Government Operations Committee on March 7th, 2017

[Ramez Ayoub, Liberal, Thérèse-De Blainville, QC]

Thank you.

Can you tell us more about the work being done by Shared Services related to the Carling campus?

[Samantha Hazen]

The Carling campus project is led by PSPC, Public Services and Procurement Canada. SSC is providing the related IT infrastructure support associated with the move to Carling campus.

[Ramez Ayoub, Liberal, Thérèse-De Blainville, QC]

Thank you.

That's it for me.

[The Chair, Conservative, Tom Lukiwski]

Mr. Gourde, you have five minutes.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you, Mr. Chair.

There is a large increase in the 2016-2017 budget of the Privy Council Office as compared to 2015-2016. You said that the responsibilities of the Privy Council Office had evolved, no doubt at the request of the government or of the Office of the Prime Minister.

Are these new initiatives, or initiatives from different departments that were placed under your responsibility?

[Serge Dupont]

There is no instance I believe where activities done elsewhere were placed under the responsibility of PCO. For instance, the Results and Delivery Unit did not exist before. Of course, the Secretariat of the Treasury Board always did work to analyze results. However, this is a complementary mechanism we are adopting at PCO in order to be able to refocus government action. This allows us to determine in a concrete way how we hope to see actions affect Canadians' lives, and the economy as well. It also allows us to measure other variables. This team was built within PCO.

In other cases, we extended resources at PCO. Intergovernmental Affairs are one example I mentioned. Our Prime Minister and government want an enhanced relationship with the provinces and territories in a number of files. For us, this means a capacity to better support the Prime Minister with regard to the overall intergovernmental relations strategy.

As for the Prime Minister's Youth Council, that entity did not exist as such before. We created a unit within Privy Council Office to support the Prime Minister.

Overall, these are new priorities which either extended the needs that were already there or created new needs that had not been defined before.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

The 33% increase for next year will be used to meet these new and extended needs. Will they become permanent, or is there a chance that they may decrease over time?

[Serge Dupont]

The 33% increase is for 2016-2017, as compared to 2015-2016. It also includes ad hoc investments for work we have to do to enhance IT infrastructure at the Privy Council Office. We had systems that were becoming outdated and so an investment was needed. This year, there has been an increase of $22.4 million as compared to 2015-2016 for those investments in the modernization of our IT infrastructure, as well as for other organizational changes we had to make simply to bring the PCO back up to level, if you will.

In certain cases, some functions will be maintained to the extent that they remain priorities for the Government of Canada. In other cases, they are one-time investments in order to upgrade the assets and capacities of the PCO.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

All of these initiatives have required that you hire new employees. Could you tell us how many new employees there are as compared to previous years?

[Serge Dupont]

I don't have that in mind right now. Just a minute, please.

Could we answer later? It wouldn't necessarily be in writing. We should be able to provide that figure to you during the meeting.

[The Chair, Conservative, Tom Lukiwski]

We can afford a few seconds. I'm not sure if we can afford a few minutes.

[Serge Dupont]

Sorry, I don't want the member to lose his time because of our searching through our papers here.

Ah, here is the answer: There are 113 more FTEs this year than there were in the previous year.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

During this year, you have about 900 or 1,000 employees?

[Serge Dupont]

We have close to 1,000 currently.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

That means that there were 900 before.

[Serge Dupont]

Around 900, yes.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

That explains that increase, in part. With a 12% increase in the number of employees and a 33% increase in the budget, there must be a relatively large increase in capital assets, correct?

[Serge Dupont]

It is rather large, yes. As I mentioned, for instance, an investment of $22 million had to be made in information technology, and that is included. In fact, these are expenditures to improve systems, but also expenses on services such as those from Shared Services Canada; these are expenses we have to make to ensure that we have a modern infrastructure.

[The Chair, Conservative, Tom Lukiwski]

Our final intervention will be from Madam Ratansi. You have five minutes, please.

[Yasmin Ratansi, Liberal, Don Valley East, ON]

Thank you. I'll ask three to four quick questions, and then you can answer. Otherwise, I'll lose my time.

I'm curious. What is the intersection between PCO and SSC with regard to a risk mitigation strategy on IT? That's number one.

Number two is in terms of cybersecurity. I understand SSC is working on cybersecurity, but you didn't use half of your budget last year. What is your thought process in moving it forward, and how are we doing there?

Number three is that when Wayne Smith came to us, he talked about the strained relationship between SSC and Stats Canada. Has it improved and are we moving forward?

The last, I think, you may have answered to Mr. Weir. Do you have baseline data for the RCMP pre-SSC and post-SSC? They were also raising some concerns.

Thank you.

[Serge Dupont]

Let me address the first question, and I think Mr. Barr may address the others.

In terms of the relationship between the Privy Council Office and Shared Services Canada with regard to the security of information technology infrastructure, think about it as we are the client and they are the service providers. We clearly will have discussions about explaining our risks, our risk tolerance—or perhaps I should say intolerance. Then they will, as technology providers, be able to work with us in developing the solutions that will meet our needs. That's the conversation. We are the client, they are the provider, and we need to get to a mutual agreement on what can actually be done.

[Graham Barr]

I'll go in reverse order. There was no baseline for RCMP services before the creation of Shared Services Canada. In fact, for the vast majority of departments there was no baseline on service levels, and that has been one of our fundamental challenges at Shared Services Canada. There was very limited information on services and assets that were consolidated at SSC, which meant that we did not have a basis for service level agreements or to measure if we were improving service.

With respect to Statistics Canada, over the past several months, we have built a strong and productive relationship with Statistics Canada aimed at ensuring that we have a reliable and secure IT platform for the delivery of their important programs. The chief statistician and the president of Shared Services Canada meet every two weeks to monitor progress on mitigating risks associated with IT.

There are currently no outstanding operational issues at Shared Services Canada related to IT. We have worked very hard over the past few months to secure their existing IT environment, and we are working on a strategy with them to eventually move them out of their old data centre into a new one that will completely meet their security requirements. All the SSC staff who work in the data centre servicing Statistics Canada are cleared to the secret level, and they take an oath to respect the requirements of the Statistics Act.

With respect to your first question about what we are doing on cybersecurity, we are using budget 2016 money to strengthen the three connections to the Internet that the Government of Canada has. This is to ensure that we can scan all the traffic that goes through those network connections even if that traffic is coded. We're also creating and building a list of applications that are safe to be installed on the shared network infrastructure. That's in addition to what I mentioned earlier in response to the earlier question about our security operations centre.

We have a computer incident response team that provides guidance and mitigation to departments in the form of information products. We've instituted, along with the Communications Security Establishment of Canada, a supply chain integrity process to ensure that no untrusted equipment, software, or managed services are procured by Shared Services Canada or used in the delivery of services to Canadians.

[Yasmin Ratansi, Liberal, Don Valley East, ON]

Is this part of your capital or operating budget?

[Graham Barr]

It's a mixture.

[Yasmin Ratansi, Liberal, Don Valley East, ON]

I guess my time is up.