Government Operations Committee on Feb. 23rd, 2017

[Kelly McCauley, Conservative, Edmonton West, AB]

For DND.

[The Chair, Conservative, Tom Lukiwski]

Thank you.

Mr. Weir, you have seven minutes.

[Erin Weir, NDP, Regina—Lewvan, SK]

Thank you, Mr. Chair.

I think it's fair to say that the concern many of us had about national security exceptions was that they could prevent an open and competitive process, so I appreciate that in your presentations you've made the point that even where the national security exception is invoked, there still can be a competitive process.

To explore that a little more, I'd like to raise one of the specific procurements that motivated me to suggest that our committee study this matter. There was a supercomputer for Environment Canada to make weather forecasts. I think it cost about a billion dollars. It was procured through Shared Services. I think there probably was some kind of competitive process because part of the way we know about it is that one of the companies that might have been interested in supplying the computer wasn't successful. I wonder, Mr. Breton, if you can talk to us a little about that specific case, given that it was such a major procurement where the national security exemption was used.

[Pat Breton]

I'd very much like to do that. I'll just caution the committee that this is a file now before the courts, so I'll disclose and discuss as much as I can.

The honourable member is correct that the procurement of a supercomputer was part of a competitive process, and it was also part of an SSC process we share with PSPC, part of our collaborative process. We issued an invitation to qualify in 2013, and we pre-qualified four vendors we then worked with over the course of the next 18 months to refine our requirements and develop an RFP. It was a very collaborative, very open, very public process that resulted in three bids and a contract award to IBM in May 2016.

[Erin Weir, NDP, Regina—Lewvan, SK]

It might have been a competitive process, but it doesn't strike me that it was a terribly open or transparent process. The government didn't even really announce that it was purchasing the computer. It was the media that uncovered that this purchase had happened.

[Pat Breton]

The purchase was disclosed through regular government processes, through our quarterly proactive disclosure. The procurement itself was initially posted on GETS, I believe. It's now on Buyandsell. So it was a public procurement. As to media announcements, that is something that isn't within my purview.

[Erin Weir, NDP, Regina—Lewvan, SK]

So you have no sense of why the government wouldn't have wanted to tout this major investment it was making?

[Pat Breton]

No, I would leave that to members of the committee and their colleagues to discuss, the pros and cons of communications.

[Erin Weir, NDP, Regina—Lewvan, SK]

Fair enough. Could you speak to why the national security exemption was invoked for that specific purchase?

[Pat Breton]

I should say that there's a history on this file. The previous procurement for a supercomputer—the computer we were replacing—was also subject to an NSE. This specific computer is a massive system. It not only provides detailed information with regard to the weather but also supports a number of other departments in executing their missions, including National Defence, Health Canada, and the monitoring of emissions—potentially nuclear emissions. It's deeply integrated with other elements like our transportation system, so it is of vital importance to Canada and its national security.

[Erin Weir, NDP, Regina—Lewvan, SK]

It strikes me that a lot of things are vital to our national security. The army could come here and say that the gasoline we have is vital to national security, and it is, but no one would accept that the procurement of gasoline should be subject to an NSE. We would all say there should be a totally open and transparent tendering process.

That's what I want to get into. It seemed, Mr. Breton, in your opening presentation that you made the point that all sorts of email systems and IT infrastructure are important to national security, and they are, but that doesn't mean that all of the hardware and software that forms part of that system needs to be subject to a security exception. Surely even if the overall system has a lot of secret information in it, many of its components could be procured through the normal, open, transparent process, with no exception.

[Pat Breton]

These procurements are subject to open and transparent procurement. What the NSE allows us to do, with the supply chain integrity process, which I mentioned previously, is go in and check regular equipment for how it has been sourced, what its component pieces are, and whether it meets the security profile of the federal government.

To address your larger comment, I think our cybersecurity perimeter is only as strong as every link in the fence, and all it takes is one vulnerability for a hostile actor to gain access to our systems, to our network, to our infrastructure. So it is one where we do need an all-encompassing perspective. SSC is working with our colleagues in Public Safety, and there is a cybersecurity study under way right now to reassess what these threats are and what the government's response needs to be. We are participating in that.

[Erin Weir, NDP, Regina—Lewvan, SK]

To open things up a bit more to the rest of the panel, one of the questions in my mind is whether the extensive use of national security exceptions reflects the fact that the procurement provisions of some of Canada's trade agreements might be excessively stringent. I know you're not trade negotiators, but is that the fundamental problem? Are the trade agreements just too stringent to begin with?

[The Chair, Conservative, Tom Lukiwski]

To our witnesses, unfortunately we're out of time. However, I see you taking note of the question. Perhaps you can incorporate the answer to that in one of our other interventions.

Now we'll go to Mr. Whalen for seven minutes, please.

[Nick Whalen, Liberal, St. John's East, NL]

Thank you, all, for coming today.

The reason we're having this briefing on the national security exemption is because another member of the committee had brought forward some concerns that a large number of procurements were occurring. When I read some of the materials, it makes it sound like it's not a lot, but then when I hear some of the numbers that were presented, it sounds like about 13% of $23 billion of procurement falls under the national security exemption. Is that correct?

[Lisa Campbell]

I'm happy to address the question.

No, the point that I was making is 13% is non-competitive, so 87% of the business value of what PSPC awards is competitive. As my colleagues and I have said, the NSE doesn't mean we don't compete; we do, and I've given—

[Nick Whalen, Liberal, St. John's East, NL]

Sure, but you're saying 13% of the procurement, so $3 billion of procurement is sole-sourced.

[Lisa Campbell]

Strategic sourcing or sole-source, as we call it, yes.

[Nick Whalen, Liberal, St. John's East, NL]

Okay. So just within the confines of the national security exemption, that's what we're talking about. Or is this 13% of all government procurement?

[Lisa Campbell]

It's 13% of the business value of what PSPC does. Keep in mind that other government departments do a lot of their own contracting, the low-level contracts. It's about 85% of all of the contracts, but a lot less of the money. We do 12% of the contracting. We do all the complex stuff and it's most of the money. It's 80% of the money.

[Nick Whalen, Liberal, St. John's East, NL]

If someone in another department, other than defence or public safety, wanted to use a national security exemption, does the process require that they clear it with your department first?

[Lisa Campbell]

In many instances, yes, and I've talked about the number that we've received in the last year—18 this fiscal year—but there are also omnibus or blanket NSEs in place that you've heard my colleagues describe that they need for their business purposes. Sometimes, the mandate of a department means that the very nature of its work means that national security has to apply, but, again, I reiterate that competition is still the norm under our laws and regulations.

[Nick Whalen, Liberal, St. John's East, NL]

I guess this is a question for Mr. Breton and maybe Mr. Watters as well. Mrs. Robertson, I can see that in your unique circumstances this might not apply.

I'd always learned in my electrical engineering studies that the stronger and more robust security systems are the ones that are open and vetted and open to scrutiny so that they can be protected. Obviously, when we're talking about things that have very tight timelines, that might not be the case, but open, honest security systems that are designed to protect against people who know the systems are the best ones.

Mr. Breton, you used the analogy of the weakest link in the fence. If we're only buying all of our links in the fence from sole-source providers in a country with only 0.5% of the population, maybe we're not buying the best links, especially for something like email, which is ubiquitous. Maybe you can talk to us about why you feel that a closed security architecture in your organizations makes any sense when most experts say that it's an open security architecture that provides the best security.

[Pat Breton]

Mr. Chairman, maybe I'll start by building off the point of my colleague, in that from an SSC perspective, in terms of procurements that were subject to our NSE, 8% of them were sole-sourced, so 92% of them were competitive. Out of that 8%, I can say that the lion's share approaching 100% were for IP reasons, not for national security reasons. Our default is open, fair, transparent, and looking for world class, best in class.

[Nick Whalen, Liberal, St. John's East, NL]

So it's not limited just to certain suppliers; it's just limited in the information that's available.