StatsCan's website struggled with software issues for almost a month, emails show

Statistics Canada's busy website was partially disabled for much longer than previously reported, as technicians struggled for more than three weeks to bring all of its functions back.

The long, slow road to web restoration is documented in a series of emails obtained by CBC News under the Access to Information Act — emails that raise fresh questions about the performance of Shared Services Canada, the government's controversial IT agency.

The Statistics Canada website was taken offline late on March 9, after the government was alerted the day before that a common web software tool, known as Apache Struts 2, was vulnerable to hackers.

There is a risk of this type of event becoming ever more frequent ...- Wayne Smith, former head of Statistics Canada

The Canada Revenue Agency site was taken down for the same reason, just as tax-filing season began.

At a March 13 news conference, a government official said the problems had been resolved after three days.

"We are pleased to note that any affected websites have been patched and have been returned to normal operations," said Jennifer Dawson, of the Treasury Board Secretariat. Officials said at least one hacker got into the Statistics Canada site, but did no damage, and confidential CRA data was never compromised.

The CRA website appeared to operate without further problems after the fix.

But the released emails show the Statistics Canada website remained dysfunctional for weeks as a series of new problems were revealed.

• Shared Services Canada spread 'too thin,' consultations hear
• Report slams Shared Services Canada for failing projects

"We received the results this morning and there are still some vulnerabilities so the focus will be to fix them and re-scan them today," says one March 27 update.

Shared Services Canada, the troubled IT agency now responsible for maintaining Statistics Canada's website, confirmed to CBC News that there were "intermittent outages" until April 4 — or 26 days after the problems were first identified.

The emails also suggest Statistics Canada was sometimes not in the loop as Shared Services Canada worked to restore the public-facing website, which is virtually the only means for widely disseminating data to Canadians.

Morning after

The decision to take down the website was made by Shared Services Canada, rather than by chief statistician Anil Arora or other senior Statistics Canada officials.

Arora and the other officials only learned it had come down the morning after, shortly before the Labour Force Survey — a key monthly jobs report — was scheduled to be posted online, emails show.

Wayne Smith, the former chief statistician who resigned in protest last September citing Statistics Canada's eroding independence, says the incident shows the agency is still beholden to an ineffective IT provider.

"This was the longest outage of Statistics Canada's website since it began operation," Smith said after reviewing the released emails. "There is a risk of this type of event becoming ever more frequent, resulting in a serious degradation of service."

And despite the Liberal government's efforts to fix Shared Services Canada, the IT agency remains a problem for other government departments as well, he said.

"Still the same crowd, steering the bureaucratic boat that brought us the failed email system, Phoenix, the outrageously expensive integrated government website, and projects spinning out of control that haven't yet hit the headlines."

The released emails have numerous redactions, most to protect security information, and Shared Services Canada declined to fill in the blanks.

'Consulted' with StatsCan

A spokesperson for Shared Services Canada, Andrée Gregoire, said the agency "consulted" with Statistics Canada before taking the web servers offline, though a released email uses the word "notified."

Canadians had access to statistical information throughout the outages through an off-line telephone service, she added.

The Statistics Canada website handles hundreds of thousands of inquiries on peak days, whereas the telephone service handles relatively simple inquiries, usually a few thousand in a year.  

Smith says the released emails show nothing has changed since his departure in September.

"I resigned [partly because] … Shared Services Canada had too much control over Statistics Canada's ability to publish its information, and that was inconsistent with the agency's necessary independence," he said, adding that the IT agency's "general dysfunction was hobbling Statistics Canada's operations."

• Bill to boost StatsCan independence called 'half measure'

CBC News reported last week that a $1.35-million consultant's report, commissioned by the Liberal government, had slammed Shared Services Canada's poor performance since its creation in 2011 under the previous Conservative government.

The report by Gartner Inc. said the agency has been hobbled by under-resourcing and red tape, and badly needs a reset.

Follow @DeanBeeby on Twitter