Public Accounts Committee on June 3rd, 2008

[Robert Fonberg]

First of all, we have tabled an action plan. I believe we have a revised action plan to actually table. The action plan itself is based on all the recommendations the Auditor General herself put forward in her report. Basically, there are four points to that action plan.

Just before I get back to them, I would like to say that the reality, which the Auditor General has recognized, is that the way most of our buildings work their way through the classification process is that, first, a function for the building is actually determined. Then there is a process by which the space is actually designed. Those spaces--the walls, the floors, the wiring, the plumbing--basically determine the scope of the project. The project itself may be broken into a number of contracts to put up what we have, in the past, considered unclassified. There would be another contract to fit up what may be classified inside the building should there be a need for any special kind of treatment, any special communications, or any special equipment that's going to be handled in that building.

Typically, in a situation in which we have a building that has a classified part to it, for the reasons the DSO noted earlier, to allow for as much competition in the bidding process as possible, we often will bid the shell unclassified, and we will bid a contract for classified work within that shell. I think what the Auditor General has pointed out is that we need to be more deliberate and more serious in the early stages of design with respect to our assessment of threats and risks for the full use of the building through its life. That is something we are currently doing.

Basically, there is a four-point action plan. We are fixing the security requirements checklist piece of this, as the Auditor General recommended, to either require an SRCL or to have an attestation or certification that one is not required. So we now have full coverage. You need one or you don't need one, and that's actually signed off.

We are in the process of clearly clarifying rules and responsibilities for everybody, through the contracting process, on the construction side, and more generally, on the procurement side. We will go through a deliberate process of propagating those new policies in a very clear way toward the end of July. We will make sure that they are amended as the government security policy, put out by Treasury Board, comes out. That will be after the end of July, I expect.

We have a group of people who are working on a very deliberate sort of communication awareness education plan for those in the department who will be involved with contracting, whether for construction or otherwise.

Thank you, Mr. Chairman.

[The Chair, Liberal, Shawn Murphy]

Thank you very much, Mr. Fonberg.

Mr. Williams, you have seven minutes.

[John Williams, Conservative, Edmonton—St. Albert, AB]

Thank you very much, Mr. Chairman.

First I have to say that I'm not exactly sure why we have such a lineup of high-priced people here with us today. We have the Auditor General and her entourage. We have the Vice-Chief of the Defence Staff with a whole entourage of military people. I thought we dealt with this issue months ago, and now they're back again. I can't understand, Mr. Chairman, what we're actually trying to achieve here by bringing all these people in for a minor concern or misunderstanding.

Anyway, here they are, and welcome everybody. We'll have our seven minutes, if I can stretch it out that far.

[The Chair, Liberal, Shawn Murphy]

You have six minutes and ten seconds left, Mr. Williams.

[John Williams, Conservative, Edmonton—St. Albert, AB]

Thank you, Mr. Chairman.

Looking at this MOU that we have been given between the Department of National Defence and Defence Construction 1951 Limited, which I think is also called Defence Construction Canada, I'm glad to see that they're taking security seriously, Mr. Chairman. There must be some things in here that we don't need to know, because we've been given the odd-numbered pages but we don't have the even-numbered pages. They must be the ones that have the classified information on them.

The other point I wanted to examine is that the agreement is dated June 2, 2008, which happens to be yesterday. I presume it's the motivation of coming before this committee that caused this to get done.

Am I correct, Mr. Fonberg, that getting this done was an important thing so that one could come to the committee and say we finally have this MOU?

[Robert Fonberg]

Mr. Chairman, we submitted a revised action plan to you and the committee last Wednesday or Thursday; I'm not actually sure of the date. At that time we identified that we expected this MOU and the framework to be signed by July 31, 2008. As we went through our work last week, we realized it was further ahead than we thought.

I was not prepared to brief it into the action plan at that point, because the lawyers were still looking at it, and as lawyers look at them, things can get somewhat off track. As it turns out, some work was done between the assistant deputy minister of infrastructure and environment and Mr. Ross Nicholls over the course of the weekend. We managed to get it done. I thought it was good for the committee to have it done, and frankly it was good for us to have it done before July 31, 2008.

[The Chair, Liberal, Shawn Murphy]

Mr. Williams is quite right. In the reproduction of this, every second page is missing. We will get the entire copy of the contract and will distribute it to the committee members.

[John Williams, Conservative, Edmonton—St. Albert, AB]

You're sure it's not classified, are you?

[The Chair, Liberal, Shawn Murphy]

I'm pretty sure it's not classified.

[John Williams, Conservative, Edmonton—St. Albert, AB]

That's good.

In taking a look at the document I have here, the DCC Security Action Plan, I think, Mr. Chairman, if I recall correctly, that at the last meeting we were unaware—or I was unaware—that there actually was an MOU between Defence Construction Canada and the department and believed they had been operating for 40 to 50 years on a fairly informal arrangement. But I see that this new MOU replaces a previous one, dated May 18, 2001, that actually predates the 9/11 catastrophe in New York. I would have thought, given the whole new security awareness that event caused, that we would review our security in the building of infrastructure before this time.

Do you have any comment on why an old agreement that predates 9/11 was the MOU that was still being used?

Lieutenant General, do you have any comment?

[LGen Walter Natynczyk]

Mr. Chair, I believe we absolutely should have taken the time to have this done a lot earlier, shortly after the event.

[John Williams, Conservative, Edmonton—St. Albert, AB]

Thank you very much.

I'm not sure I have any further questions. If any of my colleagues have questions, Mr. Chairman, I'll leave the floor to them. As I said, I'm not exactly sure what we can achieve today.

Let me ask one question of the Auditor General. Are you satisfied that progress is being made by the Department of National Defence on this report?

[Sheila Fraser]

Mr. Chair, we have looked at the action plans of both Defence Construction and the department. We believe they address the issues we raised in our audits.

As I always say, we are cautiously optimistic that they will be put into place. Obviously, some of the deadlines are out further, and we haven't gone back to actually check that everything will be done, but it looks very promising.

[The Chair, Liberal, Shawn Murphy]

There are two minutes left in that slot.

Mr. Fitzpatrick.

[Brian Fitzpatrick, Conservative, Prince Albert, SK]

If I understand things correctly, the blueprints for the building were not deemed to be classified. I'm not an expert in this, but it seems to me that the attack on September 11 by al-Qaeda was based on a good deal of knowledge about the design and structure of the towers and the effect of a plane crashing into those buildings: the pancaking effect on the building and so on.

It would seem to me—I don't want to sound like a Maxwell Smart or somebody—that if you're designing something for NORAD, it would be highly critical that the building be free of any risk from terrorists attacks, or that you would attempt to minimize the risk. To have blueprints out in the public domain would just be an invitation for these people to know what the design vulnerabilities of these buildings are.

Am I missing something here, or can you satisfy me on this point? It seems to me rather odd or strange that blueprints would not be classified information.

[Robert Fonberg]

Mr. Chairman, I assume we're referring to North Bay, not to the Trenton blueprints.

[Brian Fitzpatrick, Conservative, Prince Albert, SK]

I assume if they're not classified, they're out in the public domain and people can look at those blueprints.

[Robert Fonberg]

In the case of North Bay, I would like to be able to satisfy the member, Mr. Chairman, but he, I think, has pretty much stated the reality.

Those blueprints were not classified. In retrospect, if we had to do it again, we would probably be a little bit more deliberate, certainly through the application of a security requirements checklist, and may very well have come up with a different classification for those plans.

[Brian Fitzpatrick, Conservative, Prince Albert, SK]

Is part of the reason for maybe not being strong on classifying this is because you have to line up a contractor and you have to line up skilled labour to build this? We're in a tight labour market in this country and it's hard to get good contractors since they have lots of work to do, so you'd be really limiting the pool if you classified the blueprints. Would that be one of the difficulties?

[Robert Fonberg]

Well, whenever blueprints are classified, the available number of contractors is smaller by a significant margin because of the required security clearances. I don't know, I'd have to go back to those who were there at the time to understand exactly why. I don't know that that was the major reason, but there is no question--and Scott or the DSO may want to speak to this--that we missed the classification of those blueprints.

Dave, I don't know if you want to talk to your sense of the record there.

[LCol Dave Shuster]

Again, not being there at the time, my expectation would be that the project authority would assess the threat and the risk, including the vulnerability of the building or what sort of documents we're talking about, and in this case it was only a 50% solution of the bare building. They would look at the vulnerabilities, the probability of there being some sort of compromise or threat, and the consequence of that. They would make that assessment and come to the conclusion that in this case those basic plans would be unclassified. And that's the decision that was made for those particular blueprints.

[Robert Fonberg]

With the advantage of hindsight, Mr. Chairman, I think the bottom line is this: I think the Auditor General reported that if we had that decision to take again, we would have done a security requirements checklist on that project and those blueprints likely would have been classified. Did we make a mistake? Yes.

[The Chair, Liberal, Shawn Murphy]

Thank you, Mr. Fitzpatrick.

Mr. Christopherson, seven minutes.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you very much, Chair.

I want to make a note of what you just said and I'm going to come back to that.

Let's put a focus to this. Mr. Williams is trying to suggest that this is only a gathering of folks with no real purpose. The fact is that we did deal with this once in a chapter review. We found serious problems. The Auditor General--I want to remind everybody--on February 26 of this year said in her opening remarks:

We found serious weaknesses at almost all levels in the processes set up to ensure the security of government information in assets entrusted to industry.

And on the same day, Mr. Scott Stevenson, the acting ADM at the time, said:

I have just outlined a number of specific actions the department has undertaken or will undertake to address the concerns raised by the audit. I can assure you that the Department of National Defence is committed to ensuring that sensitive information and assets entrusted to industry through contracting are properly safeguarded. As a result of the Auditor General's report, the Department of National Defence is making significant improvements to our security provisions.

We had our meeting and we had not yet met to write our report. In the interim, along come these headlines showing that these plans are in the garbage. We've brought you back here to find out where we are on this issue. Is it closer to the opening comments that the Auditor General made, that things are serious and there are weaknesses and this is another example of that? Or are the comments that everything is fine true, and we don't need to worry about anything? Or were we given nice little assurances, patted on the head, and the reality is that we still have continuing weaknesses? Hence the hearing to find out which of those two applications would apply vis-à-vis these blueprints being found in the garbage; let's understand this.

I understand the point being made that they weren't classified as...is “secure” the correct term?

[Robert Fonberg]

Classified.