Public Accounts Committee on Feb. 26th, 2008

[François Guimont]

Since 1941.

[David Christopherson, NDP, Hamilton Centre, ON]

Holy smokes! I was getting ready for somebody to say that it was a couple of years old and that's why we're in trouble; 1941 takes my breath away.

Now, during the audit, the auditor reported that the mandate was changed twice during the audit and that standard operating procedures for the program were in draft form and incomplete.

Somebody start talking. The questions are obvious. Somebody please tell me how we could have an audit going on, the mandate changes twice during the course of the audit, we have standard operating procedures in terms of the program but they're in draft form and incomplete--and you tell me it's been around since 1941. Somebody please tell me what's going on.

[François Guimont]

Essentially the answer lies in what I explained vis-à-vis resources. We have a program that has not been resourced at the right level.

I think the department really made efforts to top up that budget in a very responsible fashion. To give $6 million, on average, in the last couple of years to a base of $6.7 million is quite telling. It's not like $100,000 or $1 million was given. It was a substantial amount. So that's the first thing.

With regard to your point about draft policies and procedures, frankly this speaks to the fact that people were going to the more pressing and the higher priority. I am not saying that finalizing the procedures and policies is not important, but they did exist. They were in draft form, not finalized. And they have been finalized, very quickly. This was taken on as being a priority, picked up by the OAG--

[David Christopherson, NDP, Hamilton Centre, ON]

Except that if the Auditor General hadn't done her report, there's a good chance they'd still be out there incomplete.

[François Guimont]

I don't really disagree with you, frankly; it's a very good point. As the accounting officer, when I sat down with my staff, I was a bit surprised that since 1941.... But setting that aside, in recent years the program had not been audited, because probably some of these things would have been picked up.

An audit is not a bad thing. An audit says you have problems here and problems there. I'm not going to pass judgment on that. It was not audited. I would like to have seen it audited in the context of a big department. You have a risk-based approach, and someone somewhere--your own people, not the OAG--says you should be looking at that program. I think a lot of these things would have been picked up and corrected.

I just want to leave with you the thought that when people are trying to work in an environment where both the complexity and the workload have increased, they will go to the more pressing. They're trying to do a good job, and things like websites and going from a draft to a final policy will be of lesser priority even if they are, to my mind, important, critical.

There is one last point: it was done, and it was done quickly. They were draft. It's not as if they didn't exist. They were polished up, buffed up, and finalized.

[David Christopherson, NDP, Hamilton Centre, ON]

I want to get a little more detail, because here's what I'm worried about. If we don't find out how this happens, then how are we going to have assurances that you have mechanisms in place to make sure it doesn't happen again?

I appreciate and respect the fact that it's done and taken care of, but there are some things here we want to get to the bottom of. Again, it's nothing to do with individuals--people move and so on--but it's about positions and systems and processes being in place to adequately protect national security.

I want to go to another issue that was pointed out in the audit. There had been 24 contracts awarded before contractors were given their security clearance. This is under a “secret” level of security clearance. For four of those contracts, the work was completed before the contractor was cleared. How? How can that be?

[François Guimont]

I will answer the question--

[David Christopherson, NDP, Hamilton Centre, ON]

You will, you're right.

[François Guimont]

In the same way as I looked at the 24 contracts, I also looked at the overall sample of 86, and quite a number of them were done correctly. It was important to me because I wanted to understand if there was something systemic or systematic in the industrial security program. The answer to that is probably no, because the majority were done correctly.

In the case of those contracts that were done ahead of time--contracts awarded before security clearance was awarded correctly--the OAG picked up that at least in six cases some measures were put in place to mitigate risk. That's the first thing.

In the second phase of our action plan we looked at all those 24 contracts to see if measures had been taken. I know it was after the fact to see if measures had been taken to minimize risk, but for the 24, they had been. In the same way as the OAG looked at six, we looked at the 24. In some cases resources that had access to certain information were escorted; in some other cases the contract had started, but the sensitive information had not been used by the contractor.

[David Christopherson, NDP, Hamilton Centre, ON]

What would you do if you found out you had serious security problems after the fact? That's the whole point of it. You have these going through at a secret level. It's not like we are talking routine; it has “secret” stamped all over it.

This is mind-boggling. These contractors came in and did the whole job. You say there were some mitigating circumstances, but it wasn't a full security clearance. What if, when you did a full security clearance after the fact, you ran into a situation like the NORAD one? We'll come back to that in a minute, but where would you be then, and who would be responsible?

[François Guimont]

To pick up on that point, all 24 contracts were security cleared, so I want to leave that very clear image with you.

What I'm saying here has been said by the OAG. She acknowledges that in all those cases the clearance was given; the issue was totally timing--i.e., the contract was given before clearance--but I want to leave the very clear statement with you that clearances were provided. What I'm telling you is that for the 24 contracts, while it was not perfect because it was clearance after the fact, during that period of time there were mitigating measures. Although they were not perfect, there were mitigating measures.

[David Christopherson, NDP, Hamilton Centre, ON]

That does not eliminate the possibility that if you do a security review afterwards and you haven't done a full, complete testing and you do it after the fact, you could find things that send you back to square one, having to do God knows what in terms of remedying the problems, up to and including tearing down the damned building if it's serious enough.

Thanks, Chair. I'll be back for another round.

[The Chair, Liberal, Shawn Murphy]

Thank you, Mr. Guimont.

Go ahead, Mr. Holland, for seven minutes.

[Mark Holland, Liberal, Ajax—Pickering, ON]

Thank you, Mr. Chair.

Thank you to the witnesses.

I'm going to continue on that point because I'm concerned about it and I'm not quite clear on the answers that have been given.

There were four specific examples in which the work was completed prior to the security clearances being issued. In these 24 contracts requiring a secret level of security clearance, the contractors had been awarded the security clearance before this had been done. That is very concerning, and I'm not hearing a lot about how you're going to rectify it. Mr. Christopher rightly asked what could have happened after they awarded this. Yes, they all received security clearance, but what happens if there had been issues? In four cases the work had already been completed, so those issues would only have been caught after the work was completed and everything was done.

This is very serious. It deeply concerns me, and I haven't really heard clearly, Mr. Guimont, how we're going to make sure it doesn't happen again, or a proper addressing of how it could have been allowed to occur in the first place.

[François Guimont]

We have the four-phase action plan. We have it addressing, first, all the recommendations made by the OAG. That is done. I'm not talking about a month from now or two months from now; we've done that.

There is one component related to IT that we will have completed sometime next October. This is to have a better cross-log of information between our contracting authority and the industrial security program database, which were disconnected for reasons of security. That is going to be done in October. That is the first phase.

The second phase is that we have looked at the 24 contracts to make sure we were satisfied that we would be at a low risk for breaches of security, and we're satisfied that is the case. The people in the 24 contracts were cleared. After the fact is not the ideal situation, but that is the reality.

On top of that, we've decided to look at active contracts, 3,000 of them, to make sure the elements picked up by the OAG don't replicate themselves into the active contracts. We are proceeding with that. It's a three-stage approach, and it will be completed in August. We are doing this very systematic wall-to-wall approach to make sure we're minimizing risk for the contracts. These measures are in addition to the procedures and policies we're putting in place and the management review we're carrying out on the program overall.

[Mark Holland, Liberal, Ajax—Pickering, ON]

This is to Ms. Fraser, because it's very important, obviously--you're hearing this as a solid refrain from the committee--that this doesn't occur again.

Are you satisfied with the actions being taken by Public Works in this matter? Do you feel that the actions they're taking are adequate to ensure that this type of thing doesn't happen again?

[Sheila Fraser]

We are certainly pleased with the action plans that have been presented. As was mentioned, we did review the action plan of Public Works, and it does address our recommendations. I say that, of course, under reserve. We will eventually go back and re-audit this to make sure these things are being put in place.

On this particular question, though, it would be easy to say that all the clearances have to be in place before the work begins. But sometimes that isn't the reality. What we would expect in that case is that there would be a very detailed and complete risk mitigation plan, so it would be clear up front that if the clearances aren't all in place, yes, the project may start. But what information do those contractors not get access to? What other risk mitigation techniques would be used until the security clearances come through?

I think that would be the way to probably handle that kind of situation.

[Mark Holland, Liberal, Ajax—Pickering, ON]

I would suggest that the committee is going to want to keep a close eye on this as well, to make sure that happens. I think you heard expressed today a lot of concern.

If I could, I'll go to a recent concern, related to this chapter, that was very disturbing. This is to Mr. Guimont. It is with respect to the 138 CDs that were released--in fact, most of them are still out there--which contained detailed corporate information, such as details about pricing and bidding. There were a lot of companies concerned that this would severely damage their ability to do business in Canada.

I want to know if you can tell us where that is right now. How many of these CDs have been brought back in? What work is being done to rectify this situation and to ensure that this doesn't happen again? That is something, as well, that causes a great deal of angst.

[François Guimont]

I must admit that I came prepared for this discussion today, so I'm not.... I will go by memory here to the extent possible, if you can bear with me.

[The Chair, Liberal, Shawn Murphy]

Mr. Guimont, if you want to, if you feel more comfortable getting back to the member with a written response, you're entitled to do that too.

[François Guimont]

I think it would probably be more appropriate, if you don't mind.

I know exactly what you're talking about. I know the file. My level of detail will probably not satisfy your questions.

[Mark Holland, Liberal, Ajax—Pickering, ON]

I'd appreciate getting that information. That, too, is something that greatly concerns me. While it doesn't deal specifically with this chapter, I think it is related. I haven't really had a good response to that, and I'm left feeling fairly uncomfortable about it.

[The Chair, Liberal, Shawn Murphy]

Will we have that within two weeks, Mr. Guimont?

[François Guimont]

Yes.

[The Chair, Liberal, Shawn Murphy]

You can file that with the clerk, and he will distribute it to all members.