PASSPORT CANADA SECURITY BUREAU EVALUATION

PASSPORT CANADA SECURITY BUREAU EVALUATION
PASSPORT CANADA

SECURITY BUREAU EVALUATION




                                 Final Report




    Foreign Affairs and International Trade Canada
            Office of the Inspector General
                  Evaluation Division




                                  August 2008

    This document may not be fully accessible. For an accessible version, please visit
http://www.international.gc.ca/about-a_propos/oig-big/2008/evaluation/pptc08.aspx?lang=eng
PASSPORT CANADA SECURITY BUREAU EVALUATION
PASSPORT CANADA SECURITY BUREAU EVALUATION
Passport Canada - Security Bureau Evaluation



TABLE OF CONTENTS

ACKNOWLEDGEMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ii

LIST OF ACRONYMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii

EXECUTIVE SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv

1.0      INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .       1
         1.1  Evaluation Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .          1
         1.2  Evaluation Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .              4
         1.3  Description of the Security Bureau . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                  7
         1.4  Challenges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .      8

2.0      RELEVANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .       13
         2.1 Most Security Bureau Functions Remain Relevant . . . . . . . . . . . . . . . .                                13
         2.2 Absence of an Entitlement Risk Assessment . . . . . . . . . . . . . . . . . . . .                             16
         2.3 Shifting to a Risk-Based Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . .                     17
         2.4 Impact of Authorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .           18

3.0      SUCCESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .   21
         3.1 On a Track of Ongoing Improvements . . . . . . . . . . . . . . . . . . . . . . . . .                          21
         3.2 Balancing Client Service and Security . . . . . . . . . . . . . . . . . . . . . . . . .                       25
         3.3 Inadequacy of Performance Information . . . . . . . . . . . . . . . . . . . . . . . .                         26

4.0      COST-EFFECTIVENESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                29
         4.1  Clarifying Roles and Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . .                    29
         4.2  Improving Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                 31
         4.3  Improving Standardization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .              32
         4.4  Impact of Security Bureau Resources . . . . . . . . . . . . . . . . . . . . . . . . . .                      34
         4.5  Need Better Tools for Decision-Making . . . . . . . . . . . . . . . . . . . . . . . . .                      38
         4.6  Passport Canada is Making Progress . . . . . . . . . . . . . . . . . . . . . . . . . .                       41

5.0      CONCLUSION AND RECOMMENDATIONS . . . . . . . . . . . . . . . . . . . . . . . . . 43

APPENDIX A: MANAGEMENT RESPONSE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46




August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                                 i
PASSPORT CANADA SECURITY BUREAU EVALUATION
Passport Canada - Security Bureau Evaluation



ACKNOWLEDGEMENTS
The evaluation team would like to express their appreciation to the many individuals
who have contributed to this evaluation. We extend our thanks to all those employees of
Passport Canada, Consular Affairs, RCMP and our colleagues in the United Kingdom,
New Zealand and Australia who provided us with their insight, valued opinions and
good-will.

Of special mention the evaluation team acknowledges that the conduct of this
evaluation occurred during a particularly challenging point in the transformation of
Passport Canada. We appreciate the additional effort and cooperation extended to the
evaluation team in order to complete this assessment.




August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                   ii
Passport Canada - Security Bureau Evaluation



LIST OF ACRONYMS


 CBSA            Canada Border Services Agency
 CIC             Citizenship and Immigration Canada
 CMO             Case Management Officer, Passport Canada
 CSC             Correctional Services Canada
 CPIC            Canadian Police Information Centre
 DFAIT           Department of Foreign Affairs and International Trade Canada
 DQA             Data Quality Analyst, Passport Canada
 ERA             Entitlement Review Analyst, Passport Canada
 ERI             Entitlement Review Investigator, Passport Canada
 IPS             International Processing Service, Passport Canada
 NPS             National Processing Service, Passport Canada
 OAG             Office of the Auditor General of Canada
 RCMP            Royal Canadian Mounted Police
 RSA             Regional Security Advisor, Passport Canada
 SICMS           Security and Intelligence Case Management System, Passport Canada
 UK-IPS          United Kingdom-Identity Passport Services
 WHTI            Western Hemisphere Travel Initiative




August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                  iii
Passport Canada - Security Bureau Evaluation



EXECUTIVE SUMMARY
Passport Canada was established in 1990 as a Special Operating Agency of the
Department of Foreign Affairs and International Trade Canada. DFAIT identified the
need to evaluate the effectiveness of the Passport Canada Security Bureau in its Report
on Plans and Priorities for 2007-08.1 The undertaking of this evaluation was considered
crucial in order to assess organizational effectiveness during a time of heightened
global security, high passport demand and organizational re-alignment to meet such
demands.

The evaluation found that the Security Bureau continues to remain relevant and has
improved its effectiveness in ensuring the integrity of the passport issuance process.
However, the Security Bureau would benefit from an assessment of risks and tolerance
levels to guide the progress to reduce security risks. The Bureau would also benefit
from a sound performance measurement framework.

Context

Passport Canada’s Security Bureau “ensures the integrity and effectiveness of the
passport issuance process, the security and quality of the passport concept and its
compliance with both Passport Canada’s eligibility policy and the Government Security
Policy.”2 This includes responsibility for the integrity of entitlement decision-making
processes and the physical characteristics of the travel document.3

The Security Bureau was evaluated at a critical junction in the implementation of its
mandate. The events following September 11, 2001 led to a focus on security and a
heightened emphasis on the integrity of travel documents world-wide. The Western
Hemisphere Travel Initiative,4 initiated by the United States, contributed to a dramatic
increase in demand and security-related measures. For Passport Canada, this
translated to a surge of applications from Canadians applying for passports. Over the
last six years, Passport Canada saw demand for passport documents increase by 137%
and a corresponding 157% jump in resources. Since 2001-02, full-time equivalent staff
positions have increased by 206%.



1
    Department of Foreign Affairs and International Trade: Report on Plans and Priorities 2007 – 2008, p. 110.
2
    Responding to Change: Annual Report 2006 – 2007, Passport Canada, p. 5.
3
    There are seven types of travel documents: regular “blue” passports (with either 24-page or 48-pages),
    temporary passports, diplomatic passports, special passports, emergency passports, refugee travel documents
    and certificates of identity. (Passport Canada Business Plan 2006 – 2009, Appendix A).
4
    This initiative will require all travelers including citizens from the United States and those living in the Americas to
    have a passport to enter the United States by June 2009.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                              iv
Passport Canada - Security Bureau Evaluation


The Office of the Auditor General conducted an audit in 2005 and a follow-up audit in
2007 which identified significant concerns with respect to Passport Canada’s capacity to
respond to increased demand and meet security requirements. Although Passport
Canada has taken many initiatives to address these issues, there still remain numerous
jurisdictional and legislative considerations beyond the control of Passport Canada that
affect entitlement.

For instance, Passport Canada, like other agencies that require proof of identity to
deliver services, has to deal with multiple agencies in different jurisdictions to confirm
identity. Vital statistics (e.g. births/deaths) fall under provincial/territorial jurisdiction,
each with different document standards. There are also legal provisions to respect
individuals’ rights to privacy and who can access and share personal information.

The evaluation findings were based on 68 interviews with stakeholders between
January and March 2008. Extensive passport documentation was also reviewed.
Qualitative and quantitative analyses formed the basis for the evaluation assessment on
relevance, success and cost-effectiveness.

Relevance

The issue of relevance addresses questions pertaining to the contribution of the
Security Bureau in achieving Passport Canada’s mandate. The evaluation found that
the Security Bureau is relevant in addressing passport entitlement but it was challenging
to assess the relevance of the Security Bureau’s activities in the absence of a risk
assessment on entitlement and issuance. Without this assessment, there is no
framework to determine which functions are appropriate to the Bureau’s mandate.

The Security Bureau’s functions5 contribute to the integrity of the Canadian passport
document by supporting entitlement decision-making through expert assistance to the
policy and operational units of Passport Canada both at home and at Canadian
missions abroad. This centralized approach contributes to ensuring the security aspect
of passport issuance. However, the evaluation also found that some functions appear
more related to passport operations, rather than to security, including some of the data
integrity functions, case management functions and support to foreign operations.

Until recently, the focus of passport security had been to provide a complete and
standard review of each and every passport application. This was conducted by a rigid
application of rules and procedures. Passport Canada has begun to shift this focus to
one that is based on an assessment of risks and the identification of the high risk


5
    Security Bureau is responsible for gathering intelligence, maintaining the integrity of the data in Passport
    Canada’s passport issuance system, providing advice on complex applications, investigating applications related
    to suspected criminal or fraudulent activities, collecting and sharing information on lost or stolen passports, and
    recommending changes to the physical characteristics of travel documents.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                          v
Passport Canada - Security Bureau Evaluation


situations. The simplified renewal process is one example of this new approach. The
simplified renewal process is based on the concept of known applicants who present a
lower risk. Any previous passport holder who has not reported a lost, stolen or damaged
passport as well as other criteria can reapply without resubmitting supporting document
and without a guarantor.

Success

The Security Bureau continues on a path of improvement. Efforts are underway to
establish a compliance function and to clarify the role of the Regional Security Advisors.
The Security Bureau ensures the integrity of the passport issuance process by providing
the necessary support to the operational units as well as to Canadian missions
responsible for the Passport Program abroad.

The Bureau has also been successful in changing its management culture. It continues
to develop new tools to support decision-making, to improve access to information, to
strengthen information systems, to increase support to Canadian missions and to
include new security measures in passports. These measures are designed to reduce
fraud and the misuse of the passport document.

The evaluation found that the Security Bureau responds primarily to identified or known
risks based on a narrow scope. Currently, the focus is to develop the tools and
processes required to be more systematic in the identification and management of
security risks. This will allow for improved management and balance between client
service demands and the security of the passport issuance process.

Some informants also had the impression that security was compromised in efforts to
maintain client service standards during the unprecedented increase in passport
applications in 2006-07. There is insufficient information on the Security Bureau’s
activities at this time to conduct a review or to assess on a broader scale the Bureau’s
performance with regard to the impact of increased volume on entitlement decision-
making.

Cost-effectiveness

The cost-effectiveness of the Security Bureau was found to be affected by such factors
as: the unclear communication of the Bureau’s role, responsibility and direction; varying
levels of standardization of security-related activities; and, on the adequate use of its
resources and information holdings.

The evaluation found that many employees did not understand the role of the Security
Bureau. This impression was most evident with the role of Regional Security Advisors
(RSAs) who are located in the regional directorates. RSAs were intended to increase
the Bureau’s capacity to enhance the integrity of the Passport Program within the

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                  vi
Passport Canada - Security Bureau Evaluation


regions in Canada. The evaluation interviews revealed that there has been little
direction given to RSAs on their expected role and, as a result, their roles have evolved
inconsistently across Canada. In some regions, the Regional Security Advisors may
deal with issues beyond the mandate of the Security Bureau for example, physical
security.

This lack of clarity on roles and responsibilities may be related to a more general issue
on the need for clear communications. Communications on security issues can come
from a variety of bureaus within Passport Canada; not just the Security Bureau. While
there was no evidence to suggest that there are inconsistencies in entitlement
decisions, there was considerable variation in work processes among the issuing
offices.

The evaluation also found gaps with respect to the tools and databases available to the
Security Bureau to ensure the integrity of entitlement decision-making both in terms of
the Bureau’s ability to make effective use of its internal information and its ability to
access external information from partner organizations. Improvements have been made
to increase data availability but there are still issues on data quality (completeness) and
comparability. For example, data are either available electronically but cannot be
searched or only on a limited case-by-case basis.

Despite an increase in resources, the Security Bureau still needs to fill positions as well
as define the roles and responsibilities for new positions. As a result, the evaluation
found it difficult to assess if the level of resources required for its mandate is sufficient.

Recommendations

The evaluation found that the Security Bureau performs a critical role in ensuring the
integrity of the passport issuance process and the physical characteristics of Canada’s
travel documents. It continues to work towards reducing barriers to strengthening its
processes and tools to provide more efficient service delivery, without compromising
security.

The evaluation proposes three recommendations. These recommendations are based
on one theme which is to establish an entitlement risk assessment, wide in scope, to
guide the effectiveness and progress on reducing security risk.

   1. That Passport Canada conducts an assessment of security risks on passport
      issuance and that the approaches to managing these risks are within acceptable
      tolerance levels.

   2. That the Security Bureau develops a management framework for its activities
      based on the results of the security risk assessment.


August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                  vii
Passport Canada - Security Bureau Evaluation


   3. That the Security Bureau develops performance measures to monitor its
      decision-making.




August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                 viii
Passport Canada - Security Bureau Evaluation



1.0         INTRODUCTION
This report presents the results of an evaluation of Passport Canada’s Security Bureau
conducted between January and March 2008. A case study was also conducted with
the United Kingdom’s Identity Passport Services as a means to offer similarities and
differences in their approach to passport security. The evaluation reports on relevance,
success, and cost-effectiveness.

1.1         Evaluation Context

Passport Canada was established in 1990 as a Special Operating Agency of the
Department of Foreign Affairs and International Trade Canada (DFAIT). The mandate of
Passport Canada is to “ensure secure Canadian travel documents through
authentication of identity and entitlement, facilitating travel and contributing to
international and domestic security.”6

As an Agency, Passport Canada finances its operations from the fees charged for
passports and other travel documents7. Passport Canada is considered self-financed
and must generate sufficient revenues to meet expenditures. It offers services through
33 local offices located across the country. To better serve Canadians, it also works in
cooperation with receiving agents like Canada Post and Service Canada to assist
Canadians with their passport applications. The Agency processes applications
received by mail, in-person, through receiving agents, and through Members of
Parliament. Exhibit 1 provides an overview of Passport Canada.

This evaluation was identified in DFAIT’s Report on Plans and Priorities for 2007-088.
The purpose of the evaluation is to establish to the extent possible a baseline of the
effectiveness of the Security Bureau. This would be used to assess the integrity of the
passport document and the issuance process. The objectives of the evaluation were to:

    •   Examine the relevance, success and cost-effectiveness of the Security Bureau;
    •   Identify any vulnerabilities associated with the Security Bureau;
    •   Conduct comparative analysis with the United Kingdom;9 and,
    •   Recommend areas of improvement.


6
    Responding to Change: Annual Report 2006 – 2007, Passport Canada, p. 3.
7
    Passport fees cover the production of the travel document. Passport Canada receives money from TBS to
    support capital projects.
8
    Department of Foreign Affairs and International Trade: Report on Plans and Priorities 2007 – 2008, p. 110.
9
    This component is addressed in a separate case study.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                      1
Passport Canada - Security Bureau Evaluation


Exhibit 1:     Overview of Passport Canada




August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                             2
Passport Canada - Security Bureau Evaluation


Exhibit 2:     Overview of Security Bureau




August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                             3
Passport Canada - Security Bureau Evaluation


1.2          Evaluation Methodology

The data collection for this evaluation was conducted between January and
March 2008. Below are the evaluation issues and questions.

Exhibit 3:       Evaluation Issues and Questions

 Relevance
 To what extent is the Security Bureau adding value in support of Passport Canada’s m ission and
 objectives?
 •   How does the Security Bureau contribute to the m andate and m ission of Passport Canada?
 •   How does it ensure the integrity of the entitlem ent process?
 •   How does the Security Bureau contribute to the im plem entation of Passport Canada business
     plans?
 To what extent are roles and responsibilities for the Security Bureau clearly com m unicated and
 understood?
 •  To what extent are the Security Bureau’s activities integrated with other parts of the organization
    and external stakeholders?
 •  Are its role and responsibilities understood within the organization?
 •  On m atters related to security, are the lines of com m unication am ong m anagers, directors and
    directors general uniform ly applied?

 Success
 To   what extent is the Security Bureau achieving objectives and expected results?
 •    W hat are the expected results?
 •    Are the objectives for the Security Bureau clear?
 •    Are the objectives com m unicated, understood and agreed upon?
 •    To what extent are perform ance expectations clear?
 •    Are the perform ance expectations com m unicated, understood, and agreed upon?
 •    To what extent are key perform ance m easures m easured and m onitored consistently?
 •    Are there best practices within Passport Canada that could be applied to the organization
      nationally?

 Cost-effectiveness
 To what extent has the Security Bureau im plem ented approaches to achieve efficiency and cost-
 effectiveness?
 •   To what extent are there consistent and standardized security functions from one location to
     another? If variance exists, to what extent are these differences between locations explainable and
     acceptable?
 •   Are there sufficient resources in place for the consistent and uniform application of security
     functions?
 •   How have new technologies, approaches or policies affected the security function?
 •   Does the Security Bureau have the capacity to respond and adopt new security standards /
     processes; for instance, the new im plem ented guarantor policy? Is there any supporting data?
 •   Are there workforce capacity issues that need to be addressed?




August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                4
Passport Canada - Security Bureau Evaluation


The evaluation methodology consisted of a mixed-methods approach. This means that
the evidence is based on several different data sources: interview data from internal and
external stakeholders, financial data and key documents. The following lists the
foundation that was used for evidence:

     •       A review of relevant documentation;
     •       Interviews with 43 key informants within Passport Canada (representing all
             regions and with direct contact with Security Bureau functions);10
     •       Interviews with 11 employees in six Canadian missions responsible for the
             delivery of the Passport Program abroad;
     •       Interviews with three representatives of the Royal Canadian Mounted Police
             (RCMP) with responsibilities for liaison with Passport Canada;11 and
     •       Interviews with 11 representatives from the United Kingdom Identity Passport
             Services, the New Zealand Department of Internal Affairs and the Australia
             Department of Foreign Affairs and Trade.

1.2.1           Data Collection

Interviews were the primary source of data for this evaluation. The interview protocols
were established in advance and provided a standard approach to interviews. The
questions were open-ended to allow for maximum latitude to explore issues of direct
relevance with key informants. On average, each interview lasted one hour. The
evaluation findings present divergent opinions as well as consistent themes delineated
from interview data.

Passport Canada provided a list of internal and external stakeholders. Seventy-nine
percent (79%) of informants were Passport Canada and DFAIT employees, while the
remaining 21% were external stakeholders. Of these informants, only three were unable
to participate. Evaluation findings are therefore based on a participation rate of 95%.
Interview data have also been aggregated to respect confidentiality.




10
     This included thirteen from the Security Bureau and the remaining from the Policy and Planning Bureau and the
     Operations Bureau (including twenty-seven from operational units – Regional Directorates and Issuing Offices).
     Only two planned interviews were not able to be completed – one with Passport Canada’s Business Information
     and Technology Bureau and one with the Canada Border Services Agency.
11
     Ibid.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                       5
Passport Canada - Security Bureau Evaluation


1.2.2         Evaluation Scope

The focus of this evaluation was on the operations of the Security Bureau as opposed to
the security function.12 Given this focus, the list of key informants was a valid frame of
reference. The results from the interviews offered reliable data to directly assess the
activities and outcomes of the Security Bureau.

The key informants were all involved in the principal bureaus within Passport Canada
that have direct contact with Security Bureau. The only Passport Canada bureau that
was unavailable for an interview was the Business Information and Technology Bureau.
Eleven DFAIT employees involved in the extension of the Passport Program at
Canadian missions were included to gain a sense of the relationship among Consular
Affairs, Passport Canada and Canadian missions. The mission sample was selected
based on geographic representation13 and volume of passport-related inquires. It is,
however, not representative of all mission-related passport activities. Of the three main
external stakeholder groups, CIC, CBSA and RCMP, only the RCMP participated.

The evaluation is subject to the following limitations on coverage and data quality:

     •   The evaluation team developed a proxy measure14 of the Security Bureau’s
         mandate, activities and expected results15 to serve as a framework for the
         evaluation. Evaluation findings are therefore proxies and, should not be viewed
         as a validated benchmark inclusive of all the Security Bureau activities, only an
         approximate of key activities.
     •   The evaluation was based mostly on interviews and other source data from
         Passport Canada.
     •   Because the focus of the evaluation was on the functions of the Security Bureau
         and not the security function within Passport Canada, it was at times challenging
         to distinguish whether key informants were referring to the functions of the
         Security Bureau or security in general (e.g. physical security, IT security function,
         operational security, etc.) This contributed to a lack of clarity on the current role
         of the Security Bureau.



12
     A description of the Security Bureau is provided in Section 1.3. The Security Bureau is not responsible for end-to-
     end security functions.
13
     Representation was defined by continent and by Canadians residents abroad.
14
     Proxies for the Security Bureau mandate, expected results and outcomes were defined based on Passport
     Canada’s business plan. These were further established based on key informant responses from Passport
     Canada employees conducted in the course of this evaluation.
15
     Responding to Change: Annual Report 2006 – 2007, Passport Canada.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                          6
Passport Canada - Security Bureau Evaluation


The impact of these limitations is that the evaluation is an internal assessment of the
Security Bureau. Given that most key informants were Passport Canada employees, the
findings reflect a localized and biased perception of the organization. Nevertheless, the
convergence of the responses validated the findings.

1.3           Description of the Security Bureau

1.3.1         Security Bureau Mandate

Within Passport Canada, the Security Bureau “ensures the integrity and effectiveness of
the passport issuance process, the security and quality of the passport concept and its
compliance with both [Passport Canada’s] eligibility policy and the Government Security
Policy.”16 This includes responsibility for the integrity of entitlement decision-making
processes and the physical characteristics of all travel documents17. In the past, the
Security Bureau also had responsibility for physical and information technology security
functions. Since 2006 these are no longer the responsibility of the Bureau.

1.3.2         Security Bureau Structure and Responsibilities

The Security Bureau is under the responsibility of a Director General and has four
divisions:

     •   Security Operations Division is responsible for the integrity of passport data,
         dealing with complex cases and compliance with Passport Canada policies and
         procedures;
     •   Enforcement and Anti-Fraud Division is responsible for intelligence gathering, the
         review and investigation of cases where there are concerns about entitlement or
         revocation, physical security characteristics of travel documents, security
         screening for Passport Canada personnel,18 and the Regional Security Advisors;
     •   Foreign Operations Division provides support for the implementation of the
         Passport Program in Canadian missions; and,
     •   Management Services Division is responsible for providing overall management
         support to the Bureau, including the development of work plans and performance
         measurement systems.



16
     Responding to Change: Annual Report 2006 – 2007, Passport Canada., p. 5.
17
     There are seven types of travel documents: regular “blue” passports (with either 24-page or 48-pages),
     temporary passports, diplomatic passports, special passports, emergency passports, refugee travel documents
     and certificates of identity (Passport Canada Business Plan 2006 – 2009, Appendix A).
18
     This function is under consideration for transfer to the Corporate Services Bureau.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                    7
Passport Canada - Security Bureau Evaluation


The overall structure of the Security Bureau is shown in Exhibit 2. The exhibit also
presents a very brief summary of the responsibilities of each section.

The Security Bureau supports:

     •   Issuing offices in the Eastern, Ontario and Western regions;
     •   The National Processing Services which processes mail-in applications, as well
         as those from receiving agents and members of Parliament;
     •   Passport services at missions abroad.
     •   The International Processing Services which processes applications for
         Canadians living abroad; and
     •   The print centres in Quebec and Ontario.

1.4          Challenges

Passport Canada continues to face many challenges that have had an impact on the
delivery of the Passport Program including, but not limited to, the specific influence of
the Western Hemisphere Travel Initiative (WHTI) on travel requirements to the United
States. This initiative requires all travelers including U.S. and Canadian citizens to
present a valid passport or other approved secure document when entering the United
States from within the western hemisphere. The U.S. WHTI is being implemented in
stages by mode of transportation. The WHTI was implemented for air travel on
January 23, 2007. Full implementation of the WHTI requirements for entry into the
United States by land and water is expected on June 1, 2009.

1.4.1        Changed Security Environment

The post 9/11 environment elevated a global focus on security which led to an
increased emphasis on the security and integrity of travel documents around the world.
This change in environment drove the pressures to strengthen the passport issuance
and control systems, practices, and policies and the physical specifications for
passports (including e-passports and the use of biometrics)19.




19
     An e-passport is a passport document that will include an embedded electronic chip that could contain various
     data such as: basic passport bearer information in the machine-readable zone and/or fingerprints and digital
     photo.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                          8
Passport Canada - Security Bureau Evaluation


1.4.2        Increase in the Demand for Passports and the Impact on Resources

The volume of passports issued rose from 2.04 million in 2001-02 to 4.83 million in
2007-08 (see Exhibit 4)20. This is a dramatic increase in demand, a surge of 137% over
six years, with the 24-page regular passport representing 98% of all passports issued.
Year-to-year changes showed steady increases each year with the last three fiscal
years being the highest overall. Since 2005-06, the number of passports issued jumped
13% over the previous year and Passport Canada’s projections show this level of
demand constant until 2009.

Exhibit 4:       Volume of Passports Issued, 2001-02 to 2007-08

                          Number of passports                 Increase since                 Year to year
                           issued in millions                    2001-02                      % change
 2001-02                              2.04                            N/A                        N/A
 2002-03                              2.29                            11%                        11%
 2003-04                              2.62                            28%                        13%
 2004-05                              2.76                            35%                         5%
 2005-06                              3.18                            56%                        13%
 2006-07                              3.66                            79%                        13%
 2007-08                              4.83                           137%                        24%

21
     Source: Passport Canada


There was no noticeable difference in the method by which Passport Canada received
its applications for processing (Exhibit 5). Walk-ins continue to be the primary service
channel accounting for nearly 80% of all passports. Passport applications received
through mail-ins, missions, receiving agents or other sources22 represent the remaining
20% of total passports.




20
     Data from Passport Canada.
21
     Includes all types of passports including passports issued through Consular services.
22
     Passport Canada Annual Report.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                 9
Passport Canada - Security Bureau Evaluation


Exhibit 5:          Percentage of Applications by Business Channel, 2003-04 to 2006-07


     Service channel                  2003-04      2004-05       2005-06         2006-07          Average

 W alk-ins                             80%           77%           79%            79%              79%
 Mail-ins                              16%           17%           11%            13%              14%
 Missions                               4%           4%            4%              4%               4%
 Receiving agents                       1%           2%            3%              4%               2%
 Other                                  0%           1%            3%              1%               1%

Source: Passport Canada


Exhibit 6 shows that the steady increase in the number of passport applications led to a
significant increase in Passport Canada resources. Between 2001-02 and 2007-08,
revenues rose from $111 million to $284 million representing an increase of 157%.
Salaries accounted for 58% of expenditures in 2007-08, up from 50% in 2001-02.
Exhibit 7 shows that over the same timeframe, expenditures were generally in pace with
revenues.

Exhibit 6:          Passport Canada Resources and Percent Change, 2001-02 to 2007-08

                          Salary               O&M           Total         %          # of           %
         Year
                         ($,000’s)           ($,000’s)     ($,000’s)     change      FTEs          change
2001-02                           56421          54,654        111075      N/A              949      N/A
2002-03                           70180          68,588       138,768      20%              N/A      N/A
2003-04                           85875          63503         149378      7%              1291      N/A
2004-05                          94,470          73013        167,483      11%             1731     25%
2005-06                        115,994           83361        199,355      16%             1900      9%
2006-07                        123,775           92,874        216649      8%              2256     16%
2007-08                        165,753          119,222        284975      24%             2900     10%

23 24
         Source: Passport Canada


Since 2001-02, Passport Canada continues to respond to passport demand. In 2001-
02, there were 949 full-time equivalents, while in 2007-08, it grew to 2,900. This
represents an increase of 206% over six years. This rapid escalation contributed to



23
        Includes employee benefits.
24
        Preliminary numbers.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                 10
Passport Canada - Security Bureau Evaluation


organizational strain in terms of personnel security screening,25 training, implementing
double shifts, integrating new employees and, of course, the need for new and
specialized accommodations.

Exhibit 7:        Revenues and Expenses, 2001-02 to 2007-08 ($000’s)




Source: Passport Canada


1.4.3         External Audit

The timing of an audit by the Office of the Auditor General (OAG) in 2005 was critical in
assessing Passport Canada’s progress to effectively respond to the passport demand.
The OAG audit identified significant concerns with respect to Passport Canada’s
capacity to respond to increased client demands and meet the new and necessary
security requirements. Passport Canada has since launched several new measures to
address the issues identified in the audit.




25
     This had a direct impact on the Security Bureau, which is currently responsible for personnel security screening.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                        11
Passport Canada - Security Bureau Evaluation


While the impact of these new measures is outside the scope of the evaluation, the
timeframe when these measures were initiated is covered by this evaluation. These
measures drove much of Passport Canada’s planning since 2004-05 and their progress
is reflected in the 2007 OAG follow-up audit.




August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                 12
Passport Canada - Security Bureau Evaluation



2.0        RELEVANCE
Evaluation findings as they relate to the relevance of the Security Bureau to achieve
Passport Canada’s mandate are reported below:

2.1        Most Security Bureau Functions Remain Relevant

The issuance of a travel document is essentially a security-based process. All aspects
of the process have security components – from checking the legitimacy of evidentiary
documents which support the applicant’s identity and entitlement to a passport, to the
secure printing and delivery of the passport. While Passport Canada is aware of the
client service aspect of its work and has made public commitments to client service
standards, ensuring the integrity of the passport document requires a security focus at
all stages of the entitlement process.

Finding 1:          Most Security Bureau functions contribute to protecting the integrity of
                    the decision-making and the Canadian passport document.

Most Security Bureau functions contributed to mitigating two passport security threats
that were identified in the Passport Canada Business Plan 2006–2009:

   •   The fraudulent use of another person’s identity or a false identity to obtain a
       passport by focusing on ensuring the security and integrity of the entitlement
       process; and,
   •   The tampering or counterfeiting of the passport book by focusing on high security
       physical characteristics of travel documents.

Security of Entitlement Decision-Making

The Security Bureau supports decision-making on entitlement. Specific Security Bureau
functions that are consistent with the Bureau’s mandate and its role in supporting
passport integrity include:

   •   Contributing to the development of entitlement decision-making policies, as
       reflected in the Passport Policy Manual and commenting specifically on the
       impact of policy on the security and integrity of the entitlement decision-making
       process;




August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                 13
Passport Canada - Security Bureau Evaluation


     •   Gathering intelligence for the System Lookout database26 also referred to as
         “watch list.” This database is the first check for identifying cases where there may
         be a security concern;
     •   Maintaining the integrity of the data in IRIS (Passport Canada’s issuance system)
         through the work of the Data Quality Analysts (DQAs);
     •   Supporting issuing offices and the National Processing Service with advice and
         guidance on complex cases (e.g. cases involving custody of children, multiple
         lost or stolen passports or travelers who have incurred a debt to the Crown for
         repatriation costs) through the work of the Case Management Officers (CMOs);
     •   Investigating cases related to suspected criminal or fraudulent activities. These
         are referred to Entitlement Review Analysts (ERAs) or Entitlement Review
         Investigators (ERIs); and,
     •   Collecting and managing information on lost or stolen passports and sharing this
         with relevant partner organizations.

Physical Characteristics of Travel Documents

The Security Bureau is responsible for researching and recommending changes to the
physical characteristics of travel documents. It is also responsible for liaising with
partner organizations to ensure that entitlement officers are aware of any changes to
key documents used in the passport issuance process – for example, birth certificates,
driver’s licenses or citizenship certificates.

 Finding 2:            Some Security Bureau functions do not appear to be distinct from the
                       ongoing operations of Passport Canada.

It appears that the Security Bureau currently has five key functions:27

     •   Supporting operational decision-making by addressing issues related to
         inconsistent or incomplete data and providing advice and guidance on complex
         cases;
     •   Ensuring the integrity of the passport issuance process through security
         compliance reviews;




26
     System Lookout is a database containing information on persons whose request for passport services might be
     subject to refusal or limitation.
27
     Not including the management services function that supports the other functions of the Bureau.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                   14
Passport Canada - Security Bureau Evaluation


     •   Gathering of intelligence and using this information to conduct entitlement
         reviews and investigations;28
     •   Recommending security features for all travel documents; and,
     •   Supporting Canadian missions with implementation of the Passport Program
         abroad.29

Only three of these five functions appear to be uniquely related to security activities
beyond those that are inherent in the ongoing passport issuance process, which is the
responsibility of the Operations Bureau. These are:

     •   Ensuring compliance with security provisions;
     •   Intelligence gathering and investigations; and
     •   Recommending security features.

The other functions appear to be more an extension of passport operations than specific
Security Bureau functions. In the interviews, key informants specifically questioned the
relevance of some of these activities and whether they are consistent with mandate of
the Bureau. Informants also questioned the relevance of maintaining functions related to
foreign operations, data quality analysis and, in some case, case management in a
security-focused bureau.

Support for Foreign Operations

Most informants questioned the appropriateness of maintaining the support functions for
foreign operations in the Security Bureau. There was little doubt expressed that it was
important to maintain a group focused on supporting the Passport Program in Canadian
missions. Most of these activities, however, related more to operational activities than to
the Security Bureau itself. Some of these activities included: advising missions, liaising
between Passport Canada and the missions, providing input to policy development on
the specific impact of policy changes on missions, monitoring the implementation of
passport training in missions and providing an emergency response for passport-related
issues in missions. The ongoing work and projects for 2007-08 currently being carried
out by the Foreign Operations Division reflects this operational focus.




28
     This function is also supported by the Regional Security Advisers; although, as will be noted in Section 2.2, the
     RSAs’ roles are not yet clear.
29
     The personnel screening function (although shown in Exhibit 2) has already been identified for transfer to the
     human resources unit of Passport Canada, although a date for the transfer has not yet been set.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                           15
Passport Canada - Security Bureau Evaluation


Data Quality Analysis

Some informants questioned the relevance of the data quality analysis function in the
Security Bureau. The vast majority of client index alerts addressed by the DQAs relate
to data integrity of the master client index in the passport issuance system – IRIS. Some
informants indicated that the responsibility for maintaining the quality of operational data
more appropriately belongs with the Operational Bureau. Additionally, interviews
indicated that these alerts detect very few cases of fraud because of limited scope. The
Security Bureau recently undertook a review of all the DQA activities and identified a
number of data verification edits that could be considered more operational than
security activities.

Case Management

The Security Bureau’s case management functions appear to constitute both
operational and security-related functions. The primary case management function is to
support decision-making on complex applications such as applications involving child
custody, lost or stolen passports, and applicants with debts to the Crown. While these
applications are more complex, they are not necessarily applications that seem to
involve a specific security-related issue. On average less than 5% of alerts generated
represented any known security issues. Case management would also reveal if a lost or
stolen passport is deemed to be related to the fraudulent use of a passport, although
this occurrence appeared rare.

2.2          Absence of an Entitlement Risk Assessment

 Finding 3:            Passport Canada has not developed an overall risk assessment of
                       the entitlement decision-making process that would provide the
                       framework for the Security Bureau’s activities.

In 2007, Passport Canada commissioned a study that resulted in a report entitled
“Passport Issuance Process – Risk and Controls Self-Assessment.”30 Security Bureau
employees noted specifically that the report focused primarily on how to address the
rapid increase in the demand for passports, rather than on the overall entitlement
decision-making process – perhaps because it was developed on the basis of a self-
assessment conducted during the peak period for passport applications.

Passport Canada reported in its Annual Report for 2006-07 that a risk management
framework and plan31 was developed and approved by senior management. Evaluation


30
     “Passport Issuance Process – Risk and Controls Self-Assessment”, Interis, 3 August 2007.
31
     “Passport Canada Annual Report 2006 – 2007” p. 27.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                         16
Passport Canada - Security Bureau Evaluation


interviews indicated that this study was not sufficiently detailed to provide the necessary
framework for the security functions. The Annual Report also notes that further work on
the risk assessment has been delayed by the unavailability of employees to work on this
initiative.32

Although an adequate risk assessment is not yet in place, the Security Bureau has
proceeded to redefine its mandate and functions using a risk-based approach. It is
working towards developing work transformation processes and tools required to
address risks in the passport entitlement process.

2.3          Shifting to a Risk-Based Approach

 Finding 4:           Passport Canada is shifting to a risk-based approach to manage the
                      entitlement decision-making.

In the past, the focus of passport security has been on ensuring that all elements of the
application process are respected. The application process was based on a one-to-one
review of all supporting documents for each application to ensure that the
documentation used for entitlement decisions contained no gaps or errors. To be
security conscious meant to apply the same procedures in each and every case. Most
informants indicated that there was a good awareness of security – a security “culture” –
in the Agency, but that the awareness was based on the idea that the only way to
ensure security was to apply the same procedures exactly the same way in each and
every instance.

Recently, Passport Canada has begun to shift the emphasis from a rigid and standard
examination for each and every case (commonly referred to as “rules-based” approach)
to focus on the identification and management of higher risk cases. This new approach
is underway. The Agency introduced “exceptional measures” in 2007 to streamline
applications based on known risk factors, without a risk framework to support these
decisions on risk.

“Exceptional measures” defined the concept of “known” and “unknown” passport
applicants. Known applicants were defined as previous passport holders, and
depending on their behavioural pattern, risk-levels were assessed. Entitlement officers
were instructed to focus on high-risk applicants; namely applicants unknown to Passport
Canada (i.e. first time applicants) or for applicants where there was evidence of risk-
related behaviour (e.g. multiple lost or stolen passports).

The “exceptional measures” were announced in May 2007 to allow for the
implementation of procedures that were going to be formalized in the simplified renewal


32
     “Passport Canada Annual Report 2006 – 2007”, Appendix A, p. 41.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                       17
Passport Canada - Security Bureau Evaluation


process announced in August 2007. The simplified renewal process is based on the
concept of known applicants who present a lower risk.

 Finding 5:           Without an assessment of the risks and mitigating strategies in the
                      passport issuance process, it is not possible to assess whether the
                      security provisions in place are adequate.

The shift to a risk-based approach has reportedly been difficult in the Agency because it
requires a change in the culture of the organization. The introduction of the “exceptional
measures” was the first formal implementation of a risk-based approach to entitlement
decision-making. Since the measures were implemented at the peak of the elevated
volume of applications, there was limited training or explanation of the rationale for the
changes. As a result, many key informants felt that these measures had been driven by
the need to improve client service and potentially compromised passport security.

Many of these informants also felt that the simplified renewal process and the changes
in the policy on guarantors also compromised security. However, some of the
informants interviewed who were in management positions, challenged this impression
by indicating that there were legitimate reasons for the changes related to both a risk-
based approach to passport issuance and increased security in the guarantor process.
Again, without a formal assessment of the risk associated with the passport issuance
process, the perceptions are difficult to validate and assess the effectiveness of the
implications of the “exceptional measures.”

Currently the “exceptional measures” remain in place but, Passport Canada’s policies
and procedures have not yet been updated to reflect this new risk-based approach.

2.4          Impact of Authorities

 Finding 6:           The Canadian Passport Order gives Passport Canada limited
                      recourse mechanisms.

Passport Canada’s mandate to issue, refuse or revoke a passport falls under the
responsibility of two bureaus: the Operations Bureau and the Security Bureau. The
authority to refuse a passport is shared between these two bureaus. The requirements
of the Privacy Act that affect the passport entitlement and issuance process is the
responsibility of only the Security Bureau. This allows the Security Bureau to receive
personal information on a specific applicant for the purpose of rendering an entitlement
decision33. Access to an individual’s information may only be granted to the Security
Bureau under specific justification for the disclosure.


33
     Passport Canada - Ombudsman’s Annual Report for 2006-2007.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                     18
Passport Canada - Security Bureau Evaluation


Although there are many different types of complex cases, there are only a limited
number that are considered to have a security focus34. These aspects represent a
relatively narrow scope when considering the wide range of security related possibilities.

Passport Canada’s mandate comes from the Canadian Passport Order – an order-in-
Council, which is a legally recognized document approved by the Governor-in-Council.
The Order specifies who is entitled to a Canadian passport and the conditions that must
be met to determine eligibility. The Order does not proclaim any powers to the same
extent as legislation.

Unlike an Act of Parliament, the Order does not include any regulations to govern the
issuance of passports35 and, as a result, Passport Canada’s mandate is open to
interpretation with respect to definition, authorities and controls. For example, the
conditions in the Canadian Passport Order are vague on issues related to revoking or
refusing passports (sections 9 and 10). The use of “may refuse to issue” or “may revoke
a passport under certain conditions” presents ambiguity in the application of the
conditions.

The Order does not provide strong recourse mechanisms or any administrative
penalties in the case of applicants who attempt to obtain a passport fraudulently.
Although the Security Bureau, in its enforcement role can refer cases to law
enforcement agencies, including the RCMP for investigation, evaluation interviews
reported that law enforcement agencies only have the capacity to investigate cases
when significant evidence has been documented. Other than that, the only recourses
open to Passport Canada are to:

     •   Refuse or revoke the passport – a remedy that requires strong grounds and is
         subject to the approval of the Passport Canada ombudsman;
     •   Require applicants to resubmit their applications – thereby, paying twice for the
         service; or
     •   Limit the validity of the passport.




34
     This includes fraud, multiple loss, mutilation, damaged, custody, repatriation and alerts relating to potential
     criminal activity.
35
     Passport Canada has begun consultations on the creation of a Passport Act which would strengthen its ability to
     fulfill its mandate (see Responding to Change: Annual Report 2006 – 2007, Passport Canada, p. 25).

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                            19
Passport Canada - Security Bureau Evaluation



 Finding 7:            Passport Canada must depend on the provinces and territories for
                       essential information on passport applicants.

Passport Canada is also challenged by the absence of a national centralized database
(or several interoperable databases) that would contain all necessary elements to verify
the identity and citizenship of a passport applicant. The reason is that vital statistics in
Canada (e.g. births, deaths) are under the legal jurisdiction of a province or territory.
The 2005 OAG report noted that Passport Canada and DFAIT have taken great strides
in addressing this identity documentation issue.36

For Passport Canada, there are two ways to demonstrate Canadian citizenship. The
applicants can either provide a Canadian birth certificate or a Certificate of citizenship.
Although citizenship certificates are provided by Citizenship and Immigration Canada,
the provision of birth certificates is a provincial responsibility and, as a result, there is
considerable variation in both the physical nature of birth certificates across Canada
and the way in which the information is stored electronically by provincial governments.

Faced with jurisdictional differences, Passport Canada has to deal with a wide variety of
documents, sources and systems to verify the authenticity of documents. It is a major
challenge to confirm an individual’s identity. Although the level of potential identity theft
is presently unknown in Canada, the birth/death registrars are considered as the main
source of vulnerability because names (and hence identity) can be duplicated between
jurisdictions.

A passport applicant could assume a false identity. When undetected this could result in
the issuance of a valid passport. This could introduce a systematic error in the issuance
process that could also go undetected through the current simplified renewal process.
This process was introduced to increase efficiency for re-issuance.

In the absence of a national identity system in Canada, Passport Canada must depend
significantly on individual provinces/territories for vital statistics information on a case-
by-case basis. When and where possible, it must corroborate such information to
address the identity and entitlement of an individual’s right to a passport.




36
     Report of the Auditor General of Canada to the House of Commons, Chapter 3: Passport Office – Passport
     Services, Office of the OAG, April 2005, p. 10.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                                   20
Passport Canada - Security Bureau Evaluation



3.0          SUCCESS
Evaluation findings as they relate to the achievement of the Security Bureau’s
objectives, including the adequacy of the Bureau’s performance measurement, are
reported below.

3.1          On a Track of Ongoing Improvements

 Finding 8:           The Security Bureau has contributed to the integrity of the passport
                      issuance process and travel documents. It continues to work towards
                      more improvements.

The 2005 OAG audit on Passport Canada identified many concerns with the Agency’s
operations – some specifically related to the activities of the Security Bureau. Over the
past two years, Passport Canada has made significant efforts to address these
concerns and, in 2007, the OAG gave Passport Canada an overall satisfactory rating for
these changes. Many key informants interviewed for this evaluation also noted
favourably the changes made in response to the audit.

The specific improvements within the Security Bureau included organizational,
management and culture changes; improved tools for entitlement decision-making;
improved physical characteristics of travel documents; and strengthening the integrity of
the use of travel documents.

Management and Culture Change

In 2006-07, the Security Bureau began a process of redefining its mandate and
developing a three-year strategic plan37. However, for most of 2007, the Security
Bureau did not have stable leadership, with two acting directors general responsible for
the Bureau. In the fall of 2007, a new director general was appointed. Informants noted
that, prior to the appointment, there was considerable uncertainty within the Bureau,
which contributed to a decline in the level of communication among Security Bureau
managers.

The Security Bureau has undertaken a number of change initiatives since the fall of
2007. A Management Services Directorate has been established and the Bureau has
begun the development of systematic work planning.




37
     “Passport Canada Annual Report 2006 – 2007,” Appendix A, p. 41.

August 2008

Office of the Inspector General / Evaluation Division (ZIE)                                       21
You can also read
Next part ... Cancel