Public Accounts Committee on Feb. 26th, 2019

[Ian Shugart]

Chair, I think it is well known to this committee that project management has been a vulnerability across government operations for many years. In many places those lessons are often being learned the very painful way. At Global Affairs we are learning those lessons and have put measures in place to improve project management.

[The Chair, Conservative, Kevin Sorenson]

I think we'd better leave it there; we're over time now. We can come to that a little later.

We'll now move to Mr. Christopherson for seven minutes, please.

[David Christopherson, NDP, Hamilton Centre, ON]

It's good to see you again. Thank you all for being here.

Starting with the focus of the audit, it states the following in paragraph 4.6:

This audit focused on whether Global Affairs Canada met its physical security needs at missions abroad to protect its staff and assets.

The overall message in paragraph is:

Overall, Global Affairs Canada had not taken all measures needed to keep pace with evolving security threats at its missions abroad.

Further, in the conclusions in paragraph 4.78, it states:

We concluded that Global Affairs Canada did not fully meet its physical security needs at missions abroad to protect its staff and assets.

I find this really surprising for a whole bunch of reasons, not the least of which is that in terms of governance, like it or not, security is a huge issue. In your department, it's what you do. I was really surprised and disappointed that something so important in a department that deals with security as its major focus would have these problems with obvious stuff. This isn't like deep intelligence and the analysis going wrong. These are basic things. It's really disconcerting when you think about how easily things can turn.

One of the greatest examples—and it's an extreme example, but a real one—was Iran in 1979. Going from no problem at all to all of sudden a crisis that can bog down a government and a nation for years, if not decades, can happen in a blink. These are the first lines of defence. I just find it passing strange.

I'll just leave that there. If you want to comment on that in some way, you can. Otherwise, I'm just going to move on to my questions.

I'm going to pick up where you were just recently. You talked about managing projects. There's been a vulnerability for governments for years, as we know. However, the Auditor General makes reference in paragraph 4.63 to the following:

Other federal entities that deliver security projects internationally have knowledge and expertise that, in our view, could benefit Global Affairs Canada. For example, Defence Construction Canada runs construction and engineering projects internationally, many with unique security requirements. It delivers most of its projects for National Defence, but it also provides services to other government entities, such as Communications Security Establishment Canada. In our 2017 special examination, we found that Defence Construction Canada did a good job

—shout out to them—

of managing construction projects and contracts. For example, it carried out contracts according to the client's requirements, and it met deadlines and budgets.

How about that? You said there are vulnerabilities, but the Auditor General was able to point to a major player in the development of projects that does a really good job. From what I know about security, when you're starting to talk of Communications Security Establishment Canada, we're getting into some really serious stuff. These have to be trusted folks.

Why didn't you go down this road? Why did you let yourself...?

The last thing I'll say concerns the chart on page 13. Holy smokes. Where were the grown-ups in the room?

[The Chair, Conservative, Kevin Sorenson]

Mr. Shugart.

[Ian Shugart]

Again, we do audits and we put this on our risk-based internal audit plan precisely so that we have an accurate picture of the vulnerabilities in our performance on security. While I fully accept the conclusions that have been made in both of these audits—ours and the AG's—we are not in any way minimizing those faults and vulnerabilities.

Equally, I don't want Canadians to have the impression, through our discussion this morning, that no security provisions are made or that no extensive work has been done. These are vulnerabilities and faults that are important and have been identified. It is not an indictment of our security posture across our mission network.

I'd like Dan to comment on the defence organization and the role it could have played in the past, and is playing now as we have accepted the audit recommendation and work with them.

[David Christopherson, NDP, Hamilton Centre, ON]

Just before you go there—and I'll give you that opportunity—I want to comment that I wholeheartedly support your comment about the security. These are issues to be dealt with, but they do not reflect the overall.... I've been to a lot of the hot spots and embassies. I've been very fortunate to have done a fair bit of travel to what is on your list there. I've been to the Egyptian embassy twice. That's a hotbed, and yet the security is fantastic.

Nonetheless, if I may also say this, some of us were talking, too, and are a little concerned about what are the implications of this out in the public domain. Does it suggest to folks that there is a free-for-all on Canadian international assets? That's not the case at all. I agree with you entirely that this is a maintenance check and not a need to overhaul the transmission and the engine. I agree with you on that.

I'm sorry. Go ahead, please, sir.

[Ian Shugart]

There's rust too.

[Voices]

Oh, oh!

[David Christopherson, NDP, Hamilton Centre, ON]

Yes. That's my next question.

[Dan Danagher, Assistant Deputy Minister, International Platform, Department of Foreign Affairs, Trade and Development]

Very simply, on the Defence Construction, we accepted the recommendation from the auditing team last year. We've already started construction—roughly a year ago—with Defence Construction to learn lessons about how they do it—

[David Christopherson, NDP, Hamilton Centre, ON]

Is there a reason why you wouldn't just use them? Is that just not a practical thing for you?

[Dan Danagher]

It's really not their mandate or their expertise to build missions that provide the range of international programs that we do in our missions abroad. Nevertheless, there are things that we can do together, and we can learn from them. We're taking it in a very open way.

[The Chair, Conservative, Kevin Sorenson]

Your time is up, David. We'll come back to you.

We'll now move to Mr. Arya, please, for seven minutes.

[Chandra Arya, Liberal, Nepean, ON]

Before coming to this particular part of the report, I would like to go back to the situation in Cuba. I understand that there are many unknowns there. In the court case that has been filed, there was one sentence that really bothered me. I hope it is not true. Let me read it:

The statement of claim contends that Global Affairs “actively interfered with the plaintiffs' attempts to receive proper health care, including going so far as instructing hospitals to stop testing and treating them.”

I hope it is not true.

[The Chair, Conservative, Kevin Sorenson]

Mr. Shugart.

[Ian Shugart]

Chair, I will defer to Heather on this point, but I would say, with respect, that I don't think this is the forum for me to respond to specific claims in the suit. I don't say that to withhold information, but it is a legal action that has been taken that the claimants are perfectly entitled to take. But I think we should respond through the appropriate venues.

Is there anything we could say in addition to that? I think we should be very careful.

[Heather Jeffrey, Assistant Deputy Minister, Consular, Emergency Management and Security, Department of Foreign Affairs, Trade and Development]

I would just add that as part of the whole-of-government approach we've been taking, we have worked with a number of different medical institutions—hospitals, primary physicians, health care providers, including Dalhousie University, which is very involved in a research program—as well as with our international counterparts to put in place the best possible service we can for our staff.

[The Chair, Conservative, Kevin Sorenson]

I will just say, on counsel from our clerk here, that we fully understand that something that is before the courts does not have to be disclosed here. If we did that, we would go in camera, and that would be a longer process. Cuba isn't mentioned in the report. We used that as an example.

This is not being taken off your time either. Just make sure that we stay focused on the report. Carry on, Mr. Arya.

[Chandra Arya, Liberal, Nepean, ON]

Thank you.

My next question is for the Auditor General's office. I know this report deals with the physical security part of it. There are two other parts of the security pillars, as Mr. Shugart mentioned. Are there any reasons why you didn't look at security as a whole and why you limited yourself to the physical structure?

[The Chair, Conservative, Kevin Sorenson]

Madam McCalla.

[Carol McCalla]

Our audit did focus on the physical security, knowing that it indeed does work in tandem with operational security and intelligence to make up the entire security posture of a mission abroad. We focused in on physical security because Global Affairs had received substantial funding to upgrade its physical security at missions abroad, and in 2017 it received another $1.8 billion to upgrade its physical security at missions abroad.

We wanted to understand how well it had worked over the past decade to upgrade its security and what needed to be done to ensure success for the next tranche of funding. We focused in on what was the physical security in place at its missions and then to understand why what improvements needed to be made for the next tranche of funding.

[Chandra Arya, Liberal, Nepean, ON]

Having lived and worked in several countries, I understand the complexities involved in construction of project implementation related to physical buildings there. As the department has mentioned they were aware of some of the things that were required to improve the physical infrastructure, did you look into the alternative mitigation measures the department may have undertaken to work on this?

[Carol McCalla]

In our six missions that we examined, we looked at what security measures had been recommended by Global Affairs security staff. We looked at their threat and vulnerability assessments, and those examined both the physical and operational security measures. They made a number of recommendations for what needed to be put in place at the missions, given the threat environment.

We understood that those assessments did identify critical vulnerabilities. As a result, it also identified several interim measures that needed to take place, such as additional operational security, additional guards and additional surveillance in general across its missions, and in each of the vulnerability assessments we had looked at.

What we found, though, was that at the missions there was not a good understanding of what those measures needed to be. Everyone was quite clear about what the critical vulnerability was, but they weren't necessarily clear about what mitigating interim measures needed to be in place, and we did find that some of those interim measures were not in place. Some of them were in place and some of them weren't, but there wasn't an understanding of why some were in place and why others weren't in place so that there would be an overall understanding of the security posture of the mission. Therefore, we recommended that that be well documented. Especially in an organization like Global Affairs, where there is cyclical rotation of the staff, we recommended that staff be very clear about what's required—particularly as these vulnerability assessments are not necessarily done every year—so that there would be a good understanding across heads of mission and with the security officials within the missions as well.

[Chandra Arya, Liberal, Nepean, ON]

Mr. Shugart, do you have a comment on that?

[Ian Shugart]

I would be delighted to. Indeed, I was wondering about asking the chair if I could make a comment on this.

My experience as deputy minister in three departments now points to a tendency across government that I think would be of broad interest to the public accounts committee. It is that frequently these faults that are exposed—rightly—in audits point to an inclination to do things rather than to plan, track and document things. As well, when you're dealing with finite resources, often putting in place the information systems and documentary systems is seen, or has been seen, as less inherently valuable than actually spending the money on the core purpose.

However, when you don't do that, what we have found over and over again is that you actually pay for it, sometimes through really bad AG reports, but also in an ability to know exactly what you're dealing with.

The proper planning and documentation actually does help manage the risk. Also, I think, as a general proposition, that is something we have been learning across government—painfully—and you can see how that lesson is driving our way forward in this particular case.