National Defence Committee on Jan. 31st, 2024

[The Chair, Liberal, John McKay]

I call this meeting to order.

First of all, I want to thank Mr. Olmsted for his patience. We had to move this meeting to a later time because of a multiplicity of votes.

Before I ask Mr. Olmsted for his five-minute opening statement, I want to bring it to the members' attention that we are now being interpreted remotely. We have remote simultaneous interpretation, or RSI. You'll notice that there's nobody in the booth except for a techie. Individuals on the committee may perceive a very small offset between the voice of a person speaking in the room and what comes through the earpiece when listening on the same channel as the language being spoken—for example, when listening on the English channel to someone speaking English in the room. This is normal and an expected part of the RSI experience. Anyone wishing to avoid this may do so by switching to the floor channel.

This is the way in which we'll be able to expand opportunities to have meetings. As you know, resources have been challenged. This will be normal for the defence committee going forward.

With that, I'll ask Mr. Olmsted for his five-minute opening presentation.

Thank you, sir. I look forward to hearing what you have to say.

[Robert Olmsted, President, Global Relocation, Sirva Worldwide, Inc.]

Thank you very much, Mr. Chairman and members of the committee, for inviting me today.

My name is Bob Olmsted, and I am president and chief operating officer of global relocation services for Sirva Relocation. In my role, I oversee all aspects of our relocation services in Canada and globally.

Sirva is a fully integrated relocation and moving company. Our unique model allows us to provide end-to-end service, including initial consulting and guidance before a move, and a range of on-the-ground services from origin to destination that help individuals and families as they settle into their new homes.

In 2022, Sirva merged with BGRS so that we could strengthen our service offerings and add greater value for our clients.

As the committee is aware, our heritage brands have provided relocation services to the Government of Canada for a number of years. Our most significant relationship is with the Canadian Armed Forces, and we are honoured to have helped thousands of members of the Canadian Armed Forces and their families relocate when they were called upon to do so. We also work with the RCMP and the Treasury Board Secretariat. All of our contracts were awarded through open and competitive bid processes and include rigorous oversight and high performance standards. Our team works hard to deliver excellent service to our clients, including the dedicated service members who make up the Canadian Armed Forces.

We commend your committee for its timely focus on the important issue of housing availability. This is a real and pressing challenge for many Canadians, and it is particularly acute for CAF members. I have heard the powerful testimony of the witnesses in your recent hearings who spoke of the stresses and challenges facing CAF members and their families when they are asked to relocate. Our job at Sirva is to help alleviate those stresses to the best of our ability.

Given our specific role, which does not include building or maintaining housing, we will defer to other experts and to policy-makers for finding solutions to these pressing needs.

We know that the committee is interested in the data incident perpetrated against our company by a sophisticated bad actor. Unfortunately, we live in a world where cyber-attacks have become commonplace, and our industry has not been immune. The data incident disrupted access to certain of our platforms and resulted in unauthorized access to information belonging to current and past clients and their employees. While we acted swiftly to contain the incident and are not aware of any major disruptions to planned relocations because of it, we sincerely regret any uncertainty, frustration and concern experienced by our clients.

Let me share a high-level summary of the timeline. Overnight on September 28, we identified malicious activity that encrypted certain of our systems. We immediately took steps to protect and further secure our systems, launched an investigation, and informed law enforcement. We then sought to restore operations from backups. As part of that effort, we informed our clients in the Government of Canada and subsequently continued to meet with CAF and DND officials, the Canadian Centre for Cyber Security and others over the following weeks and months.

We continue to work with cybersecurity and forensic specialist firms. We believe that the actions we have taken have contained and controlled the incident, and that we can continue business as usual with our clients and customers. While the process to identify impacted individuals is ongoing, we are committed to concluding that process as soon as possible, and we will notify and support any individuals, consistent with our regulatory requirements and contractual obligations.

Finally, let me say that we welcome the committee’s interest in the quality of service we provide. This is our top priority, and our team works hard every day to make the stress of relocation as smooth as possible. We abide by strict, rigorous performance oversight and accountability standards that are part of our contractual commitment to the Government of Canada. That commitment to enhancing client services is what inspired Sirva’s recent combination with BGRS. Our unified approach enables us to provide a more integrated and efficient offering for our clients.

With that, I will thank the committee again for the invitation to appear today, and I'm happy to answer your questions.

[The Chair, Liberal, John McKay]

Thank you, Mr. Olmsted.

Mrs. Gallant, you have six minutes, please.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

You told us that when the service was hacked, you contacted the Canadian government. Which agency did you contact and on what date?

[Robert Olmsted]

On October 3, we verbally contacted the Canadian Armed Forces, the Treasury Board and the RCMP.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

For the Canadian Armed Forces, was it the Department of Defence or was it somebody in the actual chain of command in the forces—and who was it?

[Robert Olmsted]

We contacted our day-to-day contact, whom we interact with on a regular basis.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

October 5 is when we found out. At that time, the minister did not know, and you said the government was contacted on the 3rd.

[Robert Olmsted]

On the 3rd, we verbally communicated. On the 4th, we sent an email communication.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

On the 5th—actually, even on the 6th—the Minister of Defence didn't even know. We're trying to figure out where the blockage is there.

How far back did the compromised data go? Was it for moves as far back as 2000?

[Robert Olmsted]

We still have not finished our evaluation of the data that was copied, so we don't have the answer to that question at this time.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

How much was the ransom that was required in order to release the data?

[Robert Olmsted]

While I was aware there were discussions going on with the bad actors, I was not involved in those discussions. Therefore, I don't know those details.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Okay. You don't know how far back it went, and you don't know about the ransomware.

Aside from money, you know they would be looking for more ways to intrude and get into military systems. What measures have you taken to ensure that the proper firewalls and ways to stop it have been put in place so that even more data cannot be penetrated from other systems?

[Robert Olmsted]

We immediately started to work with outside firms that are experts in cybersecurity to close any loopholes that might have existed. We worked immediately on getting the bad actors out of our system, which we were successful in doing immediately on the night of the 28th and on the 29th. We have now brought in those cyber experts, who have evaluated our system and given us assurances that, at this point in time, our system is secure and can be used as it was before.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Is your system regularly pen-tested independently?

[Robert Olmsted]

Absolutely. We bring in outside firms and our own security department not only to test our system, but to test our employees to ensure that they're following our policies.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

That was going on prior to the incursion.

[Robert Olmsted]

Yes.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

You have that going on and the pen test.

Is it a requirement of the federal government to have the independent pen test done?

[Robert Olmsted]

We have a requirement that ensures that we are keeping up with security standards, that we're doing all patches and that we report on that on a regular basis. That is part of our contract.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

What type of incursion was it? It obviously wasn't a zero-day incursion.

What method was used in this particular set of circumstances with your firm?

[Robert Olmsted]

The bad actors came into the system through an entryway. I'm not specifically aware of the technical words behind it, but we were able to detect that they were there and we were able to stop them in the middle of trying to copy data over. That's where we stand right now.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

What method are you using to contact the individuals who you know would have had their data breached?

[Robert Olmsted]

Once we have that list complete, we will be going out to our clients and communicating to the individuals, and then we'll work individually on how that communication will take place.