Public Accounts Committee on Feb. 26th, 2008

[François Guimont]

Mr. Chair, essentially the answer falls into two areas.

When a requirement is identified, there's an assessment carried out, and a contract clause is put forward. In order for the successful bidder to be able to get the contract, he or she or the company has to be able to meet the security requirements. That is a requirement. In some cases we do, at the request of certain companies, provide for pre-clearances. That doesn't happen in the majority of cases, but it does happen. Therefore, a potential bidder, on a contract yet to come related to certain security requirements, may say that it's probably a good thing for them to get some clearances, approaches, or industrial securities program, and ask for a clearance. Frankly, we say there's a potential for that company to be a bidder down the road, and we will carry out a process.

[Charles Hubbard, Liberal, Miramichi, NB]

I have a limited amount of time.

There's no requirement in the bidding process for the contractor to be cleared to do the work.

[François Guimont]

No, it is only if there's a requirement, but it is not overall.

[Charles Hubbard, Liberal, Miramichi, NB]

DND would have that requirement. I'm surprised that this contract went to North Bay and that companies got involved that weren't certified to do it.

Now, to go a little bit further, we'll say that you have maintenance people working at DND headquarters here in Ottawa. Contracts are given for people to do maintenance. How do you deal with clarifying the security level of people who are going into DND headquarters to do that maintenance work?

Second, you hire casual people through a company here in Ottawa, and those casual people handle some very sensitive information in the IT sector. How is that managed? Within the contracts for maintenance, is there a system for the provision of casual workers who do clerical work? Are we secure in terms of the people who are entering the most sensitive part of the whole National Defence system?

[LCol Dave Shuster]

Our policy is actually consistent with Treasury Board's policy in the sense that individuals who have access to facilities or information, either at a classified or designated level, require the necessary clearance or reliability status. That depends, again, on the information they would have access to. So if it were even a casual employee coming into a particular job--and normally, if it's casual, it's a reliability screening--that would probably be done, in most cases, through PWGSC. We would ensure that the individual had at least a reliability screening for designated information or the proper security clearance if the person had access to classified information.

[The Chair, Liberal, Shawn Murphy]

Mr. Lake, you have four minutes.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

This is a real eye opener for us.

I want to go back to something Mr. Poilievre was talking about earlier, which is the relationship between government security policy and the security and contracting management standard.

My understanding is that the government security policy was issued in 2002. Is that accurate?

[Ken Cochrane]

That's the latest version of it.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

When was it originally implemented?

[Ken Cochrane]

It's been through a number of changes over time. I think 1986 was the original timeframe. It was modified in 1986, 1994, and 2002.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Now, it says that the current security and contracting management standard predates the government security policy by six years.

[Ken Cochrane]

It predates the current version. It was implemented in 1996.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

It was in 1996. The government security policy was updated in 2002. Yet the security and contracting management standard hasn't been updated since then.

[Ken Cochrane]

It was not modified in 2002.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Yet my understanding is that the government security policy, from what you were saying earlier, is sort of the big picture, and the security and contracting management standard is sort of the detail within that big picture, in a sense.

How could you update the government security policy immediately post-9/11 and not automatically, as part of that process, update the security and contracting management standard, where the details are, including the checklist we're talking about here? It doesn't make any sense to me. We're sitting here now, five years later, and it says here that “Treasury Board Secretariat has informed us that it plans to update”. So it still hasn't happened. It doesn't make sense.

[Ken Cochrane]

A lot of things were changed in 2002 as a result of 9/11. That is one of the reasons the policy was reissued. The policy is the overarching piece that covers many different standards. Many new things went into place, like protection of personnel, identification of assets, and delivery of critical systems. Those all relate to, in many ways, the events of 9/11. IT security was implemented. Some changes were implemented to recognize the changes on the Internet, and so on.

Security screening changed a little bit. Although this particular standard didn't change, the requirement for security screening changed. Initially the standard had been at a basic level, which meant no criminal check. The change that occurred in 2002 was to increase it to include criminal checks. That also covered the contracting standard.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

I'm also a little bit concerned about Mr. Guimont's comment. I think when we were talking about 24 sensitive contracts, in regard to the 86, I think the quote was that quite a number were done correctly. It seems to me that this would be okay in some circumstances, but when we're dealing with sensitive contracts and the security of our country, I'm not sure that the threshold should be that we have quite a number done correctly. I would rather hear that we're shooting for perfection, not that we're doing okay.

[François Guimont]

I agree with you. Frankly I try to look at it as the glass half full, but on sensitive contracts I don't question the point you're making.

In the course of assembling the sample, we did pick one area that was different from high sensitivity. This was secret/top secret. It has to do with protected information, which is different, as you may imagine. It was the same pattern, which is that a contract had been awarded, work had proceeded, and we screened the person to the right protected level: protected B.

The point I'm making is that in certain circumstances there's more risk tolerance. But in other cases, I agree with you. When you're talking secret/top secret, the margin of error for documents missing or not following procedures should be close to zero. Now, that does not bring risk to zero--that's another issue--but our procedure should be followed correctly.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

I think the big problem is that we're looking at a real ad hoc approach to this. We're talking about various practices evolving over time. I want some assurances on three fronts, that with past, current, and future projects things have changed. For example, I'd like to know how the process is different for a project initiated today from when the Auditor General did her report. What should give us reason to be hopeful and optimistic here?

[François Guimont]

It's different in three ways.

First, for those contracts that we generate, our acquisition branch now systematically flags, per a policy, the requirement for security. That is not only done manually, it's going to be done through our IT system. So that's the first thing. We have reinforced the need for that through communication and discussion with our staff.

Second, the program, headed by the director general, is more systematic in making sure that security clearances have been obtained at the time of contract award, which was the issue for the 24 that were singled out. That is the second thing we are doing.

Third, as I said, we're trying to find a long-term resource base that will ensure we have continuity in the program, so that the investments we're making in people and systems today are not lost as people leave.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Are those happening today?

[François Guimont]

All the recommendations made by the OAG have been implemented. The so-called “requirement for security checklist” is happening. Resources have come from Treasury Board in the amount of $11.2 million, so that has augmented the base of $6.7 million. These things are happening today. This is over and above what we're doing vis-à-vis the active contracts, which is looking into them to make sure they're all okay.

So new contracts are going through what I described, and we're going through past and active contracts very systematically to make sure nothing is missing. That goes back to the point made by Mr. Hubbard in terms of whether we have a level of assurance that things are okay. We're doing that.

[The Chair, Liberal, Shawn Murphy]

Thank you, Mr. Lake.

Merci beaucoup, Monsieur Guimont.

Monsieur Lussier.

[Marcel Lussier, Bloc, Brossard—La Prairie, QC]

Thank you, Mr. Chair.

My first question is for Ms. Fraser.

You said that the NORAD situation had changed since last October. In your brief this morning, you still expressed some concerns, i.e., that the NORAD complex could not be used for its intended purposes. Did the information that the Department of National Defence and Mr. Stevenson provide us with this morning on the measures taken alleviate your concerns?

[Sheila Fraser]

When we completed our audit, the department indicated to us that a number of measures could be taken to ensure that the facilities could be used for their intended purposes. We asked them what mitigation measures had to be taken, as well as their cost and the plan to be used. We did not have that information at the time of the audit. I trust the word of the department officials, but I would of course like to have more details on the measures that were implemented.