Information & Ethics Committee on Feb. 6th, 2024

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

The general said yes, and you said no, so there's obviously a disagreement even at the table. I would expect that if you surveyed members they might have differing ideas if we're not even sure at this level.

[Sophie Martel]

I'm going to explain myself.

As I said earlier, when we get an account on the network, to reach the account you need to sign to say that you will only use that device to do government work.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Sure.

[Sophie Martel]

Now, will people—

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

To do government work on these phones people use messaging applications. Those messaging applications are usually the same application they use on their personal device, which would give you access to the personal information on their device.

Did you get a PIA before you first used this technology?

[Sophie Martel]

Before we first used.... What we are doing with a PIA is making sure that we follow the FAA and the Treasury Board standards.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Did you complete the process prior to first using it?

[Sophie Martel]

We completed the process that needed to be completed based on government policies and standards to do our business, which is network security.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

You don't believe that you need to do a PIA before using it.

[Sophie Martel]

No, what I'm saying is—

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

The question is very clear, Madam.

Did you or did you not complete a PIA before first using this tool? You did, or you didn't.

[Sophie Martel]

I'm not sure to be honest with you.

[BGen Dave Yarker]

We did not.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Okay. My question is why you think that you don't need to do it, but I'm out of time.

Your members are Canadian citizens. Canadians by your agreement have a right to privacy, and your failure to undertake a PIA is a failure to safeguard and respect the privacy of your members.

I'm sorry that I don't have more time to continue.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Barrett.

Mr. Kelloway, you have four minutes. Go ahead, please.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Thank you, Mr. Chair.

My questions are for National Defence.

During the course of your testimony, you indicated that DND's usage of digital forensic tools complies with government policies and standards, and they are only used on an internal basis. Then, upon being issued an official departmental device, are DND employees clearly advised that their devices are subject to forensic digital tools?

[Sophie Martel]

Yes, they absolutely are. We also send a reminder every time someone logs into the system so they're made aware of this. Yes, they are.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Thank you for that.

Considering that National Defence officials deal with matters of the utmost national security on their official devices, do you consider it an essential security measure that DND employees are subject to digital monitoring when using their official devices?

[BGen Dave Yarker]

I would say, from a security perspective, that we monitor the network, as I mentioned, for security threats, compromises and the like. We are absolutely aware that some senior leadership are more likely to be targeted by threat actors.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Thank you for that. I appreciate it.

To either of you, do you know of any other national defence or national security entity within our country, or for that matter any allied nation, that ensures total privacy for employees who handle national security information?

[Sophie Martel]

We ensure total security of privacy of employees using our system. I mentioned that part of the reason we're doing network security is to ensure the confidentiality, integrity and availability of the data. We're working with our allies to make sure that the standards that we follow here are also standards that are followed in other countries.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Thank you for that.

Mr. Chair, how much time do I have left?

[The Chair, Conservative, John Brassard]

You have a minute and 45 seconds, but I'm going to give you an extra half-minute because Mr. Barrett took an extra half-minute.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

That's very kind of you. I appreciate it.

I'm going to pivot to Natural Resources, if I can.

I'm hearing today that your digital tools were procured through Shared Services Canada and that they've never been used. I'm wondering at what point in time the department determined that a requirement existed to procure these services through Shared Services Canada.

[Francis Brisson]

If I may, from our perspective, as suggested earlier and to reinforce that point, from what we understand, the department decided to purchase this to ensure that we had the tools necessary should we need them at a certain point in time. From our perspective, that's what we've done.

Since then, on a yearly basis, we renew our licence in case it's needed. As I suggested before, should we ever decide to use it in line with a security requirement, we'd ensure that we looked at doing a PIA. However, as committed earlier, this is also something that we'll look at doing as we move forward, even if it's not being used.