Why did the ArriveCan app cost so much? What we’ve learned so far in the federal outsourcing scandal

How did a federal government travel app, which took tens of thousands of dollars to build, end up costing taxpayers tens of millions to operate? Why can’t auditors figure out how much was spent and who got the money?
These are questions parliamentarians, federal watchdogs and the RCMP are asking as Canadians learn more about the ArriveCan saga, which The Globe and Mail has helped to uncover since 2022. The implications go far beyond the fate of one app: it has prompted calls for a complete overhaul of how Ottawa oversees the billions of dollars spent each year on outsourcing. Here’s an overview of what we’ve learned so far.
In the pandemic’s chaotic first months, countries shut down non-essential travel to reduce the spread of COVID-19, and needed new digital tools to help those who could travel manage the fast-evolving rules and paperwork. For Canada, that was ArriveCan, which debuted on April 29, 2020, just weeks after the pandemic was declared. Anyone entering Canada had to use it to declare customs and health information in advance; when the first vaccines became available, ArriveCan was how travellers showed proof of vaccination. The app still exists, but only as a tool to speed up customs checks at 10 airports. It hasn’t been mandatory since the fall of 2022.
ArriveCan began life in the Public Health Agency of Canada, but quickly became the Canada Border Services Agency’s responsibility. The app’s initial launch cost was only about $80,000, but after scores of updates, the CBSA needed more money to design software, manage data and keep up with related tech-support and customer-service costs. It’s unclear what (if any) budget limits it had, and recordkeeping was so erratic that, when the Auditor-General investigated, she said it wasn’t possible to pin down an exact total. The Globe reported in 2022 that the cost had climbed to at least $54-million. February’s auditor’s report estimated it was about $59.5-million.
As ArriveCan became more complex, the border agency spent millions on the services of its primary contractor, a two-person IT consulting firm called GCStrategies. The two employees did not personally do any IT work on ArriveCan. Instead, they found subcontractors – including individual IT workers and sometimes other companies – to do the technical work. That company, as well as two others that were contracted to work on ArriveCan, are now suspended from bidding on federal contracts as their owners field questions about what happened. Here’s an overview of the key people, companies and agencies involved.
Outsourcing is when a private company or individual is hired to do work for the government. Ottawa spends about $15-billion a year on outsourcing to buy goods and services. This can include equipment such as computers and office supplies as well as professional services from individuals, such as short-term IT workers or consultants.
Federal rules aim to encourage competition so that taxpayers get the best value. However, not all contracts are fully open to competition. In some cases, departments rely on shortlists of preapproved companies. Rules also allow departments to hire companies directly without a competition under certain conditions, such as when a need is deemed to be urgent.
In the case of ArriveCan, the first three contracts awarded to GCStrategies for work that involved the app were all sole-sourced, meaning there was no public competition. According to the Auditor-General’s report, when a fourth contract worth $25-million was put out to a public competition, GCStrategies was directly involved in setting the contract’s narrow terms. GCStratagies won that contract after no other company submitted a bid. Mr. Firth initially refused to answer questions at committee about this aspect of the Auditor-General’s report. In response, MPs found him in contempt, using a little-known parliamentary ritual that’s rarely been used since the 19th century.
The ArriveCan probes have also raised questions about the federal Procurement Strategy for Indigenous Business. Some of the ArriveCan work approved through an IT services contract with Dalian and Coradix was awarded under that program. Dalian frequently wins contracts with Coradix through PSIB, but The Globe reported in December that the two companies have never been audited after the fact to determine whether they comply with the program’s criteria that at least one third of the work is performed by the Indigenous business or Indigenous subcontractors. Indigenous Services Canada, which is responsible for overseeing the program, has since launched arm’s-length audits of the two companies.
ArriveCan and the broader issues it has exposed have now prompted more than a dozen reviews, including from government departments, multiparty committees, independent watchdogs and law-enforcement agencies – each with different powers to demand accountability. Here’s where things stand so far.