Proceedings of the Standing Committee on
Rules, Procedures and the Rights of Parliament
Issue 2 - Evidence - May 31, 2016
OTTAWA, Tuesday, May 31, 2016
The Standing Committee on Rules, Procedures and the Rights of Parliament met this day at 9:35 a.m. for the consideration of the case of privilege relating to the leaks of the Auditor General's report on the audit of the Senate
Senator Joan Fraser (Chair) in the chair.
We are continuing our work on the case of privilege brought by Senator Céline Hervieux-Payette relating to the leaks of the Auditor General's report on the audit of the Senate.
[Translation]
This morning, we will hear from Gilles Duguay, Director General, Parliamentary Precinct Services, Senate of Canada —
[English]
And Mr. Mike McDonald, who is Director of Corporate Security, to talk to us about the procedures that exist in the Senate, to guard against unauthorized, inappropriate disclosure of information, and to offer us any helpful thoughts they might have about what we might include as recommendations in our report.
You recall that there was a Senate internal investigation partway through the Auditor General process here, but that was done for the Internal Economy Committee, and those proceedings were in camera, so Mr. Duguay and Mr. McDonald are not in a position to talk to us about that specific investigation.
I would hope they might be able to discuss, in general terms, lessons learned, whether then or at other times, about confidentiality and its preservation in general.
Gilles Duguay, Director General, Parliamentary Precinct Services (Senate of Canada): Good morning, honourable senators. First of all, thank you for the opportunity to come before you and talk about distribution of confidential documents.
I'll go back to my days when I was with the RCMP and dealt with privileged information. Normally, the information would be of national security issues or information that pertained to protecting the lives of individuals. The point that I'm making is that it is about marking the information that you want to be confidential.
With respect to any committees, marking would be very important to identify a document that is confidential. If the committee as a whole decides that this document needs to be treated with confidentiality, then prior to distributing the document, it needs to be watermarked "Draft," and in the normal course to identify that the document is confidential.
Now that you have reached a consensus around the table that the document is confidential, what does that imply? Who ultimately will have access to that document? Will your staff have access to the document? Because if we are asked at the end of the day to come back and investigate a leak, I want to know who had access to the document.
The committee might decide that access to the documents will be limited to senators only. So that's the marking and the understanding of the committee as to who will have access to the documents. Once you determine that, then how will this document be distributed? Electronically, by hand, or through our in-house courier service? Each option has different implications.
If it is distributed electronically, for example, then, first of all, if you say that we're going to limit the access to that document only to senators, that would mean that none of your staff should have your personal password and access to your electronic transmission.
Limiting access only to senators would be the first rule. If it involves your staff, then that could be all right. Prior to the document being sent, it would be encrypted and password protected. That would be the electronic management of that information.
If it's sent by hand, then you would log how many copies you will be distributing. You would number the copies, and after numbering them you will assign each number to a designated senator who is the recipient of that copy.
The senator will have to acknowledge that he or she received that copy. This could be done two ways: the clerk of the committee would personally distribute the report and log, as the document is being distributed to senators, who received it and the number of the report. Or, if it's distributed through our mailing system, then obviously there would be an acknowledgment at the other end that you received the report.
How you mail the report will add another implication. The report, after being clearly marked as a draft and confidential, would be put into an envelope, and the envelope would say "for the senator's eyes only" — if it is indeed for a senator's eyes only — and the address of the senator. The envelope would be sealed, and you would initial by the seal so you can verify if it's been tampered with. Normally, we would put a tape on the seal.
You would put that same envelope into another, seal it, and distribute it through our mailing services. When you receive the envelope at the end of the day, your executive or admin assistant would open it and see that this other envelope is only for the senator's eyes and, without opening it, give it to the senator receiving the draft report.
Then, there is storage. We would recommend, obviously, that the report be kept under lock and key; it should not be left on a desk.
I oversaw the investigation and our experience was there was a process that we recommended at the end of the day, because some senators, through their own admission, did not know all the rules about the in camera aspect of the meeting.
As well, in the process of doing the investigation, we went back to what was in place already. Mike can talk about the report that this committee received in 2000: We found that the recommendations that were made in that report were actually very appropriate.
Mike McDonald, Director, Corporate Security (Senate of Canada): In doing some research, many of the answers and applications that should be entertained are found in issue 49 of the Journals of the Senate, from April 2000, and you can find all of Mr. Duguay's comments there, as well.
The parameters are already available to you. Mr. Duguay has talked about other important issues such as password protecting and watermarking. Beyond that, obviously there is limiting attendance and applying the need-to-know principle: Who really should be aware, read and see? And, who sees your account? It's a matter of being cognizant and applying those rules.
Another consideration is the destruction of documents in a controlled manner, having everything funneled back, accounted for and destroyed appropriately.
It's unfortunate if you have to get to this point, but there is also the investigation and the enforcement aspect of the process. It's a matter of making sure that we are aware so that we can try and shed light on what happened and provide you findings and recommendations based on what you're seeking from us.
The Chair: We're here to listen to you. If you have more to say, please say it.
Mr. McDonald: I'd be happy to expose the recommendations in issue 49, but perhaps you're already aware of these.
The Chair: A number of senators were not here in 2000, so could you summarize them for those whose memories are short?
Mr. McDonald: It would be my pleasure to do that. Section 30 of issue 49 states:
(a) that draft reports and other confidential documents be individually numbered, with the number shown on each page;
(b) that each numbered report and other confidential document be assigned exclusively to an individual, and always given to that individual, and this should be carefully recorded;
(c) that if senators are to be given draft reports or other confidential documents in advance of a meeting, or are to take such documents away after a meeting, they be required to sign for them. Certain documents, such as in camera transcripts, should only be able to be consulted in the committee clerk's office, with the chair's approval;
(d) that the names of all persons in the room at in camera meetings to discuss draft reports — including assistants, research staff, interpreters and stenographers — be recorded, preferably on the record; and
(e) that the chairs of committees ensure that all senators and staff are cautioned and reminded of the nature of confidential and in camera proceedings and documents, the importance of protecting them, and the consequences of breaching such confidentiality. . . .
It goes on in section 31 to say committees should make clear decisions about the circulation of draft reports, the disposition of evidence and the publication of their minutes.
In a nutshell, that captures many of the lessons learned or applications that should be considered.
The Chair: Do you have anything to add, Mr. Duguay?
Mr. Duguay: If I could go back to my RCMP days, we had special file folders that categorized the type of information that we were dealing with. Confidential information was put into a special folder so that anybody within the office would know that any information contained in that folder was confidential.
The Chair: Using colours?
Mr. Duguay: Colours, yes.
The Chair: Thank you very much. We'll begin the questions with the deputy chair of the committee, Senator White.
Senator White: Thanks to both of you for being here.
To be blunt, at the end of the day, dishonesty can't be regulated by any rules. If people are going to do something with material that they're not supposed to do, as long as they understand and they are educated, there is not a thing you can do; am I correct?
Mr. Duguay: That's correct.
Senator White: We've arrested some of our own police officers not because they didn't understand the law but because they chose to ignore it.
Mr. McDonald: I'd add that the awareness and education piece you mentioned is key. Sometimes you do things not knowing that you shouldn't, so it's important that people understand.
Senator White: Agreed. If I may, the last time you did a review on the Internal Economy request and the investigation two officers came and spoke to me as well. They acknowledged that a number of people they had spoken to didn't understand what the words "in camera" meant beyond not being in public. That meant that information was not to leave. Many people's perspective was that the public couldn't view it, but that there were no rules. Once I walk out of there I could take it to my office and share it with my staff.
Going back, some of the recommendations that came out of that review around education are key. We can't stop everyone from sharing information they shouldn't, but if we understand what we should and can do with material, it's important. I'm not sure that everyone understands that. Is it different than what I thought?
Mr. Duguay: Education was the biggest factor, ignorance about the rules, even just the concept of going in camera.
Senator White: And what it means.
Mr. Duguay: There is a formal process whereby the clerk talks to the committee attendant, the committee attendant will call broadcast and say that now we're going into an in camera setting. He will call the security operational centre and advise security that the meeting will go in camera. Then it's assigned for the constable to manage or stop people from coming in.
Once that process has completed, the committee attendant will speak to the clerk of the committee and confirm that now we're in camera. A lot of people did not understand that process.
Senator White: That's really what Senator Céline Hervieux-Payette talked about at the end of her meeting with us, the importance of a go-forward education piece for all senators, so they can educate staff separately about the importance of the confidentiality and in camera process. Thank you very much.
Senator Cools: I'd like to thank the witnesses for their diligent and good services on our behalf. I happen to believe that the Senate is very well served by these two young gentlemen.
These are only thoughts, but at one point in time I was a member of the National Parole Board, and those files were stored behind bullet-proof doors. This may sound corny to many. Any time we had those files, there was a page on the file cover where it was signed for at all times.
So if we were going to Millhaven to see inmates, and we had those files, they could trace how long we had those files for. The system was very thorough. When you understand the issues and risks involved, it is mind-boggling.
When we receive documents that are highly confidential, we don't sign off that we have received them. I'm not sure that we even know whether or not some of us have received the documents.
By the way, I do not believe the leak came out of the Senate. That's only a belief and a speculation.
Chairman, I think you will find a lot of support on this committee for us to examine how we do it now and see if we can do it better, especially when the Auditor General has made it clear that he's not taking responsibility for those leaks.
I encourage us to continue the discussion, but there are many ways that we could make our business a little tighter. Maybe we've been too lax.
The Chair: Do either of you want to comment on that?
Mr. Duguay: It's all about the nature of the information, what you keep behind locked doors. If I go back to my RCMP days, there's a central repository for files and one has to go to that repository and sign. You keep track of who had what file at what time. I'm not sure this scenario would be conducive to the environment you operate in because of the nature of the information that you manage.
You want to stop the leak of a draft document before it becomes final, and then it's to assess how crucial the confidentiality is of that document. The more crucial, the more extreme measures you want to take. At the end of the day, what do you have in place to discourage that? Are there any sanctions?
The Chair: That is a question we have been contemplating.
Senator McInnis: Thank you, gentlemen, for being here.
Leaks have been something that have been around for a long time, and at the last meeting, Senator Joyal alluded to former Auditor General Fraser, and I read that she said there were 10 leaks on public reports. She simply said that it didn't come from her office.
I'm not sure how seriously we take leaks. It's hot at the moment when it happens, but where are the repercussions? To my knowledge, there are no penalties here. In Australia they do have penalties in the lower house, both monetary and suspension.
Senator White says education is more important. It's very difficult to prevent leaks. We saw here, over the last year or so, that one reporter started a program on television, "The Halls of Parliament," and he was able to get all kinds of information and have program after program.
It's quite prevalent, the so-called unnamed source. Until it is embedded in all staff and senators' minds that this is a very serious matter, do you not agree that we're just going to go on doing the same old thing?
How many investigations have you had on leaks in the last five years?
Mr. Duguay: In the last nine years we had one.
Senator McInnis: That tells you. If it's so serious, and if we take it seriously, why have there not been investigations?
Mr. Duguay: To be fair, we don't initiate investigations. We get mandated. Only once did we get mandated to investigate a leak. Have there been more leaks than what we've been mandated to do?
Senator McInnis: In my previous career in politics in Nova Scotia, there were lots of leaks, but we never seemed to find out. Once again, we didn't take them all that seriously.
Mr. Duguay: Also, going back to my former life, when you mark information as protected A, B, C, top secret or secret, it is an understanding that that information cannot be shared and would only be when it's declassified because then it stays in the file and it's never shared.
In this environment, it's secret just for a while, because eventually it will make itself public. It's a different approach, and it's only through education that you can mitigate that threat of a leak. It's to have a clear understanding as an individual that when you are in possession of that information for that time frame, that you clearly understand that it's not to be shared with anyone.
Senator Cools: I think it is fair to say that there are leaks and there are leaks. I'm not particularly bothered when I see a leak in the newspaper which might have scooped somebody's great opportunity at making a very great point on the floor or in a press conference.
The matter that bothers me deeply is that in the leaks for this report, we are dealing with extremely damaging information to people's careers, personal lives, their families and their reputations. A reputation is supposed to be secure in our business as I think we made the point last week to the Auditor General.
In politics, our reputation is the finest tool that we have and there is nothing quite like it, and this is what was very bothersome to me. I made that point in the committee so it's on the record: the Auditor General elected to name senators in the report. I've never heard of any such thing and in my view it should never have happened.
But the mere fact of doing that heightened, I would say, the interests of the leakers, if there is such a group of people. It really bothered me because I saw some of those individuals when they discovered that they were going to be investigated by the police and I swear to God I thought some were going to die right in front of my eyes.
This continued for a few months, but in the last month or so they've been informed that there is nothing; the RCMP has said there are no grounds or reason to prosecute anybody. The situation is worsened by that because, then, all it turned out to be was damage to people's lives and reputations and none of these people — and I'll be quite frank, I don't mind speaking for some of them — are not young. These are all individuals that are moving up.
The Chair: I think we tend to agree, but we do have time limits.
Senator Ogilvie: Thank you, chair.
I want to come back to the train of discussion that Senator White initiated, that you followed up on, Mr. Duguay, and on which Senator McInnis commented.
There is no doubt that the procedures that you outlined can be developed and adopted, and my experience is that when those of you in the process have an accident with a leak, there is tremendous fury, and there would be tremendous fury from us.
However, the other side of the issue is, generally, in my experience where problems occur, is with actual people who have access to the information and leak it. Here on the Hill, it is my experience that we don't pay much attention to that.
We admonish our committees on a regular basis. I'm chair of one committee and recently I co-chaired an important committee in which we, at each in camera session, admonished the committee with regard to the confidential nature of the meetings, and when we got to report writing stage it was doubly and triply enforced. However, when the final report was adopted it was leaked to the press the night before, when the agreement was it was to be introduced in the two Houses of Parliament. It wasn't a question of a secret leak, as individuals were actually quoted in terms of what it would contain.
I was, I should say, not very happy about that, and I spoke to a senior parliamentary clerk with regard to the issue that morning and was informed that there was really not much we could do about it.
I would submit it doesn't matter what procedures we put in place and how rigorous we are in admonishing you and others as to how you should enforce them, if in fact when we have flagrant violation of our rules and people are clearly identified, even on important issues, and we take no action against them.
I think it's a sham, quite frankly, and I don't see how we can go much further unless we are determined in dealing with the violation of parliamentary privilege. That is how it's put to members of committees: that it's a violation of parliamentary privilege, and unless we enforce that, in cases where it's clearly important, I don't see how we can ever hope to have it enforced.
The Chair: Is there a question? Do you agree?
Senator Ogilvie: Thank you, Madam Chair. I would ask if they could clarify my observation based on their experience and see if they have a way of dealing with this.
Mr. Duguay: For any enforcement you need a deterrent, and clearly, in this case, there is no real deterrent or sanction.
Senator Ogilvie: Thank you, Madam Chair.
Senator Oh: Thank you, gentlemen, for providing all of this information.
When I receive highly confidential and sensitive information or documents, I have no place to store them in my office, and I can't carry them everywhere I go. There is no proper secure area in my office where I can lock up those documents.
Mr. Duguay: Right now, it's the purview of each committee to decide how to manage confidential documents. Unless we were contacted and provide you with recommendations as to how they should be handled, it's up to the committee. If they need to be locked up and you don't have a lockable cabinet, we would obviously work with you to acquire the proper equipment to secure your documents.
For transporting documents, there are even special briefcases with special keys on the market that can be used to carry classified documents. We can work with the committees and clerks to establish processes and procedures for how to better secure documents. That's not a problem. But right now, like I said, it's up to each committee to decide.
Mr. McDonald: For your staff, there is the information security policy that provides guidance on how to secure and safeguard documents. You're within a secure building, within a secure zone in your office and within your office, cabinets can be used to further secure documents based on a document's classification level.
The Chair: We'll have a look at that, but the point about space within the office is interesting, actually.
Senator Seidman: Thank you for being here and for the valuable services you provide to the Senate.
I would like to ask you about corporate security and its role. I hear you need to be mandated and asked to investigate, but what role do you play in a general way in making recommendations for best practices in a more proactive fashion? I hear you, Mr. Duguay, talk about how every committee has its own approach to confidential documents. However, I do think, administratively — if I think about the administration management of the Senate — there are general, overarching principles for how things have to be run.
What role do you play in a proactive fashion? How do you connect, and do you make recommendations?
Mr. Duguay: Everything that has to do with information falls under the information service directorate, commonly known as ISD. Right now, ISD is in the process of updating those policies and we participated with them by providing some comments and recommendations as to how to improve policies for marking, distributing and safeguarding documents. We've provided that advice to ISD, and now that policy is in the process of going before Internal Economy to be sanctioned by them, and then after that it's going to be a Senate policy as to the guidelines in place as to how we manage documents in general.
Senator Seidman: We've talked about, and you agreed, the importance of education, best practices in management mechanisms or regulations that can be in effect, and we've alluded to deterrence and sanctions. Given your expertise in security, what role do you play in presenting recommendations, not just for ISD or electronic systems, but in a larger fashion in this area?
Mr. McDonald: I believe some of that is captured through the general security awareness sessions we hold, and they're recurring sessions. A big element pertaining to what we're discussing today is captured by ISD. New employees have to do an on-boarding process where they go through policies and practices and what is necessary to safeguard information. I believe it's very well captured there, in addition to the other awareness sessions we provide.
Mr. Duguay: I would like to play a bigger role and initiate, but we are not mandated by the Senate to initiate, oversee and investigate. That only comes when we have specific orders, and we're not there yet as an institution.
Senator Seidman: You would have to be asked to provide more proactive education sessions, for example?
Mr. Duguay: Yes.
Senator Joyal: If I understand the answer you have given to Senator Seidman's question, you're not aware of any "training session" to new employees about the importance of confidentiality and respect of embargo, what "in camera" means and access to documents. They won't even understand what "privileged documents" means?
Mr. Duguay: When it comes to employees, we have this accreditation process where you fill out forms before you're issued your identification card.
Senator Joyal: That's for a security check. That doesn't mean training of a person.
Mr. Duguay: Michael has a checklist he goes through with the prospective employee and checks what needs to be done, upon which he can elaborate. With respect to the education of new senators, that job is left to the committee chair and the clerk of that specific committee to educate the new members of a committee as to the meaning of confidentiality and everything we spoke about. Right now we do not play an active role.
Senator Joyal: I'm putting it in even broader terms. The human resources service of the Senate has the responsibility to hire people for any senator's office or any other position in the Senate. What training is given to a new employee who is starting work in a senator's office? We have seven new senators. We will have 19 or 20 more in the forthcoming months. Who will inform those people of what a privileged document is, what "embargo" and "in camera" mean and what are leaks? Who trains them?
Mr. McDonald: ISD again is the driver behind that type of information.
Just so you're aware, the policy has responsibilities of the different parts of the Senate. It has classification, storage, retention and disposition of documents. So it covers the key components to protecting information.
Senator Joyal: It doesn't mean there is no policy. I'm asking you a simple question: Who is training the people who are hired by human resources of the Senate for a new senator's office?
Mr. Duguay: If I can be candid —
Senator Joyal: On the broader terms of confidentiality.
Mr. Duguay: I think it's left up to the senators to educate their own employees. We do not play a role in it.
The Chair: What about administration staff? Who trains them and in what detail does that training occur?
Mr. Duguay: In committees, I'm assuming?
The Chair: Not in committees, in the Senate administration.
Mr. Duguay: Because, in general, the staff doesn't deal with sensitive matters.
The Chair: Oh, yes, they do — expenses and salaries.
Mr. Duguay: In specific areas, finance and HR, everything is dealt with behind closed doors on a need-to-know basis, and we have no knowledge of what's being discussed or what they are sharing. We have no knowledge about the information they are handling.
Senator Joyal: So it's not your business?
The Chair: Whose business would it be?
Mr. Duguay: That's why there was a need to update the policy on information. That's why the things that I have just talked about have now been identified. According to the new policy, this is what the administration will be required to do, but we're not there yet.
Senator Joyal: It's a very important issue to determine who is responsible for splitting the activities of the Senate.
It is a senator who is responsible for training his personnel to be sure they are fully aware of the various levels of confidentiality, how to treat some information vis-à-vis other information. The new senator presumes that he or she will know all that.
Mr. Duguay: Senator Joyal, I have no knowledge, and I don't want to speak on behalf of HR, finance or any other directorate. My personal involvement with this is that we investigate when asked.
Senator Joyal: You're the fireman. You come when we call you. You don't visit to prevent fire hazards in a house.
Mr. Duguay: We do.
Senator Joyal: I'm trying to make it simple to understand.
Do you meet the new senators to inform them of all the implications of confidentiality that are pertinent to their new position? Do you brief them in relation to confidentiality?
Mr. Duguay: This is pure speculation, because I was not part of the briefing that the various directorates have given to the new senators coming in, but I'm being told that they will go through a process of informing the new senators as to what these processes are, but I can't confirm that.
Senator Joyal: You can't confirm that confidentiality is information that is provided to the new senators?
The Chair: You can or cannot?
Mr. Duguay: Cannot.
Senator Joyal: It's helpful. We have to understand how this system works and not hide under vague assumptions that something is happening somewhere. You understand that. You're a policeman. I want to talk about the documents that we went through, which is a very serious issue.
The Chair: I have a list. I have Senators Martin, Batters, yourself and myself sneaking in a question somewhere.
Senator Martin: I think Senator Joyal's line of questioning was quite important. I have more questions on that but I know it's not necessarily here for me to ask them.
I was curious as we were talking about overall security and the spaces that we occupy. We have committees, but in our own office in the last few years I have been shredding everything. When I think about recycling and what happens to it, it's hard to know what should or should not be shredded because after I leave my office, there many others that can go through. I was curious about after hours. We leave the Hill and in the morning things have happened overnight, different people come through.
Regarding overall security after hours, would you describe the level of security and the personnel that work on the Hill in terms of their overall training and the level of confidentiality enforced there? Would you speak a bit about some of the things that happen beyond the hours that we are here?
Mr. McDonald: I can certainly speak about what happens from a physical security standpoint. From a corporate security, all of our systems continue to be functioning. If you have a swipe on your card, you can know if someone went in at a certain time. We're able to have a view from one of our cameras as well. The controls from the Parliamentary Protective Service — that is, those who provide physical security within the precinct — remain in place 24/7. Those are the controls that exist.
Mr. Duguay: Under the old Senate Protective Service, we had a policy that our constable would inspect every office. When they inspected the offices, if documents were left on the desk the occupant would get a notice that you left confidential documents unattended. That was one way of reinforcing — with occupants, staff and senators — the need to store confidential documents.
Now with PPS, I'm assuming that's the same process. Also, as a senator, you can choose not to have your office inspected as well.
Senator Martin: To double-check, in the evening the security personnel are doing a sweep of our offices and we can choose not to have anyone come in?
Mr. Duguay: Sure.
Senator Martin: These are all things we discover sometimes in committee. I was curious about oversight of the various groups of people that are on the Hill regularly. We have our interpreters, but who manages and who makes sure that confidentiality is in the forefront?
I don't think you can answer that question for us today but that is something we should definitely look into because there are eyes and ears everywhere. I feel like my life is an open book. The last few years of the audit, with the highly sensitive information, were a stressful several years. I think this is an important process, but I'm hearing new things today that I haven't heard. That, too, is quite enlightening for me.
Thank you very much for what you do. I do appreciate the work you do.
Mr. Duguay: My concern about the confidentiality of documents is if it's left to senators to destroy their own documents, how is that confidential document being accounted for? Who authorized you to destroy the document? Who's keeping track of confidential documents?
I would certainly recommend to committees that if you're going to log who you distribute the document to, if there is a date the documents should be returned to the committee, and if the committee looks after the destruction of the document, that should be implemented.
Senator Martin: To clarify, those kinds of documents are returned. As deputy leader, I have information about what's happening. It may have been distributed but for myself I end up shredding a lot of things. I want to put that on the record. Those are the documents I was referring to.
The Chair: Some of these documents are confidential for the first four hours of the day and then you can wallpaper your room with them.
Senator White: I'm going to bring Mr. McDonald back to meetings we had in Washington about a year and a half ago, when there were discussions about security and the fact that all the staff of every single congressman and senator had to go through a training program when it came to security issues. We were saying at the time that we don't do that for staff of senators here, for example. I think there needs to be a large discussion around a training plan for staff. There is no question about who they work for but there is a question of where they work. I think we're lacking the training piece around what it means to work in the Senate of Canada from a security perspective and a confidentiality access perspective.
When I first arrived here there was an issue around one staff member of a senator who had kept their pass and had actually accessed one of the buildings at Wellington with that pass even though they no longer worked there because they hadn't turned their pass in. I think it's a bit of education that goes beyond the confidentiality piece. Do you not agree?
Mr. McDonald: In fact they do, senator. As you were speaking, I was thinking ISD, IT security, corporate security, and media as well, regarding the phishing tactics and the rest. It should be an all-encompassing session to educate the employees.
Senator Joyal: I would like to come back to the Senate expenses audit of the Senate and individual senators. Do you have any of that information under our control now?
Mr. Duguay: No.
Senator Joyal: You have no secretive, sensitive information about any senators under your control?
Mr. Duguay: No.
Senator Joyal: Do you have any responsibility in protecting the confidentiality of the personal information that was provided to the Auditor General during the course of his mandate to investigate Senate expenses?
Mr. Duguay: No, we had no role in it.
Senator Joyal: No role at all in it. So you have no discussion, and you have not been asked to protect the confidentiality of the information that the Auditor General is still keeping on each and every senator?
Mr. Duguay: No.
Senator Joyal: Do you see any risk of leaving the situation as it is now or should we be more cautious in terms of making sure that we protect the secrecy of that information?
Mr. Duguay: Like I said, it's the purview of each committee to determine how it will manage its own documents. The only thing is this: Should there be a rule as to exactly how documents should be managed so that it's applied equally across the Senate?
How do you do that from a senator's point of view and committees? Who has the authority to put those rules in place? I'm not the expert in that area but my recommendation would certainly be that there should be an explicit rule stating how to manage these documents.
Senator Joyal: So you don't know where that information is stored now?
Mr. Duguay: No.
Senator Joyal: Is it in the Senate precinct or within the Auditor General's office, do you know?
Mr. Duguay: I do not have a clue.
Senator Joyal: You do not have a clue. Should we take additional steps to make sure that that information remains out of reach from anyone? The Auditor General told us when he testified here that he intends to keep all of that information for 15 years. In 15 years, many of us will be gone from here. I will be for one. It means, for instance, that more than 10 years after I have left this place there will still be personal information somewhere retained by the Auditor General. In my opinion, that is something we have to address, but it's for us to determine how we are going to deal with that.
In terms of your responsibility, do you have to ensure confidentiality of the information that is in Senate hands in relation to the Senate or senators individually?
Mr. Duguay: Not really because I have no authority to initiate an audit. If I suspected, for example, that maybe you were not complying with certain guidelines, then I could confirm that through an audit. But as it is now, I have no authority whatsoever to initiate an audit, even though I suspect that you aren't conforming to the policies that the committee has established.
Physical security is a matter of the Parliamentary Protective Service, it's not us. We can make recommendations to PPS, and we play a role in that perspective.
Senator Joyal: Do you have the mandate to conduct an audit of security?
Mr. Duguay: Not unless it is asked for.
Senator Joyal: You have not been asked?
Mr. Duguay: No.
Senator Joyal: You have never been asked?
Mr. Duguay: Never.
Senator Joyal: Was there, in your opinion, a need to conduct one? We will be leaving this place in a year or so from now. In moving everything somewhere else, as you know, we have to ensure that information is kept as secure over there as it is here. Are you involved in the operation of the transfer and the security that will be attached?
Mr. Duguay: We are not involved. Specifically with the Auditor General, they have their own information and that's their world. We have no say into the manner in which they document, manage and store their documents.
The Chair: Senator Joyal, we're building up a list of supplementary questions. You have sparked everyone's interest. Can we interrupt?
Senator Joyal: I'm trying to reflect on where we are going with that. I don't sit on Internal Economy, contrary to my colleague Senator Wells and maybe some other senators, but it seems to me that these are very important issues and we have to be satisfied that there is an answer, and if there is no answer, that we provide the proper recommendation. As you know, that's our role here this morning. I don't want to be adversarial and that's not my intention. I want to try to understand how the system works.
Mr. Duguay: We don't know what each committee stores in terms of information. I'm not in a position to make recommendations or observations because I am not privy to what's going on behind closed doors.
Senator Joyal: I would like to come back to the information in relation to personal expenses of senators and in relation to Internal Economy.
Senator Batters: Mr. Duguay, I don't have the transcript of the Auditor General's testimony here when he was before our committee at the last particular meeting, but I'm quite certain that we were advised that the confidential documents that the Auditor General's office had provided back to the Senate are now stored in the Senate offices of the Chambers Building. If you don't have authority to ensure the security of those documents, who does?
Mr. Duguay: Who keeps them accountable?
Senator Batters: Who is ensuring the security of confidential documents that the Auditor General's office has indicated is now stored in the Senate offices of the Chambers Building? If you don't know the answer to that, could you please provide the committee with that as soon as possible?
Mr. Duguay: We can investigate.
Senator Cools: The audit committee took control of all of those affairs in respect to the Auditor General's audit. That is a subcommittee of Internal Economy. It's pretty clear where the responsibility rests.
Senator McInnis: You have no jurisdiction to do investigations within the offices of the Auditor General?
Mr. Duguay: The Auditor General, that's right.
Just to clarify, could you tell us what information we are talking about? Are we talking about the working documents that the Auditor General had access to from finance?
The Chair: My recollection of the testimony is that the Auditor General kept under his control documents or copies of documents that in his view were needed to support his conclusions. Other documents, as I understand it, were returned to the Senate to be kept under Senate control and secure for a period of time that escapes me. If your recollection is different, then speak now.
Sen. Batters: My recollection is 15 years.
The Chair: But 15 years really astounded us, as you can imagine. The Internal Economy Committee was ultimately responsible for dealing with the Auditor General, this committee was not.
We are trying to get an understanding of systems, so we're not asking you — at least I am not asking you — to opine on the appropriateness of what the Auditor General has done. But we are asking for your expert opinion on systems and things like storage, what is considered a normal, appropriate time for storage and that kind of thing.
That's not my question. That's just a supplementary comment. Do you agree?
Mr. Duguay: Yes.
The Chair: My question is related to your repeated statement, Mr. Duguay, with which I agree, that you can have all the principles and policies you like but if there are no sanctions it is difficult to enforce those policies.
Within the Senate administration, as distinct from committees, what sanctions exist for unauthorized disclosure of information, do you know?
Mr. Duguay: Because we have never faced such a dilemma, I'm not really sure what sanctions are in place. I can tell you that under the collective agreements that fall under my purview there are disciplinary measures that a manager can take if someone has breached working conditions.
The Chair: Those would be reprimands, suspensions, ultimately dismissal, I suppose?
Mr. Duguay: Exactly.
The Chair: The usual range, in other words? But you don't know?
Mr. Duguay: That's right.
The Chair: If you could provide us with information pertaining to that in the various collective agreements.
Mr. Duguay: Okay.
Senator Joyal: I would like to come back to the confidential information that is with the financial division of the administration of the Senate.
Have you ever conducted an audit of the practices of maintaining confidentiality of information to ensure that our system is tight in terms of protecting information?
Mr. Duguay: Because we don't have the authority to initiate, the only thing we can do is to have a pulse on what is going.
It has never surfaced with the Finance Directorate that because they were holding records or documents, there was a specific document that was leaked because of their negligence. It never prompted us to investigate and be curious as to if they have the proper means to protect the documents.
One thing that I'm aware of, though, is that when the Auditor General came in and they were lodged at the Chambers Building and had access to the finance documents — they were in a specific area — the access to that room was limited to the employees of the Auditor General, and everything was controlled through card access.
Because my mandate is to look after all kinds of services within the Senate and in some instances to provide services to the Auditor General, I have witnessed first-hand, when I came to their door, it was not an open and welcome environment. I had to identify who I was, what I was there for and who specifically I wanted to talk to.
The Chair: For the record, they would close their computers or laptops.
Mr. Duguay: That's right.
Senator Joyal: In other words, you are not suggesting to us that it would be a matter of good governance to, at this point, conduct an audit of the way that the confidentiality of the treatment of personal information of senators is secure because, if I read your answer, there has never been any complaint. So if it works, don't try to fix it.
Mr. Duguay: Absolutely not. I would strongly recommend, because of the apprehension that I'm hearing around the table, that this concerns you, that we do an audit to confirm that measures are in place to protect your information.
Senator Joyal: I would certainly say too strong doesn't break, if the system works. It will be easy for you to conduct the audit. I don't know your business, but you have a checklist of things you want to check first, the systems and whatnot. If the system is perfect, it's going to be an easy job to conduct an audit, and you will satisfy us, generally, that the system works.
We live in an age where it's very easy to spread information, and a leak could be damaging. I don't want to make an outrageous comparison, but it's like a forest fire. Once it has started, you don't know when it will end.
As my colleague has stated — and I have stated myself many times — the greatest asset we have is our reputation as public figures. It seems to me that it is wise to make sure that we ensure the system meets all the criteria of the best practice to maintain confidentiality.
That is what I could share with you as a concern on the basis of what we have seen in the last couple of months in relation to the audit.
Senator Wells: It seems to me that in the timeline of this there is before the leak, the leak and then after the leak. I have a fair degree of confidence that the systems were in place before the leak to protect from outside infiltration and that sort of thing.
In the case of after a leak, when there's an investigation to determine who or how it was breached, have you done investigations in the past? I have a follow-up question when I hear your answer, but have you done investigations in the past on how leaks happened?
Mr. Duguay: Not to my knowledge, no.
Senator Wells: I remember a couple of years ago there was a discussion — in fact, I think you were there — at Internal Economy where we talked about a leak. It might have been about this one. I think you had requested or there was a discussion around accessing emails, phone records and that sort of thing. That was denied.
Mr. Duguay: That was in relation to the audit. The investigation that we conducted, the time frame was in June 2013 to January 2014. That was the span.
Senator Wells: You requested access to emails and phone records?
Mr. Duguay: I did.
Senator Wells: They were denied?
Mr. Duguay: They were denied.
Senator Wells: It stands to reason that it's difficult to do a full investigation of how something might have happened if you don't have permission or the tools to do a full investigation. You can only do an investigation up to a certain point, and then you're not permitted to do, perhaps, what would have been more revealing than anything else.
Mr. Duguay: Yes. I also provided an opinion that even though we would have access to it, unless you find specific information, that's the difficulty investigating the environment that you operate in. I can see in an email that you made a rendezvous with a media person, but that doesn't confirm anything. In your job it could be a daily occurrence as to why you're talking to the media.
Things are leaked to the media. Unless I can get specific information that points to one direction, it's complicated. The best avenue is to put processes in place that will discourage people, perhaps, from doing it in the first place, and if you're going to do it, you're going to do it knowingly. If you're doing it knowingly, then I as an investigator can come back into the picture and look at who knew what, where and when. What was the discussion in that private meeting? What were the minutes reflecting?
In interviewing every senator who sat around the table, the stenographers, committee attendants, everybody that was in that room, and who said what, and creating timelines as to exactly when someone spoke to that media person, it's just a basic investigation. If you have documented processes in place, obviously by leaving a paper trail it would facilitate the job of the investigator.
The Chair: Clearly, I don't think the Senate wants to go down the police-state road, but I think you are teaching us a reasonable amount about reasonable systems.
I would like to clarify something about the security rounds at night. I think it's a fine thing if the security people are checking my office to see if there's no intruder, the water isn't coming down through the ceiling or whatever. I'm rather alarmed, however, that they might feel it appropriate to contemplate the top of my desk, to see what's on it.
Are they authorized to do that, to look at our papers that may or may not be lying around?
Mr. Duguay: It's not about sifting through your papers. It's something that catches your eye, that you've got a document that is marked "confidential," and it's left unattended on your desk where normally confidential documents would be stored in a locked cabinet.
It's all part of the educational process more than anything else. That's why they will leave a note saying that a document marked "confidential" was left on your desk. That's all part of education and prevention more than anything else. It's not about reading or looking at the document itself.
The Chair: One would hope.
Senator Joyal: Have you ever developed an instrument or a briefing note for new senators that they would read and be aware that confidentiality is part of their job, so an instrument that would be made available for new senators to read as much as they would read the code of ethics or the administrative rules of the Senate in relation to expenses, what is admissible or not? They are must-read points for a new senator. Have you ever developed an instrument or would you be willing to develop such an instrument to inform the new senators? You say that it pertains to the new senators to be responsible for ensuring their personnel are properly trained. If we want the personnel to be trained, the senator himself or herself has to be aware of it.
Would you be willing to do that? We don't have the authority to ask you to do that. It might be more Internal Economy.
Mr. Duguay: That's an excellent point. With the creation of the Corporate Security Directorate, with PPS now focusing on physical security, it is giving us a new life on prevention and education. Now that Mike is getting his team in place, that's an area where we obviously are going to invest much more. Thank you for the suggestion, and certainly Mike will take the initiative to look at it and the best way to deal with chairs and the committee clerks as to what is the best product we can put in place to educate the staff and senators.
The Chair: Thank you both very much. This has been an interesting session indeed. This meeting now stands adjourned.
(The committee adjourned.)