Public Accounts Committee on Feb. 26th, 2019

[Randeep Sarai]

Lastly, do you believe the new funding commitments will help ensure these problems will be less frequent in the future?

[Ian Shugart]

I absolutely do. The resources, as we've indicated, cover not just the physical circumstances, the physical capacity, but also the training, documented and tracked with information systems, that we are giving to our staff when they go out, as well as the operational measures we've put in place. The expenditure on guards or relatively inexpensive equipment such as closed-circuit TV can be medium-term risk mitigation, as opposed to a major reconstruction project.

We're very confident that we're on the right track.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Sarai and Mr. Shugart.

We'll now move back to Mr. Kelly, please.

[Pat Kelly]

I want to turn to a common thread that has come up throughout the Auditor General's reports we've received at committee. It is around problems of data collection, data retention, and being able to respond or react to data. Much has been made of evidence-based policy-making, but there is no evidence-based policy-making without evidence. I bring to your attention, Mr. Shugart, some items from the report:

In paragraph 4.12 it says:

...security assessments were missing or incomplete.... Global Affairs Canada did not have the information it needed to prioritize investments....

Again, at 4.24, we have:

...had not been tracked or prioritized for action.

We see at 4.44:

...rationale behind funding decisions was not properly documented to ensure that the most urgent security needs would be met.

The report indicates throughout that there were failings to respond, or even have the information with which to make proper decisions. How was that allowed to happen?

[Ian Shugart]

First of all, this typically—and in this case—doesn't arise through conscious decision. I think it happens because of a practical focus sometimes on moving resources out. When the proper planning and documentation systems aren't in place, they're not used. It does take a conscious investment to put those systems in place, and that is what we are now doing.

As I said earlier, I think this is a broad problem. But during the period of those funding programs, one of the missions that had enormous security requirements was Kabul in Afghanistan. The needs there were obvious; they were patent. In the absence of a documentary system that will hold you to a plan, sometimes the urgent needs act as a big magnet. The resources are put where the practical, day-to-day assessment is needed.

We're not being blind to the circumstances as they evolve. We have in place the systems that will track what we're doing, whether we are on schedule, how the needs have changed, and we're evergreening those risk assessments so that we will not have this kind of finding in the future.

You're absolutely right, but we've put in place the systems that will prevent that from reoccurring.

[Pat Kelly]

Yes, and we can't have that. We can't have the scenario that we've seen in others, where we'll come back five or 10 years from now with another audit with the same failures. Having had this audit tabled in the public domain places a particular urgency on getting this together and getting these known security lapses addressed as soon as possible.

I know that my colleague, Ms. Kusie, had one quick question she didn't have time to ask, so I'll let her do that right now. I have about a minute left.

[The Chair, Conservative, Kevin Sorenson]

You have about one minute.

[Stephanie Kusie]

I just want to state briefly, as a former foreign service officer abroad, that I feel that the government truly has the deepest obligation to keep its employees safe abroad. I know there has been a lot of discussion this morning about the situation in Havana, but what is apparent to me through the media is that the Canadians serving there did not feel safe and did not feel that the present government protected them as soon as it should have, especially compared with the Government of the United States—which also political comments while ours made none.

What have we learned from this? I want to give you the opportunity as representatives for Global Affairs Canada here today to say what have we learned from reacting to this so slowly, so that we never put our people in harm's way like this again? Furthermore, should something like this occur, how do we recognize and respond to it sooner to stem the problem as quickly as possible?

[The Chair, Conservative, Kevin Sorenson]

Very quickly.

[Ian Shugart]

I'm not, at this point in my comments, going to accept all of the assertions made. I would say that I think it is too soon for us to have learned all the lessons, because we still don't know a great deal of what we're dealing with.

The test is always based on what you are finding. First, are you taking it absolutely seriously? Secondly, are you applying a reasonable standard of care given all of the circumstances, including the need to continue to serve Canadians in the field? Are the actions you take meeting the reasonableness test in the legal understanding of the duty of care? That is what we are striving to do.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Shugart and Mrs. Kusie.

We'll now move to Ms. Yip, please.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

Thank you for coming.

I'm concerned about the security training for staff. Two in five employees at high-threat Canadian missions had not taken either the personal security seminar or the hazardous environment training, or both. GAC had not routinely provided enhanced security awareness training at high-threat missions.

Why are Canadian staff members posted to missions operating in high-threat environments not given the training and the seminar before their departure?

[Ian Shugart]

I don't want to quibble, but I would say that the tense is important. It is an absolutely valid question, why were staff not given the appropriate training, but it wouldn't be accurate anymore to say why are staff not being given this adequate training, because this is something that we have worked very hard to correct. I'd invite Heather to elaborate a little bit on our training program.

[Heather Jeffrey]

We have a number of specialized course offerings for high-threat missions—the hostile environment training and the personal security seminars—which are multi-day, very specialized, very well-regarded courses.

The issue we had faced in the past was that, while people were being trained going out to mission from headquarters, it was very difficult for operational reasons for us to train people moving between missions abroad, which is frequently the case with our rotational staff. Under our new duty of care investment program, training offerings have been prioritized. We've increased the quantity of those offerings by 40% this year. We've also piloted new ways of offering these courses. For example, they can now be offered abroad in the local environments there. Rather than bringing people back here, we're able to offer the courses on site in the local environment, which also enhances the training. We're well on track to implementing that recommendation.

Another aspect of the recommendation was, of course, the ability to track this. Our new security and information management system and a dedicated training tracker are already in place and functioning to make sure that we have adequate oversight of the completion of that training.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

What is the difference between standard and enhanced security awareness training?

[Heather Jeffrey]

What I would say is that all departmental staff receive on a regular basis a basic level of security training—the types of document classifications, entry protocols, access. However, in travelling to a high-threat environment, as would be the case, for example, in Afghanistan or Iraq, we found that our officers required a much higher level of training on some of the threats our diplomats face when they are in areas of high conflict. There is a five-day training program offered by the Department of National Defence on how civilians operate in militarized environments. That is our hostile environment training course. That's an example of the type of enhanced training we're offering for people who are exposed to those types of threats.

[Jean Yip, Liberal, Scarborough—Agincourt, ON]

So there isn't a progression of training in response to the increasing threat in the environment? By that I mean training done more on an emergency basis, as opposed to just five days of training here and then trying to deal with whatever emergency or threat in the immediate environment?

[Heather Jeffrey]

On an annual basis, we review the security postures and evolving threats in our missions abroad and we adjust the course offerings. There are quite a number of courses of gradated importance. Some focus more on information security and environments where espionage could be a problem. Some are much more focused, as I mentioned, on combat risk. Others are focused on personal security. High-crime environments are actually much more prevalent than the militarized ones I was speaking of. There is a very wide range of missions.

I would say that almost three-quarters of our missions abroad require some form of enhanced training above the normal security baseline. That's looked at on a regular basis to make sure it's adequate to the needs on the ground. In addition, when staff are deployed on missions, they receive a very detailed local security briefing on the threats specific to their mission environment and also in the outlying regions. Our staff don't just work at embassies; they also travel throughout countries working on humanitarian or other projects, for example. It's very important that they understand the risks not just at the mission but also out in the wider country.

[The Chair, Conservative, Kevin Sorenson]

Thank you very much, Ms. Yip.

I'm being told that the House will open, the bells will start, and a vote will disrupt us today. Since we're in the same building where the vote will take place, with everyone's permission we'll go a little bit in. I'll still give at least 10 minutes for us to get up there and take our places.

[Chandra Arya, Liberal, Nepean, ON]

Last time, I remember, [Inaudible—Editor] minutes and you were late.

[Voices]

Oh, oh!

[The Chair, Conservative, Kevin Sorenson]

I was late. Okay. Well, we'll try to speed it up again. I'm probably slower than any of you in getting up there.

We'll now move to Mr. Christopherson, please.

[David Christopherson, NDP, Hamilton Centre, ON]

Great. Thanks, Chair.

This is just an observation. One of the challenges of dealing with security issues in a democracy is that accountability and transparency don't necessarily go hand in hand with security and preparation. I just want to say that I think we've done a pretty good job, all of us concerned: you, representing the department; the Auditor General's office; the committee itself; and the governance by the chair. I think we've done about as good a job as we can on transparency without doing damage to the very entities we're trying to help. I would just make that observation.

The second thing I want to say, and this is really important, is that I really, really liked what you said, Mr. Shugart, at the beginning of your answer to a previous question. As you know, I am likely the least academic member who has ever sat, and who likely ever will sit, on the public accounts committee, but one thing I've learned from my years on this committee is that there's the planning ahead of time, the processes, the checks and balances, the evaluations, and then, when you're done, there's the starting all over again, the re-evaluating, and the going back and examining. You know the old tradesperson's proverb, “measure twice, cut once”. That is so important.

Given your broad experience in recognizing that this is not an area where the government has been as effective.... The Auditor General's office has been pounding it and pounding it and pounding it, certainly to the point where I get it, and as I said, my knowledge based on that is the least. So I'm so glad to hear you say that, because my experience tells me that that's where it is—that and the other part of what we do, which is the follow-up to make sure you honour the commitments you make. Those two things really make a huge difference. I just wanted to emphasize that.

I have one more question. As Ms. Yip already brought forward, 41% of the staff had not completed the mandatory personal security seminar, and 35% of staff had not completed the mandatory hazardous environment training course. Now, when we're dealing with security and with mandatory, that seems pretty important to most people. When did Global Affairs decide that they can create their own definition of mandatory? Where else in your organization is mandatory not being treated as mandatory? Do we need a new word?

My understanding is that “mandatory” means “must do”. You didn't do it. Even in your response you said that you're going to start doing it, playing with your tenses. You say here: “Mandatory training for staff being posted abroad, especially to designated high and critical threat missions, is a key element of Global Affairs pre-posting practices.” But you didn't seem to believe that before you were held to account by the Auditor General's report.

So what's the deal with “mandatory”? When did mandatory in Global Affairs, as it relates to security, become not mandatory?

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Christopherson.

Mr. Shugart.

[Ian Shugart]

Very simply, it always was mandatory, and not living up to that was a failing. As Heather indicated, we have increased the offerings of that one particular enhanced training program by 40% this year alone. More importantly, we have put in place the tracking system so we will be able to follow. Any slippage in our performance on that mandatory standard will be very obvious to managers. It will be corrected much more rapidly, and we will be able to stick to that commitment. We did not have that kind of tracking in place before.

To find out the degree of gap, of slippage, the audit staff had to examine the records. We now have in place a tracking system that will tell us our performance in real time.