Industry Committee on April 4th, 2017

[Steven MacKinnon, Liberal, Gatineau, QC]

But you did make a very serious move in tendering your resignation on the grounds that the progress—or your perceived lack thereof—of IT projects at Statistics Canada was undermining its very independence.

[Wayne Smith]

Mr. Chair, there were three essential reasons I tendered my resignation.

The first reason was that I felt that the fact that Shared Services Canada was handling confidential respondent information under the terms and conditions that existed was in fact a violation of the Statistics Act, and that's still my view.

The Statistics Act requires that confidential information be held by employees of Statistics Canada or people that the chief statistician voluntarily and not as a matter of obligation deems to be employees of Statistics Canada. That's not the case today. I've actually filed a complaint with the Privacy Commissioner to see how he views that matter.

The second issue was that, in principle, when Statistics Canada needs hardware infrastructure to carry out its programs, which it doesn't have today, it has to request that from Shared Services Canada.

Shared Services Canada is not obliged to provide it, which means that they have meaningful control over Statistics Canada's ability to operate. That is inconsistent with independence in principle, regardless of whether a specific case has occurred.

The third issue was that the reality of those two factors together meant that Shared Services Canada was making decisions and failing to make decisions in a way that was hobbling Statistics Canada's ability to operate. My resignation was meant to draw attention to that issue, and I understand that at least it had the effect of getting a lot of attention from Shared Services Canada for a short space in time.

[Steven MacKinnon, Liberal, Gatineau, QC]

Your view is that Statistics Canada should be enabled to engage whatever experts—you said you're not an IT expert—are required, and to expend whatever resources, financial and human, are required to do its own IT planning and execution, and to queue jump, in essence, over any other client departments or agencies of Shared Services Canada. To fail to do so, to fail to provide you with resources to do those things, on your own and independently, undermines the independence of the agency.

Is that your view? Please provide a short answer.

[Wayne Smith]

I'm comparing the situation now to what it was ex ante. Ex ante, Statistics Canada made the decisions regarding its informatics infrastructure. When it needed infrastructure, as long as it had the budget, it could proceed. It has lost that ability. Therefore, it has less independence than it had in the past. I'm not saying that Statistics Canada should do everything itself, but I am saying that it should have full management control, which means that it should control its own budget. It should be able to make a decision to implement some aspects of hardware infrastructure. If Shared Services Canada is not able or willing to do it, it should have the alternative of going to some third supplier, or doing it itself. That will assure the most efficient and effective operation of the national statistical system.

[Steven MacKinnon, Liberal, Gatineau, QC]

You refer to cybersecurity in your presentation and the existence of legacy software, if I can call it that, that was vulnerable—I presume you inferred it was vulnerable to attack—and that the system in fact proved vulnerable to attack. Is it your view that Statistics Canada should or can or is capable of developing its own siloed cybersecurity to conform to world standards—and we know of the risks that are inherent in that world—as opposed to that being within the Government of Canada's perimeter, including organizations like the Canada Revenue Agency, Elections Canada, and other obviously critical data sources? It's your view that Statistics Canada should exist outside of that?

[Wayne Smith]

I would note that Statistics Canada's data is supposed to be protected not only from people outside the federal government, but also from other people within the federal government itself. The CRA, RCMP, CSIS, and CSEC's having access to Statistics Canada's data is as much a violation of the Statistics Act.... So pooling that data in the shared data centre constitutes a new risk for Statistics Canada.

In reality, Statistics Canada has been gradually pushed towards a world that's putting our data at greater risk, not less risk. Historically, we've maintained a wall, and we actually have not linked our databases and systems to the outside Internet world. There's no physical link. In order to participate in the Shared Services Canada and other government-wide initiatives, we're being forced to open that up for no reason of our own. There's no business reason for us to open up access to confidential respondent data. It's because of the models that are being adopted.

I would argue first that this movement is actually enhancing and increasing the risk of hacking Statistics Canada's information, but at the same time the number of incidents that we've had, as we've tried to go down this path, has actually been more than any hacking we've ever experienced.

[Steven MacKinnon, Liberal, Gatineau, QC]

How much time do I have?

[The Chair, Liberal, Dan Ruimy]

That's it.

[Steven MacKinnon, Liberal, Gatineau, QC]

I'm all out of time. Okay.

Thank you, Mr. Smith.

[The Chair, Liberal, Dan Ruimy]

Sorry.

We're going to move to Mr. Lobb for seven minutes.

[Ben Lobb, Conservative, Huron—Bruce, ON]

Thanks a lot, and thank you, gentlemen, for appearing here today.

I must say, I pretty well agree with everything you had to say, and that spans both a Liberal government and a Conservative government, so I appreciate what you say. Sometimes hindsight is a valuable tool to look at.

The third component that you mentioned, Mr. Smith, has to do with performance around Shared Services Canada. At a time when software companies—I won't say every—in North America are transitioning from their own internally managed data centres to cloud computing, it only seems logical to me that this be an option for us. We heard from Mr. Parker from Shared Services Canada that some government departments and agencies are in fact transitioning to that, so they are better able to respond to peak demands on bandwidth. I asked Mr. Parker if he could name me a couple of departments that have huge bandwidth spikes, and he either wouldn't or he couldn't name them.

Both of you gentlemen have been at Stats Canada and know there are huge spikes, and you know that Shared Services Canada has absolutely no ability to handle those huge spikes. That's my opinion, and I'm not an expert, but based on what I saw a couple of weeks ago and when the census was launched, I believe that is the case. I wonder if you could comment on your experiences with them in just being able to react to something basic that a data centre should be able to provide to its customer.

[Wayne Smith]

Well, the census isn't a good example, because it was a huge spike, absolutely, probably one of the biggest spikes the government has ever seen in terms of demand for informatics, but we knew exactly when it was going to happen and were able to build the capacity to face it.

The problem that happened at the very beginning of the 2016 census, which we recovered from very quickly, was actually caused by a bug in the commercial software. It wasn't Shared Services Canada and it wasn't Statistics Canada that caused us the problem; it was actually the third leg of the stool.

One of the problems that Shared Services Canada is facing is that they're trying to build new infrastructure at the same time they're operating the legacy system. They had no funding to allow them to do these two things simultaneously.

Their strategy has been to run down the legacy data centres. They've cancelled service contracts. They're not replacing the obsolete servers. They're hoping that these servers will stay on their feet until such time as they get their new systems up and running, but they have no reason to believe that. There is no evidence that this will be the case.

Just before I left Statistics Canada, there was a major outage caused by the fact that one of these old pieces of equipment failed. At the very moment we needed it to disseminate a major release, it brought down the entire data centre. It didn't just bring down the web server. It brought down our entire data centre. That was a consequence of the strategy of running obsolete equipment into the ground: causing an unnecessary lapse in the service for Canadians.

[Ben Lobb, Conservative, Huron—Bruce, ON]

I know that both of you gentlemen are still involved a bit around the world with developed countries, inside their own statistics offices. For their platforms, are they looking at cloud computing? What are they looking at to make sure they have the independence that's required?

[Wayne Smith]

The United Kingdom and Australia also have launched these kinds of cross-government informatics consolidations. In the U.K., the issue was raised about the independence of the statistical office. Ultimately, the statistical office was given a waiver to not participate because of the issues of independence and confidentiality of respondent information. The same issue occurred in Australia. In Australia, they were given a pass, again because of those issues.

The New Zealand government took a completely different approach to this. Instead of trying to build a government cloud computing capacity, such as Shared Services, they simply said that they would go to the private sector. While there's pressure on the national statistical office in New Zealand to move in that direction, there is provision for an exception if they apply for it—which they haven't yet, but they have full management control. They hold their own budget and they make their own decisions. They have to work with private sector suppliers. It's different in character from Shared Services Canada, because they still have full management control.

There is some discussion in the United States about moving in a similar direction, but it hasn't been acted on yet. In the U.K. system, the general government issue is unravelling to some extent. Other than that, I'm not aware of any other developed country—Dr. Fellegi might be aware—where the national statistical office has been required to turn its hardware infrastructure over to a central agency.

[Ben Lobb, Conservative, Huron—Bruce, ON]

I'll provide a comment and ask another question. It just seems that the reason why these software companies in North America and probably around the world are making this decision is not because they're afraid of any security risk, but because they know it's a huge capital cost to launch a data centre, to maintain it, and to then compete for labour to maintain it. It seems to me that it would be prudent for a government to look at those, because you flip the switch and you get more bandwidth.

I want to talk briefly about your issues in resolving outstanding performance issues with Shared Services Canada. Maybe you have a couple of anecdotal stories about the time an issue was identified, the time that it was ever fixed or solved, and the time frame around that.

[Wayne Smith]

I didn't prepare to answer that question, so I don't have the details. The most flagrant example is the one I mentioned in my speaking notes, in regard to what we call at Statistics Canada a new dissemination project, or major overhaul of the way we disseminate information. It was supposed to replace all of the obsolete software that might be vulnerable. For this project, the idea was that we would develop it and would deploy it first for the census of population. Part of the agreement with the cabinet was that we had to improve the usability of our website, and this was part of that strategy.

We did the work. We wrote the programs, but we required delivery of the hardware infrastructure to run them on. That infrastructure was supposed to be.... Actually very early in the process, in 2012 I think, I wrote to the previous president of Shared Services Canada highlighting the census. This project was among the highest possible priorities of Statistics Canada that had to be delivered. The census got delivered because they got a whole whack of additional money for that purpose, but in terms of this other project, the new dissemination model project, the date set was May 15, and they missed it completely.

There are tremendous issues inside Shared Services Canada. There are silos, and people don't talk across silos. We would discover such things as one person telling us that the equipment had been ordered and they were going to have it momentarily, and then three months later we discovered that the equipment hadn't been ordered because the person who was supposed to order it didn't know where the money was supposed to come from. There were those kinds of issues.

[The Chair, Liberal, Dan Ruimy]

Sorry, we are tight on time and are going to have to move on.

Mr. Masse, you have seven minutes.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

Thank you to our witnesses for being here.

I think it's important to note that Shared Services Canada is exactly that: it's involved in the dissemination of information and the collection of information into one central site from other sites. I guess its very nature creates that vulnerability. We've seen that. All you have to do is do a little review of it. A cabinet order created Shared Services Canada. It wasn't run through Parliament. Historically it has had all kinds of budgetary issues related to it. In fact, as it was being formed, it was being cut for savings, so there are all kinds of issues with regard to it. I think it needs to be commended that if we're going to protect our census and Stats Canada, first and foremost is the independence and solidarity of the information gathered and the dissemination of its use for public purposes.

That said, I do want to drill down. One of the things that is important is the independence of the chief statistician. With regard to our current selection process versus what's being proposed, what have other countries moved towards? My concern is that we still seem to lack the ability to recruit the best, and we also have to make sure that their own independence is secured. I think in the current age of alternative facts being used for all kinds of different reasons, having a fact-based, independent chief statistician could be an economic advantage in many respects and a social responsibility. I'd like to hear from that vantage point, because I do believe it is probably going to be one of the most key appointments that we make for many, many years to come.

[Dr. Ivan Fellegi]

Thank you for the question.

I mentioned that I had personal experience with how the currently proposed process wouldn't work. That was in the late seventies when Statistics Canada—and this is forgotten now—was in deep trouble and was a public scandal-ridden organization. All the tremendous reputation that it has acquired since was quite in ruin at that time. It was essential to find a chief statistician who could turn the agency around.

The government did appoint a search committee, but it couldn't find anybody it could recommend for the task. In the end, it undertook an active courtship of the vice-president of AT&T at the time, who agreed to take an enormous salary cut for the public service that he was intrigued to provide to Canada. That was Martin Wilk, my predecessor, who actually did turn the agency around. The government would not have been able to find anybody like him through the passive application process, and in fact it didn't find anybody like him until a formal search committee was created. The search committee engaged in an almost courtship with the most promising candidate. That's the kind of person one needs to attract to the extremely complex position that the chief statistician is. It's a manager, a professional, a public spokesperson for the agency, and ultimately the defender of its independence.

[Brian Masse, NDP, Windsor West, ON]

Mr. Smith, with regard to that, will we be able to track somebody with the current legislation, or would it be enhanced by ensuring that the position is outside of cabinet, independent of political influence, and is accountable to a wider body that is able to fully review and renew the position in the future?

[Wayne Smith]

I wouldn't be concerned about ability to attract candidates, but I would be concerned about the ability to attract the very best candidates. The person assuming that role will want to know that they would be empowered to do the job to the very best of their ability and that they wouldn't be hamstrung by political interference, and all forms of external interference. I think it's really the question of whether you'll get the very best candidates.

[Brian Masse, NDP, Windsor West, ON]

One of the things that has been raised by both of you was regarding the alteration of the census by cabinet order or by decision without Parliament's approval—effectively going back to a short-form census without Parliament's being able to determine that—or having the census questionnaires determined without scientific methodology. I worry about the comparables. For example, how do we look at the most recent bump that we have and how do we compare data from before?

How do we protect and make sure that there's going to be integrity in that process? Do we simply write it in the legislation so that the chief statistician has that, and cabinet cannot interfere with it?

[Wayne Smith]

I've thought a lot about the provisions. There are a number of things that have to happen. One is that a definition of the census needs to be inserted into the act that will ensure and make clear that even questions asked on a sample basis are part of the census. That's not there right now, and the courts have used that absence to say that this isn't part of the census; it must be a separate survey. If you clarify that particular point and stipulate in law that the census must be mandatory, you've solved part of your problem. Now this whole census has to be mandatory. No part of it can be made voluntary.

The next issue you have to deal with is whether it's going to be a comprehensive census. You need to set some kind of reference point. In a bill that was developed in the previous Parliament by Ted Hsu, the idea was to say that the content should be commensurate in scope to the.... I don't remember what the reference was. I think it was the 1981 census. That would mean that you would have a census that contained a large number of variables. The government could not decide to truncate it to only 10 questions, just do a basic head count. That would solve your second problem.

There's a third problem, because there has been a history of political intervention on census content, and there is a precedent in Australia for the chief statistician's having the authority to fix the census content after extensive consultation. That's an alternative. I am of two minds about that. When you're going to ask questions of the entire population and force people to respond, you might want parliamentary oversight, but you need to think about that.

The fourth piece is to be careful in the wording not to prevent Statistics Canada from using the most efficient mechanisms to get the data, which may not be the classic survey.

[Brian Masse, NDP, Windsor West, ON]

Yes.

[Wayne Smith]

So those four pieces need to be there. They're not there today, and as a result, as both of us have said—