Why are we still using the ArriveCAN app? Why is it still mandatory?

Jordan Hey, it’s Jordan. I’ve been hosting this podcast for four years now. We’ve done all right. More than 1,000 episodes, a couple of awards, millions of downloads, lots of Canadian stories, and lots of fun, too. But there was one thing missing before I finally felt like a real big-time podcaster. That’s right, a mattress to test and report on in ad breaks. And I am happy to report that day has finally arrived. Over the next little while on this show, you will hear my unfiltered thoughts on the Douglas Mattress, a made-in-Canada eco-conscious mattress that comes with a 120-night guarantee. Personally, as I record this, I’m on night five with this mattress, and I like it a lot so far. That’s my very quick first impression. I’m not an expert, but it’s honest. I am also writing this spot while I work on the mattress, and this isn’t in any of their ad copy, but as somebody who’s been working from home for two-plus years now, a mattress that is firm enough to both sleep on and work on is important to me personally. One major thing I’m looking forward to testing is the cooling gel foam that is meant to keep me cool on hot nights. We’ve got a few of them coming up as I record this, so we’ll talk about that the next time. In the meantime, they are having a big sale in honour of sponsoring The Big Story, and you can head to Douglas.ca/TheBigStory, and get what many are calling Canada’s best mattress and follow along to see if I will eventually be joining them. That’s Douglas.ca/TheBigStory.

Clip You’re listening to a Frequency Podcast Network production in association with CityNews.

Jordan Like so many things created in the early days of the pandemic, this was supposed to be a short-term fix, a way for Canadians returning home or foreigners entering the country to follow the government’s strict COVID protocols, to provide contact tracing information and sorry if I snicker a bit here, to streamline the border entry process. Two plus years later, the federal government’s ArriveCAN app is still doing all those things, and it is working even harder on the streamlining part of it.

Clip Passengers arriving at Toronto, Pearson and Vancouver International Airports can now use ArriveCAN to complete customs declaration forms before landing in Canada. Due to a technical glitch with the ArriveCAN app, a small number of travellers received an erroneous notification instructing people to quarantine.

Jordan But why are we still using ArriveCAN? Why is it still mandatory? What purpose does it now serve? Is it still for quarantines and contact tracing? Or is it now an attempt to modernize the border? Is it helping with the mass at our airports or hurting? Will we use this app forever? Will it always be mandatory? What does a looming September deadline mean for the future of our border experience and for Canadians’ digital privacy? I’m Jordan Heath-Rawlings. This is The Big Story. Bianca Wylie is a technology expert. She’s a partner at Digital Public and a co-founder of Tech Reset Canada. Hello, Bianca.

Bianca Wylie Hello, Jordan.

Jordan So for those who haven’t travelled internationally during the pandemic and I guess I’m one of those I think you are too, can you just describe what the ArriveCAN app is?

Bianca Wylie Sure thing. So I haven’t used it myself, but it’s an app that the federal government has made mandatory for travellers coming into the country to collect information because of the pandemic. That was the rationale for this app. So to collect information about who you are, where you’ve been, where you’re going, your vaccine information, test information, if that’s related to your travel or to your history and your plans for quarantine, should you need to do such thing.

Jordan Right.

Bianca Wylie So it’s an app that’s available both on mobile phones, or you can use the web app. And that’s what it’s about and that’s how it’s being presented. It’s mandatory for people to use it if you’re travelling to Canada.

Jordan What’s it like and why did you decide to start looking into it?

Bianca Wylie So I had one family member who was considering travel, and they don’t have a smartphone. And when they asked me about this, I could tell they were already kind of nervous about their trip, and this had added in sort of a new layer of something that they were worried about. So I started to look into it. Then this is maybe three or four months ago, and a friend of mine who travelled and used it got in touch with me and said, I use this app. I don’t know what it was about. I don’t feel comfortable that I used it. I’m not sure what’s happening now. And so in both cases, it was people expressing concern and basically discomfort with this app in relation to their plans. And so that’s why I started to look into it.

Jordan What is looking into it mean to you? Maybe you could explain a little bit about what you do in terms of tech and security and how you looked into it.

Bianca Wylie Certainly. So I like to look at how we are using technology in our democracy in Canada and elsewhere. And what I mean by that is, as we use apps like this, say, in the delivery of a public service, what does that mean for our governance? You know how are we making sure that we’re doing this in a way where we’re in control of how technology is used and how people’s rights are respected or not, making sure people are comfortable and making sure that we have access to public services. So that’s really the focus for me. A lot of my interest in technology is on the public side. So when I started to look into this app, it was actually on the heels of we had this COVID Alert app in Canada

Jordan Yes

Bianca Wylie Which was a voluntary exposure notification app. Also related to the pandemic. And my colleague Sean and I from the beginning had concerns about that app because historically that technology generally hasn’t worked well. You often hear of concerns of surveillance, privacy, data use, and those are all valid and important. But with the COVID Alert app, the primary thing was, does this even work? Does this work? Because right now there’s so much enthusiasm for technology and sometimes people get really mired in the harms related to privacy, surveillance and those issues but we skip over this question of does this work? Is this something we should be doing at all?

Jordan Yeah.

Bianca Wylie And so having looked at that app and then hearing about this one, I started to sort of go down the same road of what is this? How does it work? Does it work? And the first major red flag, of course, COVID Alert was a voluntary app. This is a mandatory app. That’s a very rare thing to do for the government to say this is a mandatory use of technology. I think I’ve only found one more of those at Canada Post. And so that red flag was waving around. And from there I’ve just been looking into its history, issues with it, what’s going to happen in the future, and primarily asking that the government move this to voluntary use.

Jordan Let’s talk first about the history before we get into how it’s evolving, how it may or may not stick around and definitely will go down some of the red flags in terms of information, when we talk about stuff like this that’s been around since early in the pandemic, I always like to add a caveat that back then we didn’t know what we were doing. We had to try things. We had to try to find solutions. So I try not to discredit any government for trying to take action back then. I think it’s totally fair game now, more than two years later, to say, like, what has this become instead of what it was intended to be? Like, how is this app evolved over the last couple of years?

Bianca Wylie Yeah, and I’m nodding as you were talking about that in a crisis when a public health emergency, wanting to try things and knowing, hey, maybe this does or doesn’t work, but let’s give it a shot.

Jordan Yeah.

Bianca Wylie I empathize with that position. I also think it helps us understand that this is actually experimental. And I think when we consider it that way, we know that when you do experimentation, you also do have guardrails and you also do have methodologies for experimentation. And so when we go back to the beginning of the story here, very interesting on a few fronts, one of them is that the rationale for this app and its use is actually sitting in the Quarantine Act, and it’s still sitting there. So we need to remember that 100% of the reason given for ArriveCAN at the beginning was to support the implementation of the Quarantine Act, which relates to keeping track of people and keeping track of where they’re going and making sure if they need to quarantine, they do so.

Jordan Right. Contact tracing back when we still did that stuff.

Bianca Wylie That’s right. And that intent and that desire for this to be collected, this information to be collected was coming from the Public Health Agency of Canada, okay, at the beginning. So that is who was saying this is the information we need and we need to implement the Quarantine Act. Now, here is one really important piece of history. The Quarantine Act says that we must collect information as a mandatory exercise. It says nothing about how, it says nothing about having to use technology or having to use an app. And what it says is this is information that we can compel from people. But it’s interesting because nothing in the act said it had to be done through an app. So we need to remember we have, had data collection happen at the border for a long time. And there are other systems we have in place that could have been used, whether it’s kiosks, forms, or interviews with the border agent.

Jordan Sure, everybody’s gotten those forms 30 minutes before their flight lands.

Bianca Wylie Right. People know how to do that. Right. So that was the beginning of this. And I think like most people when you’re told, you know, we’re in an emergency, we need to do this thing, although people might not have liked it, it felt like, okay, this is what we’re going to do as relates to this emergency. Okay. What we didn’t have at that point in time was any conversation about what that app working really looked like from a public health perspective and this is going to come back later. So when it was launched and still is using the Quarantine Act for a public health rationale, over the course of time it has shifted and the language has shifted. And now we’re at the point when you look at the app today and the website that Canada Border Services Agency is talking about, border modernization, which is a very different exercise and a very different use than pandemic rationale. And another really interesting piece of history that surprised me when I found out about it ArriveCAN was existing before the pandemic. We also had customs create an app that would allow you to clear customs by using, by filling in a form online or a mobile app, very similar functionality. And so we had some of this going on before the Pandemic. It wasn’t widely used, it was voluntary. Then we have the pandemic, we’ve got mandatory use. And you can see how these two very different rationales have now come together into the same piece of technology. And so I think the way I’ve been thinking about this lately is that there is an interest and some people like this app, and we need to talk about that too. There’s an interest from the government. There’s an interest from some people that live in Canada visit, that this is great, that they like ArriveCAN, which is part of border modernization, but that is not the way in which most people started to use it. They were using it and are using it because they have to. So if you think about this as sort of training people and using this moment to get people using this app that they weren’t using before, to me, this is not good governance. You don’t mix and mingle these things, regardless of whether they’re defensible independently. So yeah I think those are some interesting pieces of history. And we can talk about the Quarantine Act because it’s really important in relation to the data that’s collected.

Jordan Maybe first, because we’re about to get into privacy and security. What data is explicitly being collected? What is the government doing with it? Are they getting rid of my quarantine plans after the two weeks would have theoretically expired? Like what’s happening there?

Bianca Wylie I don’t know the fine print. I know that the Privacy Commissioner looked at this app. They were asked to review it. I know that it’s collecting pretty standard stuff when you travel your own information, people within your travel party places you’re going as part of your plan. If you need to quarantine how that is being managed from data retention and use perspective, I can’t speak to the details. What I can say is that the Privacy Commissioner reviewed it all and said this is, as expected, no major concerns.

Jordan Okay.

Bianca Wylie However, there’s also the fact that we have a black box here. We have closed code. We don’t have governance around use to a certain point in terms of how things are being used. Now, when I say things, I mean the information that’s collected. You know I’ve had people tell me I’ve shown their receipt, and no one’s really looking. It’s unclear how some of this is working in practice to me, so I don’t want to go too far down that road. But I think to get your point and your question, nothing about the collection and use of the data was a flag for the Federal Privacy Commissioner when they reviewed it. And recently, the Federal Privacy Commissioner said that they were you know continuously working with the Public Health Agency of Canada, and I think also the Canada Border Services Agency to basically make sure that they are adhering to best practice. That’s as far as I’ve heard about data collection and use.

Jordan What about closed code? You just mentioned it. What does that actually mean? And why is that a red flag for you if it is?

Bianca Wylie There are a few reasons. Close code is an issue, and in this case, personally, I’m an advocate for transparency and accountability. And so it’s one thing for the government to tell us this is how this works, or to say, well, a contractor may have access to your data because they work on it. So in the ArriveCAN case, we’ve got five private contractors that have been working on developing the app and maintaining it. So when I say close code, what I mean is the way the software works is not open for anyone in the public to audit or review. And this you hold in contrast with what was happening with COVID Alert, where there was open source code, it was available, anybody could look at it. So you could have a sense and you could have sort of some third party and some oversight in terms of how it all worked. So to an extent, that’s important to have it open as possible. There’s also a reality here when we talk about software code and technology that if you can’t see the whole system, you can’t really know the full story. And what I mean is, even if the code for this app was online, that doesn’t mean that you see how that system is integrated with other systems within the government. You also need to realize that even if you hand the government information on a piece of paper, they can manually enter it into a system and they’re holding it.

Jordan Sure.

Bianca Wylie So there are a few risks that are relative and specific to people downloading this kind of app on their phone or using something like this on a browser on their home computer. But for the most part, we really need to understand that it’s difficult for us to see how this information is used. And I think that’s why only having one Federal Privacy Commissioner who is our general oversight person is lacking because there’s a significant amount of information here and we’re also dealing with a Quarantine Act. And I can tell you the one little piece of the Quarantine Act that is relative to this conversation. I keep bringing it up because it gets lost over, over and over again and it’s a problem.

Jordan Yeah, tell me, what is it?

Bianca Wylie What it is, is that and there’s a letter that the Federal Privacy Commissioner shared with shadow ministers in late in 2020 where they were saying, do you have concerns with this app? And the commissioner, I’m paraphrasing here, basically said all of this makes sense, makes sense., it goes with our Privacy Act, everything here looks like it’s in line. But then it gets to this point because this is the Quarantine Act, which says there’s also a point at which you don’t have to receive consent from the person who shared the information to use it in ways that they relate back to the act, which may involve sharing with law enforcement or sharing it in ways that you may not know or have to be told about. And so the Privacy Commissioner sort of hits this point after saying all of this seems fine, but also this is a Quarantine Act and this is why emergency powers are important to understand. There’s a little clause in there that basically says and he said, I can’t tell you if I’m comfortable with how this is being used because I don’t know and I’m still having to learn about it. Now, the reason this is important is twofold. Firstly, that relates to the Quarantine Act, that’s emergency power stuff, right? So as long as the app is being that the rationale is under the Quarantine Act, that issue is there.

Jordan Right.

Bianca Wylie That’s not clear for any of us to understand what’s really going on. But the really important thing is, regardless of whether the information was collected from an app, from a web app, from a form, from a kiosk, it’s the same vulnerability from a how is the government using the information perspective? So what I find difficult about the discourse right now is you’re getting a lot of concerns about surveillance. And I would classify some of this as the misinformation space where there are a whole lot of things that we don’t know. You know there’s a sort of potential for harm, there’s a potential for abuse. It’s there. But that’s one of those issues that are always there, what we have is actual harm.

Jordan Hey, it’s Jordan. I’ve been hosting this podcast for four years now. We’ve done all right, more than 1,000 episodes, a couple of awards, millions of downloads, lots of Canadian stories, and lots of fun too. But there was one thing missing before I finally felt like a real big-time podcaster. That’s right, a mattress to test and report on in ad breaks. And I am happy to report that day has finally arrived. Over the next little while on this show, you will hear my unfiltered thoughts on the Douglas Mattress, a made-in-Canada eco-conscious mattress that comes with a 120-night guarantee. Personally, as I record this, I’m on night five with this mattress, and I like it a lot so far. That’s my very quick first impression. I’m not an expert, but it’s honest. I am also writing this spot while I work on the mattress, and this isn’t in any of their ad copy, but as somebody who’s been working from home for two-plus years now, a mattress that is firm enough to both sleep on and work on is important to me personally. One major thing I’m looking forward to testing is the cooling gel foam that is meant to keep me cool on hot nights. We’ve got a few of them coming up as I record this, so we’ll talk about that the next time. In the meantime, they are having a big sale in honour of sponsoring The Big Story, and you can head to Douglas.ca/TheBigStory and get what many are calling Canada’s best Mattress and follow along to see if I will eventually be joining them. That’s Douglas.ca/TheBigStory

Jordan What’s happened with the app to raise these concerns, like what are actual examples?

Bianca Wylie So there’s a range of harm there that this is why to me, it’s so important that this is voluntary which means we should all be comfortable when we use a public service. That brings us back to the key principle of any defensible technology, informed consent. If you like this app, you understand the risk and you understand all of what it is and you’re comfortable and you like it. That’s great. Good for you. You take that on because it’s an informed decision. There is a large number of people who do not feel that way. And that’s why you can’t make these kinds of public services a mandatory technology. So the lack of another approach, you know to be able to come to the airport or whatever border, whichever way you get there, and to not have an option where you’re comfortable, to me this is far and away the worst harm because that harm translates into distrust. And this is also why, looking at the trajectory of this, the history of this, it’s one thing when you start a program with the intent and you’re using public health rationale, we’re well beyond that. And so I think that is not technical harm, that’s democratic harm. So if you have to ask me what the number one harm is, to me it’s a trust issue. We need to have public services that work for everyone. And when the government decides that they are just going to steamroll through and ignore the fact that some people can’t access it, some people aren’t comfortable, I think that’s really bad and that decision was made quite a while ago. So to me, that’s primary harm, secondary and not inconsequential by any means. Over 10,000 people received an automated notice that they had to quarantine and it was wrong. And I saw people online, some people saying, oh, you just got to look it up, of course, it’s a known issue, there’s a bug, didn’t you know? And I’m looking at this and I’m thinking, can you imagine how many people would get a notice like that and not take it seriously? Like me, this is very dangerous when you’re sending notices out that are about something as important as a quarantine. And to automate that sort of communication from the federal government and not have it be proactively managed. That story came out because people were getting in touch, filing ATIPs. Matt Malone filed an Access to Information request, basically saying how many people had this problem happen? It wasn’t like the government came out and proactively was managing it. For me, it’s very difficult to believe that the government ever thought automating that kind of notice was a good idea. Because when you work with technology, there’s one thing you know, it will not work all the time. It will not always work as expected. And so you have to build really good governance around when things go wrong. And the federal government hasn’t displayed any sort of capacity to do that well. So that actual harm of sending out an error notice and I’d say the higher-order one, of people being uncomfortable in a time when they didn’t have to be, and the government should have had alternative public service provision. Those are two major serious harms from a democratic technology perspective.

Jordan Right.

Bianca Wylie Those don’t have to do with the what if those both happened.

Jordan So let’s talk about what happens now and the evolution of this app, because this really makes me curious. As I mentioned earlier, I’m inclined to cut slack for the first year or so when we’re still in a clear, clear emergency. Who made the call, and I don’t recall seeing it discussed anywhere, to move this app from just, yes, you must use it under the Quarantine Act because COVID regulations to now we’re going to streamline your border process and you still have to use it. Like, was there ever a decision made there? Was there ever any public consultation? Consultation with the privacy commissioner? I don’t even know what I’m asking now. It just seems like it just happened.

Bianca Wylie So nothing that I saw in terms of being explicit about it being consultative, this is referred to sometimes as the ratchet. For some people, they would say, oh, of course, in a crisis you’re going to accelerate technology use. And it always struck me as I don’t want to say it’s cynical, but in this instance it’s really difficult to believe that the government would go from that public health rationale you know where people are doing this because they’re trying to do collective good to opportune moment, to modernize the border. I know that there was reporting when the website copy switched that’s the kind of subtlety that indicated that the language of border modernization was creeping into the ArriveCAN conversation. So nothing explicit. You started to hear more from, I believe, the Canada Border Services Agency and public safety. I haven’t tracked it all the way from the beginning, but if you look at who’s speaking to this now, you’re hearing a lot about the border, right? So nothing clear and explicit about that shift. But what’s interesting is that it was the Public Health Agency of Canada that really was the leader on we need to make a mandatory technology, as far as I have been told. So if that’s where this comes from and now it’s shifted over to the Canada Border Services Agency and the border modernization rationale. For me, this is very anti-democratic. I don’t know a better way to describe it. It’s like, if you want to do that, that’s okay, but do it under the appropriate terms.

Jordan Yeah.

Bianca Wylie You don’t use a public health crisis as cover to accelerate and train people in a totally different initiative.

Jordan And there are people who would probably want to do this if you gave them the option and said, look, this could make your border entry easier. You might not have to wait in line at customs, et cetera, et cetera. It’s voluntary, try it out 100%.

Bianca Wylie This is what some people really like it and this gets back to why I keep going back to the Privacy Commissioner because it’s basically the only entity that has a public oversight mandate. They said in 2020, if you want to make sure you have consent and trust from people, you make technology voluntary when you’re in a public health crisis, that’s the way to do it. And I think at this point in time, I’m just looking at the federal government in this sort of disbelief where I’m saying that this is feeling so unnecessary because it’s not to say that the app has to go away. This is just saying make it voluntary. So if people are happy and comfortable using it, good. We can talk about improvements to governance. There are just some very clear things that they can do but have alternatives. This isn’t saying all or nothing. This is just saying just stop making it mandatory. There are so many people who are uncomfortable. And so September 30 is the next point in time where the Quarantine Act would have to basically be re-upped as the rationale for the app. So to me, September 30, it will be the perfect time to end the mandatory use and they can shift it to voluntary and perhaps it will move under the Canada Border Services Agency sort of rationale and go live over there rather than keeping it tangled up in this public health crisis rationale.

Jordan That was going to be my last question is what’s the next deadline? I guess it’s September 30. Do we have any knowledge, any hints from anyone in government if that act will be renewed? We can’t keep doing this forever.

Bianca Wylie No, I don’t know what’s going to happen on September 30. I can tell you two things about this. One, the budget for this app is now at 46.4 million. So I think what I see mostly published was from the last budget, which had it at 25. So it’s almost got double the amount of money allocated and the completion date is slated for September 2023. So what that tells us is there’s basically a doubling of the budget and this app will be worked on until what is that? It’s almost a year out. So that helps us understand the trajectory.

Jordan So it’s not going away in September?

Bianca Wylie No, it’s not going away in September. And I think what is up to us from a democratic perspective is to say at what point does this move to where it lives and how it is really being treated. Which is border modernization. And you decouple it from anything to do with the pandemic. Whether this is voluntary and this continues to live on. We need to consider what was good about the COVID Alert governances, which basically had open code. It had an advisory. It had a sense of reporting to the public. It had oversight. These are things that the federal government can improve on. So if they’re going to keep this up and then also address these issues because even if this app is voluntary, we don’t want it sending out erroneous notices. So that’s one major sort of course that we need to follow as we seek to get this used to voluntary. And then the second thing is for all of us to understand we don’t want mandatory technology as part of our public service. We just don’t like the legal terms to think about here, which you have brought up are necessity and proportionality. If you’re going to make technology mandatory, you better have a really damn good reason for it. And it has to work. It has to do what it’s intended to do. And you have to take that really seriously. And I think just to close on your point, it’s one thing to try something out or to think, hey, let’s give it a shot, bring it into operation, see how it works. But this sort of failure to adapt to and address the fact that we’re in the 7th wave of a pandemic and no one is really acknowledging that we’ve dropped so many interventions that we know work, but we’re digging in this hard on this mandatory technology, it doesn’t hold on a public health rationale. It does not hold from a good governance rationale. It’s not democratic. And I think the longer that we sort of refuse to come to the reality here, the more harm that happens. It keeps happening because this is a really bad situation for trust. So in the future, the lesson here, even on experimentation, you can set up guardrails that would have avoided some of this to make sure you have reporting efficacy metrics, oversight, all of that. But we really need to know we do not want mandatory technology. We need to always invest in alternatives, redundancy infrastructure people are comfortable with, not take it on as private activity. Because once you start bringing public services into your phone and into your house and you’re doing that labour, you’re taking on new risks. And I just don’t think we understand these aren’t consumer apps. This is a public service. This has to do with our rights. So we should be very careful that this doesn’t set a precedent that we’re okay with mandatory technology. That’s not something we want to do. We always want to have at least two ways to do everything. We need to up the investment in our public services so we’re happy with them you know and invest in people and invest in good service.

Jordan Bianca, thank you so much for this really informative.

Bianca Wylie Thank you so much, Jordan, it was a pleasure.

Jordan Bianca Wiley of Digital Public and Tech Reset Canada. That was the big story. For more from us, head to thebigstorypodcast.ca. Find us on Twitter at @TheBigStoryFPN. Email us at [click here!] or leave us a voicemail 416-935-5935. Find us in every podcast app. Ask for us on any smart speaker. Thanks for listening. I’m Jordan Heath-Rawlings. We’ll talk tomorrow. Back to top of page