Government Operations Committee on Nov. 25th, 2020

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Mr. Glover, are you saying—

[Paul Glover]

Perhaps I can finish my answer.

When we are replacing broken equipment, we do it like for like. When we look forward to modernize, we are far more open. It is done through a procurement process that allows us to get the best possible technology moving forward, and that is done through open and competitive processes.

Finally, we are working to make sure that Canadian SMEs are integrated into this process and system and that our contracts encourage resellers, vendors and large multinationals to set up shop here—

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Mr. Glover, are you saying there aren't any Canadian companies that can provide the type of enterprise software you were talking about that you're currently going to IBM, Cisco and Microsoft for?

[Paul Glover]

No, Mr. Chair. I don't think that was what my answer said at all.

I said that when you look at some of the predominant...those were a number of examples. We have BlackBerry, a great Canadian company that is deeply entrenched into the IT infrastructure and services we use, and we will continue to use them.

Absolutely, there are Canadian companies. We seek them out. We seek out those small and medium-sized enterprises to help them grow, to make sure that the Government of Canada is one of their first customers.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

These companies have approached me. They're very frustrated because there are so many sole-source contracts—very large contracts—going to these American companies, and they feel that they don't even have the opportunity to bid.

I recently learned that Shared Services issued a sole-source contract for a service. Global Affairs issued a competitive bid for the same service, and Global Affairs got the service for 40% cheaper. Can you address why Global Affairs is getting the same software that Shared Services Canada is getting for 40% cheaper when they go with a competitive bid as opposed to a sole-source contract?

[Paul Glover]

Mr. Chair, the member's question is more than a little vague without specifics, but I can tell you that we use standard procurement processes. We go to the street to make sure that our processes are competitive. We use pre-qualified vendors to make sure that we are getting the best deal possible. We also, on some of our larger deals, engage some of the specialists—the Gartners of this world, the Lloyd's, the Accentures—who are experts at ensuring value for money to make sure that, when we go toe to toe with negotiating some of these big contracts, we get the best advice possible.

With specifics, I would be more than happy to follow up and respond in writing.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Okay. Thank you.

I'm going to change tack here a bit and follow up on the quantum security questions that I was asking the minister.

We know that quantum computing poses a huge potential risk to our security systems and our encryption systems, and I'm hoping that maybe our civil servants can provide a little more clarity on this. What is being done by the government to address the threat of quantum computing?

[Paul Glover]

Mr. Chair, I'll start and maybe ask Marc Brouillard, our CIO, to also answer.

At Shared Services, we do have what we call a future-looking series of programs where we are assessing technologies that are in their infancy. I would say that quantum is not in what I'd call its infancy. It is maturing quickly. We have experts in this domain. They are working with some of the larger Canadian companies that are active in this space. We also work with academia—some of the leading researchers in universities across this country—to understand technology—

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Can you tell us what the threats are to Canada's...? Can you illustrate that to the committee?

[Paul Glover]

Quantum generally.... The short answer is that it has the ability, both through brute force and because of the states in which it's able to assess things, to render current encryption technologies pretty much obsolete when they get that figured out. That's what the literature suggests, and that's why we have the program—

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

How will that impact government operations if we're not prepared for that?

[Paul Glover]

Well, we'll have to be prepared. That's the short answer. There is no not preparing for that.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Give us an example of what would happen if we weren't prepared, please.

[Paul Glover]

In all sincerity, Mr. Chair, with respect to the member's question, if encryption gets compromised, then you can't communicate, or we would have to assume that all of our communications are accessible. That's why we monitor the technology and the developments, and we will make sure that we are ready.

[The Chair, Conservative, Robert Gordon Kitchen]

Thank you, Mr. Glover and Mr. Lloyd.

We will now go to Mr. Drouin for six minutes.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

Thank you, Mr. Chair.

I want to tell this committee that I, too, have been hearing a lot from industry.

Mr. Glover, I do want to touch on Gartner. I know that when Gartner talks about network infrastructure, it says that the infrastructure and operation leaders “should never rely on a single vendor for the architecture and products of their network, as it can lead to vendor lock-in, higher acquisition costs and technical constraints that limit agility. They should segment their network into logical blocks and evaluate multiple vendors for each.” The blocks are defined as data centering, LAN and WAN.

I'm just wondering, within all these blocks, is Shared Services comfortable that it's operating in a multivendor environment, as Gartner would probably advise the Government of Canada?

[Paul Glover]

The short answer is, sort of. I apologize for that vagary. Gartner is correct. That is the strategy, but we're not there yet. We are working towards that. We inherited numerous departmental networks that were non-standardized and were all behaving somewhat differently. Part of that enterprise approach is to simplify, to standardize and to move—and this goes to the previous question—to zero trust networks with some of the latest state of the art.... We are working towards what, as the member points out, Gartner recommends.

That's why I differentiate between when we are fixing legacy and when we are moving forward. We do want to make sure that we are not ever dependent on solely one vendor. We have more than one mainframe vendor. We have more than one network vendor, etc. We will continue to make sure that we do that as we move forward, but I have to confess that we're not there yet. There is more work to do because of the legacy that we inherited.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

Those legacy systems would have been inherited, I can safely say, August 4, 2011, nine years ago, through the order in council.

[Paul Glover]

That's correct.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

Do the life cycles for these technologies date from five to seven years, or are they longer than that?

[Paul Glover]

There are two parts to that. There is what I call “iron gear”, which can run quite well for many, many years. Then there are things like switches that are a little bit more active and disk arrays that are more likely to break. There are different classes of hardware. They all have a different lifespan and expectation there. In addition to that, the software is accelerating even more quickly, rendering some perfectly reasonable hardware no longer viable because it can't keep up with the processing speeds and requirements.

I don't mean to complicate the answer, but it is variable.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

I'd love to go back to where you said you're not quite there yet and you're trying to move forward. I would ask about the status now. Are we...? For instance, if I tell my wife I'm a vegetarian but I eat vegetables only once per month, she would kind of challenge me on that.

Without naming any vendors, are we at 50-50 capacity, or 60-40 capacity, or are we at almost 100%? What is the strategy for Shared Services Canada, if we would be close to 100%, to reduce that so we can manage the risk and make sure we get at least two OEMs per network block, as Gartner is suggesting?

[Paul Glover]

Mr. Chair, I'm looking at my notes for the numbers.

I would suggest that today it is probably somewhere around 70-30 in terms of the split the member is asking for. I would also say that, moving forward, we are committed that any new...is open and competitive.

In saying that, we are also saying that it must be interoperable. When you run a network the size that we operate, it is important that all of the pieces talk to one another smoothly and efficiently. That is something the industry is getting better at. It will be easier for us to be more agnostic about who the vendor is, moving forward, and it doesn't matter what the gear is. They don't put in updates that work with only their stuff and complicate that.

Interoperability will be a key requirement even in a multivendor environment, moving forward. There are technologies to make that happen. We are introducing those quite rapidly.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

Obviously, you have to deal with procurement. How are we trying to make sure we get the market leaders in terms of building that new network infrastructure and minimize that risk? Are we asking industry how we can do this, or are we just doing the same old same old?

[Paul Glover]

There are three parts. First, we look to those who we think are world class and leading. I regularly have touchpoints, as I call them, with industry leaders to obtain their advice on what they're doing and how they're doing.

Second, you referenced Gartner. They are a wonderful research firm. They put the players into quadrants. There are the well-established market leaders, but we also look at the new and up-and-coming companies, who may not be in what Gartner calls the golden quadrant, the perfect one, to see if there are new and emerging technologies that we should be aware of and experimenting with, because they will eventually be in that preferred quadrant, moving forward. We are taking those steps as it moves forward.

Finally, our approach to procurement is different. We are going out with, “This is the problem. Tell us what the best solution is.” In the past, we would have gone out with, “Here's the problem. This is how we want it solved.” That meant we were far less open to new technologies and new approaches. It gets back to creating more space for some of the Canadian small and medium-sized enterprises and new and developing start-ups to be able to interact with us.