Procedure and House Affairs Committee on Feb. 10th, 2011

[Thomas Mulcair, NDP, Outremont, QC]

Thank you, Mr. Chair.

I am going to continue what Mrs. DeBellefeuille started, because my questions are about the same thing. She referred to the responsibilities of a reasonably diligent member of the House of Commons. That is what the committee must decide, ultimately. It must decide whether the necessary precautions were taken. Part of our discussion today will be useful in future. There is a retrospective aspect,and also a retroactive aspect that we have to consider, which is what happened in the case of Kelly Brock.

I have a question for you, Mr. Bard. Are there techniques that can be used to determine whether or not a file has been opened after it was sent? Do those techniques apply here?

[Louis Bard]

Should we get involved in techniques to be used after the fact or should we really try to prevent a situation? It's a lot easier to incorporate properties into a document to make sure it will not be altered or distributed, but after it is sent, it becomes more difficult to control it.

As Ms. O'Brien said, the entire structure here is designed to maintain your security, and at the same time to guarantee that your information will not be lost and that it can be located. If something happens and you lose your data, we have to be able to restore it to enable you to continue working.

To answer your question, the emphasis is really not placed on what can be done after the fact.

[Thomas Mulcair, NDP, Outremont, QC]

Is there a technical method of including a digital tattoo in an electronic document?

[Louis Bard]

Yes.

[Thomas Mulcair, NDP, Outremont, QC]

Conversely, if it were discovered that there was a confidential document from the Standing Committee on Finance in Lobbyist X's office, would there be a way of having a digital tattoo that identifies the copy of a particular member? Is such a technique possible?

[Louis Bard]

There is the whole watermark technique for paper documents. The same kind of technique certainly exists for electronic documents. But once you add components to limit access to the documents, you have to use much more sophisticated technologies that call for infrastructure and investment, and place a lot of access restrictions on members.

How far do you want to go to guarantee security? I will never be able to guarantee 100% that there will be no malicious intent on the part of someone who decides not to follow the rules.

[Thomas Mulcair, NDP, Outremont, QC]

True, but the rules are always made for the people who want to get around them. That is somewhat the nature of...

[Louis Bard]

It will never give that assurance, because the more sophisticated it is, the more capacity for maliciousness there is. In reality, the question is always how to put together a document in the purest possible form, to be able to use it in your work. All the other aspects relate to the packaging of the document, the way the packaging and distribution of the document are overseen.

[Thomas Mulcair, NDP, Outremont, QC]

Thank you.

Ms. O'Brien, I have a question for you. I was elected in a by-election. So I received a condensed version of the course given to new members, because I got here when the machine was already running.

[Pierre Paquette, Bloc, Joliette, QC]

You were starting from the back of the pack.

[Thomas Mulcair, NDP, Outremont, QC]

I was starting from the back of the pack after picking up all sorts of bad habits in another parliament.

But I do know that orientation sessions are organized for new members. In those sessions, are documents distributed about the confidentiality of information? Are there instructions, ways of doing things, things you share with the newly elected members?

[Audrey O'Brien]

I have to say no, there is nothing specific. But after my first appearance before the committee, and given the popularity of social media, I understood the need to address the question of confidentiality in the next orientation program for new members.

In fact, we intend to speak with the party whips, because we would like to meet with members—not just new members but the entire caucus—to review certain basic rules, because the environment has changed. Members are sometimes elected for decades and things have changed, but some of them may not have realized it. We would like everyone to start out with the same understanding of the rules.

[Thomas Mulcair, NDP, Outremont, QC]

Good. Thank you, Mr. Chair.

[The Chair, Conservative, Joe Preston]

Thank you.

Mr. Andrews.

[Scott Andrews, Liberal, Avalon, NL]

Ms. O'Brien, as members of Parliament, we're responsible for the e-mail addresses that are given to us, the four, five, or 10, or whatever number it is. As a member of Parliament, we have access to monitor what our staff are sending and receiving on those e-mails if we choose to do so.

We're also issued electronic devices. I'm going back to the PIN question. If we can monitor our staff's e-mails, why shouldn't we have the ability to monitor what our staff are sending to individuals on PIN communications?

[Audrey O'Brien]

Well, frankly, Mr. Chair, through you to Mr. Andrews, there's no reason why you shouldn't be allowed to do that. It's just that the question has never come up. Even on the monitoring, as Mr. Andrews puts it, of e-mails, the idea is that the e-mail addresses are assigned to the various assistants in the office and then that's managed by the member. We have no role in that. That's entirely the affair of the member.

So there are no real tools, I guess, put in place to assist the member in monitoring his or her staff. The presumption is that the member, in selecting staff, will have made judicious choices, and that such monitoring will not have to be particularly vigorous.

[Scott Andrews, Liberal, Avalon, NL]

Absolutely, and we are all responsible for the people we hire. It's under our name. That's why I ask. If I wanted to do this, it can't be done, so would you take into consideration that maybe this is something to which we should give some consideration as well as SMS texting and BlackBerry messaging?

[Audrey O'Brien]

We'll certainly look into possibilities of what kinds of tools we might be able to make available to members. The committee will understand, of course, Mr. Chairman, that we have cost constraints. We have to juggle things within the question of priority, so it becomes a question of whether this is something that would have a high priority for a lot of members. Unfortunately, I suspect this is the kind of thing that one turns to in a situation where the horse has already bolted, right, and so we couldn't necessarily anticipate the horse doing that.

[Scott Andrews, Liberal, Avalon, NL]

No, no. That's fair enough. I understand that.

Mr. Bard, we're also restricted from putting certain applications on our BlackBerrys. Couldn't we also be restricted from communicating by those unsecured methods?

[Louis Bard]

Again, it's much more complex than the device and the features of the device. It's the complete environment. Madam O'Brien explained at the beginning that we have an environment to conduct the usual day-to-day business of members of Parliament.

If you were in a place like DND, as an example of those places where you want to be purely secure and confidential and you want to control everything, they have a separate environment. They don't use the network. They don't use the mail. They don't use a lot of these things, and you can go so far...it's not just one layer. You have to look at security like peeling an onion. There are many, many layers and securing the device is not helping me if I don't secure the rest of the infrastructure, if I don't secure the wireless network. For PIN to PIN, it's like putting a lot of money in something that is not secure as a technology. CSIS, DND, and the world will tell you that you don't do that. You don't do business on cellulars if it's that confidential. That's why you need to assess the risks and the investment and also manage your environment.

My objective for many, many years has been to try to give the members as much flexibility as possible and not to put on too many constraints. I think every member is unique. You are competitive among one another and therefore I need to give you that flexibility to be who you are and to serve your constituents. Therefore, when you work in Ottawa with the institution, we already have a lot of restrictions. It is a balancing act.

[Scott Andrews, Liberal, Avalon, NL]

I don't disagree with you there. Thank you.

[The Chair, Conservative, Joe Preston]

Thank you, Mr. Andrews.

Mr. Lukiwski, are you sharing some time with Mr. Young?

[Tom Lukiwski, Conservative, Regina—Lumsden—Lake Centre, SK]

Yes, but I have just a quick question here. A spitball kind of question just came to me. I don't want to give the impression that I think we should institute a new bureaucracy of e-police out there, because there is a certain trust factor for MPs as well as their staff, under which all of us have to work in this environment, and I appreciate that.

From time to time, I'm sure, certain committees will be producing highly confidential documents. It is one thing to put some procedures and protocols in place to perhaps--at least I hope--prevent those documents from being forwarded or released to people who shouldn't see them, but that doesn't really stop, if someone wanted to.... Madame DeBellefeuille said that if people want to cheat, if they want to break the law, they'll always find a way.

One way, obviously, is by examining a document closely enough, without physically forwarding it either in hard copy or electronically, and then verbally informing someone of what it contained. Currently, I understand, there is really no way to stop that from happening.

Would there be a need--or perhaps would there be the capability within the House--if there were highly sensitive documents, to develop a secure site where the documents could be sent? Then, for anyone who wanted to examine the documents, their name and the time at which they examined those documents would be registered. That may be complete overkill. I'm the first to admit it may be out of there. But is that something that could happen?

[Louis Bard]

Yes, I think it could be a combination of things. Yes, we can isolate the document in a particular area. I call that a collaboration site. We can put all kinds of restrictions on that site and then for sure we will know who accesses that site. You can say that you cannot change the document and you cannot copy the document. All kinds of things like this can be done.

At the same time, there are some very well established procedures that exist today in the government for secure documents and what you can do. There are all kinds of rules and decisions you need to make on whether you want to make versions of the document, number the documents, or have people sign. There's all kinds of information that exists.

I think the best way to address that for me...I mean, we can make those available, but at the same time, you really have the key in your hands, and the key in your hands is at the preplanning stage of that report, when you have all those questions. Bring this to the attention of the committee clerk, and it will be very clear at that time, and if need be, sit down with each instance and say, “That's the proposed approach for this particular report”.

[Tom Lukiwski, Conservative, Regina—Lumsden—Lake Centre, SK]

Thank you, Chair.

I'll certainly cede my time to any of my colleagues if they have questions.