Human Resources Committee on Feb. 14th, 2013

[Ian Shugart]

We do that through training, and we have, as I mentioned, committed to upgrade our focus on training in this particular area. However, between training events the employees have to build it into their DNA.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

So what went wrong here?

[Ian Shugart]

In these cases, it clearly was not sufficiently in the DNA of the employees. That is what a business culture is, and our obligation is to facilitate the protection of information through the software and the hardware and the policies and to put in place the training.

I'm going to invite Mr. Parker to add to that.

[Ron Parker, Associate Deputy Minister, Department of Human Resources and Skills Development]

In response to your question, there were two particular policies that are relevant here: first, employees have a responsibility to report incidents; second, data that's sensitive should be encrypted before it's put on any particular portable storage device.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

So why wasn't this particular data set encrypted?

[Ron Parker]

As the deputy said, it seems the employees did not encrypt the data as would have been required.

[The Chair, Conservative, Ed Komarnicki]

Your time is up. You took a little extra time to answer, and that's fine.

We'll now move to Dr. Leitch.

Go ahead.

[Kellie Leitch, Conservative, Simcoe—Grey, ON]

Thank you very much for taking the time to be here today.

As you've mentioned, Deputy Minister, for both ourselves as government members and for all of the opposition members here, this is a very serious concern. It is a very serious concern for all Canadians, particularly regarding their privacy and the direction and how it is treated.

As you mentioned, Deputy Minister, the minister has taken some action, whether it be upgrading the network for security practices or whether it be providing mandatory training, as you were talking about. I think we appreciate—I appreciate, at least—your sensitivity to this issue and how you and your colleagues are approaching it today.

I have a few questions. I'll go through them individually. Whether it's you or your colleagues who answer them, I think we're fine, as I think my opposition colleagues are of the same mindset: we want to get to the bottom of what occurred and address the seriousness of the issue.

With respect to the department and discovering this missing hard drive, what were the immediate steps taken? I know you outlined them in your notes, but as I was just reading through the notes here and following your dialogue, I noticed there was a bit of time with respect to when it was first brought forward and following that.

What was the immediate action? Also, what is the staff training to do that? You said part of it is culture. Obviously, we all have to take a little bit of individual responsibility for what we do, but what is that training? What was in place, and do those staff members now recognize the gravity of the situation?

[Ian Shugart]

Perhaps, Chair, I could respond to the honourable member's third question, and then Ron and Al can give the details on the other two.

I believe that staff are now very well aware. I think in an organization as large as ours one could expect—and I think it's the reality—that some staff are more aware throughout, and others are less aware or seized of the importance. Part of the focus on training being mandatory and being for all employees is to try to do our best to make sure there are no gaps, so that there is no employee in the department who can say he or she didn't realize that was the standard. If there have been such gaps in employee awareness, we want to close those gaps.

Generally speaking, I can tell you that in the organization we have taken some encouragement from the fact that employees have cooperated fully, including in the assessment of devices in the organization. We wanted our staff to be so concerned about this that they would drop whatever was necessary to drop in order to comply with the direction that we were going, but not so terrified that they would go underground. We believe that given the response of employees—their response in meetings and information sessions and so on—they have responded in that fashion.

I'll stop there and turn to my colleagues for the details.

[Ron Parker]

In terms of the immediate actions, initially the incident, as the deputy explained, was treated as a case of a missing asset—something to be found—with the belief that it was on the premises, still in the building.

As that set of searches became less likely, it pointed to a lower likelihood of the drive being found. Corporate security and the regional security officers were advised, which is the standard protocol. They began, then, a series of professional searches for the drive, and interviews were continued through the month of December into early January, when the likelihood of recovery of the asset seemed to be very low. At that point we launched a formal investigation that entailed professional investigators and we took the steps to begin to inform Canadians in early January.

[The Chair, Conservative, Ed Komarnicki]

Is that it?

Okay.

[Kellie Leitch, Conservative, Simcoe—Grey, ON]

Similar to the comment the deputy minister had made before, we too find this completely unacceptable. We need to make sure that the privacy of Canadians is protected.

I think we all know the division of responsibility, with the policy side being taken in the House and the minister taking action. I know you've been involved and heard direction to make sure those things have taken place.

With the administration we took some action as well, and it also has some degree of responsibility of making sure that these things are implemented going forward to make sure we have a secure environment.

One of the items that has come up—and we've heard and talked about it—has been the involvement of the Privacy Commissioner and the timeframe for engagement in that, but also the engagement of the RCMP because of the seriousness of this matter.

Could you comment on when and who made the decisions with respect to engaging the Privacy Commissioner as well as the RCMP in order to make sure that Canadians were protected?

[Ian Shugart]

Mr. Parker referred to the protocols that we have, and I referred earlier to our standard, our approach, to the Privacy Commissioner's office.

As soon as we were aware of the likelihood of this information having gone and being not likely to be recovered, we knew, without any question, that the Office of the Privacy Commissioner needed to be engaged, and that's when we took that action.

It was in the minister's office that involving the RCMP and referring the matter to the RCMP was taken.

In the department, I might just say that we have absolutely no issue with that. That decision was taken on the basis of the seriousness of the situation we are in. It will be, of course, up to the RCMP to determine how they wish to deal with that request.

We will work in the appropriate fashion with the Privacy Commissioner's office for the investigation that they are undertaking and on anything that the RCMP decides to undertake, and on our own internal investigations to ensure transparency and openness and compliance with those investigations, and also to ensure appropriateness of information so that the integrity of any investigations that occur is not compromised.

[Kellie Leitch, Conservative, Simcoe—Grey, ON]

Thank you very much.

[The Chair, Conservative, Ed Komarnicki]

We will now move to Ms. Charlton.

Go ahead.

[Chris Charlton, NDP, Hamilton Mountain, ON]

Thank you very much, Chair.

Thank you to all of you, gentlemen, for being here before the committee this morning. I know it's probably not where you wanted to be on Valentine's Day, but thank you very much for sharing this part of the day with us.

Let me ask you this first, Mr. Shugart. Can you tell the committee what you understand “ministerial responsibility” to mean?

[Ian Shugart]

Ministers are responsible to Parliament, Chair, for ultimately all matters within their jurisdiction, including the policies of the government and the appropriate conduct of officials in their departments. By convention and in many cases by formal instrument of delegation, those authorities are delegated to departmental officials. That is often spelled out in the regulations to statutes and sometimes in the statutes themselves.

By convention, ministers are responsible for policy and officials advise ministers on policy. Officials are responsible for the administration of their departments.

[Chris Charlton, NDP, Hamilton Mountain, ON]

Thank you very much, sir. You'll have heard our chair admonish my colleague that questions with respect to policy would not be appropriately directed to you today, which is why initially our request had been that the minister appear here.

You're quite right: you need to answer questions within the context of the administration of your department. In that context, let me try to ask some questions that you will be able to answer.

Can you tell me when a breach, in your ministry's understanding, is "totally unacceptable"? Those are the words that your minister used in response to questions that we raised in question period: that this breach was “totally unacceptable”.

[The Chair, Conservative, Ed Komarnicki]

You can indicate what you think is totally unacceptable, but obviously not what somebody else might think.

[Chris Charlton, NDP, Hamilton Mountain, ON]

No, but it's also in the notes that this breach was unacceptable, as my colleague pointed out.

Chair, seriously, we only have seven minutes.

[The Chair, Conservative, Ed Komarnicki]

I know. What I'm trying to tell you is that we want to focus on the three issues before us. If your question to him is why he finds it totally unacceptable, he's entitled to answer it, but not what somebody else might have said or what you think they mean by that.

With that, you can answer her question. You understand what I'm saying.

[Chris Charlton, NDP, Hamilton Mountain, ON]

Chair, with respect, this comes out of the presentation that's before us. The deputy said it was unacceptable, so let me follow up.

[The Chair, Conservative, Ed Komarnicki]

I'm telling you that he can answer that with respect to his use of those words.

Go ahead.

[Chris Charlton, NDP, Hamilton Mountain, ON]

Thank you, Chair.

Can you please—

[The Chair, Conservative, Ed Komarnicki]

Well, let him answer.