Government Operations Committee on May 16th, 2017

[Kyle Peterson, Liberal, Newmarket—Aurora, ON]

Thank you, Mr. Chair.

Thank you, everyone, for being here this morning.

All of you indicated in your testimony that you remain committed to the overall enterprise approach that obviously is part of Shared Services Canada's mandate and is really its raison d'être, to be quite frank. Does delegating some of Shared Services' authority and having other entities making these decisions take away from that overall enterprise approach?

[Ron Parker]

Mr. Chair, to me this is a practical acknowledgement of the needs of our customers and a spot where we can improve the efficiency of delivery to our customers. It's not at all intended to take away from the enterprise approach but to address the circumstances in which the enterprise model itself is at the wholesale level—and these are getting into the delivery of a set of services at a retail level.

[Kyle Peterson, Liberal, Newmarket—Aurora, ON]

I want to elaborate a little on the numbers you threw out there, Mr. Parker. The way you look at them, I think you could have classified them as low-value, high-volume transactions, in that you used $25,000 as the threshold. Do you see that as an appropriate threshold when we're fleshing out the details, if this should come into force? Is the way of looking at what you should and shouldn't be doing a money threshold?

[Ron Parker]

Mr. Chair, I think we'll have to look at a number of factors when studying the thresholds. At the heart of it, you want to get to the risk associated with the acquisition of those goods and services. Monetary thresholds are one kind of indirect proxy for assessing that, but not the only factor we'd want to take into account. Also, I would expect it will vary by the degree of capability of the entity taking on the responsibility.

[Kyle Peterson, Liberal, Newmarket—Aurora, ON]

Are these smaller transactions inefficient because fixed costs are associated with every transaction, regardless of the dollar value? Is that part of the reason the high-volume, low-cost transactions are inefficient for your department to implement?

[Ron Parker]

Mr. Chair, for us the efficiency issues arise through.... Because it is centralized, all the orders come in to a pretty small group of individuals and team members to deal with. They cannot deal with that volume of transactions on as a timely a basis as when it would be on a distributed basis.

[Kyle Peterson, Liberal, Newmarket—Aurora, ON]

Thank you for that.

I want to turn to both Global Affairs and National Defence. I will ask the same question of both of you.

The goal of this, obviously, is to increase efficiency in procurement and its process, but of course, everyone depends on not just efficiency but also secure IT infrastructure. Do you see this as undermining the security of the infrastructure in the name of efficiency?

[Martin Loken]

Mr. Chairman, I wouldn't. The reality is that the vast majority of the IT equipment at our embassies and consulates abroad is already procured in Canada and is subject to the existing supply chain integrity steps that SSC takes. In these small, edge cases abroad in which this proposed legislation could provide the flexibility for Global Affairs Canada to do certain procurements, we would, as I mentioned earlier, continue to operate under the overall security guidance set for us by the Government of Canada.

[Kyle Peterson, Liberal, Newmarket—Aurora, ON]

Okay.

Mr. Bastien.

[Len Bastien]

Thank you, Mr. Chair.

I would concur. As Mr. Loken indicated earlier, we are still accountable for the security within our departments from an IT perspective at the end-user device level, and these peripherals would fall into that category. We'd be as passionate about making sure they're safe and secure as we would be from wherever we procured them. I think it would simply allow us to be more reactive and perhaps even more expeditious in our reaction to the issues. I don't see it as creating any more risk.

[Kyle Peterson, Liberal, Newmarket—Aurora, ON]

Okay, thank you.

Mr. Parker, one of your directors general, Mr. Breton, testified at the finance committee, last week, I believe, and part of his testimony included a discussion of an overlap between the mandates of Shared Services and Public Service and Procurement Canada—part of the reason, perhaps, why this is necessary—and of its leading not only to inefficiencies, but also to confusion in the supplier community.

Can you elaborate on the way in which that confusion might have manifested itself and on any negative consequences that arose from it?

[Ron Parker]

Mr. Duplantie will take the question, Mr. Chair.

[Alain Duplantie]

Thank you for the question, Mr. Chair.

I read his comments, and my interpretation of his message was that Monsieur Breton was making reference to the situation before the shift in mandate. SSC had received a mandate to deliver IT, email, network, and data centre for the enterprise, but before the September 2015 OIC, workplace technology device responsibilities remained with PSPC, leaving the industry to wonder, when looking for IT peripherals as related to IT contracts, which organization to deal with, PSPC or SSC.

The clarification of the mandate that came by way of the OIC in September 2015 brought that remaining part of the mandate into SSC and provided a more stable source of supply for the industry to deal with, and clarity for our partners and clients as well.

[Kyle Peterson, Liberal, Newmarket—Aurora, ON]

Okay, thank you.

Do I still have some time?

[The Vice-Chair, NDP, Erin Weir]

You have 30 seconds.

[Kyle Peterson, Liberal, Newmarket—Aurora, ON]

Well, I don't think there's enough time for a good question and answer, so I want to thank you for your comments and thank you for being here.

[The Vice-Chair, NDP, Erin Weir]

Thank you.

My suggestion is that we'll now have a five-minute round from each side, and then will take a few minutes at the end to see whether, as a committee, we can come to a consensus about these provisions of the budget implementation bill.

Mr. Clarke.

[Alupa Clarke, Conservative, Beauport—Limoilou, QC]

Thank you, Mr. Chair.

Hello, gentlemen. Thank you for being here this morning.

I want to talk about some of the amendments proposed through the omnibus Bill C-44, which implements Budget 2017-18.

On August 4, 2011, we wanted to consolidate all the government's technological services and procurement, including computers, USB keys or other things of that nature. Unless I'm mistaken, I would say that clause 113 of the bill, which will replace section 7 of the Shared Services Canada Act, aims to deconsolidate what we wanted to consolidate, to a certain extent. Am I mistaken, or is that what's going on?

[Graham Barr, Director General, Strategic Policy, Planning and Reporting, Shared Services Canada]

Thank you for the question.

Yes, when Shared Services Canada was created, it was the idea, and it remains so, to consolidate and standardize the delivery of IT services. The amendment to section 7 of the Shared Services Canada Act does not in any way undo that desire to consolidate. As has been previously mentioned, it merely mirrors an almost identical section in the Department of Public Works and Government Services Act, which ensures that the management of the procurement is consolidated but that access to the various procurement instruments can be done by the individual departments, because that's the most efficient way to do it.

[Alupa Clarke, Conservative, Beauport—Limoilou, QC]

Why wasn't this done in 2011? Is there a particular reason?

[Graham Barr]

In 2011, Shared Services Canada did not have the mandate for what we call “workplace technology devices” or end-user devices, that is, the peripherals that my colleagues have been talking about. We received that mandate through a subsequent order in council in the year 2013. The years 2013 to 2015 were the period of confusion that my colleague Mr. Duplantie spoke about. In 2015 we got the mandate for the procurement of the workplace technology devices, but we did not have the power to delegate back to departments the ability to access our procurement vehicles.

[Alupa Clarke, Conservative, Beauport—Limoilou, QC]

That's fine. Thank you.

As of 2017-18, $77.4 million will be provided over five years to strengthen cybersecurity. Can you tell the committee exactly what actions will be taken using the money to strengthen cybersecurity?

[Ron Parker]

I think you're talking about the funds in Budget 2016. These funds have been allocated to strengthen the Government of Canada's network perimeter and its ability to analyze the vulnerability of IT systems. Another initiative is anticipated, namely, investments in identity management systems. These are the largest investments that will be made.

[Alupa Clarke, Conservative, Beauport—Limoilou, QC]

This past weekend, a fairly massive global cyberattack occurred. I suppose that, over the weekend, people from the department needed to be ready to respond to make sure all the government's equipment and Internet services were protected.

Is there an emergency response team that we can call 24 hours a day? I suppose so. In that case, what has been done in the past 48 hours to analyze whether everything is running smoothly on the government's side?

[Ron Parker]

We were very active during this incident. When a vulnerability was detected, we started checking to make sure all the systems had received a Microsoft security patch. Over the rest of the weekend, we checked to make sure that all the necessary changes had been made correctly and that the changes had worked. To date, we haven't detected any issues in our systems resulting from the incident.