Insider Risk Management (Guardian) Program – Phase I

Security Services Directorate
Security Branch

On this page

• Overview & Privacy Impact Assessment Initiation (PIA)
• Summary of the project, initiative or change
• Risk identification and categorization

Overview & Privacy Impact Assessment Initiation (PIA)

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Harry Gill
Assistant Commissioner and Agency Security Officer
Security Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Steven Morgan
Director General
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Travel and Other Administrative Services

Standard or institution specific class of record:

Security
PRN 931

Standard or institution specific personal information bank:

Insider Risk Management (Guardian) Program
TBS Registration Number: pending
Bank Number: CRA PPU 921

Legal authority for program or activity

Canada Revenue Agency Act

Matters over which Agency has authority

30(1) The Agency has authority over all matters relating to

• general administrative policy in the Agency;
• the organization of the Agency;
• Agency real property and Agency immovables as defined in section 73;
• human resources management, including the determination of the terms and conditions of employment of persons employed by the Agency; and
• internal audit in the Agency.

Human resources management

51(1) The Agency may, in the exercise of its responsibilities in relation to human resources management,

• determine requirements for the training and development of its personnel and fix the terms and conditions on which that training and development may be carried out;
• provide for the classification of Agency positions and employees;
• after consulting with the President of the Treasury Board, determine and regulate the pay to which persons employed by the Agency are entitled for services rendered, the hours of work and leave of those persons and any related matters;
• provide for the awards that may be made to persons employed by the Agency for outstanding performance of their duties, for other meritorious achievement in relation to those duties and for inventions or practical suggestions for improvements;
• establish standards of discipline for its employees and prescribe the financial and other penalties, including termination of employment and suspension, that may be applied for breaches of discipline or misconduct and the circumstances and manner in which and the authority by which or by whom those penalties may be applied or may be varied or rescinded in whole or in part;
• provide for the termination of employment or the demotion to a position at a lower maximum rate of pay, for reasons other than breaches of discipline or misconduct, of persons employed by the Agency and establish the circumstances and manner in which and the authority by which or by whom those measures may be taken or may be varied or rescinded in whole or in part;
• after consulting with the President of the Treasury Board, determine and regulate the payments that may be made to Agency employees by way of reimbursement for travel or other expenses and by way of allowances in respect of expenses and conditions arising out of their employment; and provide for any other matters that the Agency considers necessary for effective personnel management, including terms and conditions of employment not otherwise specifically provided for in this subsection.

Summary of the project, initiative or change

Overview of the Program or Activity

The legislative requirements to protect taxpayer information, commits the Canada Revenue Agency (CRA) and the Government of Canada (GC) at large to maintain public confidence in the Agency’s workforce’s ability to protect the information entrusted to the CRA. 

The Guardian Program is managed by a new unit within the CRA’s Insider Risk Monitoring Section (IRMS), a unit under the Personnel Risk Assessment Division (PRAD). The PRAD sits under the Security Services Directorate (SSD), which is one of several directorates under the Agency’s Security Branch.  

Our ongoing commitment to supporting our employees in building taxpayer confidence is the driving force behind the CRA’s Guardian Program, including:

• Severity and increasing frequency of public and private sector data breaches by current or former employees (e.g., Desjardin’s data breach in 2019).
• Priority to improve the protection of taxpayer information against internal activity risks (Minister’s Mandate Letter).
• Commitment to develop a program to enhance personnel security continuous assurance (Commissioner’s Performance Expectations 2020-2021 and 2021-22).
• Positioning the CRA to be fully compliant with the upcoming TBS policy requirements (still under development) on personnel security continuous assurance and placing the CRA at the forefront of GC organizations in this realm.

The goal of the Guardian Program is to create a holistic and comprehensive continuous assurance approach to mitigating insider risks. This will be accomplished by leveraging existing CRA capabilities and information, learning from the experience of other government departments and industry best practices, and assisting in the development of new security controls and processes.

An insider risk can be characterized by an individual with access to and/or knowledge of a company, organization, or enterprise that can exploit its vulnerabilities and misuse their access in a manner that negatively affects the company. This may involve espionage, sabotage or intellectual property theft. An insider can be anyone with access to specific resources, networks, systems, and operations and facilities, such as current or former employees, business partners, or contractors. An insider can also be acting on behalf of a foreign state actor, which could constitute a threat to Canada’s national security.

The Guardian program has three key objectives:

• Develop and implement a continuous assurance framework that leverages innovative technologies to identify and assess the risk of insider activities that could impact CRA’s security posture while respecting the privacy rights and civil liberties of individuals working for or with the CRA.
• Identify and address CRA policy and culture gaps, as well as related trends in non-compliance using a People First philosophy, that is, to better support service delivery and to make it easier for employees, contractors, and trusted partners to understand and comply with their security responsibilities.
• Develop and implement a mechanism that supports employees at all levels in consistently applying the CRA Integrity Framework.

The CRA’s approach to personnel security continuous assurance will look closely at both how security incidents related to insider activities happen and why they take place. The outcome will be establishing a framework / mechanism for identifying technical and behavioural indicators that can proactively identify potential risks. This converged approach involves centralizing the orchestration of security and other controls across various threat domains.

During Phase I of the Guardian Program, user information from various CRA systems will be collected and analyzed to identify alerts which are shared with CRA stakeholders, who, in turn, are responsible for further assessing/investigating those alerts. 

The Guardian Program will aim to further protect the information, assets, systems and revenues entrusted to the CRA from insider risks by applying the People First philosophy, while continuing to respect the privacy rights of employees and individuals working for or with the CRA. The Agency’s development of the Guardian program is well aligned with the other continuous assurance initiatives currently underway in the Government of Canada.

Insider risk mitigation includes security controls that detect, prevent, and respond to insider activity by integrating and analyzing available technical information and anomalous behaviour to provide continuous assurance while respecting privacy requirements. Empowering employees to comply with security obligations through education, care, trust and support at the forefront, while verifying the effectiveness of our security controls, are the cornerstone of a robust Guardian Program.

For the purposes of this PIA, the term “Insider Risk” will be used to refer to the topic, in general and to describe more specific incidents involving inadvertent human error, as well as malicious actions.

Scope of the Privacy Impact Assessment

The PIA approach adopted by the Treasury Board Secretariat (TBS) is iterative in nature and advises that PIAs should be undertaken when personal information is used for or is intended to be used as part of a decision-making process that directly affects the individual, and for a new or substantially modified program or activity.

The methodology and approach outlined in the TBS’ Directive on Privacy Impact Assessment and the Office of the Privacy Commissioner’s (OPC) Expectations: A Guide for Submitting Privacy Impact Assessments to the Office of the Privacy Commissioner of Canada were used as the basis for this document.

This PIA focuses on the implementation (April 1, 2023) of Phase I of the Guardian Program, which includes the description and analysis of the collection, use, disclosure, and retention of personal information. 

Specifically, the scope of this PIA includes the following:

1. Collection of personal information from internal stakeholders in order to create models;
2. Storage, access, and use of the personal information collected by the Guardian Program;
3. Business rules and procedures in creating and analyzing data/data models, as well as the creation of alerts;
4. The thresholds and procedures utilized to create/not create an alert;
5.  Sharing an alert with internal stakeholders;
6. Retention and disposition of Phase 1 records.

The development of this PIA included the following: 

• Collaboration and consultations with CRA representatives/stakeholders, including ATIP – Privacy Policy, Legal Services, Information Management, Human resources/Labour relations and Security/IT Security;
• Review of TBS publications such as CRA’s submission to Information about Programs and Information Holdings (formerly Info Source): Sources of Federal Government Information;
• Review of legislation and policies pertaining to CRA’s programs; and
• Review of process documents pertaining to the Guardian and its implementation.

Out of Scope of this PIA

This iteration of the PIA does not include the full slate of detection models and does not include any new systems and/or IT-based tools. Updates to this PIA are anticipated as the CRA determines the scope and timelines of future phases of the Guardian Program.

Also out of scope are the investigative activities and disclosures of internal stakeholders who receive an alert from the Guardian Program, the investigative procedures of those internal stakeholders and the potential subsequent administrative actions (training/awareness, employee discipline, prosecution).  This includes fraudulent actions contravening the Criminal Code of Canada or the Financial Administration Act and other corrective measures that may be taken by the Agency leading to criminal investigations and prosecution by other investigative bodies (i.e., RCMP). While the potential outcomes of these cases will be referred by CRA for investigation purposes, the actual investigations themselves are considered to be out of scope of this PIA.

Risk identification and categorization

A) Type of program or activity

B) Type of personal information involved and context

C) Program or activity partners and private sector involvement

D) Duration of the program or activity

E) Program population

F) Technology & privacy

G) Personal information transmission

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

The sensitivity of information utilized through the Guardian Program is considered Protected B.

In the event of a privacy breach (unauthorized use/disclosure), the possible impacts to the individual or employee could include loss of privacy, moderate personal financial injury and or embarrassment to the employee.