Report Highlights: Digital Validation Of Identity To Access Services

AUDITED ENTITIES

Treasury Board of Canada Secretariat: The secretariat is responsible for leading the work of the federal government towards a common and secure approach for a trusted digital identity platform to support seamless and secure access to online services for Canadians across the country.
Shared Services Canada: The department is the contract authority for the procurement of the federal single sign-in system for accessing federal government services.
Employment and Social Development Canada: The department is responsible for working with the Treasury Board of Canada Secretariat and Shared Services Canada to procure and implement a federal single sign-in system and is responsible for managing the implementation of the system across the federal government.
Innovation, Science and Economic Development Canada: The department transferred responsibility for its digital credentials initiatives to the Treasury Board of Canada Secretariat in August 2022 and is responsible for supporting the work of the secretariat where digital credentials for business are concerned.

CONCLUSION

Treasury Board of Canada Secretariat, with the support of Shared Services Canada, Employment and Social Development Canada, and Innovation, Science and Economic Development Canada and in consultation with other departments, did not plan a national approach to digital identity. This was because the secretariat lacked funding to pursue this initiative. The secretariat has prioritized the purchase of a modern federal single sign-in system to replace almost 90 separate sign-in systems across government. The new single sign-in system is intended to be able to validate the identity of Canadians when they access online federal services.

FINDINGS AND RECOMMENDATIONS

A National Approach to Digital Validation of Identity Was Delayed by Lack of Funding

Findings:

The secretariat did not receive funding in Budget 2023 or Budget 2024 for the national approach or for establishing a digital identity program office. However, Budget 2024 provided $25.1 million to Employment and Social Development Canada to establish a modern, single sign-in system for federal government services.
In February 2023, the Treasury Board of Canada Secretariat formed a working group to develop a national approach to digital identity through consultation with interested parties with the federal, provincial, and territorial governments as well as with industry. Members of the working group included Employment and Social Development Canada and Innovation, Science and Economic Development Canada.
After the period under audit, the Treasury Board of Canada Secretariat and Employment and Social Development Canada signed a memorandum of understanding giving Employment and Social Development Canada the responsibility for leading the federal government’s work on a national approach to digital identity.
Federal departments, provinces, and territories are moving forward with their own identity and access management programs at different rates. Residents of Alberta and British Columbia can access certain provincial online services by signing in with a verified provincial account. The federal government will need to make sure that its new federal single sign-in system can interoperate with the various systems being developed by provinces and territories.
Internationally, countries are at varying stages of implementing digital identity.

Recommendations:

Employment and Social Development Canada should lead the work of the federal government to plan and develop a national approach to digitally validating identity to support seamless and secure access to online services for Canadians across jurisdictions. In doing so, the department should:
- Consult with relevant parties to determine the resources it needs, including appropriate funding.
- Determine how to secure the funding and then proceed to do so.
- Ensure that the federal government single sign-in system will interoperate with other systems across jurisdictions.

ESDC’s Response – Agreed:

ESDC/CDS is prioritizing work on a federal single sign-in service, while undertaking research and continuing to work with other departments and Canadian jurisdictions to better inform a national approach and promote interoperability.
ESDC/CDS will work collaboratively across the Country to implement a national approach to standards to digitally validate identity which will enable eventual cross-jurisdictional interoperability.
ESDC/CDS and the Treasury Board of Canada Secretariat will continue to consult and engage with relevant parties at cross jurisdictional tables to determine what potential policy and legislative amendments that would be required to implement such an approach.
ESDC/CDS also commits to working with central agency partners to explore appropriate funding/resourcing.

Cost of Implementing and Operating the New Federal Single Sign-In System Was Not Yet Known

Findings:

Given the lack of funding for a national approach to digital identity, the Treasury Board of Canada Secretariat had prioritized working with Employment and Social Development Canada and Shared Services Canada to procure a modern, single sign-in system for the federal government. The new system aims to replace almost 90 separate sign-in portals managed by individual federal departments. The system is intended to digitally validate the identity of Canadians when they sign in to access federal government services online. The secretariat considered the procurement of a new sign-in system to be an immediate priority for 2 key reasons:
- First, there were security vulnerabilities in existing sign-in systems (which have been temporarily addressed). In July 2020, a cyber-attack targeted the Canada Revenue Agency and Employment and Social Development Canada.
- Second, Employment and Social Development Canada requires a modern, secure sign-in system to support the planned 2025 release of Employment Insurance on the new Benefits Delivery Modernization system.
Budget 2024 provided Employment and Social Development Canada with $25.1 million over 5 years, starting in the 2024–25 fiscal year, to establish a modern, single sign-in system for federal government services. On 25 April 2024, Shared Services Canada issued a request for proposal to procure the system. The closing date for bids was 3 June 2024.
Shared Services Canada has a cost-recovery model in place with departments to use the existing services of GCKey and Interac® sign-in for their departmental portals and plans to recover costs from departments when they transition to using the new federal single sign-in system as well. The Treasury Board of Canada Secretariat and Employment and Social Development Canada expect the old and new systems to operate concurrently for up to 3 years as departments transition to the new system.
While there is a plan to recover costs from departments for using the new system, Employment and Social Development Canada, the Treasury Board of Canada Secretariat, and Shared Services Canada had not yet fully determined the transitional and ongoing costs for departments and how those costs would be funded.

RECOMMENDATIONS

Employment and Social Development Canada, with the support of the Treasury Board of Canada Secretariat and Shared Services Canada, should:
- Determine what it will cost for departments to transition to and use the new federal single sign-in system.
- In consultation with these departments, evaluate whether these costs should be funded through revised or new funding mechanisms designed to help departments and agencies modernize their information systems as recommended in our 2023 Report 7— Modernizing Information Technology Systems.

ESDC’s Response – Agreed:

To provide accurate cost analysis, Employment and Social Development Canada (ESDC) / the Canadian Digital Service (CDS) will work with departments through pilots and onboarding early adopters to analyze the needs and costs associated with onboarding departments and business lines of various sizes and levels of complexity. In addition, to ensure a realistic understanding of the long-term costs of operating this enterprise service, ESDC/CDS will monitor and analyze actual costs over an extended period.
ESDC/CDS will work with Shared Services Canada and the Treasury Board of Canada Secretariat to engage central agencies to explore appropriate funding models. This will take into consideration the recommendation 7.52 of the Fall 2023 audit “Modernizing Information Technology Systems,” specifically as it relates to funding models which “will include centralized control and management of modernization investment funding.”

Sonya is a young professional who holds a Bachelor of Arts degree, with a major in Political Science and a minor in Law & Society from the University of British Columbia (UBC), and a Master of Arts degree from the University of Toronto (U of T) – Munk School of Global Affairs & Public Policy. During her time at school, Sonya had the opportunity to conduct various research projects for her department, including investigating Greece’s defence expenditures on behalf of the Munk School of Global Affairs & Public Policy – Centre for European, Russian, and Eurasian Studies.