Appearance of the Chief Information Officer and Canadian Digital Service on the Government’s Response to the COVID‑19 Pandemic (Cyber Security) at the Standing Committee on Government Operations and Estimates (OGGO)

Opening Remarks for Marc Brouillard, Chief Information Officer of Canada, to the Standing Committee on Government Operations and Estimates (OGGO) regarding the Government’s Response to the COVID‑19 Pandemic (Cyber Security)

Ottawa

May 31, 2021

Thank you, Mr. Chair.

I am pleased to be joined today by Aaron Snow, Chief Executive Officer of the Canadian Digital Service, along with my colleagues from the Communications Security Establishment and Shared Services Canada.

After my opening statement, my colleagues and I will be available to answer the Committee’s questions.

Mr. Chair, it may be helpful to briefly explain the roles and responsibilities of the Office of the Chief Information Officer as it pertains to cyber security in the Government of Canada.

The Office provides strategic direction and leadership in information management (IM), information technology (IT), security, privacy, and access to information across the Government of Canada.

We also provide support and guidance on capacity-building, project management and oversight across the Government of Canada.

Treasury Board policy instruments outline the roles and responsibilities for government cyber security management and departmental management. Leveraging the Policy on Government Security and the Policy on Service and Digital, we provide strategic direction and oversight.

We define cyber security requirements to ensure that Government of Canada and departmental information and data, applications, systems and networks are secure, reliable and trusted. During cyber security events, The Treasury Board of Canada Secretariat (TBS) will perform strategic coordination, which may include the issuance of strategic direction to departments and agencies on measures to minimize the government-wide impact.

This is critical work, which is why our Office works closely with the Canadian Centre for Cyber Security and Shared Services Canada to collectively form the Government of Canada IT Security Tripartite, established to develop and maintain a coordinated and collaborative approach to enterprise IT security. This includes maintaining awareness of the global cyber threat environment, regularly scanning for new vulnerabilities that may impact government systems, and ensuring there is a coordinated response to potential and active threats through the Government of Canada Cyber Security Event Management Plan.

And this work has only intensified over the past 14 months, Mr. Chair.

Throughout the pandemic, we have been working very closely with Shared Services Canada to support government operations by ensuring that secure IT infrastructure and systems continue to enable the delivery of critical federal services.

Virtual collaboration was a key element in ensuring that continuity of operations. To enable this, the Government of Canada had to adjust rapidly, enabling 290,000 employees and contractors to work securely and remotely, representing a 60% increase in remote connections from pre-pandemic levels.

From the early days of the pandemic, TBS, Shared Services Canada and the Communications Security Establishment worked closely together to address the quickly evolving needs of the government. Shared Services Canada procured and provisioned new devices and equipment, and rapidly deployed new secure cloud-based collaboration and communication systems, while the Office of the Chief Information Officer provided resources, advice and guidance to Government of Canada departments, employees and contractors on working remotely securely. During this time, the Communications Security Establishment provided ongoing advice on the evolving cyber threat conditions related to the pandemic.

This was to ensure that public servants could continue serving Canadians, all while ensuring that the security, privacy and integrity of government information were not compromised.

Another example of collaboration is the work of the Canadian Digital Service, a team within TBS that collaborates with departments to address service delivery challenges.

The Canadian Digital Service has developed GC Notify, a platform tool that allows departments to quickly and easily “push” email and text messages to subscribers.

When the pandemic started, misinformation was prevalent. The Canadian Digital Service, Service Canada and Health Canada came together to use GC Notify to build “Get Updates on COVID‑19,” an email service to get people quick and trusted information about COVID-19.

Since launch, the service has securely sent over 5.5 million notifications to subscribers.

Indeed, Mr. Chair, security has been a priority throughout the pandemic.

With so many public servants working from home, we have taken concrete steps to ensure the ongoing security and safety of government networks.

We have robust systems in place to monitor, detect and investigate potential cyber security threats to information, including new and emerging threats that resulted from working remotely.

Safeguards such as enhanced and enterprise secure remote access, digital signature workflows, as well as appropriate policy guidance, have been used to protect information, while ensuring employees can continue delivering trusted services and programs to Canadians.

It has also been working to protect the Government of Canada by defending important programs against cyber threats – including COVID-related benefits such as the Canadian Emergency Response Benefit.

The Centre is constantly monitoring the security of cloud usage across the Government of Canada and evaluating cloud applications, including for the Public Health Agency of Canada.

Mr. Chair, the COVID‑19 pandemic continues to transform the operational and service landscape of government departments.

It has forced us to accelerate digital transformation efforts that were already underway and to move quickly to deliver new services that directly support Canadians.

At each step of the way, security has remained at the forefront.

We remain focused on continuously enhancing cyber security in Canada by preparing for all types of cyber incidents and protecting Canadians and their data.

Thank you, Mr. Chair.

We are ready to take the Committee’s questions.

Standing Committee on Government Operations and Estimates (OGGO)

Issue

What has the government done on the digital front to address operational and service delivery challenges related to the COVID‑19 pandemic?

Key facts

• The Office of the Chief Information Officer is working with Shared Services Canada, the Canadian Digital Service and the Digital Transformation Office to support the operation of government IT infrastructure and systems and maintain continuity of critical federal services.
• The Digital Transformation Office is coordinating the whole-of-government approach to online citizen service at Canada.ca/coronavirus with Health Canada, the Public Health Agency of Canada, the Privy Council Office and Service Canada.
• Following COVID, the Secure Remote Access capacity was increased to support 300,000 simultaneous connections, which represents roughly 72% of the employees working for federal entities supported by Shared Services Canada.
• Over 282,855 accounts for Microsoft 365 were created, supporting employees across the government with collaborative tools.
• The mobile phone inventory grew by 45,000 new accounts during the pandemic. This includes smartphones (voice/text/data) and regular mobile devices (voice/text).

Response

• We are accelerating our efforts for digital transformation during this pandemic to continue advancing an open, secure and resilient digital government.
• We are actively supporting the ongoing operation of IT infrastructure and systems and have also increased the federal network’s capacity so that critical services can continue.
• We are ensuring that departments and public servants have the knowledge, tools and equipment they need to work remotely. This includes procuring and provisioning new devices and equipment, and rapidly deploying new cloud-based collaboration and communication systems government-wide.
• Working with many departments since early March 2020, the Digital Transformation Office has been coordinating the whole-of-government web response to COVID‑19, constantly improving the user experience through evidence-based updates on Canada.ca/coronavirus.
• The Canadian Digital Service is helping Canada respond to the COVID‑19 crisis by working with departments and other jurisdictions to build new open source tools and services such as GC Notify, a tool that provides any department with the ability to send email or text notifications quickly.

Background

The COVID‑19 pandemic continues to transform the government’s operational and service landscape. In mounting its response, the government is accelerating its digital transformation, delivering results that directly support Canadians during this time of crisis while strengthening the government’s foundation for becoming a more open, people-centric and resilient digital government into the future.

The Office of the Chief Information Officer of TBS is working with Shared Services Canada, the Canadian Digital Service and the Digital Transformation Office to actively support the ongoing operation of the government’s IT infrastructure and systems and maintain continuity of critical federal services.

In parallel, Shared Services Canada and the Office of the Chief Information Officer are ensuring that departments and public servants have the knowledge, tools and equipment they need to work remotely. This includes procuring and provisioning new devices and equipment, and rapidly deploying new cloud-based collaboration and communication systems government-wide.

The Office of the Chief Information Officer is in continuous contact with the Canadian Centre for Cyber Security to maintain awareness of the global cyber threat environment, including regular scanning for new vulnerabilities that may impact the government.

The Office of the Chief Information Officer is working closely with departments and agencies to support service delivery by strengthening business continuity planning, identifying critical services, and focusing committee forward agendas on COVID‑19-related efforts. This includes working with Shared Services Canada and Public Safety Canada to identify critical service interdependencies, including between services identified in departmental service inventories, critical services and the IT systems that support them.

TBS has reached out to chief information officers from all departments to understand their unmet staffing needs in priority areas, and to develop a tool to centrally identify and deploy talent to the most-needed areas. This includes repurposing and upgrading features on the Talent Cloud platform to create the GC Talent Reserve, a tool to capture staffing needs and available talent. This will be used initially for the chief information officers community, and the Office of the Chief Information Officer is working with the Office of the Chief Human Resources Officer to determine its suitability for wider use. 

TBS is actively supporting government in managing its legislative and policy responsibilities during the COVID‑19 response, including those related to IM. Key activities include system modifications and website notifications, as well as regular guidance to departments and agencies. The Office of the Chief Information Officer also improved the searchability of open government resources, including datasets and infographics, related to COVID‑19 by creating a COVID‑19-specific search functionality on open.canada.ca.

The Office of the Chief Information Officer is engaging within the Government of Canada, as well as across Canadian jurisdictions, sectors and internationally, to establish strong lines of communication, share best practices, and support a coordinated response by chief information officers to the COVID‑19 pandemic.

On the global stage, this includes engaging partners through key forums like the Digital Nations, the Open Government Partnership, and the Organisation for Economic Co-operation and Development (OECD).

At the national level, the Office of the Chief Information Officer is leveraging its role as co-chair of the Public Sector Chief Information Officer Council and the Chief Information Officer Strategy Council to bring together chief information officers from provincial and territorial public sectors, and from Canada’s public and private sectors, respectively, for coordinative action on COVID‑19 challenges.

The Office of the Chief Information Officer is also exploring opportunities to leverage private sector expertise to support the COVID‑19 response. This includes launching a task force to act as a coordinative hub for all IM/IT COVID‑19 vendor offers of support across government.

The Digital Transformation Office is working with lead COVID‑19 departments to ensure that the COVID‑19 information and services provided through Canada.ca/Coronavirus are provided in an integrated, whole-of-government way. It’s providing rapid prototyping and usability research and testing skills to key COVID‑19 files, such as vaccines, public health guidelines, travel, ArriveCAN, the Canada Recovery Benefit, the Canada Emergency Wage Subsidy, and the Canadian Emergency Response Benefit. Moreover, the Digital Transformation Office has put in place a performance measurement framework to gather, evaluate and improve the performance of top COVID‑19 information and services so that departments and agencies have data and direct feedback from citizens and businesses to support improvements.

On a national level, the Digital Transformation Office established a COVID‑19 web working group with provincial and territorial counterparts to improve the coordination of COVID‑19 efforts across jurisdictions, including sharing usability testing results and feedback received from citizens and business through Canada.ca. The Digital Transformation Office is also working with the Communications Community Office on a collective staffing process to bring in more skilled user experience researchers, content designers and digital communication specialists to fill the talent gap in these functional areas in the federal government.

The Canadian Digital Service is helping Canada respond to the COVID‑19 crisis by working with departments, other jurisdictions and sectors to build new open source tools and services and leverage existing ones.

For example, the Canadian Digital Service is helping combat misinformation during COVID‑19 with GC Notify, working with Health Canada to launch a new notification service that has sent more than 5 million messages to Canadians to provide them with up-to-date and accurate information on COVID‑19 that they can trust.

The Canadian Digital Service also collaborated with Employment and Social Development Canada and the Canada Revenue Agency to launch an online service that has already helped more than 1 million Canadians receive personalized advice on financial help available to them from the government during the pandemic.

This includes partnering with public and non-profit partners (including the Canada School of Public Service) to leverage available open source tools and services for effective collaboration and service delivery through the Open Call initiative.

Issue

In May 2021 (TBC), Canada’s Minister of Digital Government will be releasing the Digital Strategy for the Government of Canada.

Key facts

• On November 20, 2019, the Government of Canada announced the Honourable Joyce Murray as Minister of Digital Government, with a mandate to lead work across government in its transition to a more digital government and improved services to citizens.
• The Office the Chief Information Officer, Shared Services Canada and the Canadian Digital Service have worked collaboratively to support the operation of government IT infrastructure and systems and maintain continuity of critical federal services.
• Four key areas of work to enable digital transformation have been identified:
  • modernizing how the government replaces, builds and manages major IT systems
  • providing services to people when and where they need them
  • taking a coordinated approach to digital operations
  • transforming how we work, recognizing that this isn’t just an IT challenge – it’s also a culture challenge
• The strategy is an online, evergreen plan that lays out the necessary steps to transition to a truly digital government that employs up-to-date technology to deliver the type of services citizens and residents expect in a digital age. The strategy, along with the Digital Operations Strategic Plan and the Government of Canada’s Digital Standards, will provide the framework for the government to deliver secure, reliable and easy to access services to citizens, residents and businesses.

Response

• The Government of Canada is accelerating its digital transformation and strengthening its foundation for a more open, people-centric and resilient digital government, now and into the future.
• This includes enabling new ways to deliver more secure, reliable and easy to use services to Canadians.
• The Digital Strategy is an iterative plan to transform Canadians’ experience with the Government of Canada and offer the level of service we have all come to expect in the digital age.
• The Digital Strategy outlines four key areas of work to deliver secure, reliable and easy to access services to citizens, residents and businesses.
• First, we are modernizing the way that we replace, build and manage major IT projects.
• Second, the government is also exploring options for new platforms, tools and services, designed for the people they serve, that make it easier for Canadians to find and use services.
• Third, we are building and strengthening our foundational infrastructure to support whole-of-government operations, meet departments’ digital operational needs, and continue to protect information, people and assets to deliver trusted programs and services to citizens, whether digital or in person.
• Finally, this accelerated transformation includes looking at ways to transforming the institutional barriers to digital change within government, ensuring we always have the right digital skills, in the right places, supported by a strong, enabling leadership that empowers the change.
• Throughout this transformation, we continue to advance the Digital Standards and Digital Operations Strategic Plan to ensure that users and their needs are at the heart of our services, programs and operations.

Background

On November 20, 2019, the Government of Canada announced the first stand-alone Minister of Digital Government, with clear mandate letter commitments to lead work across government to transition to a more digital government and improve citizen service.

Issue

The Digital Operations Strategic Plan is the Chief Information Officer of Canada’s annual, forward-looking three-year strategic plan. It sets government‑wide priorities and lists key actions that departments and agencies need to transition to a more digital government and to meet the requirements of the Policy on Service and Digital.

Key facts

• The Digital Operations Strategic Plan for 2021–24 was published on May 13, 2021.
• In April 2020, the Treasury Board Policy on Service and Digital formalized the requirement for the Chief Information Officer of Canada to issue “an annual, forward‑looking 3‑year enterprise‑wide plan that establishes the strategic direction for the integrated management of service, information, data, information technology (IT) and cybersecurity.”
• The 2021–2024 Digital Operations Strategic Plan fulfills this requirement and outlines four strategic pillars – or areas of work directly related to the Digital Government Strategy – necessary to make digital government a reality for Canadians and the public service. These pillars are:
• modernize legacy IT systems
• improve services
• implement enterprise
• transform the institution

Response

• The Government of Canada is accelerating its digital transformation and strengthening its foundation for a more open, people-centric and resilient digital government, now and into the future.
• The 2021–2024 Digital Operations Strategic Plan provides the strategic direction for the government’s integrated management of service, information, data, IT and cybersecurity.
• The current Digital Operations Strategic Plan has been updated and refreshed to reflect the accelerated digital transformation and lessons learned from the COVID‑19 pandemic.
• The Digital Operations Strategic Plan is made up of four areas of work which represent the objectives that support the achievement of a transition to a more digital government:
  • modernizing the way we replace, build and manage major IT systems
  • providing services to people when and where they need them
  • taking a whole-of-government approach to digital operations
  • transforming how we work

Background

In fall 2016, in response to an audit conducted by the Office of the Auditor General, the Office of the Chief Information Officer of Canada in TBS issued strategic direction to federal departments and agencies for IM and IT by publishing the first Government of Canada Information Technology Strategic Plan.

As committed to in response to the audit, the first annual update to the strategic plan was produced in 2017. It was then refocused in fall 2018 to include service alongside IM and IT priorities and renamed the Digital Operations Strategic Plan.

In 2019, the government reaffirmed its commitment to digital government and better service delivery, a commitment strengthened when the Prime Minister created a separate portfolio for digital government and appointed its first stand-alone Minister responsible for the Digital Transformation of Government.

In April 2020, the Treasury Board Policy on Service and Digital formalized the requirement for the Chief Information Officer of Canada to issue “an annual, forward‑looking 3‑year enterprise‑wide plan that establishes the strategic direction for the integrated management of service, information, data, information technology (IT) and cybersecurity.”

The 2021–2024 Digital Operations Strategic Plan, published on May 13, 2021, fulfills this requirement and outlines four strategic pillars – or areas of work directly related to the Digital Government Strategy – necessary to make digital government a reality for Canadians and the public service. These pillars are:

• modernize legacy IT systems
• improve services
• implement enterprise
• transform the institution

Each pillar is articulated through priorities and associated actions that departments and agencies need to fulfill to advance the digital government agenda.

Deputy heads are responsible for developing their annual, forward‑looking three‑year integrated plans for service and digital in alignment with the Digital Operations Strategic Plan and in support of their departmental mandates and requirements.

Issue

How will investments included in Budget 2021 support digital government in Canada?

Key facts

• Budget 2021 proposed to invest a total of $101.4 billion over the next three years.
• The Budget includes $648 million over seven years to TBS and Employment and Social Development Canada to continue implementing Benefit Delivery Modernization, invest in Service Canada’s IT systems and related activities, and support service delivery to Canadians.

Response

• Budget 2021 recognizes the critical role played by digital government and provides the investments needed to continue the government’s digital transformation and ensure a resilient digital government for the future.
• Proposed key investments outlined in the budget will enable the government to improve and defend our cyber networks, repair and replace critical IT infrastructure, and to continue to help departments move digital applications to modern computing facilities.
• Budget 2021 investments will also allow continued work on the Benefit Delivery Modernization program and support the government’s future service delivery to Canadians.
• We look forward to working together to ensure the investments made through Budget 2021 continue to strengthen the Government of Canada’s ability to meet the needs and expectations of Canadians, now and into the future.

Background

Budget 2021 proposed to invest a total of $101.4 billion over the next three years, which is forecasted to result in a deficit of $354.2 billion in 2020–21. The deficit is further forecasted to decline to $30.7 billion in 2025–26, approximately 1% of GDP.

To support digital government, Budget 2021 committed:

• $88 million over four years, with $25.8 million ongoing, to the Canadian Digital Service to continue to design and deliver digital government services
• $34 million over five years, with $7 million ongoing, to the Office of the Chief Information Officer to continue to provide strategic direction and leadership in the areas of IM, IT, security, privacy and access to information across the Government of Canada
• $456.3 million over five years, starting in 2021–22, with $60.7 million in remaining amortization and $62.2 million ongoing, to Shared Services Canada and the Communications Security Establishment, to ensure the security of Canadians’ information (allocation of funds between Shared Services Canada and the Communications Security Establishment is not publicly disclosed)

Other Budget 2021 investments supporting the government’s digital service delivery include:

Issue

How is cyber security addressed in the Government of Canada, including cyber threats that may pose a risk to government infrastructure, or when aimed at private enterprise?

Key facts

• TBS, Shared Services Canada and the Communications Security Establishment are the primary stakeholders with responsibility for ensuring the government’s cyber security posture is effective and continues to evolve.
• The Royal Canadian Mounted Police (RCMP) is the primary investigative department on all cyber security incidents dealing with actual or suspected cybercrime of non-state origin on the government’s infrastructure.
• The Policy on Service and Digital outlines the roles and responsibilities of departments for specific aspects of cyber security.
• The Policy on Government Security outlines the roles and responsibilities for lead security agencies.
• Government of Canada departments and agencies play an integral role in establishing governance to ensure the integrated management of service, information, data, IT and cyber security within their department.

Response

• Government of Canada departments and agencies, in collaboration with lead security agencies, are responsible for ensuring that cyber security risks are assessed and mitigated within their organization.
• Together, TBS, Shared Services Canada and the Communications Security Establishment work to ensure the government’s cyber security posture is current and effective.
• We have robust systems and tools in place to monitor, detect and investigate potential threats, and take active measures to address and neutralize these threats.
• The government will continuously work to enhance cyber security in Canada by preparing for all types of cyber incidents, protecting Canadians and their data.

Background

Issue

In the context of the COVID‑19 pandemic, a large portion of the public service is working from home. Concerns have been raised regarding potential risks associated with security and IM.

Key facts

• In her letters to the President of the Treasury Board on April 2, 2020, and April 28, 2020, the Information Commissioner of Canada reminded the government of the importance of documenting decisions and proactively disclosing data during these extraordinary times.
• In April 2020, TBS released guidance entitled “Managing government information when working remotely” to guide employees in managing government information securely when working remotely.
• On May 28, 2020, the President wrote to his Cabinet colleagues encouraging Ministers to proactively publish as much information as possible related to COVID‑19 and reminded them of the importance of ensuring best practices in IM.
• TBS released an updated version of the Guideline on Service and Digital in November 2020 that provided organizations with the most current advice and guidance for the strategic management of information and data.

Response

• The government remains committed to managing information securely and effectively, in accordance with its sensitivity, while ensuring transparency, openness and accountability to Canadians.
• All public servants are expected to manage, secure and document information according to legislative requirements and Treasury Board policies, whether working on-site or remotely, and regardless of the tools they use. Tools that are publicly available can only be used for unclassified, non-sensitive discussions that would be permitted in an open, public setting.
• Robust systems are in place to monitor, detect and investigate potential cyber security threats to information that may result from working remotely.
• Safeguards such as encryption, encrypted virtual private network (VPN), encrypted storage devices and upgraded tablets, have been used to protect information, while ensuring employees can continue delivering trusted services and programs to Canadians.
• Guidance has been provided to departments and agencies emphasizing the importance of documenting decisions and adhering to IM security requirements and to notify departments that security policy requirements for the protection of government assets remain in place, including information, whether in the office or off-site.

Background

Government of Canada employees were reminded of the requirements to manage information securely and effectively in accordance with its sensitivity and all relevant policy and legislative requirements while working remotely. These requirements are set out in legislation, including the Library and Archives Act, as well as in Treasury Board policy instruments, including the Policy on Service and Digital and Directive on Service and Digital and the Policy on Government Security, including the Directive on Security Management.

These requirements include the obligation of employees to document decisions and activities of business value. This includes information, regardless of medium or form, which is created or acquired because it enables and documents decision-making in support of programs, services and ongoing operations, or supports departmental reporting, performance and accountability requirements. Information of business value, no matter where it is created or collected, is required to be transferred to and stored in the appropriate organizational corporate repository.

Employees are also required to ensure the security and proper handling of sensitive information, consistent with the security categorization of the information, as outlined in the Policy on Government Security instruments. This means respecting security markings, and making sure that appropriate tools, devices and methods are used to store, transmit, use and protect the information. In the case of third-party applications, such as Zoom and Google Drive, their use is acceptable for unclassified information. Employees have been reminded to use approved government tools and services for collaboration and communication, such as Microsoft 365, Microsoft Teams and GC Tools, wherever possible.

TBS continues to provide guidance to organizations on IM and security. Last April, we released guidance entitled “Managing government information when working remotely” as well as a toolkit to further guide employees in managing government information when working remotely. The toolkit has been updated regularly since its initial release to ensure it provides the most relevant and up-to-date guidance.

TBS also co-hosted a virtual security summit in October 2020 and reinforced the important leadership role of the government security community to continue to provide direction and guidance to employees on the protection of government information. This message was again re-emphasized to government chief security officers in an email from TBS in January of this year.

TBS hosted a virtual event last November for over 1,600 public servants to launch the Policy on Service and Digital, with a focus on the integrated approach of the policy that brings together technology, information and data, services, and cybersecurity. This event coincided with the release of updated policy guidance that provides organizations with the most current advice and guidance for the strategic management of information and data.

Issue

The Government of Canada’s response to cyber incidents such as GCKey, SolarWinds, Microsoft Exchange and the recent third-party supplier incident.

Key facts

• On August 5, 2020, the Government of Canada was made aware of a credential stuffing attack against the GCKey service.
• Of the roughly 12 million active GCKey credentials in Canada, the passwords and usernames of just over 9,300 GCKey credentials were used by bad actors to access government accounts.
• On December 13, 2020, SolarWinds disclosed a security advisory outlining recent malicious activity impacting SolarWinds Orion Platform resulting from a supply chain compromise. SolarWinds Orion software products are used to help monitor networks for problems.
• In early March 2021, Microsoft announced that they detected four zero-day vulnerabilities being exploited to compromise on-premises versions of Microsoft Exchange Server in limited and targeted attacks. Microsoft released out-of-band patches to address all four vulnerabilities.
• On March 12, 2021, a third-party printing services supplier to the government was impacted by a ransomware cyber event. Upon its detection, the supplier shut down all external access to their systems. This attack was not directed at the Government of Canada, nor its IT infrastructure.

Response

• The Government of Canada, like many other public and private sector organizations in the world, faces ongoing and persistent cyber threats.
• The government has robust systems and tools in place to monitor, detect and investigate potential threats, and to neutralize threats when they occur.
• TBS, the Canadian Centre for Cyber Security, Shared Services Canada and other partners work closely together to investigate and respond to the cyber events as soon as alerted, and to make data, applications and systems secure for Canadians.
• We work continuously to protect Canadians’ data and personal information against cyber threats. We will continue to work to identify cyber threats and vulnerabilities and preparing for and responding to all types of cyber incidents.

Background

In this past fiscal year, the Government of Canada experienced four notable cyber security events: GCKey credential stuffing attack, SolarWinds supply chain compromise, the exploitation of Microsoft Exchange critical vulnerabilities, and a ransomware incident at a third-party printing service that has contracts with the government. The incidents are the result of threats faced by public and private sector organizations alike.

Issue

The protection of personal information is paramount in Canada’s increasingly digitally enabled government.

Key facts

• The Government of Canada has to be particularly vigilant to ensure the protection of personal information.
• The Privacy Act requires that government institutions protect Canadians’ personal information. TBS privacy policies, directives and guidelines support institutions to meet these obligations.
• Since 2019, TBS has been implementing a Privacy Breach Action Plan, which focuses on strengthening the prevention and management of privacy breaches across government.
• Recent cyberattacks have highlighted the need to continue to protect personal information.

Response

• The Government of Canada takes the privacy of Canadians seriously.
• A number of policies guide federal organizations to build in privacy considerations, including the Policy on Privacy Protection, the Policy on Service and Digital and the Digital Standards.
• All new or significantly modified government programs that collect personal information must conduct Privacy Impact Assessments and provide them to the Office of the Privacy Commissioner and TBS.
• TBS has also been strengthening the prevention and management of privacy breaches across government through the Privacy Breach Action Plan, including those that might arise as a result of cyber incidents.

Background

The Policy on Privacy Protection and its related directives require institutions to undertake a Privacy Impact Assessment (PIA) for new or substantially modified government programs and activities that involve collecting, using or disclosing personal information.

A PIA is an evaluation process ensuring the sound management and decision-making as well as careful consideration of privacy risks with respect to the creation, collection and management of personal information as part of government programs or activities.

Institutions must provide PIAs to TBS and the Office of the Privacy Commissioner.

To support the government’s urgent response to the COVID‑19 pandemic, TBS issued an interim privacy policy and related directives.

Effective from March 13, 2020, to March 31, 2021, the interim policy and related directives gave institutional heads the discretion to undertake a more condensed, but still rigorous, analysis of privacy considerations to ensure privacy is protected in the implementation of urgent COVID‑19 initiatives.

These measures were used to ensure that privacy continued to be protected as the government delivered urgent initiatives in response to the COVID‑19 pandemic

Issue

Workplace measures to curb the COVID‑19 pandemic and protect the health and safety of federal employees affected institutions’ ability to respond to access to information and personal information requests in the first few months of the pandemic.

Key facts

• In response to public health direction on COVID‑19, most employees have been working remotely, and many had reduced access to documents and information systems that they would usually use to respond to requests.
• There are no provisions in the Access to Information Act or the Privacy Act to extend deadlines or place requests on hold due to an emergency.
• On May 28, 2020, the President wrote to his Cabinet colleagues encouraging Ministers to proactively publish as much information as possible related to COVID‑19 and remind them of the importance of ensuring best practices in IM.
• On June 3, the President sent a letter responding to the Information Commissioner’s recommendations shared on April 28, 2020, concerning the Access to Information and Privacy (ATIP) Online Request system, recognizing the importance of adhering to best practices in IM and mentioning upcoming government plans to better support information practices across government.
• On July 10, 2020, the Information Commissioner wrote to the President of the Treasury Board calling for strong leadership and concrete actions by government to repair the access to information system.
• As of April 26, 2021, of the 152 institutions that responded to TBS’s biweekly capacity questionnaire, 29 reported having full capacity to respond to requests.

Response

• The government remains committed to maintaining the openness and transparency of government during this challenging time.
• The Access to Information Act requires that government institutions make every reasonable effort to assist those who request information and respond to requests in a timely manner.
• Since the onset of COVID‑19 workplace measures, institutions have worked hard to mitigate the impacts on their ability to respond to access to information or privacy requests.
• In response to the Information Commissioner’s recommendations, we committed to making information related to COVID‑19 and its response proactively available.
• Institutions are asked to respond to a biweekly questionnaire regarding their capacity to receive, process and respond to requests, the results of which have been published on Open.Canada.ca.
• The government will continue to work with the Information Commissioner to meet Canadians’ needs for open, accessible and trustworthy information.

Background

Government of Canada employees are currently working remotely wherever possible to help slow the spread of COVID‑19. Consequently, most institutions are operating with significantly reduced on-site workforces, which limits their ability to respond to requests and within the timelines mandated by the Access to Information Act and the Privacy Act.

Issue

The conduct of the government’s Access to Information Act review

Key facts

• In 2016, the government committed to reform the Access to Information Act in two phases, with Phase I consisting of targeted amendments to deliver on specific commitments, and Phase II constituting a full review of the Act.
• Phase I was accomplished in June 2019, with targeted changes made by Bill C‑58, including a requirement for the President of the Treasury Board to undertake a review of the Act every five years, with the first review beginning by June 21, 2020.
  • The review was launched on June 18, 2020, focusing on three themes:
  • examining the legislative framework
  • opportunities to improve proactive publication to make information openly available
  • assessing processes and systems to improve service and reduce delays
• On March 31, 2021, the government launched public engagements on the review, and is currently receiving online submissions. The first virtual public event took place May 20, 2021. Other engagement opportunities are being planned for the coming months.

Response

• Access to information should reflect today’s digital world and Canadians’ expectations for accessible, timely and trustworthy information.
• On June 18, 2020, we launched a full review of the Access to Information Act.
• The review will take a broad look at access to information, which will include:
  • examining the legislative framework
  • identifying opportunities to improve proactive publication to make information openly available
  • assessing processes and systems to improve service and reduce delays
• On March 31, 2021, we launched public engagement and began receiving submissions through our online engagement portal.
• On May 20, 2021, we held our first virtual public event. There will be other opportunities for stakeholders, Indigenous groups and representatives, and interested Canadians to share their views over the coming months.
• This review is an opportunity for Canadians to participate in an open exchange about the right to access government information.

Background

Canada’s current access to information regime dates to 1983, when the Access to Information Act first came into effect. The Act represents a key cornerstone of the Canadian democratic system, but its administration across 265 federal institutions faces increasing pressures. In the last five years alone, the number of requests has more than doubled from approximately 68,000 requests in 2014–15 to more than 150,000 in 2019–20.

In 2015, the government made the reform of the access to information regime a key mandate commitment for the President of the Treasury Board. In 2016, the Government announced that it would review the Access to Information Act in two phases, with Phase I comprising a targeted set of amendments to deliver on specific commitments, and Phase II representing a full review of the Act.

Phase I, or Bill C‑58, was introduced in Parliament in June 2017 and received Royal Assent two years later, on June 21, 2019. One of the amendments made to the Act through Bill C‑58 was a requirement for the President of the Treasury Board to undertake a review of the Actwithin one year of Royal Assent, and every five years thereafter. This requirement represents Phase II of the government’s commitment to reform Canada’s access to information regime.

On June 18, 2020, the government launched the Access to Information Act review in fulfillment of the legislative requirement. The review focuses on three broad areas: reviewing the legislative framework, opportunities to improve proactive publication to make information openly available, and assessing processes and systems to improve service and reduce delays. The Terms of Reference, published on the review web page, outline the mandate of the review and indicate that a final report of recommendations will be submitted to the President of the Treasury Board by January 31, 2022.

The review is seeking the views of Canadians through an online engagement platform and virtual events. The review will also seek the views of national Indigenous organizations, and other Indigenous groups that are interested in access to information issues. A “What We Heard”report summarizing the input received will be made public in fall 2021.

The President of the Treasury Board invited the Information Commissioner and Privacy Commissioner to provide him with recommendations to improve access to information, given their important roles and expertise. Both Commissioners have responded and submitted their input into the review. The President of the Treasury Board has also sent invitations to the Multi-Stakeholder Forum on Open Government and National Indigenous Organizations. These invitations have been published on the review web page in support of an open and transparent review.

Issue

AI and quantum computing bring new challenges and opportunities. Governance and investments are required for the Government of Canada to adapt to these new technologies.

Key facts

• The Government of Canada’s Directive on Automated Decision-Making was introduced in March 2019 and came into force on April 1, 2020. It encourages the responsible use of automation and AI in delivering services to Canadians.
• Together, these tools help ensure that the government’s use of technology leads to more efficient, accurate, consistent and interpretable decisions.
• The Government of Canada relies on cryptography as an effective way to protect the confidentiality and integrity of information and to protect systems from cyberattacks.
• Quantum computing threatens much of the cryptography used today to protect the confidentiality and integrity of information and to protect systems from cyberattacks.
• Experts estimate that a large universal quantum computer could exist as early as the 2030s.
• Virtually all systems used by the Government of Canada will need to be updated or replaced in the coming years to support quantum-safe cryptography to address this threat.

Response

Background

Issue

Much of the Government of Canada’s applications, infrastructure and hosting environments are outdated, lack modern security, and are at constant risk of outages.

Key facts

• Digital services to Canadians are underpinned by the applications and infrastructure on which they reside.
• At present, only 36% of government applications are considered healthy.
• Many of these applications and their associated data remain hosted in legacy data centres, which, while being maintained through the Information Technology (IT) Repair and Replacement Program, have greater risks of service interruptions, loss of data, and security vulnerabilities.
• Shared Services Canada, in collaboration with TBS, supports the migration and modernization of these outdated and mission-critical government applications to safe and secure modern environments, either to the cloud or to a newer enterprise data centre.
• By adopting cloud computing, the government is better able to support a digitally enabled workforce and digital services for Canadians, particularly during this critical pandemic period.
• Moving application workloads from on-premise environments to the cloud supports green IT initiatives by reducing the corresponding carbon footprint.
• The protection and privacy of government data stored and processed in the cloud is a top priority for Shared Services Canada and includes compliance monitoring.

Response

• As government applications continue to deteriorate, we must prioritize investments to replace those applications that rely on aging IT and outdated infrastructure.
• The 2021 federal budget announced $300 million to Shared Services Canada over the next three years to repair and replace critical IT infrastructure and another $215 million to continue to help departments migrate digital applications to modern computing facilities.
• The government is building the digital foundation for modern service delivery to Canadians by adopting cloud technologies, modernizing IT systems, as well as the IT infrastructure and networks on which they reside.
• Shared Services Canada in collaboration with TBS is supporting these efforts, ultimately improving overall application health to provide efficient, secure and stable digital services.
• Over the last three years, the measure of overall health of the application portfolio has increased from 28% to 36% which is progress, but we need to continue this trend.
• TBS is providing departments and agencies with financial assistance to acquire the expertise to accelerate department readiness to modernize their applications.
• Shared Services Canada is providing core services to departments and agencies by assessing and modernizing IT infrastructure and works with departments on new initiatives to further advance cloud adoption, standardize support, improve processes and service levels and enhance security.
• Cloud adoption presents great opportunities for better serving Canadians through agility, elasticity, improved service levels and enhanced security.

Background

To provide Canadians with important programs and services, federal government organizations depend on Shared Services Canada to provide modern and reliable IT infrastructure and services.

To modernize/enhance the government digital services, Budget 2018 proposed significant investments to address evolving IT needs and opportunities, while proactively addressing cyber security threats. As part of this investment fund, TBS received $110 million over six years, starting in 2018–19, to be accessed by Shared Services Canada’s partner departments and agencies to help them modernize their applications by migrating them from older data centres into more secure modern data centres or cloud solutions.

In addition to the Budget 2018 investment fund, the following activities support departments in improving the health their application portfolio:

• The Chief Technology Officer for the Government of Canada co-chairs the Enterprise Architecture Review Board along with the Chief Technology Officer of Shared Services Canada, which defines current and target architecture standards for the government and reviews departmental digital proposals for alignment, which includes:
  • alignment to the 2018 GC Cloud Adoption Strategy that provides direction in delivering IT services using modern technologies
  • promotion and prioritization of enterprise solutions and reusable assets in order to reduce technical debt
• To reduce cyber security threats and vulnerabilities, TBS and the Canadian Centre for Cyber Security are continuously:
  • enhancing cyber security guidance and tools for digital identity, security and privacy
  • publishing a Zero Trust Security Model for use by departments
  • developing reusable cloud security code (that is, guardrails) available to departments to help accelerate their Cloud adoption
  • promoting secure application development practices and implementation of Top 10 Security Actions
• Departments are invited to share their cloud strategies and present lessons learned at the Cloud Technical Working Group and the Cloud Computing Network of Expertise in order to promote collaboration between departments.
• TBS is producing improved data driven insights from the government Application Portfolio Management framework to enable senior leaders in making empirical-based prioritization decisions regarding enterprise investments.
• TBS publishes guidance, standards and playbooks including but not limited to government Digital Standards, Cloud Adoption Playbook, and Zero Trust Security Playbook for Information System Solutions.
• TBS, in collaboration with industry, hosts an annual cloud event for government IT professionals (and scientists) to showcase their success stories in adopting cloud and modern application development practices.

Issue

With an unprecedented number of federal public servants working remotely, the Government of Canada has ensured that government workers are appropriately equipped to maintain continued operations.

Key facts

• There are approximately 287,000^{Footnote 1} federal public servants in the Government of Canada. In addition to this number are contract workers, students and casual workers forming a population of federal users that leverage technology on a daily basis in support of government operation. This total number does not include Canadian Forces Members, RCMP Civilian Members, RCMP Regular Force Members, employees on leave without pay, Ministers’ exempt staff and employees locally engaged outside of Canada.
• Federal users are averaging over 230,000 remote connections daily.
• Since March 16, 2020, government’s secure remote access capacity has increased by 72% effectively allowing for government operations to be delivered by a predominantly remote workforce largely unimpeded.
• As of March 2021, approximately 306,000 federal users are using Microsoft Teams – one of the tools that is part of the Microsoft 365 suite of applications – to collaborate, with more than 280,000 federal users participating in virtual meetings on that platform in the past month (March 2021).
• An Emergency Communication System has been implemented to support the government business continuity activities for up to, and including, Protected B work and collaboration. With over 680 users, it is designed to be operational even in the event of an interruption in the availability of government infrastructure.^{Footnote 2}
• Of the over 225,000 mobile phones deployed, over 183,000 are now enrolled on Wi-Fi calling, enabling employees to make and receive calls in areas with poor cellular service.

Response

• Our response to the COVID‑19 pandemic continues to transform the government’s operational and service landscape. In mounting our response, we have accelerated our digital transformation to better enable public servants in delivering results that directly support Canadians, while strengthening the foundation to become a more open, user-centric and resilient digital government for the future.
• We have deployed new tools that allow employees to work and collaborate remotely with their colleagues.
• The deployment of Microsoft 365 has been accelerated across government to allow collaboration and remote conferencing within and between departments, that follows appropriate levels of securit
• In situations where new equipment is to be purchased, federal organizations have been reminded of their duties to be stewards of public funds, and to ensure that value for money is considered in all actions.

Background

The pandemic has prompted an unprecedented shift, requiring a majority of the 287,000 federal public servants to work remotely.

TBS’s Office of the Chief Information Officer is working with Shared Service Canada to actively support the ongoing operation of the government’s IT infrastructure and systems and to maintain continuity of critical federal services.

Ensuring that departments and public servants have the knowledge, tools and equipment they need to work remotely means:

• increasing network capacity to support the rise in remote work across government
• prioritizing network access and IT services to maintain critical service continuity
• providing guidance on the use of tools such as Zoom, Google Meet and GCCollab when access to the government network was not available
• mobilizing the chief information officer community to identify support needs
• providing real-time feedback on IT needs in core service areas and coordinating government action to ensure key IT infrastructure continues to function

The Office of the Chief Information Officer is working closely with departments and agencies to support service delivery by strengthening business continuity planning, identifying critical services, and focusing committee forward agendas on COVID‑19-related efforts. TBS is also working with Shared Services Canada and Public Safety Canada to identify critical service interdependencies, including between services identified in departmental service inventories, critical services and the supporting IT systems.

The Office of the Chief Human Resources Officer has developed a remote working toolkit, available to all federal public servants, providing helpful advice, tips and tricks to both existing and new public servants. This toolkit touches on areas including (but not limited to):

• mental health
• setting up your workspace
• communications with your colleagues
• official languages

Issue

The national exposure notification app, COVID Alert, was developed to let users know that they may have been exposed to COVID‑19.

Key facts

• COVID Alert, a national exposure notification app, was launched July 31, after approximately 45 days of design and development efforts.
• It was made available to provinces and territories as a public health tool intended to help individuals know that they may have been exposed to COVID‑19.
• Onboarded provinces and territories include Ontario, Manitoba, Saskatchewan, Quebec, Newfoundland and Labrador, Nova Scotia, Prince Edward Island, New Brunswick and Northwest Territories.
• Metrics about app downloads and usage of one-time keys have been available in the public domain since the launch of the app on Canada.ca.
• COVID Alert was developed by the Canadian Digital Service, using open-source code developed by volunteers from Shopify, as well as Bluetooth exposure notification technology co-developed by Apple and Google. It received security reviews from the Office of the Chief Information Officer at TBS, the Canadian Centre for Cyber Security and BlackBerry.
• Engagement with the Office of the Privacy Commissioner began before the launch of the app and continues as improvements and features are added to the app.

Response

• As Canadians continue to face the health and economic impacts of the pandemic, we need to work together to keep people safe and healthy and contain the virus.
• One of the tools that some countries have found effective in helping to slow the spread of COVID-19 is exposure notification. That’s why the government of Canada developed the COVID Alert app.
• COVID Alert is just one of many tools the Government of Canada has made available to provinces and territories for Canadians to help protect them from the pandemic and keep them safe.
• The COVID Alert app has been downloaded by millions of Canadians, but because there continues to be a low distribution of one-time keys to people who test positive, COVID Alert hasn’t realized its potential.
• The federal government has continued to engage with the provinces and territories – both those who have adopted COVID Alert and those who have not – to find ways to encourage uptake of the app and improve distribution of one-time keys when people test positive.
• We are continually assessing the value of COVID Alert in the dynamic context of the pandemic.

Background

Exposure notification uses Bluetooth technology via an application that is downloaded to mobile devices. This is different from conventional contact tracing done by public health officials, a manual process requiring extensive personal information.

As of May 18, COVID Alert app has been downloaded approximately 6.5 million times, with 32,603 one-time keys (OTKs) claimed in the app across nine provinces and territories. Low rates of one-time key distribution continue to limit the effectiveness of the OTK-based service. Fewer than 5% of people in Canada diagnosed with COVID‑19 have received an OTK to enter into COVID Alert. Of the COVID Alert users who tested positive for COVID and did receive an OTK from their provincial or territories’ health authority, nearly all (over 80%) entered that OTK into the app. This indicates that users are willing and able to participate in the system. However, while there have been ongoing discussions with provinces and territories at all levels, OTK distribution is reliant on provinces and territories, which face limited capacity and competing priorities, including vaccine distribution. Downloads of COVID Alert have plateaued since December 2020.

Consideration is being given to a Quick Response (QR) Code exposure notification service (QR Code service) that could be introduced into the app with the potential to help to break the chain of transmission faster, by streamlining contact tracing for app users, businesses and organizations, and public health officials. It is also intended to help respond to the rise in variants of concern. The success of a QR Code service would depend on widespread uptake from provincial and territorial health authorities and businesses.