OTTAWA — Health Canada’s technology systems were in such shambles before the COVID-19 pandemic that more than 35,000 computers were missing, an internal audit found.

That was only one of a very long list of problems the auditors found in the department’s information-technology branch, which also manages IT for the Public Health Agency of Canada (PHAC). The two bodies led the federal response to the pandemic.

The auditors heard that the IT operation didn’t have the resources to replace old computers, so most of the “primary computing devices” it handled were out of warranty and at risk of failure—or hacking.

The branch had never considered what it cost to maintain and support its software, and when old programs were removed, workers didn’t follow proper procedures and put potentially important data “at risk of being mishandled or lost.”

“The Public Health Agency of Canada acknowledges the need for improvement and has made many changes in recent years to policies, governance, planning and tracking,” spokesperson Tammy Jarbeau told The Logic by email. “Additionally, new technology is being implemented to improve automation with the management of IT assets and reduce the risk of manually introduced errors.”

Asked how obsolete equipment and software affected Health Canada’s and PHAC’s capacity to respond to the pandemic, Jarbeau gave an answer about the audit itself rather than the problems it uncovered: “The recommendations resulting from the audit … had no bearing on the department and agency’s response to COVID-19.”

The auditors conducted their examination in 2019 but presented their final report to the department only last January, after top managers had a chance to respond and promise fixes. It went online earlier this summer; The Logic obtained a copy through an access-to-information request, along with a briefing note saying it had been accepted by chief financial officers at Health Canada and PHAC, and by an assistant deputy minister in charge of digital transformation. The note recommended a “responsive media strategy,” meaning the department would respond to questions but not draw attention to the audit report.

The branch’s operations have been troubled for more than a decade, according to the auditors. An audit in 2009 found problems; a follow-up in 2012–13 to check on improvements found there had been some, but not enough. That led to an overhaul of its protocols, including a new tracking system for the department’s and agency’s computers that went into effect in 2017.

But migrating the old system’s data into the new one was cumbersome and “a manual entry process has proven to be inefficient and has led to incomplete and unreliable IT hardware data,” the auditors found. 

They ran a scan for devices connected to Health Canada’s network that “allowed for real-time discovery of 16,577 IT assets.” When they compared the results to the official inventory, the scan had turned up only 27 per cent of the computers in the whole system, and 53 per cent of the computers added since the 2017 overhaul.

All the computers found in the network scan had entries in the inventory, but 20,473 devices from the old system were nowhere to be found on the network, and 14,808 devices first entered in the new-and-improved version were also absent.

“[T]heir existence and location could not be confirmed,” the audit team reported.

The IT department had explanations, according to the audit report. Some of the computers in the inventories might not have been deployed and hooked up yet. Some might have been “permanently offline” but not recorded that way. Some might have gone with workers in the former First Nations and Inuit Health Branch, which became part of the new Indigenous Services Department after Prime Minister Justin Trudeau created it in 2017.

But even in the new inventory, many of the entries were shoddy, the auditors found.

“For example, out of the 59,760 assets in the new hardware inventory, only 49 per cent of assets had an assigned user or location, with the rest of the assets marked as missing or left blank,” they reported. Sometimes different items had the same tag numbers, which “increases the risk that the assets cannot be appropriately safeguarded, maintained or monitored.”

There was also no process for checking the inventory of “low dollar value IT assets,” such as USB sticks, servers, laptops, tablets, computers and monitors, because the department simply decided to exclude those sorts of items from its periodic reviews of its goods. The devices themselves might be inexpensive, the auditors pointed out, but the data they hold could be incredibly sensitive.

(Those devices should be tracked, the department acknowledged in its formal response to the audit’s recommendations. But it said only secure USB sticks have been allowed to connect to the department’s devices since 2014, hard drives are all encrypted and Health Canada and PHAC computers from 2015 or later have sensors from the Communications Security Establishment’s cybersecurity operation installed on them.)

Only 27 per cent of the devices in the newer inventory had target replacement dates, the audit found, but there’s no “evergreening” program anyway because—the department told the auditors—there wasn’t the money for one.

“Instead,” the auditors wrote, “aging hardware was primarily maintained through a ‘break and fix’ approach.” In other words, when something stopped working, the IT department would go try to fix it, but didn’t do preventive maintenance or replace gear before it failed.

As a result, Health Canada had computers running Windows 7 after Microsoft stopped supporting it in January 2020 and they became increasingly vulnerable to malware and cyberattacks.

“Given today’s increasingly sophisticated cyber threats, it is important for [Health Canada] and PHAC to not only account for all assets in their digital environment, but also proactively repair, support or replace damaged assets in a timely manner,” the audit report says.

We are on it, the department replied. Senior officials formally agreed with all 10 of the auditors’ recommendations for cleaning up. Among other things, Health Canada’s management promised another new inventory system, to be put into operation this fall, that will be better than the last two.

The department did quibble with the auditors’ recommendation that obsolete software needed to be replaced immediately. “Governance related to [software] application management is more mature than represented,” the departmental response said. It promised “ongoing” work to monitor and upgrade, with no deadline.

The auditors grouped their findings into 10 categories and ranked the risks associated with each on a five-point scale. Three were worrisome enough to get the full five points:

• The disastrous inventories
• The poor monitoring of devices that are inexpensive in themselves but could hold valuable data
• The outdated software

Six got four-point ratings. One of the 10 categories, on outdated policies and guidelines, got three points.

Jarbeau told The Logic that managing “material” like computers and software is supposed to be a balancing act under federal rules, requiring that departments do their jobs while considering finances and efficiency.

“That is why PHAC will continue using a balanced approach to mitigate risks in the management of IT assets,” she wrote.