Government Operations Committee on Nov. 18th, 2020

[The Chair (Mr. Robert Kitchen (Souris—Moose Mountain, CPC)), Conservative, Robert Gordon Kitchen]

I call this meeting to order.

Welcome to meeting number seven of the House of Commons Standing Committee on Government Operations and Estimates. The committee is meeting today from 4:10 p.m. to 6:10 p.m. to begin a study on the Nuctech security equipment contract.

Officials from Public Services and Procurement Canada, Global Affairs Canada, the Communications Security Establishment and the Canada Border Services Agency are here to discuss this subject.

Pursuant to the motion adopted by the House on Wednesday, September 23, 2020, the committee may continue to sit in a hybrid format. This means that members can participate either in person in the committee room or by video conference via Zoom.

To ensure an orderly meeting, I would like to outline a few rules to follow.

Interpretation in this video conference will work very much like in a regular committee meeting. You have the choice, at the bottom of your screen, to use floor, English or French. Should you be speaking in French, I would ask you to make certain that your language is in French for the interpreters, and likewise in English.

Before speaking, please wait until I recognize you by name. When you are ready to speak, you can click on the microphone icon to activate your mike. When you are not speaking, your mike should be on mute. To raise a point of order during the meeting, committee members should ensure their microphone is unmuted and say “point of order” to get the chairman's attention.

In order to ensure social distancing in the committee room, if you need to speak privately with the clerk or an analyst during the meeting, please email them through the committee email address.

I will now invite representatives of PSPC to make their opening statements.

[Lorenzo Ieraci, Acting Assistant Deputy Minister, Procurement Branch, Department of Public Works and Government Services]

Good afternoon, Mr. Chair.

Good afternoon, honourable members of the Standing Senate Committee on Government Operations and Estimates.

Thank you for having me here today.

My name is Lorenzo Ieraci, and I am the acting assistant deputy minister of the Procurement Branch at Public Services and Procurement Canada.

Joining me today are two of my colleagues from our Departmental Oversight Branch, Catherine Poulin, director general of Integrity and Forensic Accounting Services, and Claude Kateb, director general of the Industrial Security Sector.

Today I would like to focus my brief remarks on two areas. First, I will provide some general background with respect to roles, responsibilities and process in contracting security. Second, I will provide an overview of the specific procurement process involving Nuctech, which is the focus of today's meeting.

With regard to security and contracting, each federal department is responsible for protecting sensitive information and assets under its control, not only in its own operations, but also through any contracts it manages. Federal departments are also responsible for determining if suppliers will require access to sensitive information, assets or sites.

In its capacity as a common service provider, Public Services and Procurement Canada has two distinct responsibilities with respect to security and contracting.

First, the contract security program is responsible for security screening companies and personal. The program also provides the necessary security clauses to be included in each contract based on the information provided by the client department.

Second, the Procurement Branch ensures that the procurement is undertaken in a way that reflects the security profile, and that suppliers have received the necessary clearance prior to contract awards.

It should be noted that the level of security required is determined by the client department in consultation with their departmental chief security officer. These security requirements are captured at a high level through a security requirements check list, which is sent to Public Works and Procurement Canada along with other documents.

When procurement officers at Public Services and Procurement Canada receive these documents, and where security requirements have been identified, they contact the contract security program. In turn, the program provides the procurement officer with security clauses to be used in the solicitation and contract.

Prior to awarding a contract with security requirements, our procurement officers must confirm with our contract security program that the supplier holds the appropriate security clearance.

Mr. Chair, I will now move on to the procurement at issue, which involves Nuctech.

In December 2019, Public Services and Procurement Canada issued a competitive request for standing offer with the requirement to establish two standing offers for the supply of two types of securing screening equipment—conveyor-style X-ray machines and walkthrough metal detectors. This standing offer would be for Global Affairs Canada and other federal departments on an as-and-when-requested basis. The various trade agreements to which Canada is a signatory applied, and international suppliers were eligible to bid on this process.

I note that a standing offer is not a contract; it is an offer from a supplier to provide goods or services at prearranged prices, under set terms and conditions, when and if required. It is not a contract until the government issues a call-up against the standing offer, which is a notice to a supplier to provide the goods or services in accordance with their standing offer. It is important to note that the government is under no obligation to purchase until such a time as a call-up has been issued.

The request for a standing offer for screening equipment closed in early April. Seven offers were received for the supplier of conveyor-style X-ray machines. All were evaluated against the requirements of the request for standing offer. This included the need for offers to demonstrate that they met a set of 63 mandatory technical requirements to be declared responsive.

In accordance with the request for standing offers, the responsive offer with the lowest evaluated price would be selected. Three of the seven offers received were determined to be responsive, meaning that three of the seven offers met the 63 mandatory technical requirements. Of these three, Nuctech had the lowest evaluated price and was therefore awarded the standing offer.

I would like to conclude, Mr. Chair, by noting that to date no call-ups have been issued against this standing offer.

Mr. Chair, thank you for the opportunity to provide this overview. I'll be happy to take questions.

[The Chair, Conservative, Robert Gordon Kitchen]

Thank you very much. I appreciate that.

Now we'll go to Global Affairs Canada.

[Dan Danagher, Assistant Deputy Minister, International Platform, Department of Foreign Affairs, Trade and Development]

Thank you, Chair and members of the committee.

My name is Dan Danagher. I am the assistant deputy minister of the international platform at Global Affairs Canada. My team and I are responsible for providing the infrastructure required by Canada's network of missions abroad. That includes all real property, common services and physical installations.

We are grateful for the opportunity today to provide some background on Global Affairs Canada's recent procurement of X-ray equipment for those missions.

First, we at Global Affairs are seized by the importance of keeping our employees, our information and our assets safe. We have a robust security framework that continuously monitors the threat and risk environments, and we adapt our approach as those threats and risks change. We work with our closest partners globally and exchange ideas and approaches. We learn from each other.

Our installations are often complex, including high-security zones, security zones, as well as operations and public access or reception and public zones. X-ray equipment is used in the latter and helps screening deliveries and visitors to the mission. While this equipment represents a small part of our installations, every component is important for the good functioning and safety of our missions abroad.

In mid-July PSPC awarded a standing offer worth up to $6.8 million over five years for Nuctech X-ray equipment. To date, Global Affairs has not availed itself of this arrangement and has no Nuctech equipment in its missions abroad.

In the days following the award of this standing offer, the Minister of Foreign Affairs directed me to conduct a review of how we acquired security equipment such as X-ray machines. I turned to Deloitte Canada, and they conducted an exhaustive review. Their findings are currently in draft form, but I am sufficiently satisfied with their recommendations and we've already begun to implement them.

First, Deloitte found that Global Affairs Canada followed all applicable policies. While that is reassuring, they also found that those policies asked two key questions that fundamentally influenced our approach: Would the equipment handle sensitive information or be connected to our information networks? Because this equipment is used in a public access zone and the answer to those questions was negative, the procurement proceeded through normal processing without the application of a national security exemption or higher levels of security, which my PSPC colleagues can explain should the chair or committee members be interested. I should point out here that Global Affairs Canada has in place a national security exemption for the acquisition of equipment to be used inside the more secure zones of our chanceries.

Deloitte, however, recommended that we consider that the technical specifications themselves, even for the detection equipment in the public zone, should only be accessible to companies with higher levels of security clearance. Further, they recommended that we consider that service personnel who had access to the equipment should be security-cleared. These two steps could go a long way toward future-proofing our public zones from future threats should they emerge.

We are currently working through the mechanics of implementing these recommendations. However, I can confirm today that Global Affairs Canada will not avail itself of the standing offer awarded in July 2020, and we have already begun the process with PSPC to design a new procurement strategy that will implement Deloitte's recommendations.

We thank the committee for giving us this opportunity to explain how we are continuously improving and adapting as we strive to keep our people, information and assets safe. I am pleased to take your questions. Thank you.

[The Chair, Conservative, Robert Gordon Kitchen]

Thank you, Mr. Danagher. It is much appreciated.

I understand we're having a little bit of difficulty with your sound, but we'll try to make certain that we keep on top of that as we go through, if we need to interrupt briefly to correct that.

We'll now start our questions in the first round with Mr. Paul-Hus.

You have six minutes.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

I thank the witnesses for joining us today to answer our questions.

I heard what was said about the first assessment carried out, and then the one Deloitte did. My problem is that the Government of Canada has agreed to enter into a standing offer with Nuctech.

My first question is for the Communications Security Establishment. Ms. Mullen, what is your security assessment of Nuctech right now?

[Michele Mullen, Director General, Partnerships and Risk Mitigation, Communications Security Establishment]

Hello. Thank you very much for the opportunity to speak to you today.

Let me begin by giving you a feel for my role within the organization, so that you understand where I'm coming from with my remarks today. As the director general of partnerships and risk mitigation at the Canadian Centre for Cyber Security within the Communications Security Establishment, I'm responsible for three main functions.

First is building trust-based partnerships with all levels of government, Canadian critical infrastructure and the private industry. Second is providing cybersecurity architecture advice and guidance to our partners and the Canadian public at large based on the threat landscape that we observe. Third is implementing risk mitigation programs aimed at reducing the risks identified through our assessments of technologies on the basis of our understanding of the threat environment, which is informed by both—

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

I apologize Ms. Mullen. I don't want to be rude, but I have only six minutes to ask questions.

Can you directly answer my question on the assessment of Nuctech's security risk? Can you confirm that Nuctech is linked to the Chinese Communist Party and is under its direct control?

[Michele Mullen]

CSE was not asked to assess Nuctech as a part of the Global Affairs Canada standing offer that we're here to speak about today.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Ms. Mullen.

My next question is for Public Works and Government Services.

If no assessment request has been made, how can we justify the Government of Canada wanting to give a contract to Nuctech? Is it because the government turned a blind eye or did not want to know?

Had we not gotten involved, the contract would have probably been concluded. I understand that it did not materialize, but the offer was made in July. Can you explain to me why?

[Lorenzo Ieraci]

Thank you for your question.

In the case of procurement concerning Nuctech, needs and their associated security levels were set by the Department of Foreign Affairs, Trade and Development. The department provided us with information given that, at the time, no potential security risk had been identified. We undertook the procurement process, which was open to all businesses.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

However, you know that the U.S. Department of Transportation has been warning people against acquiring airport equipment from Nuctech since 2014. That should have been known here, in Canada. Isn't that right?

[Lorenzo Ieraci]

Thank you for your question.

Were we aware of the information relayed by the United States? Yes, we were.

However, as I said, the process had no impact on security. Being in charge of procurement, we cannot know who will award or receive the potential contract. In this case, it was a standing offer and not a contract. As there were no security-related eligibility conditions, the process was undertaken openly.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

We just voted on a motion in the House of Commons to obtain answers on Huawei. Given everything we know about China right now, how can we do business with a company directly related to the Chinese Communist Party without carrying out more thorough security checks? Please explain that to me.

[Lorenzo Ieraci]

Thank you for your question.

Procurement processes are based on security codes set by our client, which was Global Affairs Canada in this case. Our current procurement approach does not exclude companies from certain countries. Given that, at the time of the procurement, we had identified no security-related issues, the process went ahead.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Okay.

Can the Global Affairs Canada representatives tell me why they did not deem it important to establish security measures in their eligibility conditions even though we are talking about our embassies?

[Dan Danagher]

We did do a security review, Mr. Chair, prior to the issue of the requests for a standing offer. That security review really was based on two fundamental questions that we asked, in accordance with the Government of Canada's security policy. When those two questions were considered negative, this was considered low-risk. It was the paradigm that existed at the time. That has now changed.

[The Chair, Conservative, Robert Gordon Kitchen]

Thank you for that response.

Mr. Weiler, you have six minutes.

[Patrick Weiler, Liberal, West Vancouver—Sunshine Coast—Sea to Sky Country, BC]

Thank you, Mr. Chair.

I'd also like to thank all of our witnesses for coming to join us and speak with our committee today.

I'd like to jump right into it here. I was hoping that the witnesses could explain a bit more about what our government does to protect against unethical and illegal business practices.

[Lorenzo Ieraci]

Mr. Chair, thank you for the question.

I'm not sure if that was directed to Public Services and Procurement Canada, but I will start. From a procurement perspective, we do have the integrity regime, which is part of the work we do, as well as the contract security program, as I mentioned during my opening remarks.

Briefly, the contract security program does a few things. First, once we receive a requisition from a client department that indicates security obligations, the contract security program is engaged to ensure that the appropriate security clauses are included in the tender documents as well as the resulting contracts. In advance of a contract being awarded, the procurement officers will check in with the contract security program to ensure that the company has the appropriate security clearances to meet or to match the security requirements of the procurement.

In addition to that, the department manages the integrity regime, and I have colleagues from the department who are available to provide more details if necessary. In essence, what that does is ensure that companies have not been tried or convicted of offences. If they have been, they are placed on an ineligibility list, whereby we ensure that we don't undertake procurement with them.

Briefly, that's from a Public Services and Procurement Canada perspective.

[Patrick Weiler, Liberal, West Vancouver—Sunshine Coast—Sea to Sky Country, BC]

Thank you for that.

With this in mind, what implications do the integrity regime and the other measures you mentioned have on the Nuctech standing offer?

[Lorenzo Ieraci]

With regard to both of these, in terms of contract security and integrity, I'll deal with the first one first.

In terms of contract security, as I indicated, once we received the requirement from Global Affairs Canada, there was no security requirement associated with it; therefore, the procurement went ahead in the manner that it did. In advance of awarding the standing offer, the procurement team did a check-in with the integrity regime to ensure that Nuctech was not identified at that time and Nuctech was not part of the inadmissibility list.

[Patrick Weiler, Liberal, West Vancouver—Sunshine Coast—Sea to Sky Country, BC]

Thank you.

With this in mind, have you considered any...? I heard in the opening remarks about the recommendations that were made by Deloitte, and I was wondering if you could speak a bit more to how, as a government, we're considering new steps to protect the security of our workplaces abroad.

[Dan Danagher]

Mr. Chair, that question is probably best fielded by me.

We do have a very robust threat and risk assessment process. It's called the global security framework. It has been in place for a number of years now. We have a very, very large security team that focuses on it, and we deliver those installations abroad, so it's pretty robust. This equipment hasn't previously been considered to be sensitive—

[The Chair, Conservative, Robert Gordon Kitchen]

Mr. Danagher, can you hold on for a second? We need to check some technicalities. You're not coming through clearly yet. Just hold on for a second, if you would.

I will pause the time for you, Mr. Weiler.