A new report from the Office of the Auditor General in Canada revealed that the federal government failed to adhere to strict security protocols when awarding sensitive technology contracts to GC Strategies, the company behind the controversial ArriveCan app.

According to the report, government entities did not comply with the security standards typically imposed on contracts involving sensitive systems or information, leaving room for “potential security risks” that were not adequately assessed.

Key Points:

Contracts were awarded without conducting the mandatory information security assessment.

It was not proven that the benefiting company was fully qualified in terms of security.

The report indicates shortcomings in follow-up and administrative accountability within the Canada Border Services Agency (CBSA) and the Department of Public Affairs.

The total cost of the project reached $54 million, sparking sharp criticism from observers and MPs due to the ambiguity surrounding how the funds were spent.

Reactions

Following the report, the Auditor General stated that this case reflects a systemic failure in the governance of government contracts, calling for urgent reforms that include transparency and security risk assessments before awarding any contract.

For its part, the government promised to review the procedures in place and committed to taking steps to ensure that all future contracts undergo necessary security reviews, especially those related to technology and digital services.