Ombudsperson Final Update – The Lockout: Communication Was the Key

From February 8 to 9, 2021, the Canada Revenue Agency (CRA) reviewed user IDs and passwords, referred to as “credentials,” for its online accounts so that it could identify any information that could potentially be compromised and lead to unauthorized access. The CRA’s review identified 187,000 accounts that could be accessed using potentially compromised credentials.

To secure the affected accounts, the CRA locked them on February 11, 2021. Then, on February 16, 2021, the CRA removed the email addresses from 119,200 of these accounts. Taxpayers could still receive paper mail from the CRA while they did not have access to their account.

Normally, when the CRA removes an email address from an account, it sends out an automatic email to the taxpayer. This email is usually suppressed when the CRA is locking the account without first consulting with the taxpayer. However, in this case, the CRA did not prevent this email from being sent. As a result, the CRA unintentionally sent an email to each of the 119,200 taxpayers whose email address had been removed. Within about an hour, the CRA realized it had sent the emails in error and soon began to hear from the media.

The lack of clear communication from the CRA during this situation led to us opening this examination. Our goal was to examine the CRA’s communication efforts and identify any opportunities to improve its communication to taxpayers.

More specifically, the examination highlighted a recurring issue at the CRA, where it communicates reactively rather than proactively. The examination also pointed out that taxpayers should not need to call the CRA to find out more information, especially in the context of the recurring issues with reaching its contact centres. 

Our observations and findings during this examination touched on the crisis itself and the CRA’s communication approach to handling it. 

One of the main issues we found during this examination was that the CRA was not prepared to share information about the action it took. It did not communicate with taxpayers in a timely manner after it locked out 187,000 of them and unintentionally emailed 119,200. However, it should have been prepared to share information as soon as it locked the accounts.

When examining this issue, we recognized it as a crisis for the CRA and the 187,000 affected taxpayers. For the CRA to effectively put people first, it needed to view this situation as a crisis and not underestimate or fail to recognize its seriousness.

To communicate effectively in a crisis, we must first understand how people process information during a crisis.

During a crisis, people respond better to messages that are direct and concise. However, some of the messages the CRA provided during this crisis were neither. The CRA should have made taxpayers aware that it was actively pursuing an alternative approach to help them regain access to their CRA accounts. By doing so, it would have lessened the burden it had created for its contact centres, as well as the frustration and anxiety experienced by many taxpayers.

Additionally, people rely on credible sources for information to guide them through crises. The Government of Canada’s website, Canada.ca, has built a reputation as a credible source for all Government of Canada communications and information. However, after this incident occurred, we found it concerning that there was a lack of information available on Canada.ca and that the CRA relied on social media to provide the full picture.

Further, because certain social media platforms have a limited character count, any information posted on social media should link to a Canada.ca web page with more details. However, the CRA did not provide a link from its social media posts to Canada.ca.

While communication is key, consistency in the messaging is equally important. Consistency helps to build trust and confidence in the messaging. However, for this crisis, the CRA’s messaging was inconsistent throughout, from its contact centre agents to the media, from Canada.ca to its social media accounts with Facebook, LinkedIn, and X (formerly known as Twitter). 

We commend the CRA on being proactive by identifying potentially compromised credentials and safeguarding sensitive information against constantly evolving threats. However, because it had sent the notification emails, the CRA had to be reactive rather than strategically prepared to communicate how it safeguards sensitive information. While it communicated important information to the media, it did not effectively communicate with taxpayers directly.

Because the CRA did not follow an adequate crisis communication strategy, its approach created some unique issues, many of which further exasperated the problem. Specifically, the CRA:

• provided a statement on LinkedIn, which was not easily accessible to some
• lacked updated directives on what to do in a crisis
• did not have a progressive communication approach
• failed to make decisions empathetically
• did not conduct a post-mortem to identify its communication missteps

We made five recommendations in the report. The CRA agreed with all of them, created and completed an action plan. However, this action plan did not sufficiently address all aspects of each agreed recommendation. 

The Taxpayers’ Ombudsperson recommended that the CRA conduct a formal review of its processes to ensure it has a flexible plan that provides for a coordinated effort to proactively inform Canadians, in a timely manner, namely on Canada.ca, through social and traditional media, and email about issues that could affect them.

The CRA agreed with the recommendation. However, its response did not detail the concrete actions it would take, but rather its current processes. Consequently, taxpayers and our Office continue to observe issues related to communications at the CRA. We were hopeful that when the CRA provided an update, it would detail more of the actions it has taken in light of the recommendation we made; however, this was not the case. No further update was provided.

It remains unclear how the processes that were in place when the issue happened would prevent any reoccurrence. Therefore, we have concluded that the CRA’s action plan did not address recommendation 1. 

The Taxpayers’ Ombudsperson recommended that the CRA create an update schedule for its contextual alerts to ensure the information that it is still providing is helpful and up to date.

Although the CRA agreed with this recommendation, its action plan implied that it would not create an update schedule for its contextual alerts. According to the CRA, contextual alerts are placed on Canada.ca web pages based on operational requirements or issues that arise, and they are reviewed and updated on a case-by-case basis. Additional information the CRA provided explained what it does to keep its contextual alerts up to date and the challenges in doing so.

The CRA’s agreement with recommendation 2 did not align with its action plan. Therefore, we have concluded that the CRA’s action plan did not address recommendation 2. Furthermore, even recently, three years after we made this recommendation, there remains reoccurring issues with contextual alerts being out of date that we continue to flag to the CRA. Addressing issues on a case-by-case basis, rather than developing an efficient process, leads to taxpayers being provided out of date information that can cause confusion. 

The Taxpayers’ Ombudsperson recommended that the CRA ensure that it always provides a link for more information to the Government of Canada’s web presence, such as Canada.ca, from its social media posts.

The CRA agreed with this recommendation. It indicated in its action plan that it already follows this best practice and requirement under the Directive on the Management of Communications. That said, even though the CRA is required to follow this practice, it did not do so during the lockout crisis, demonstrating that it does not always follow the requirement. The CRA could have explained what steps it could take to ensure that its social media posts always include a link to Canada.ca for more information.

This issue came to the forefront once again during a new crisis, namely the Canada Post strike. Many taxpayers were expecting benefit payments by mail. When there was a strike at Canada Post, the CRA once again did not follow the required process, and its social media post on X did not include a link to Canada.ca for more information. The CRA knew the importance of the post; therefore, it pinned it. However, because the CRA only provided additional details in pinned comments, taxpayers without an X account were restricted from seeing anything else.

We subsequently requested that the CRA update its post to include a link to Canada.ca, but unfortunately the CRA chose not to do so. That said, after a subsequent request, the CRA indicated it would create a new post.

The problem was further compounded because the CRA’s web page that did have additional information was not easy to find by visitors to Canada.ca.

In light of these recurring issues, we have concluded that the CRA’s action plan did not sufficiently address recommendation 3. While the occurrence is not frequent, the CRA should develop a process to ensure it always includes a link to Canada.ca on its social media post, especially in a crisis.

The Taxpayers’ Ombudsperson recommended that the CRA make the information it provides to Canadian media outlets available to Canadians at the same time, for example, through Canada.ca.

The CRA agreed with this recommendation. In its action plan, the CRA detailed the efforts it makes to have the same information available on all mediums and platforms at the same time, and the challenges it faces in doing so. The CRA stated the following: 

While we acknowledge the CRA’s efforts to make the information it sends to Canadian media outlets available to taxpayers at the same time and the challenges this presents, we believe the CRA could have improved its current processes in this regard. This practice can lead to the media being provided with more information than taxpayers. However, we have seen no substantial changes.

Therefore, we have concluded that the CRA’s action plan did not sufficiently address recommendation 4.

The Taxpayers’ Ombudsperson recommended that the CRA ensure that it has an issue management plan that is adaptable so it can efficiently communicate with Canadians when there is an emerging issue.

The CRA’s action plan detailed what it already has in place for issues management, including:

• the Issues Management Directive, which
  • is an overarching policy
  • does not describe specific processes
  • outlines roles and responsibilities for the Issues Management community and senior management at the CRA
  • states “As soon as an issue is identified, a proactive (when possible), coordinated approach is required to ensure that it is quickly analyzed, reported, and addressed”
• its Issues Management plans and approaches, which
  • are leveraged in the event of a major incident involving or implicating the CRA
  • require a coordinated response from some or several CRA branch heads
• its policies and committees to address and guide the CRA and the Issues Management Network through an emerging or ongoing crisis or issue, including: 
  • the Issues Management Directive
  • the Business Continuity Plan
  • the Crisis Management Readiness framework
  • the Quick Response protocol, supported by Communications
  • the Agency Operations Centre
  • the Incident Management Committee

The CRA Action Plan suggested that it would not be good practice to develop a formal issues management plan, as the CRA must be adaptable and may not follow the same process for every single issue. The CRA indicated the following: 

While we understand that having a non-adaptable formal issue management plan may not be feasible, our recommendation was for the CRA to develop a plan that could set out certain deliverables that could be used as a template for how it could handle crisis that could provide more details than the CRA’s current issue management directive.

Therefore, we have concluded that the CRA’s action plan did not sufficiently address our recommendation 5. 

Despite issues with its communication approach in the lockout crisis, there are improvements the CRA made after the lockout, as highlighted in the report. For example, the CRA has since improved how it safeguards its accounts. As of March 13, 2021, it no longer locks accounts when it identifies credentials that are potentially compromised. In these cases, it only revokes the affected credentials. In doing so, users can still access their CRA account using another credential, through a Sign-In Partner or provincial partner.

Moreover, since we opened our examination, the CRA has been proactive in communicating with taxpayers about any upcoming revocations. In these cases, it included the media and provided contextual alerts on its web pages. This helpful approach works in conjunction with its practice of now emailing specific instructions to taxpayers directly when a credential is revoked.

However, even though the CRA agreed with all five recommendations made in this report, its action plan generally presented what it has already been implementing. The CRA did not commit to exploring new communication approaches or review its current processes to improve them so it can efficiently communicate with taxpayers when there is an emerging issue.

As suggested in the title of this report, communication is the key. While pointing out the CRA’s lack of sufficient crisis communication strategy while handling the lockout crisis, this report also highlights many reoccurring issues with the CRA’s communication approach with taxpayers in general. That said, many of the issues we hear about from taxpayers stem from their communication with the CRA, specifically the information the CRA provides to them, which sometimes lacks accuracy, clarity and timeliness, or is simply not available. More work is needed, but it is up to the CRA to act on the recommendations that were made.

We will continue to monitor potential communication issues at the CRA from the complaints we receive, information the CRA provides online, outreach, and media reports.