Last week, Transport Minister Omar Alghabra had the unenviable task of defending the mandatory use of ArriveCAN. Speaking to the Standing Committee on Transport, Infrastructure and Communities, and in response to a question about the effects of ArriveCAN at airports, he said, “There is no evidence whatsoever that [l’application] ArriveCAN causes some problems. »
Let’s take a closer look at this remark.
On the one hand, this comment is patently misleading. The government already admitted a few weeks ago that ArriveCAN sent faulty notifications to fully vaccinated arrivals. A total of 10,200 people have been affected by this bug. That’s a big deal: According to ArriveCAN’s Privacy Statement, failure to comply with a quarantine notice is punishable by a fine of up to $750,000 or imprisonment of up to up to six months.
People who received these offending notifications were only notified by the government up to 12 days later. In the meantime, to resolve their issues, they were led to a “Contact Us” website through an electronic form. So the minister’s comment is clearly wishful thinking.
On the other hand, his statement was accurate — as the government has consistently refused to release any evidence regarding the app’s cybersecurity. For example, he rejected every request for the source code of the application. (In contrast, the COVID Alert app was built with open source code.) Compared to cyberdiligence assessments, the government has released nothing publicly.
Shaken confidence
The algorithm that does document verification for ArriveCAN is designated as a trade secret. One of the few publicly available documents on this algorithm is an Algorithmic Impact Assessment which highlights that it received a rating of 47 out of 107 for cyber risk mitigation. This evaluation also reveals that the algorithm has not been tested for bias, discrimination, use of unreliable data and more.
Other than these technological issues, it is not at all clear why the government is so insistent on using ArriveCAN. Every privacy commissioner in the country has advocated, in a joint statement in May 2020, the use of mobile apps as public health tools on a voluntary basis, as this factor is “essential to building public trust”. audience “.
Conversely, the government threatened to fine everyone for not using the app. Failure to submit their information on this platform could result in travelers being required to self-quarantine or pay a $5,000 fine. Air carriers, meanwhile, could face fines of $25,000 if they don’t check a traveler’s ArriveCAN before they board an aircraft.
Minister Alghabra told the committee that more than 99.5% of travelers at airports had their ArriveCAN ready when they arrived. With such heavy penalties and fines allowed by the Quarantine Act, is it really surprising?
Transparency requested
As for the concerns of public health that would justify this muscular approach, it is difficult to find them. The app does not collect information about booster doses. It is not used to facilitate contact tracing (which was its original purpose). A few weeks ago, the government even introduced the “CBSA Advance Declaration” function in ArriveCAN — a function that has nothing to do with public health, and which serves to facilitate the transmission of declarations customs and immigration.
It is becoming increasingly clear that the government is using the Quarantine Act to modernize its border policies — conduct that undermines the government’s ability to invoke public health discourse in the future.
All of this sets a dangerous precedent. ArriveCAN standardizes the use of mandatory technologies based on automated decision-making and artificial intelligence to deliver essential services — without disclosing any information about how they work. Preventing access to the information necessary to understand or contest the decisions of these technologies thus goes against the principles of procedural fairness.
With all the foreseeable uses of these technologies—law enforcement, delivering employment insurance benefits, determining refugee status, public sector hiring, and more—when our government insists on their use, we have a duty to insist instead on the transparency and accountability of such tools.
ArriveCAN is a precedent that must be rejected.