[DevilsAdvocate]

Never blame on malice what can be equally explained by incompetence.
I am a federal IT project manager.

Security checks are ONLY required if the person is going to be accessing private data or national defence information. I have seen projects where we have gotten around security checks by giving "fake" data to a contractor and saying "we need to process data like this". In cases like this, where no security checks are required, the contractor and sub-contract who can sub-sub-contract all they want. And unless it is stipulated in the contract, they are under no obligation to tell us who they sub-contracted to.

The bigger question that should be asked is - why was this contracted out at all? Every large contracted out project has been a MASSIVE waste of taxpayer money. Phoenix. Consolidating all federal email onto Bell servers. ArriveCan. I was invited to a meeting where I was told that company X was being brought in to replace system Y. I said that X's software was the wrong product and that my team could write a replacement for half the cost of their software + consultants. I was promptly asked to leave the meeting. Apparently my boss's boss had recommended the product to senior management. Nothing nefarious. No relatives in the company. No kickbacks involved. Just stupid management making stupid decisions based on ego. The cost savings promised by my boss's boss ended up being a cost nightmare as company X's software did not meet our needs. And yet we continued to renew the contract for three years because we had no other option.

How do these things spiral out of control? Same as Phoenix.

Let's say the government is contracting out making 100 submarine sandwiches. They then have to make out a scoring method. Basically "Do you have experience cutting bread? 5 points.", "Do you have experience slicing cheese?" 10 points, etc, etc,. At the outset, you set a minimum passing grade. If 10 companies get a passing grade, then it goes to the lowest bidder.

Now, let's say IBM is the lowest bidder. IBM won't make much money on the low bid. The big money is on contract renewals. Or contract amendments. Or add-on contracts. Let's say we have reached the end of the contract and IBM only has 30 sandwiches and those sandwiches don't hold together and for some reason the Australian contractor slathered them with Vegemite. Okay. Now we are in a big mess. We could embarrassingly scrap the whole project. Or we can offer a new contract to fix the project. But now IBM is sitting pretty. Not only did they get the highest score last time, but they know this sandwich game. They have even more experience. IT DOES NOT MATTER THAT THEY F'ED UP THE FIRST CONTRACT. THEY ARE THE HANDS ON FAVORITE TO GET THE NEW CONTRACT. There is no negative scoring for "Do you have experience completely wasting taxpayer money?"

From what I understand happened with ArriveCan was that once "GCStrategies" got the initial contract, each contract for updates got more expensive. "GCStrategies" had subcontractors that knew the code, knew the development tools, etc.. So they could basically set their price. What was CBSA gonna do? Hand a pile of code over to a new company to try to understand from scratch? I mean it's possible, but that takes developer time, so it increases the price. And given that the company had knowledge of the software, they would always get high scoring on any evaluation grid. So requests for updates almost always goes back to the original vendor. And once you are tied to them, they know the've got you and they take advantage of it.

If you think that somebody slipped some money to someone on the sly, that is nearly impossible. And pointless. There are completely legal ways to fleece the government. There are so many checks and balances to prevent money from "going missing". First thing the Harper Conservatives did was bring in hundreds of FI/AUs (Financial auditors) to check and double check that all the books add up and nothing goes missing. I don't mean like CERB money going out and nobody knows where it went; that's not the FI's job. They just look at procurement. To avoid something like the Chretien "Sponsorship Scandal". Which, frustratingly, did not involve a procurement department. The malfeasance was at the politician level, not with any government department. So all of these auditors brought in would not prevent another similar scandal because it is a different pot of money. Anyway, I believe that ThinkOn Inc saying they didn't work on the app is likely CBSA providing bad information, not that that money walked out the door somewhere.