Question Period Note: Cloud Services in the GC

To support the Government of Canada (GC) access to cloud supply, Shared Services Canada (SSC) has established Framework Agreements with eight (8) leading Cloud Service Providers. On December 6, 2022, Deloitte released a publication titled ʺCapitalizing on government’s cloud momentumʺ, indicating that systemic issues continue to exist.

• Cloud application development and hosting offer opportunities to improve essential digital service to Canadians
  • The Cloud Adoption Strategy guides departments to use the public cloud to store, manage and process data and applications, when it makes sense to do so
  • The Government of Canada benefits from the flexibility provided by public cloud, as commoditized services can grow and shrink with the level of demand; we pay only for what we need, when we need it
  • While reliance on cloud services is increasing, most of the IT operations continue, and will continue, to rely on data centers and networks operated by Government of Canada employees
  • Secure access to cloud services is amongst the array of services provided by SSC to its partners and clients
  • As such, SSC is investing to grow the capacity of its personnel to support partner departments and clients, so they can operate securely both in data centers and the cloud
  • Utilisation of cloud services through SSC’ grew from $1.4 million in fiscal year 2019-20 to $103.8 million in fiscal year 2021-22

If pressed on Deloitte Report:

• The Government of Canada is working to achieve a secure digital government that delivers high-value, essential digital services to Canadians and digital tools to federal employees, through an enterprise approach aligned to IT service standards government-wide

If pressed on procurement of cloud services:

• Cloud adoption is a shared responsibility across the government. SSC enables cloud adoption and provides critical building blocks, such as access to cloud services, secure connectivity and active monitoring, guidance and expertise
• Through a competitive process, SSC established a procurement vehicle to provide government departments with access to world-class, secure cloud services from pre-qualified vendors who meet security requirements
• Departments can select the cloud services that best meet their business and technical requirements, and according to the clear standards

If pressed on Amazon Web Services:

• Amazon Web Services is one of the 8 pre-qualified vendors. These are separate and distinct from general distribution, shipping, or warehousing services offered by companies such as Amazon

If pressed on ThinkOn Inc.:

• ThinkOn Inc. is one of the 8 pre-qualified vendors on SSC’s procurement vehicle
• Through SSC’s procurement vehicle, ThinkOn services are currently leveraged by 5 GC departments and agencies:
  • SSC
  • Canadian Transportation Agency
  • Destination Canada
  • Innovation, Science and Economic Development Canada
  • Women and Gender Equality

If pressed on cloud security:

• The protection and privacy of Government of Canada data stored and processed in the cloud is a top priority for SSC
• Measures in place that enforce where data resides and how it is controlled
• Processes are in place to ensure that specific security requirements and standards are met when awarding cloud contracts
• To securely consume cloud services, each department must implement and maintain specific security guardrails
• SSC actively monitors adherence to security requirements

To enable GC cloud adoption and support progress towards a digital government, SSC ensures that a variety of cloud services are available to meet the unique business needs of each federal department. SSC also acts as a centre of excellence for cloud services across the Government, providing technical expertise and tools to guide customers and simplify cloud adoption.

SSC’s optional Cloud Brokering Service provides customers with self-serve access to commercial cloud services. SSC acts as a bridge between customers and Cloud Service Providers offering Software-as-a-Service (SaaS), Platform-as-a-Service level (PaaS), and Infrastructure-as-a-Service (IaaS) public cloud services.

To support Government of Canada access to cloud supply, Shared Services Canada established Framework Agreements with eight leading Cloud Service Providers:

• Amazon Web Services, Inc
• Google Cloud Canada Corporation
• IBM Canada Limited
• IPSS Inc., ServiceNow Inc. in Joint Venture
• Microsoft Corporation
• Oracle Canada ULC
• com Canada Corporation
• ThinkOn Inc

The Framework Agreements provide departments with standardized terms and conditions, and cloud services that have been assessed by the Canadian Centre for Cyber Security and the Contract Security Program. The Government has processes in place to ensure specified security requirements are met when awarding cloud contracts.

Since the establishment of the Framework Agreements, overall consumption has been growing. The total consumption for year 2019-20 was $1,395,709 and grew to $103,807,761 by fiscal year 2021-22. Consumption through the Framework Agreements is shared across the eight Cloud Service Providers, in alignment with the needs of GC departments and agencies.

All pre-qualified suppliers and available cloud services are accessible in one place: the GC Cloud Services Portal.

Other levels of government can, and do, make use of these Framework Agreements. A few examples are:

• The Ontario Ministry of Health and Long-Term Care
• The Halton Region
• The Government of British Columbia
• A Board of Education of School District in Vancouver

The protection and privacy of Government of Canada data stored and processed in the cloud is a top priority for SSC.

GC departments and agencies that use cloud services remain accountable for the confidentiality, integrity, and availability of IT services and related information that a Cloud Service Provider hosts.

In 2019, SSC, the Treasury Board Secretariat’s Office of the Chief Information Officer (TBS OCIO) and the Canadian Centre for Cyber Security co-developed a Secure Cloud Operationalization Framework for enabling secure access to public Protected B Cloud services for the Government of Canada. This Included a minimum set of 12 mandatory guardrails, which departments are obligated to implement. SSC has the validation function, including reporting and notification of customer compliance to the guardrails, while TBS OCIO has the compliance function, such as remediation oversight and enforcement.

Amazon Web Services Inc

On April 1, 2022, TVA shared a news report, stating that expenditures related to Amazon Web Services (AWS) increased, both for the Government of Canada and the Government of Québec. It states that, across the federal government, over the last year, the federal government spent $24.6 million on services provided by AWS.

At Government Operations Committee, on April 29, 2022, MP Julie Vignola (BQ) asked Minister Tassi the following question:

Last year alone, the federal government signed contracts totalling $24.6 million with Amazon Web Services, which is about $2.4 million more than the annual amount it invests in Canada Post. That's not counting other contracts from 2011 to 2020 and those with the Canada Border Services Agency.

Is it normal for the federal government and its agencies to do business with American companies instead of a Crown corporation? Doesn't this send the message that the Crown corporation is not even competitive enough to serve the government properly?

The Amazon Web Services are separate and distinct from general distribution, shipping, or warehousing services offered by companies such as Amazon, and are not services offered by Canada Post.

ThinkOn Inc

On October 21, 2022, the Globe and Mail published an article stating ThinkOn never worked on the CBSA ArriveCan app, despite ThinkOn’s name appearing on the CBSA September 2022 Report to Parliament on the costs of developing and supporting the app. On October 26, 2022, the Globe and Mail published a second article stating that Microsoft, not ThinkOn, received the $1.2 million contract related to the ArriveCan app. CBSA is conducting a full review of contracts related to the ArriveCan app.

The ArriveCan app was built and is hosted in an Amazon Web Services (AWS) environment and uses Google’s Captcha solution as a security measure to verify users are not robots. It was launched across the country on July 20, 2020, as a means to enable travellers to submit customs and immigration declarations online in advance of flying into Canada for a faster border experience. The cloud-based application was developed between CBSA and Public Health Agency of Canada (PHAC). SSC’s primary role in the ArriveCan app has been enabling the cloud connectivity, testing the solution and monitoring the supporting infrastructure.

Currently only five customers have accounts with ThinkOn through SSC’s Framework Agreements:

1. SSC – total consumption $472,580
2. Canadian Transportation Agency – total consumption $47,984
3. Destination Canada – total consumption $33,622
4. Innovation, Science and Economic Development Canada – total consumption $30,094
5. Women and Gender Equality – total consumption $2,523

Total consumption of ThinkOn services since 2020-21: $586,803

Deloitte Report

On December 6, Deloitte released a publication titled ʺCapitalizing on government’s cloud momentumʺ and a media release, creating a possibility that Shared Services Canada will receive related media inquiries.

The report’s main narrative is based on the pandemic’s effect on government, and how cloud enabled large scale transformation. Despite the GC’s success with cloud, Deloitte’s research indicates that systemic issues continue to exist. Additionally, perceptions of Canada being behind in terms of cloud adoption remains of concern.

The report recommends that the GC take ʺbold enterprise leadershipʺ to maintain the momentum of cloud adoption, focusing on innovation, value for money, resilience, and reducing technical debt. Looking to the future, the report notes that environment, social, and governance considerations are emerging as major drivers for cloud adoption and lists several examples on how cloud service providers are doing this today.

None