Questions and responses 41st Parliament, 2nd session October 16, 2013, to August 2, 2015

With regard to software used by the government on all digital platforms: (a) what software is permitted for use, broken down by (i) servers, (ii) workstations and desktops, (iii) laptops and portable computers, (iv) personal digital assistants, cell phones and other personal electronics, (v) rationale; (b) for each subsection of (a), what software is banned from use; (c) for each subsection of (a) and (b), where is this software developed; and (d) for each subsection of (a) and (b), if the software is not released as an “open source“ (as defined by the Open Source Initiative) or “free software“ (as defined by the Free Software Foundation), are viable open source or free software alternatives available, (i) have they been explored, (ii) what was the rationale for their rejection?

With respect to software developed by the government since January 2011 for use by any non-government entity or the public, including, without limitation, software programs, mobile applications, website applications, embedded systems, and all other programming done by or on behalf of the government: (a) what were all names for the software, broken down by dates of use; (b) on what date was the software released for public use, or on what day is its public release anticipated; (c) through what means is the software accessible by its intended users; (d) what was the total cost of developing the software; (e) what is the total revenue generated for the government by the software; (f) how many times has the software been downloaded, copied, or otherwise accessed by its intended audience; (g) how many times has the software been downloaded, copied, or otherwise accessed by anyone other than its intended audience; (h) for what reason was the software developed; (i) for what reason was the software released, or in the case where it has not been and will not be released, for what reason will the software not be released; (j) under what license was the software released; and (k) what are the file numbers and details of all ministerial briefings or departmental correspondence or other government records relating to the software, broken down by (i) minister or department, (ii) relevant file number, (iii) correspondence or file type, (iv) date, (v) purpose, (vi) origin, (vii) intended destination, (viii) other officials copied or involved?

With respect to servers, including leased physical and virtual servers and cloud-based servers, owned, operated, shared, or otherwise used by the government for all platforms and protocols, broken down by department: (a) what operating system and kernel version is the server using, including, for all unix-variant systems, the output of "uname -a"; (b) in what datacenter is the server physically located; (c) who owns, provides, and operates the server; (d) what is the purpose of the server; (e) for each service provided by the server, what is the name, type, software used, protocol, and listening ports of the service; (f) what security compromises have been detected in each service provided by the server, broken down by (i) the nature of the security compromise (privilege escalation, rooting or rootkits, sniffed packets, compromised passwords, worms, viruses, trojans, lost data storage devices, unauthorised use of information by otherwise authorised users, etc.), (ii) the details of any information accessed without proper authority, damaged, or lost, (iii) the classification and designation of the compromise and the information compromised, (iv) measures taken to prevent further security compromises, (v) date the security compromise was detected, (vi) date the security compromise was believed or found to have taken place, (vii) date the security compromise was resolved; (g) of the security compromises identified in (f), what are the file numbers of any correspondence or government records related to any such security compromises, broken down by (i) relevant file numbers, (ii) correspondence or file type, (iii) subject, (iv) date, (v) purpose, (vi) origin, (vii) intended destination, other officials copied or involved; and (h) on what dates have any threat risk assessments been conducted that affected or involved the server or its surrounding infrastructure, stored data, use, or relevant department?