Human Resources Committee on Feb. 14th, 2013

[Marjolaine Boutin-Sweet, NDP, Hochelaga, QC]

Based on what you are saying, a notation is made on credit files, but there is no oversight. In other words, no one will check to see if the social insurance number has not been used by someone else somewhere to get a loan or to apply for credit cards. In fact, neither the government nor Equifax will provide any surveillance.

[Ron Parker]

Not exactly. The two are actually independent from each other.

The people in question are clients of financial institutions. When they make a request to obtain additional credit or a mortgage, or to increase their credit limit, the institution will see the notation on their Equifax file indicating that they might have been involved in an incident. According to their protocol, financial institutions will then be able to ask for additional proof of identity.

[Marjolaine Boutin-Sweet, NDP, Hochelaga, QC]

I have not received an answer to my question about costs—

[The Chair, Conservative, Ed Komarnicki]

Thank you, Madame Boutin-Sweet—

[Marjolaine Boutin-Sweet, NDP, Hochelaga, QC]

I already asked this question.

[The Chair, Conservative, Ed Komarnicki]

—your time is well up. Sometimes you don't always get the answer you want or like the way it comes out, but your time is up. If Mr. Parker wishes to elaborate somewhere along the way, he can, but we'll move now to Mr. McColeman.

[Phil McColeman, Conservative, Brant, ON]

Thank you for coming today to deal with a most difficult—and the word's been perhaps overused, but I'll state it again—a most unacceptable event.

It reminds me of risk. One comment Mr. Shugart made was that you can never give absolute guarantees. There will always be risk. There was a level of risk before this happened, and now perhaps another level of risk afterwards because of the new protocols that are put in place as a result of this situation. It reminds me of 9/11 and what happened in terms of our feeling secure after 9/11. The world changed. We had to put a lot more security in place.

Having said that, I'm interested to know the protocols that were in place at the time that these devices went missing with this important information about Canadians. Were the protocols for the handling and storage of that information followed?

[Ian Shugart]

My colleagues can elaborate, but subject to anything we may learn in the investigation, it seems to us that given the requirement for encryption and the fact that the information transferred was not encrypted, it's pretty clear that the policy was not followed.

The policy was in place and the requirement was in place, but the indications we have are that the policy was not followed.

[Phil McColeman, Conservative, Brant, ON]

Would that include your policy regarding storage and the place where they were stored? We're told it was in a locked cabinet. Was that the proper protocol for where backed-up hard drives should be placed?

[Ron Parker]

The devices are to be stored in a secure locked cabinet. The investigation will look at what the circumstances were when that the device, the hard drive in particular, was not in that locked cabinet.

At one point we knew that it was, right? The evidence points to it being in the cabinet. What we know is that it's unaccounted for at this time, and we are looking to understand how that came to pass.

[Phil McColeman, Conservative, Brant, ON]

You mentioned in your opening remarks, and it's been mentioned here in our questioning, that the level of consequences for not following protocols goes right up to and includes termination.

What actions are being taken?

[Ian Shugart]

Chair, first I need to say that we don't have the results of the investigation with respect either to certainty about the individuals involved or the circumstances. Therefore, to go further than that would be conjecture. Mr. McColeman will understand that I won't do that.

I can say, however, that a number of things would be taken into account in such situations with respect to what discipline is appropriate, including the genuine awareness of the individual employee. Responsibility by a manager, for example, would be expected to be greater than that of an employee, and an employee who deals constantly with this kind of information would have a greater expectation of compliance than one who was unaccustomed to it. These are all illustrations of that factor, that criterion of awareness.

Motivation—the intent of the individual—is clearly a factor in any decision about discipline. Again, I won't theorize in this situation, but intent is clearly a factor. The gravity of the situation is a factor, as is the degree of remorse of an individual and the willingness to comply. We would take all of that into account in deciding each individual case, based on what we know.

Of course, one has to have clear knowledge before acting on the basis of discipline. We would take all of that into account in deciding where on that continuum an appropriate action would be taken.

[Phil McColeman, Conservative, Brant, ON]

I appreciate your articulating it in those terms of taking the broad range of circumstances, and I suppose, cultural influences, into consideration.

I think that on both sides of the political spectrum, we all recognize the gravity here. There has been some mention, I think by the minister, that because of the gravity and the seriousness of this situation, in the go-forward situation and the establishment of new protocols and procedures, there will there be an increased toughening, shall I say, of the consequences, should this happen again.

[Ian Shugart]

Again, I don't want to stray too far, Chair, into the realm of conjecture, but I think I can say that as a consequence of deepening our culture and our training and our awareness of these issues, one ought to be able to expect a higher standard in the future.

As I indicated before, the code of ethics includes both the range of disciplinary action that can be taken and the obligation for personal information protection. To the extent that we deepen the cultural awareness and the rigour and the extent of the training and so forth, in this issue particularly we will be able to raise the awareness and commitment of employees. I have to say that of course we have many areas where public servants have mandatory obligatory training, and that is appropriate. As our CIO knows only too well, and we all do as managers, the area of information technology security and information management is itself becoming more and more complex and broad and intertwined, and in order to achieve that desirable state of culture that I've referred to here, we do need to raise our game in terms of awareness and commitment of employees.

Against that backdrop, I think that employees should expect that we will be going about this in a strict fashion.

[The Chair, Conservative, Ed Komarnicki]

Thank you, Mr. Shugart.

We'll now move to Mr. Cleary for seven minutes.

[Ryan Cleary, NDP, St. John's South—Mount Pearl, NL]

Thank you, Mr. Chair.

Mr. Shugart, I reviewed your speaking notes and the timeline for both incidents, and my first question is in regard to the timeline.

In the first incident, which was November 5, we have a missing hard drive with the information on 583,000 Canadians, the student loan information. It was reported to the privacy commissioner on December 14. That was more than five weeks after this device went missing. In the second case, the USB went missing on November 16 and the privacy commissioner was notified six days later.

Why did it take more than five weeks in the first case—what I would describe as the more serious case and the one that affected more Canadians—and six days in the second case? Why?

[Ron Parker]

I think the reason is that from the early days—from the November 5 period to the end of November, roughly—we were looking for an asset. What was on that asset was not well understood. The extent of the information that was on it became clear on December 6. At that time we began to react swiftly, in terms of the actions taken. The searches intensified, and, as I mentioned, the privacy commissioner was notified as of December 14.

[Ryan Cleary, NDP, St. John's South—Mount Pearl, NL]

Mr. Parker, I'll stop you there. I've got to ask this question.

You describe the actions as “swift”. You say you acted swiftly, but on November 5 this first hard drive went missing, and there wasn't an informal investigation launched until the first week of January. How can you describe that as “swift”?

[Ron Parker]

The search for the hard drive and the security incident protocols call for corporate security to become involved. That took place on November 28, once the management of the department was notified. At that time the protocols kick in and the notification up the line takes place and we became aware of the incident.

Until that time the employees were looking for a hard drive. As of December 6, in terms of moving quickly, once it became clear that we were dealing with 583,000 lost records of students and the information for 250 employees, we had a short time between that and the notification of the Privacy Commissioner. We intensified the search, and once that was done and we came to the view that the likelihood of finding it was low, we notified the Privacy Commissioner.

[Ryan Cleary, NDP, St. John's South—Mount Pearl, NL]

Mr. Parker, I'm sorry to interrupt, but I want to get a few more questions in quickly.

I know that the minister and the officials here today have described the potential security breach as unacceptable, but on the department's response to the loss of a hard drive and USB port, would you also describe that and the timeline here as unacceptable?

[Ian Shugart]

No, I wouldn't, and I don't want to be misunderstood as in any way saying that what occurred was acceptable. It wasn't, but with the information we had at the time that we had it, we believe we acted appropriately with respect to our protocols for the Privacy Commissioner.

We were continuously searching for the assets. At the same time that we became aware of the content, we immediately began the process of informing people and putting in place throughout that period the additional measures—hardware, software, and so on—for prevention of such things in the future. On all three of those paths we were proceeding, we believe, appropriately, given the gravity of the situation, which we do not in any way question.

[Ryan Cleary, NDP, St. John's South—Mount Pearl, NL]

I have two requests as well. In terms of a hard copy—you probably wouldn't want to give this on a USB port or whatever—of the new policies and procedures on the handling of personal data, can this committee be presented with a copy of your new policies?

Also, are you prepared to give this committee a copy of the report into your investigation into both of these incidents?

[Ian Shugart]

Chair, as to the first, I will undertake to provide the committee with whatever information the committee asks for.

With respect to the second, I will provide any information that we can that is not precluded by the statutes of Canada.

[Ryan Cleary, NDP, St. John's South—Mount Pearl, NL]

At what point—

[The Chair, Conservative, Ed Komarnicki]

Mr. Shugart—