Public Safety Committee on Oct. 21st, 2026

[Dr. Christian Leuprecht]

You have my written statement in front of you, and I read from my statement.

I can find the line, but the essence is that the bureaucracy was knowingly exposed to risk by political decisions. Commensurate security resources were not provided to ensure that the screening for 50% more civil servants could be done thoroughly for cases where more in-depth screening would be necessary.

I can say with a reasonably high degree of certainty that there are likely cases where decisions simply would have been made about whether to “just let this one go” or not, given the relative growth.

I've been on record for years as saying that Canada, both with regard to its federal bureaucracy and with regard to the country, has a rather homeopathic approach when it comes to national security. I think the multiple reports that I cite in my statement document that, particularly when it comes to China.

[Marcus Powlowski, Liberal, Thunder Bay—Rainy River, ON]

Okay. I want you to clarify something else.

Again, correct me if I'm wrong, but you said with respect to Ms. Zhang that there was a security lapse in not flagging the vulnerability “of a young, racialized woman”. Are you implying or telling us that people of racial minorities are more likely to be treasonous or should be subject to a higher degree of scrutiny?

[Dr. Christian Leuprecht]

That is neither what I said nor the inference to be drawn.

What I pointed out is that in a federal government that has made it clear that it prioritizes diversity policies, a manager—particularly a junior manager—who would be flagging such an individual had better come with very robust evidence or likely face serious headwinds in trying to flag that individual.

What I'm saying is that we need to create an environment where even weak signals can be taken seriously and reported by managers without fear of retribution when the individual involved in weak signals might be an individual whom government priority and government policies have favoured.

[Marcus Powlowski, Liberal, Thunder Bay—Rainy River, ON]

Is being a minority a weak signal of risk?

[The Chair, Liberal, Jean-Yves Duclos]

I'm sorry, MP Powlowski. Again, I hate to do this, but time is up.

Now is the time to thank the three witnesses for taking the time to be with us, for making the effort to prepare, and for attending today's meeting.

Mr. Leuprecht, Mr. Wernick, and Mr. Piedboeuf, we'd like to express our gratitude to you, and we hope you enjoy the rest of your day.

I now turn to the members of the committee. We will recess for five minutes before resuming with three more witnesses.

Thank you.

[The Chair, Liberal, Jean-Yves Duclos]

We are resuming our meeting.

Thank you for joining us for the second hour of this meeting, for which we have three witnesses.

We welcome Dr. Wesley Wark, senior fellow at the Centre for International Governance Innovation, appearing as an individual. From Cinchy Incorporated, we welcome J. Paul Haynes, chief executive officer. Finally, from the Privy Council Office, we welcome David Morrison, senior diplomatic and international affairs adviser to the Prime Minister.

You each have five minutes to present your remarks.

We will begin with Dr. Wark.

[Dr. Wesley Wark, Senior Fellow, Centre for International Governance Innovation, As an Individual]

I thank you, Chair and members of the committee, for this invitation to appear as part of your study on Canada's security screening processes.

I'm going to take you in a different direction and scare you, perhaps, in a different way than you've heard from your witnesses in the previous session. I want to begin by making a few factual points.

The Government of Canada process for security screening is set out in detail in a relatively new directive on security screening that only came into effect on January 6, 2025. The second point is that CSIS shoulders the main burden of security screening for the Government of Canada. I'm going to come back to that point. Global Affairs has a subsidiary role in conducting security screening of locally engaged staff and other governments' officials at Canadian missions abroad. CSIS security screening is based on, effectively, assessing “loyalty to Canada, and reliability as it relates to that loyalty”.

On the purpose of a CSIS security screening assessment, I'll quote from the Treasury Board directive:

Assess, where sufficient information is available, whether there is reasonable cause to believe that the individual has engaged, is engaged or may engage in activities that constitute a “threat to the security of Canada,” as defined in section 2 of the [CSIS] Act....

The final point is that CSIS is responsible for two separate streams of security screening advice. One is related to immigration files when red-flagged by IRCC and/or CBSA. The other is for Government of Canada security clearance approvals at different information access levels.

CSIS provides security screening advice according to the criteria I've mentioned. The advice is a judgment call based on the information available. As you've heard from Mr. Wernick, denial of a security clearance has serious ramifications for the applicant. Essentially, it means they are fired. Of course, denial can be tested through a complaint process adjudicated by the National Security and Intelligence Review Agency.

Judgment calls, which security screening advice is always a matter of, can be affected by incomplete information or inadequate management of data. In particular, looking into someone's future behaviour to decide whether they might pose an insider threat is always difficult, if not impossible.

The case that has prompted the committee's study may or may not be a spy case. I don't judge it in advance of the Belgian court process. An arrest has been made, and it is before the Belgian courts, as you know. That will no doubt complicate this study of the committee in terms of its access to some key documentation.

What I want to do is look past this case and offer the committee the suggestion that the current system for security screening in Canada is simply unsustainable. The dual burdens of immigration and security clearance screening on CSIS are simply too great. In my view, they threaten to erode the operational effectiveness of CSIS as it addresses its core missions. An intelligence service should not be a security screening shop.

Consider the statistics. In 2025, according to the “CSIS Public Report”, CSIS received 129,130 requests under the government security screening program and 438,600 referrals for immigration and security screening. That is a total of 567,730—or 1,555 per day, assuming they arrive in an orderly fashion, which of course they don't. Buried in this mountain were 360 requests for what is called “foreign screening”, defined as, “Security assessments to foreign governments, as well as to international organizations, when Canadians seek employment that requires access to sensitive information or sites in another country.” Even with those relatively small numbers for foreign screening, the CSIS report indicates that there was a backlog in terms of their ability to deal with them.

An alternative model is already being practised by one of our closest allies, the United Kingdom. The U.K. has a separate, centralized organization for security clearances—in the U.K. system, it's called security “vetting”—that covers all government departments. U.K. security vetting was established in 2017, and since 2020 has been housed centrally within the cabinet office. It isn't left as a responsibility of MI5 or MI6 or any of the security agencies.

In my view, and this is my suggestion to this committee to give some consideration to, Canada should study and adopt the U.K. model, create a separate, centralized security clearance agency and divest one of its main intelligence organizations of this onerous responsibility.

Such a fundamental restructuring would also, in my view, create the circumstances for more coherent processes and better data management.

Should we, though, decide to stick with the existing model, there will be more recourse to AI usage, more outsourcing and continuing impossible burdens on CSIS. Which would you prefer?

Thank you.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you very much, Dr. Wark.

Mr. Haynes, you have five minutes.

[J. Paul Haynes, Chief Executive Officer, Cinchy Inc.]

Thank you, Mr. Chair.

Thank you, members of the committee.

My name is J. Paul Haynes. I'm with a company called Cinchy. We're doing security for AI. I've spent many years prior to that doing frontline cybersecurity with, probably, one of the largest organizations in the country that's in the private sector. I feel like a fish out of water here because I'm coming from that perspective, but hopefully that's useful to you.

I'm not going to focus on the specifics of the Belgian case, but I'm going to try to stick to the system and shape my remarks around things that we see that work in the private sector. There are a few key points, and some of this has been heard already.

The system is sound but it's static. The duration of clearances, five or 10 years without re-upping them, is completely at odds with how we would do things in the private sector. Anyone who's accessing financial records or securing them for banks, in the U.S. or anywhere else, is getting criminal and credit background checks every year. People change their behaviours if they have a credit problem. That's the number one reason we do that, just as an example.

The next point is the notion of “trust but verify”. I've dealt with this in private sector context scenarios where, if you're going to put extra monitoring on someone, you can't target them specifically. You have to trust but verify all of your team. That's a bit contrary to how, when we get a signal and we want to investigate the signal, from the human rights perspective our HR teams in the private sector are saying, “You can't target that person. You have to do that for everyone.” Trust and verify...it's easy to say but it has some challenges in practice.

The signalling that cybersecurity teams use to identify human behaviour, the synchronizing of the vetting and the way we do things on personnel versus cybersecurity, as I think we've heard in other comments, those things need to come together.

The information also exists but it's not connected, and there were a lot of examples that I was able to discover within the government. However, it occurred to us that having some sort of transferable integrity document, a passport for people who have clearances that gets maintained, might be a way that's going to get implemented—electronically, of course, that sort of thing—so that you would not have this disconnection of important data from the hiring managers in the new agencies that the new government groups are moving to.

Privacy also has to be balanced and not maximized. Through having an operation in Ireland, we saw scenarios in which the Irish had such extreme privacy protections that you couldn't compel employees to submit to credit and criminal background checks unless they were dealing with vulnerable people or children, or working for a police agency. That actually cut Ireland out of significant economic opportunities in aerospace and other security-related sectors. We have to get the balance right on this.

Then the other challenge, which has come up in different words, is having a limited verifiable history of new Canadians. Getting 10 years' history isn't possible for some of them, even though they might be the eligible candidate to work in the role. How do you trust another foreign government's agency, especially if they may have an interest in not necessarily giving the full story of the applicant or to help this country? We have some interesting challenges there. Again, you have to look at the risk level and put in mitigating controls that are commensurate with the risk level.

Where I would go in terms of recommendations—and I hinted at some of this—is to the notion of continuous evaluation, as the banks do. It works. It's not going to solve all of the problems, but it's not that expensive and it's very easy to do. There are a lot of private firms that do this. I'm sure the government has its own capabilities that could match it.

The notion of this shared integrity record that can bridge the PSC, the CBSA and the RCMP, among others that have a horse in the race, would probably go a long way to expediting this and ensuring that you have an integral view of that applicant in all their different roles. In the private sector this would happen, so I don't understand why we couldn't do it here.

As for connecting insider risk and IT security, we always talk about the worst-case scenario: How do you prevent a Snowden scenario? This is what we're talking about here. He was an insider, a contractor with Booz Allen, who had high privileges. When you see things like massive data downloads, which he was doing, they would be flagged. That sort of thing has to be connected, and then, obviously, there has to be additional oversight of external placements, as in this case we're talking about.

I can wrap up with this. Canada's system was built to check trust once and assume, and you know what happens if you assume. The greatest gains will come from connecting personnel security and cybersecurity.

I look forward to any questions.

Thank you, Mr. Chair.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you very much, Mr. Haynes.

Mr. Morrison, you have five minutes.

[David Morrison, Senior Diplomatic and International Affairs Adviser to the Prime Minister, Privy Council Office]

Mr. Chair and members of the committee, thank you for the opportunity to speak with you today.

As the senior diplomatic and international affairs adviser to the Prime Minister, I jointly lead the national security, intelligence and international affairs branch at the Privy Council Office. Within the Privy Council Office, my branch provides policy support to the Prime Minister, the Clerk, ministers and departments on matters relating to foreign affairs, defence policy, national security and intelligence, and we help coordinate across the government.

As I believe you are aware from previous testimony, our system here in Canada holds that individual departments are accountable for deciding to issue security clearances based on common requirements and informed by centralized expertise. The Treasury Board Secretariat establishes the policy framework. The public safety portfolio, through the RCMP and CSIS, contributes criminality checks and national security assessments, and individual departments collect relevant information, assess risks and make security clearance decisions under delegated authorities, with deputy heads remaining accountable for the integrity of those programs within their organization.

The allegations involving a Canadian citizen employed by the North Atlantic Treaty Organization have naturally raised questions about Canada's personnel security regime and the lessons that can be learned from this incident.

While Belgian authorities continue to lead the criminal investigation and Canada continues to co-operate fully with that process, the relevant departments have conducted reviews and made recommendations for potential improvements to the personnel security framework.

Having served as deputy minister of foreign affairs at the time the security clearance in question was granted, I note that Global Affairs Canada has informed the committee that its review found no breaches of the policies or procedures in effect at that time.

That said, this case highlights the importance of continually ensuring that decision-makers have the information, tools, governance mechanisms and safeguards needed to make the best possible security decisions in an ever-changing threat environment.

The Minister of Public Safety told this committee he has tasked departments with reviewing the case that has brought us all here and proposing process improvements. In a similar spirit, and in my Privy Council role of supporting the coordination of national security, intelligence and international affairs, I would offer some observations that I hope will inform the committee's consideration.

First, a government-wide repository or registry of security clearance information would improve efficiency, reduce duplication and help departments identify where relevant personnel security information may already exist.

Second, human resources-related information relevant to an assessment of an individual's reliability or loyalty should be available to personnel security decision-makers without compromising privacy protections or procedural fairness.

Third, open-source verification should be used more consistently across the government for a wider range of security levels. Its use would also benefit from common tools, training standards and methodologies across departments.

Fourth, a robust personnel security program should extend throughout employment through insider risk programs, continuous personnel security assurance, recurring screening, reporting obligations and security awareness, as the witness before me has just stated. These would help identify emerging risks, ensure that clearance-holders remain reliable and loyal, and ensure that clearances reflect current information.

Finally, I'm aware of suggestions made to this committee for CSIS, or even the Minister of Public Safety, to be the ultimate decision-maker in complex cases. I believe this would be a mistake. In our Westminster system, accountability for personnel decisions rests with the deputy head. That is by design and it has been codified in the Financial Administration Act.

I would add, for the record, that in almost six years as a deputy minister at Global Affairs and now going on four years in two different stints at the PCO, I'm not aware of a single case where security clearance was granted despite unaddressed concerns regarding a public servant's loyalty or trustworthiness.

Deputy ministers work collaboratively with the security services. In any complex case, I'm very confident that the clearance would either be denied or, in an extreme case, be approved with mitigation measures agreed upon with the security services.

I'm not able to comment on any individual cases today. I would be pleased to discuss the broader personnel security framework, governance considerations and ongoing efforts to strengthen Canada's personnel security system.

Thank you. I look forward to your questions.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you very much, Mr. Morrison.

We can now move to Ms. Kirkland for six minutes.

My apologies, it's actually Mr. Caputo's turn.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Thank you very much, Mr. Chair.

Thank you to the witnesses for appearing on this very important issue.

Through you, Mr. Chair, I will direct my questions to Mr. Morrison.

The Zhang case was and is a failure of our intelligence. Was it not?

[David Morrison]

I can't comment on any specific case.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Okay. Let's look at this just generally, and then we can get into hypotheticals.

I think you could comment, sir, on this: If we had somebody who went to a foreign nation on behalf of Canada because Canada had given them security clearance, and at the time the security clearance was obtained, they had a documented history of fraud in Canada, that would be a failure of intelligence—would it not?

[David Morrison]

I would say, in that hypothetical situation, all of the rules and protocols applicable at the time could have been applied. At the same time, systems can always be strengthened.

Hypothetically, information before a decision-making system could be acted on appropriately and decisions could be rendered appropriately and we could still get unintended outcomes. That's why I say there are systems that can be strengthened, and that's why I suggested four ways of doing so.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

I'm mindful of that. What I'm saying is that when we have situations in which there is a documented history of fraud, that to me is the end of the discussion, because fraud is an integrity offence. It is an offence that speaks to your character. It isn't something you just do on a whim. I know you can't comment on the specific case, but Canada gave security clearance to somebody with a history of fraud.

I'll tell you this. We're very fortunate to have an intern in our office. She found the Zhang decision. As an intern of two weeks in our office, she was able to find the Federal Court decision. As she pointed out to me, people research people for a first date. They google this type of information and, I think, find it.

I will say it again. When the information is publicly available and we nonetheless give security clearance—high clearance, at that—that is a failure in intelligence. Would you care to comment?

[David Morrison]

My comment would echo that of my former colleague Tara Denham, who I believe testified here on October 7 and reviewed for members of the committee how GAC would be involved in such a case. I believe Ms. Denham also testified that even though it was not required at the time the clearance was given—therefore, all protocols were followed—GAC would now, for any similar fact pattern, indeed do an open-source search.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

I would hope so. I think doing an open-source search is in itself a security failure. When I was a prosecutor, our security people did an open-source search for me, just to check on my safety, and this is somebody who is representing Canada.

At the end of the day, we gave security clearance, as Canada, to an alleged spy. It was not Canada, but Belgium that figured it out. We had a witness just earlier in the hour who said Canada is the most infiltrated country on earth. Fraud was known, and even after the decision was rendered on fraud, as backed up in a judicial review, Ms. Zhang continued with Employment and Social Development Canada despite the finding of fraud.

A French newspaper called it Canada's embarrassment. Does this not diminish our international standing with our Five Eyes allies and the G7?

[David Morrison]

For the record, I agree with the honourable member about the use of open-source, Google or however you want to characterize it. I think that should be a standard part of our vetting process.

I also agree, and tried to say so in my statement, that personnel information that speaks to someone's integrity should be part of the system. It was not part of the system at the time, and that has now been rectified, according to my colleagues at GAC—

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

We have only 40 seconds. I don't mean to interrupt you.

I misspoke when I said most infiltrated in the world. It should have been in the G7.

You were here at committee in 2023 because of foreign interference. You are very well aware of foreign interference. My colleague Michael Cooper questioned you about foreign interference around MP Chong and a report that was not forwarded. You said, “We have foreign interference. We have what the Indo-Pacific strategy calls—I might not get the wording right—an increasingly assertive China.”

This was on people's radars based on this, yet somebody got through at the highest level. How is that not a colossal failure of our intelligence?

[The Chair, Liberal, Jean-Yves Duclos]

Answer very quickly.

[David Morrison]

I believe I've tried to answer that question. All of the relevant protocols and procedures were followed.

In the hypothetical case that I'm trying to respond to, if all protocols are followed and we have an unintended outcome, clearly the protocols need to be strengthened. That is the spirit with which I've come before your committee today, with suggestions for how to do so.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you, MP Caputo.

Mr. Ramsay for six minutes.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

I'd like to thank all three witnesses.

If I may, I'll begin with a somewhat philosophical observation: I think we need to acknowledge that our system works quite well in over 99% of cases and that the cases we're examining today are rather rare. That said, I'm the first to want to improve the system. We have received a few suggestions from our witnesses today. Indeed, I believe the system needs to be improved, but we must be careful not to create a bureaucratic monster. We know that 500,000 audits are conducted each year in Canada, including nearly 130,000 for the public service and 400,000 for immigration.

Dr. Wark, you told us that, in your view, the British model—which separates the two entities—is the solution. With all due respect, I think that's a cosmetic fix to some extent. It's not about creating another agency. It could be that, but it's not that simple to create another agency that would, in effect, forgo the expertise of the Canadian Security Intelligence Service, which can contribute.

Mr. Haynes, you suggested certain measures to us. You did, however, tell us that there are nuances when it comes to confidentiality and privacy. You told us about the American model.

Essentially, my question to both Dr. Wark and Mr. Haynes is this: How do we create an effective system that improves upon what we're already doing, without creating a bureaucratic monster, with oversight that will require an incredible amount of resources? We must always remember that our system is quite effective and that it fails only in rare cases.