and can attest to its accuracy.

In conclusion, Mr. Chair, ArriveCAN was downloaded more than 20 million times, and used for more than 30 million submissions.

It was developed during an extraordinary time when speed was of the essence. That is the context in which this work took place over the past two and a half years.

Thank you.

Key messages: Questions and answers

What was the driver that led to the ArriveCAN application?

In March 2020, Public Health Agency of Canada (PHAC) officials asked CBSA to digitize the process. It was launched on April 29.

The app was developed when PHAC indicated that it was not able to manage the manual, paper-based collection of information.

The App allowed PHAC to share health information with provinces and carry out COVID-19 measures in a timely way.

Was investing in ArriveCAN worthwhile?

Helped protect the health and safety of travellers as well as expediting processing at the border.

Was downloaded more than 20 million times and there were almost 30 million ArriveCAN submissions.

Saved about 5 minutes at the border for each traveller.

Prevented fraud by verifying proofs of vaccination.

Continues to be used voluntarily to make customs and immigration declarations saving time at participating airports.

Why did ArriveCAN cost that much?

The budget includes more than just the creation and launch of the app itself.

It includes all the work needed to operate, maintain, make changes to, and upgrade the app. 70 updates had to be made over two years to keep up with the changes to health and travel border measures.

We did not have the workforce to do the required work in the amount of time we had to do it so a significant portion of the funding was used to augment our staff through contractors.

The budget also attempts to be transparent by including internal transfers to SSC and various other aspects of government overhead that were not incremental to ArriveCan.

How much money was spent on contractors for ArriveCAN?

As of October 26, 2022, $34.77 million has been spent towards professional services, the large majority of which was for contractors.

How many contractors were hired to work on ArriveCAN?

As there are potentially many consultants for each contract, it would difficult to provide an exact figure, however we are aware that 25 contractors were involved in the development of the application.

We can provide a more detail response in writing after this meeting.

How much are we currently spending on ArriveCAN? How long do we expect to pay for consultants over the next year?

CBSA has requested $1.5 million in non-salary to support ArriveCAN advanced declaration. This includes cloud computing services.

Was the Minister briefed on the cost of ArriveCAN?

The Minister was briefed on emerging issues associated with COVID including PHAC’s need to have CBSA develop an App to collect data on border arrivals to assist the provinces and territories.

This data was intended to better develop health measures to cope with the rising cases of COVID and the impact on the health care system.

The Minister was briefed about ArriveCAN and it’s funding as part of the briefings for both the 2021 to 2021 Supplementary Estimates B and C. The Minister was also briefed about ArriveCAN post Budget 2022 as part of what the Public Safety portfolio was allocated through that process.

What is CBSA’s budget and how much do we spend annually on contracts?

In fiscal year 2022 to 2023, the CBSA’s gross budgetary authorities (Main Estimates) total $2,368 million.

Personnel costs account for 68.8% of gross budgetary expenditures ($1,628 million).

Professional and special services account for 21.7% ($514 million).

There are contractual elements to most of the expenditure lines (for example, buildings and equipment) and so the expenditure on professional services will cover most of the consultants we use.

In Budget 2021, CBSA received $857 million over 5 years with $124 million on-going for sustainability and modernisation.

Who authorized costs for the app? Was there a budget? Who approved the budget?

CBSA and PHAC agreed at the onset that PHAC would assume costs related to the app. Those costs were based on the effort required to meet new health measure under the Quarantine Act.

In fiscal year 2020 to 2021, CBSA absorbed $5.6 million in expenditures from existing reference levels.

In fiscal year 2021 to 2022, CBSA spent $23.5 million. The source of funds was $12.4 million from a PHAC transferred through Supplementary Estimates B and Supplementary Estimates C included $12.4 million for proof of vaccination credentials.

In Budget 2022, it was announced that CBSA is to received $25 million for ArriveCAN; the Agency is cash managing these funds until they are accessed through a future Supplementary Estimates.

Why did CBSA use so many different contractors?

ArriveCAN was developed on an emergency basis and CBSA did not have the expertise in house.

CBSA maintains 180 different IT systems and it was not feasible to suddenly redirect all of these resources to the development and maintenance of the app, the Agency did not have sufficient staff with the skills to do everything that was needed for ArriveCAN.

ArriveCAN had to be updated 70 times over two years to respond to the regular adjustments to border health and travel measures.

What are the main differences between ArriveCAN and the app that was developed at the hackathon?

The hackathon apps mimicked ArriveCAN capabilities. Although it has a similar look and feel, they don’t meet Government standards on cyber security, they aren’t built to handle sensitive data, and can’t integrate themselves in the ArriveCAN ecosystem.

Did CBSA ever buy or ask anyone to increase the number of reviews for the app?

Not to my understanding.

Was this within TB policy?

Yes, the procurement practices used were within TB policy.

In the early stages of the pandemic, the most efficient procurement strategy was to leverage large procurement vehicles established by PSPC.

This is a common practice to support sound stewardship of financial resources as these contracts were established through competitive processes.

What about project authorities?

Because of the need for urgent timelines as the pandemic unfolded in early 2020, the ArriveCAN development work was not treated as a project following the standard CBSA Project Management Framework.

ArriveCAN development and maintenance was treated as an initiative and did not fall under formal project authorities.

Oversight bodies at the working, DG and ADM levels were set up to review upcoming OIC changes and discuss the resulting business requirements.

How did incorrect information end up being provided in an Order Paper Question?

This resulted from a one digit keying error which led to the wrong company being listed.

On behalf of the Agency, I regret that the error occurred and can confirm that the CFO has re-reviewed all of the other information contained in the OPQ to ensure it is accurate.

Did ThinkOn mistakenly receive funds from CBSA for work not provided?

When asked to report on contracts for ArriveCan, CBSA included ThinkOn in error. We did not have a contract with ThinkOn Inc. and no payment has been made to the company.

Is CBSA planning to amend their response to the Order Paper Question?

Yes, we have identified the coding error and determined that the contract in question was with Microsoft Canada.

CBSA has provided this Committee with an amended list of the contracts and the revised question should be re-tabled in parliament in this week.

How do we know there are not more mistakes in the Order Paper Question?

The CFO has conducted a thorough review of the contracts and invoices and has confidence in the information that it is now putting forward.

Contracts and payments were made in accordance with Government of Canada’s policies and directives.

This Committee has also requested the invoices for these contracts, where are those documents?

CBSA has identified over 500 invoices related to these contracts and is in the process of getting these documents translated and ready for to the Committee. If the committee is amenable, we can provide the documents in batches as they become available.

The union said ArriveCAN was developed without consulting BSOs.

The decision to have ArriveCan and then make it mandatory was made by the Public Health Agency and subsequently the Governor in Council so that was not an issue on which we would have consulted BSOs.

From an operational perspective, there was no time to consult BSOs on the initial versions of the app given how quickly it was developed and deployed. We did receive feedback from BSOs throughout its use that was taken into account in both the app and our SOPs.

ArriveCan was also on the agenda of the National Labour Management Consultation Committee throughout the pandemic.

The union says you could have hired 500 additional officers instead – how many officers could you have hired with $54 million?

No, this funding was not ongoing.

The union says it was a cost-cutting measure and that it reduced security.

This is not true.

The use of ArriveCAN didn’t stop the CBSA employees from doing their jobs.

Without ArriveCAN, public health processing at the border would have taken longer, and would have left BSOs with less time to fulfil their other mandated duties in ensuring Canada’s security.

In 2021, the CBSA seized over 1,100 firearms, more than double the number from 2020.

Can you confirm who initiated the contact GC Strategies Inc.?

In April 2020, CBSA initially developed mock screens to meet PHAC business requirements. We reached out to three companies with known experience in this field – Deloitte, Apple and GC Strategies Inc. – to ask them to submit proposals.

Proposals were received from GC Strategies Inc. and Deloitte. The proposals were reviewed and assessed based on a number of criteria, including expertise in mobile development, prior experience with CBSA, flexibility in process and approach, security clearance, etc.

The GC Strategies Inc. proposal best met the criteria we were evaluating, specifically that it was based on a staff augmentation model using a CBSA Cloud with resources readily available, while the Deloitte proposal was for a managed service where they were responsible for the work using their own Cloud. A recommendation was made to proceed with a staff augmentation approach with GC Strategies Inc.

A third unsolicited proposal from Pivotal was received after the proposals from GC Strategies Inc. and Deloitte were evaluated, and after work was underway on the sole source contract with GC Strategies Inc..

GC Strategies Inc. said they never missed a deadline and completed over 150 releases over 2 years. Is that true?

Yes. CBSA staff were responsible for the management of the ArriveCAN development. The resources that GC Strategies Inc. provided as part of staff augmentation met the deadlines set by the CBSA team.

What other projects were GC Strategies Inc. working on?

E-Commerce (low value shipments); CBSA Advance Declaration, Next Generation Hand Held, Mobile Border, and CBSA Connect (Client reporting ad Engagement).

Do you know to whom GC Strategies Inc. subcontracted?

No. The resources provided by GC Strategies Inc. were known to the CBSA team managing the ArriveCAN development, but their status as contractors or subcontractors was not.

Did any of the contractors or subcontractors work outside of Canada?

Not to my knowledge. All resources must have a valid security clearance, and that process includes confirming place of work.

How are we trying to hire IT specialists that we need?

This is an extremely challenging area. Recruiting IT talent is highly competitive, and the public service hiring process takes many months.

One of our strategies is to build teams comprised of employees and consulting resources to enable knowledge to be transferred from private-sector experts to our staff, to help build our employees’ IT skills and competencies.

What is TBS OCIO’s position on hiring vs. contracting IT specialists?

TBS sets out the direction to departments to ensure accurate application of terms and conditions of employment across the core public administration as indicated in the Public Service Employment Act (PSEA).

It is a management decision to determine if they want to hire using the PSEA or through procurement using the contracting method.

How come other countries could have border measures without ArriveCAN?

Each country implemented their own public health related border measures. While I cannot speculate on individual decision making processes, the information required, whether it was mandatory and risk based approaches to verification would have been considered.

I am aware that other countries did have digital elements to public health measures at the border. One example, European Union (EU) countries had the “EU Digital COVID Certificate” which communicated with other EU countries regarding the authenticity of the certifications using a QR code.

Will ArriveCAN have a purpose going forward?

Now that health measures have been removed, the Advance CBSA Declaration in ArriveCAN can be used voluntarily to make customs and immigration declarations in advance. This will save travellers time at participating airports.

The CBSA is exploring other optional ArriveCAN features to provide travellers with easy access to information, such as border wait times and other self-serve functions. This will be expanded for travellers by land so they can make use of available technology to expedite and facilitate their travel.

Will you bring it back if another pandemic hit?

The Public Health Agency of Canada will determine what health requirements are needed in the event that a new COVID-19 variant emerges in the future.

Travellers received incorrect notifications from the ArriveCAN application

The problem affected approximately 10,200 Apple users across 30 million ArriveCAN Submissions. CBSA immediately informed these travellers that there was a problem and to ignore the erroneous quarantine messages.

In the six days from when the erroneous messages on the iOS version of the App came to our attention and when we made the fix, no travellers were ordered into quarantine by any government official.

The fix required that we develop enhanced vaccination logic, and we performed over 1800 test cases to make sure the release to fix the problem worked. We also enhanced our capacity to perform testing to prevent a situation like this from occurring again.

What steps has the CBSA taken to protect the information collected?

The CBSA and PHAC took the protection of travellers’ information very seriously. We involved the Department of Justice from the beginning to ensure compliance with the requirements of the Canadian Charter of Rights and Freedoms.

Legal reviews were also conducted on an ongoing basis to ensure that every use or disclosure of information collected via ArriveCAN was duly authorized by law.

Thorough verifications were made to validate the existence of the proper legal authority to support the collection of each element of information that travellers were required to input into the app.

How is CBSA responding to complaints received by the Office of the Privacy Commissioner?

We are aware of investigations by the Privacy Commissioner related to the ArriveCAN app and we are cooperating fully.

As the investigations are ongoing, we cannot provide details. The Office of the Privacy Commissioner has been consulted on any collection of personal information through ArriveCAN.

Are there enough resources at airports and other ports of entry?

The CBSA takes appropriate measures to ensure that there are sufficient resources available to adequately manage the border.

The Agency continuously monitors traveller volumes and wait times to allocate resources and adjust staffing levels during peak travel periods to minimize processing times and delays at our ports of entry.

This includes making additional kiosks available in the customs hall areas at the Toronto Pearson International Airport.

Mark Weber said there is a deficit of 2,000 to 3,000 BSOs. Is that true?

The CBSA’s workforce has remained relatively stable over the past decade. Over this time period, there was an average of 6,538 employees at ports of entry across the country.

The annual attrition rate has been sufficiently mitigated by an annual intake of approximately 324 BSO trainees over the same period. The College is planning to train 576 recruits this fiscal year, 2022 to 2023.

There is no merit to the 3,000 BSO deficit alleged by the CIU.

Mark Weber said that we have 300 fewer BSOs at Pearson today from 2017, in Montreal we had 260 in 2019 and now have 200, at Vancouver Airport we had 181 in 2009 and now you have 77. Is that true?

The reduced number of travellers had an impact on resources needed/allocated at the frontlines. There have been variations in BSO numbers at these locations however, they are not as drastic as stated:

• For Pearson (combining Passenger and Commercial Operations in GTA), there were 679 active BSO’s in April 2017 and 629 as of today; a drop of 50, not 300
• For Montreal (using numbers at Trudeau International Airport), there were 239 active BSO’s in April 2019 and 209 as of today; a drop of 30, not 60
• For Vancouver International Airport, there were 233 active BSO’s in April 2012 and 168 as of today; a drop of 65, not 104

In light of the above, it is important to keep in mind that our workforce is agile, being able to mobilize BSOs in other areas of the Agency, if, and when, needed.

What is the reason for delays at airports?

The CBSA works with airport authorities, airlines and PHAC in planning for arrivals based on scheduled flights. However, the convergence of flights arriving at the same time, sometimes because of early or late arrivals of flights can increase the overall processing time.

When several flights converge and travellers accumulate, it can create a funnel effect leading into the pre-primary waiting area, which may cause lineups. Due to infrastructure and space limitations, travellers may have to be staged prior to entering the CBSA processing area.

Each Airport Authority is responsible for the planning and coordination of the required holds and flow of travellers throughout the terminal building.

What is the CBSA doing to reduce the NEXUS backlog?

The CBSA and US Customs and Border Protection are working closely to implement measures necessary to reopen the Canadian locations. We are also exploring other options to increase capacity, such as virtual interviews for renewing members.

It will take time to clear this backlog. Those applying for a NEXUS card for the first time may have to wait a year or longer to complete the interview.

In the meantime, membership validity is being extended for renewing members who are unable to complete their interview in person. We remind renewing members to submit their application before the expiry of their current membership to ensure they are able to benefit from this extension.

Can CBSA leverage other programs to improve border wait times?

In terms of Canada not leveraging trusted traveller programs to their full extent, it's important to note the investments currently underway by the CBSA to modernize processing for all travellers. Advance reporting, dynamic risking and biometric verification will facilitate the processing experience of many residents and visitors.

Do we have Wi-Fi at all ports of entry now?

Not yet. There has been significant progress and as of November 9th, across all CBSA Regions, Wi-Fi is available at 96 Ports of Entry out of a potential 116.

Public Wifi was installed at these ports of entry primarily for the public to complete or modify their ArriveCAN Submissions.