Government Operations Committee on Nov. 25th, 2020

[Marc Brouillard]

There are service standards in expectations of responding to ATIPs. As was said earlier, during the pandemic there were challenges, especially as business continuity plans were invoked in departments and employees could no longer access the networks.

There are three primary issues related to that. The first is that ability to connect remotely from home. That has largely been addressed by Shared Services Canada. There still remain departments that rely heavily on paper-based records. Even if they are able to connect to the network from home, they can't access the paper-based.... As well, there is the sensitive and classified information that is on secure networks.

There are still capability requirements for being able to physically access buildings to be able to produce some of those ATIP requests, causing natural challenges and concerns for health and safety.

As of October 26, of the 131 institutions that responded to our questionnaires, 30 institutions say that they're at full capacity to respond to requests, and 101 institutions are at reduced capacity. None are at zero capacity. All departments have reported that they are processing ATIP requests on a best-effort basis.

[Matthew Green, NDP, Hamilton Centre, ON]

Here's hoping I get mine at the end of the week.

Thank you.

[The Chair, Conservative, Robert Gordon Kitchen]

Thank you, Mr. Green.

Thank you, Mr. Brouillard.

We have a little bit of committee business that we have to do at the end of this meeting. We're going to reduce this next round to three minutes for the first two, one and a half minutes for the next two, and then three minutes for the final two.

We will go with three minutes for Mr. McCauley.

[Kelly McCauley, Conservative, Edmonton West, AB]

Thank you, Chair, and thank you, gentlemen.

How much IT equipment and software is purchased for the whole of government through Shared Services? I think it used to be all, but over the years I think there have been some adjustments to that. Would you be able to let me know?

[Paul Glover]

Thank you, Mr. Chair, for the member's question. The short answer is that we would have to follow up in writing.

[Kelly McCauley, Conservative, Edmonton West, AB]

Can you ballpark it?

[Paul Glover]

I would say it's the vast majority—maybe 80%. There is some software as a service—

[Kelly McCauley, Conservative, Edmonton West, AB]

What I'm getting at is just the security. How do we ensure that the equipment coming in is secure?

I know it's in your departmental plan for collaborating with TBS, the Centre for Cyber Security and CSE to maximize security, but how are we ensuring the security for those 20% outside of purchasing through Shared Services?

[Paul Glover]

I apologize, Mr. Chair. I misinterpreted the member's question.

[Kelly McCauley, Conservative, Edmonton West, AB]

Okay.

[Paul Glover]

I interpreted systems to also include software. When it comes to hardware and any of the hardware that gets plugged into the data centre and into our network—

[Kelly McCauley, Conservative, Edmonton West, AB]

Software, as well, though, besides buying Windows 7 or something....

[Paul Glover]

No, Windows would not be allowed. Those are the kinds of things we do. We purchase any of the stuff that's critical to infrastructure. Then, we are able to monitor and see the software that runs on that. While we don't purchase it, we have to look at it to make sure it's properly configured and understand its load on the network and, therefore, we are able to assess its security.

[Kelly McCauley, Conservative, Edmonton West, AB]

Thanks.

How do we ensure that's actually getting done? The reason I bring this up is that we were looking at the Nuctech issue where Global Affairs and PSPC both kind of shrugged and said that there isn't a box to tick that it could be a security issue and therefore it's not a security issue. No one checked with anyone because it didn't ask them to check a box on whether it was a security issue.

How are you preventing another department from not inquiring, or bringing something in because they don't know enough to ask, or if they're just ticking a box?

[Paul Glover]

I'll start, Mr. Chair. Marc, you could help.

The short answer is that within Shared Services it is a box to tick. Security is paramount to what we do. It's part of how we patch.

The second is the monitoring we do of any software. They're not allowed. They don't have what we would call “administrative rights” to install some of that critical stuff. The access to the data centres is physically limited. The short answer is that we have the keys and they don't.

On cloud, we are setting that up to set up parameters that will limit what they are able to do. They can transact what they need in order to do the development to build the applications without compromising the security posture.

[Kelly McCauley, Conservative, Edmonton West, AB]

Perhaps the best efforts of another department would be blocked by you.

Thanks.

[The Chair, Conservative, Robert Gordon Kitchen]

Thank you, Mr. McCauley.

[Kelly McCauley, Conservative, Edmonton West, AB]

Thanks, Mr. Chair.

[The Chair, Conservative, Robert Gordon Kitchen]

Now we'll go to Mr. Kusmierczyk for three minutes.

[Irek Kusmierczyk, Liberal, Windsor—Tecumseh, ON]

Thank you, Mr. Chair.

I have a question for Mr. Glover.

I want to pick up on my colleague's line of questioning, which I found really interesting, about the threat of quantum computing.

In 2018, this government, our federal government, invested about $15 million in the Institute for Quantum Computing in Waterloo. Last year, this government invested an additional $41 million in the Quantum Valley Ideas Lab. This year it invested an additional $7.2 million in numerous tech companies, including ISARA Corporation, which is a quantum-safe security company. The goal here it to help turn Waterloo into the world's quantum valley.

Can you comment on whether this is a smart strategy, to be basically partnering with and making investments in quantum research, Canadian quantum research institutes and Canadian quantum tech companies? Is this a smart strategy to protect ourselves from quantum threats, or is this something that really is just a role for Shared Services to consider?

[Paul Glover]

Thank you, Mr. Chair, for the member's question, and I will also ask Marc to help me with the response.

I need to be briefer. I apologize to all the members for my rambling.

The short answer is, I believe it is. These are fast-paced technologies that are developing very rapidly. It would be arrogant for us to think that we have all the expertise in Shared Services to be able to do what we need to do.

Furthermore, as was pointed out, if you look at the global movement of large tech companies, if we do not invest in Canadian IP, that is a challenge for us. I want to be able to do business with Canadian companies, and that means we need to encourage them to play on a global field, to think big. We're a big client, so it only makes sense that we make ourselves available to them to tap into the IP that they are building and developing. If we don't, we won't have it, or it will just be bought up.

[Marc Brouillard]

I would just add that the quantum shift is a very complex and multi-faceted endeavour that requires many areas of research. Paul earlier mentioned Moore's Law. We anticipate that Moore's Law may reach physical barriers on our current technologies. Quantum will be the answer to be able to continue in our thirst for more powerful digital, so it absolutely behooves us to invest in it, both for the protections and for the advantages.

[Irek Kusmierczyk, Liberal, Windsor—Tecumseh, ON]

Gentlemen, I appreciate your answers to that question so much that I'm actually going to share my time, because I think we should just leave it at that.

Thank you very much.

[The Chair, Conservative, Robert Gordon Kitchen]

Thank you, Mr. Kusmierczyk.

You have 11 seconds to share, so consider them shared.

[Kelly McCauley, Conservative, Edmonton West, AB]

That's so generous.