HOW THE CERB RESPONSE COULD BECOME A NEW TEMPLATE FOR ACTION
During the first part of March 2020, Frank Vermaeten, the assistant commissioner of the Canada Revenue Agency since 2014, was living in denial. He had seen how the coronavirus was progressing, of course. But a big part of his job was managing the annual flood of 30 million tax returns, just then beginning to peak.
“Things were looking great,” he noted in an internal agency interview shared with employees.
Then, on March 15, Vermaeten learned the Employment Insurance system was being overwhelmed by applications from employees of companies shutting down because of COVID-19 restrictions.
This was a defining moment for government operations. The EI system was run by Employment and Social Development Canada, the second-largest employer of civilians within the federal government, with 27,000 workers. Only the Canada Revenue Agency had a bigger workforce, some 45,000 strong.
More pertinent as far as the EI system went, these two organizations maintain some of the government's deepest reservoirs of computing power. If they couldn't handle the sudden spike in COVID-related volumes, the government — and millions of EI and other claimants — would be in trouble.
Spurred by adrenalin, the Canada Revenue Agency and ESDC co-developed the $500-a-week Canadian Emergency Response Benefit in little more than three weeks, leaving next to no time for testing. They watched nervously as two million Canadians applied for it the first three days it was made available, then sighed in relief when it became apparent there were no significant glitches.
Information technology experts consulted by the Citizen claim the development effort involved would not normally constitute a high degree of difficulty. But, they added, it did feature unusually complex collaboration between federal departments working at speed. Software engineers wrote hundreds of thousands of lines of code in making changes to more than 40 of the agency's larger computer systems and databases.
Annette Butikofer, assistant commissioner of the CRA's information technology branch, explained that a team of more than 200 were on conference calls daily, tracking legislative and technical developments and how these would affect how CERB should be calibrated. Another 500 plus members of the agency's information technology group were given the job of designing and implementing the expanded networks.
“No one would think that government is innovative,” Butikofer said during her joint interview with Vermaeten, “but we really had to be creative.”
When it suddenly became apparent the agency's call centre capacity would fall well short of what was required, Butikofer called Amazon, which offers a way of quickly expanding computing power (known as cloud services) through its Web Services unit.
“Can you stand up a call centre for us in the next 24 hours?” she asked. “Sure,” came the reply, only slightly exaggerating the prowess of Amazon Web Services. It took 36 hours, Butikofer said.
The quick deal with Amazon was possible because Canada Revenue Agency had already been conducting trials of a variety of cloud services, an option recently made available by government through Shared Services Canada.
That still left the question of who would staff the expanded call centre. Reasoning that auditors and other specialists within the agency could competently answer queries about CERB, Vermaeten called for volunteers. More than 7,000 offered their help, and the agency put 4,000 to work on the help desk until the initial flood of CERB applicants receded.
In the first ten months, $50.6 billion CERB and CRB (the successor program) went through Canada Revenue Agency's system while $27.5 billion were processed by ESDC.
The assistance programs were not free of consequences, not surprisingly, given the speed with which everything moved. CERB on its own has triggered a lively sub-industry in litigation. The Canadian law database, canlii.org as of March 25 listed 159 legal actions in which CERB featured — mostly over matters of interpretation and how the payments intersect with other federal and provincial support programs.
Claimants in B.C. and Ontario have also filed applications for a class-action lawsuit against Canada Revenue Agency, claiming that CERB “was implemented hastily” with the result that taxpayers' personal information was not protected.
The agency in February contended that its own system had not been compromised, that unauthorized third parties had been able to access Canada Revenue Agency accounts by stealing commonly used passwords from other, non-government sites and using them to unlock My Account, the CRA vehicle used to process CERB payments.
When Canada Revenue Agency spotted compromised passwords, it froze the accounts, urging taxpayers so affected to re-register for online services using more secure credentials. By February, some 800,000 agency accounts had been frozen.
Canada Revenue Agency and ESDC are stressing enhanced security in their ongoing efforts to modernize, with the wider inclusion of (among other things) two-step authentication, which is difficult to hack even with stolen usernames and passwords. Even so, this promises to be a never-ending war as hackers escalate their tactics and strategies. They, too, seized the opportunity presented by COVID-19 to up their game.