NDDN Committee Meeting

     I call this meeting to order.

    First of all, I want to thank Mr. Olmsted for his patience. We had to move this meeting to a later time because of a multiplicity of votes.

    Before I ask Mr. Olmsted for his five-minute opening statement, I want to bring it to the members' attention that we are now being interpreted remotely. We have remote simultaneous interpretation, or RSI. You'll notice that there's nobody in the booth except for a techie. Individuals on the committee may perceive a very small offset between the voice of a person speaking in the room and what comes through the earpiece when listening on the same channel as the language being spoken—for example, when listening on the English channel to someone speaking English in the room. This is normal and an expected part of the RSI experience. Anyone wishing to avoid this may do so by switching to the floor channel.

    This is the way in which we'll be able to expand opportunities to have meetings. As you know, resources have been challenged. This will be normal for the defence committee going forward.

    With that, I'll ask Mr. Olmsted for his five-minute opening presentation.

    Thank you, sir. I look forward to hearing what you have to say.

     Thank you very much, Mr. Chairman and members of the committee, for inviting me today.

    My name is Bob Olmsted, and I am president and chief operating officer of global relocation services for Sirva Relocation. In my role, I oversee all aspects of our relocation services in Canada and globally.

    Sirva is a fully integrated relocation and moving company. Our unique model allows us to provide end-to-end service, including initial consulting and guidance before a move, and a range of on-the-ground services from origin to destination that help individuals and families as they settle into their new homes.

    In 2022, Sirva merged with BGRS so that we could strengthen our service offerings and add greater value for our clients.

    As the committee is aware, our heritage brands have provided relocation services to the Government of Canada for a number of years. Our most significant relationship is with the Canadian Armed Forces, and we are honoured to have helped thousands of members of the Canadian Armed Forces and their families relocate when they were called upon to do so. We also work with the RCMP and the Treasury Board Secretariat. All of our contracts were awarded through open and competitive bid processes and include rigorous oversight and high performance standards. Our team works hard to deliver excellent service to our clients, including the dedicated service members who make up the Canadian Armed Forces.

    We commend your committee for its timely focus on the important issue of housing availability. This is a real and pressing challenge for many Canadians, and it is particularly acute for CAF members. I have heard the powerful testimony of the witnesses in your recent hearings who spoke of the stresses and challenges facing CAF members and their families when they are asked to relocate. Our job at Sirva is to help alleviate those stresses to the best of our ability.

    Given our specific role, which does not include building or maintaining housing, we will defer to other experts and to policy-makers for finding solutions to these pressing needs.

    We know that the committee is interested in the data incident perpetrated against our company by a sophisticated bad actor. Unfortunately, we live in a world where cyber-attacks have become commonplace, and our industry has not been immune. The data incident disrupted access to certain of our platforms and resulted in unauthorized access to information belonging to current and past clients and their employees. While we acted swiftly to contain the incident and are not aware of any major disruptions to planned relocations because of it, we sincerely regret any uncertainty, frustration and concern experienced by our clients.

    Let me share a high-level summary of the timeline. Overnight on September 28, we identified malicious activity that encrypted certain of our systems. We immediately took steps to protect and further secure our systems, launched an investigation, and informed law enforcement. We then sought to restore operations from backups. As part of that effort, we informed our clients in the Government of Canada and subsequently continued to meet with CAF and DND officials, the Canadian Centre for Cyber Security and others over the following weeks and months.

    We continue to work with cybersecurity and forensic specialist firms. We believe that the actions we have taken have contained and controlled the incident, and that we can continue business as usual with our clients and customers. While the process to identify impacted individuals is ongoing, we are committed to concluding that process as soon as possible, and we will notify and support any individuals, consistent with our regulatory requirements and contractual obligations.

    Finally, let me say that we welcome the committee’s interest in the quality of service we provide. This is our top priority, and our team works hard every day to make the stress of relocation as smooth as possible. We abide by strict, rigorous performance oversight and accountability standards that are part of our contractual commitment to the Government of Canada. That commitment to enhancing client services is what inspired Sirva’s recent combination with BGRS. Our unified approach enables us to provide a more integrated and efficient offering for our clients.

    With that, I will thank the committee again for the invitation to appear today, and I'm happy to answer your questions.

    Thank you, Mr. Olmsted.

    Mrs. Gallant, you have six minutes, please.

    You told us that when the service was hacked, you contacted the Canadian government. Which agency did you contact and on what date?

    On October 3, we verbally contacted the Canadian Armed Forces, the Treasury Board and the RCMP.

     For the Canadian Armed Forces, was it the Department of Defence or was it somebody in the actual chain of command in the forces—and who was it?

    We contacted our day-to-day contact, whom we interact with on a regular basis.

    October 5 is when we found out. At that time, the minister did not know, and you said the government was contacted on the 3rd.

    On the 3rd, we verbally communicated. On the 4th, we sent an email communication.

    On the 5th—actually, even on the 6th—the Minister of Defence didn't even know. We're trying to figure out where the blockage is there.

    How far back did the compromised data go? Was it for moves as far back as 2000?

    We still have not finished our evaluation of the data that was copied, so we don't have the answer to that question at this time.

    How much was the ransom that was required in order to release the data?

    While I was aware there were discussions going on with the bad actors, I was not involved in those discussions. Therefore, I don't know those details.

    Okay. You don't know how far back it went, and you don't know about the ransomware.

     Aside from money, you know they would be looking for more ways to intrude and get into military systems. What measures have you taken to ensure that the proper firewalls and ways to stop it have been put in place so that even more data cannot be penetrated from other systems?

    We immediately started to work with outside firms that are experts in cybersecurity to close any loopholes that might have existed. We worked immediately on getting the bad actors out of our system, which we were successful in doing immediately on the night of the 28th and on the 29th. We have now brought in those cyber experts, who have evaluated our system and given us assurances that, at this point in time, our system is secure and can be used as it was before.

    Is your system regularly pen-tested independently?

    Absolutely. We bring in outside firms and our own security department not only to test our system, but to test our employees to ensure that they're following our policies.

    That was going on prior to the incursion.

    Yes.

    You have that going on and the pen test.

    Is it a requirement of the federal government to have the independent pen test done?

    We have a requirement that ensures that we are keeping up with security standards, that we're doing all patches and that we report on that on a regular basis. That is part of our contract.

    What type of incursion was it? It obviously wasn't a zero-day incursion.

     What method was used in this particular set of circumstances with your firm?

    The bad actors came into the system through an entryway. I'm not specifically aware of the technical words behind it, but we were able to detect that they were there and we were able to stop them in the middle of trying to copy data over. That's where we stand right now.

    What method are you using to contact the individuals who you know would have had their data breached?

    Once we have that list complete, we will be going out to our clients and communicating to the individuals, and then we'll work individually on how that communication will take place.

    Has there been a general notice to anyone who's had your services provided to them that they may have had their data breached, so that they can change their password or do whatever they need to do?

     What kind of data do you keep? Is it their address, financial information or credit card information? What types of data could have potentially been stolen?

     To be clear, the data was copied. It was not taken from us.

    We maintain data, in our databases that were not compromised, relating to our process of moving people. The data that was compromised included unstructured files, spreadsheets, Word documents and things like that. That's why it has taken time to go through and look at those things. However, we do maintain data relating to people's addresses, because we're moving them and things like that.

    Thank you.

    Thank you, Mrs. Gallant.

    Ms. Lambropoulos, you have six minutes, please.

    Thank you, Chair.

    Thank you to our witness for being here with us to answer some of our questions today.

    We've heard from quite a few members of the Canadian Armed Forces and from different people who have experienced difficulties when it comes to relocating and when it comes to finding housing at this point in general when they're asked to change location. I'm wondering what you think is one of the most pressing issues that military members and their families face during relocation and what solutions you think would be effective.

    As it relates to housing, as I look at the issues, we share the concern of the committee, but we aren't involved in building or maintaining housing. With respect to the role of policy-makers in finding those solutions, we believe that is best. We don't get involved in that part of the process.

    If you don't mind, perhaps you could go through what you do when you're helping them relocate so that we have a better understanding of what services you offer. As well, let us know if that's been more difficult in recent times because of shortages, perhaps, and difficulties in finding housing.

    The relocation process is very complicated. We start in the process working with members to communicate what they're entitled to and what services will be paid for. We advance them funds. We then collect receipts as they work through the process. We do provide a list of local suppliers who can help them in the process—folks who can help them buy houses or find rental properties—but those are local Canadian businesses that do that. We just maintain the directory of lawyers who help close.

    A separate process assigns a household goods carrier to move their belongings. We are part of that contract as a household goods carrier, but our group, which is doing the consulting to help share and answer questions around the policy, does not get directly involved in assigning which mover gets the shipment.

    Thank you.

    In terms of dealing with these different companies and with the consultants who work at your company, I'm wondering if you've noticed that it's more difficult to actually fulfill the service, given the lack of housing available right now. Do you think there are certain provinces, for example, around the country that may be experiencing this difficulty more than others?

    As I said, the relocation process is complicated. It's been complicated for as long as I've been in the business. We don't collect data day to day on the local challenges that the CAF members may be having, so I don't have data or an opinion to share on that.

    All right. Thank you.

    I'm not sure if you're aware, or if this falls under what you help with, but the Department of National Defence has instated a policy to ensure that housing charges can't exceed 25% of combined gross household income of all occupants residing in the DND residential housing unit in any one year. Is this something that people are made aware of through your company? Is this one of the services?

    I guess I'm a little bit confused as to what exactly you do. Can you elaborate on the impact of this particular policy and let us know what other policies currently exist that would help members find housing that is more affordable?

     We provide policy consulting related to the relocation from point A to point B. We are not involved in the ongoing budget or living expenses of members once they move.

    I'm going to share my time with my colleague Mr. Collins.

    Thanks.

    You have about a minute and 15 seconds.

    Mr. Chair, I'm just curious to know if the company undertakes satisfaction surveys with Canadian Armed Forces staff and their families as it relates to the services it provides.

    No, we do not. That is not part of our contractual relationship, but we measure what we and the government have agreed are key statistics that lead to satisfaction. We look at how quickly we're getting back to customers, the briefing calls and when we schedule them, and making sure that we have availability to answer questions.

    That's it. Thanks, Mr. Chair.

    Thank you, Ms. Lambropoulos and Mr. Collins.

    Ms. Normandin, you have six minutes.

    Mr. Olmsted, Madame Normandin will be speaking to you in French.

    Good evening, Mr. Olmsted. Thank you for being with us.

    Before I get into my questions, I want to make sure I have the dates right. Correct me if I'm wrong, but the first contract that Brookfield Global Relocation Services, BGRS, won was in August 2009, and a second contract was awarded in August 2016, right?

    I don't know if there's a technical issue, but I'm not getting the translation.

    I'll get the clerk to help you here.

    Mr. Olmsted, at the bottom of your screen, there's an option to pick the language. It is a globe icon that says “Interpretation”. You just have to make sure that you're listening on the English channel. That will give you the English interpretation.

    I apologize.

    Is it working now, Mr. Olmsted? Can you hear me in English?

    Yes, I can.

    Problem solved.

    Go ahead.

    Thank you, Mr. Chair.

    Mr. Olmsted, thank you for participating in this committee meeting. We appreciate it.

    Before I get into more specific questions, I'd like to make sure I have the right information. Correct me if I'm wrong, but the first contract that Brookfield Global Relocation Services, BGRS, won was in August 2009, and a second contract was awarded in August 2016. Is that right?

    I believe there was a predecessor company that received a tender in 1999.

    Perfect. Thank you very much.

    So it's been at least—

    The other dates are correct.

    You've been working with the Canadian Armed Forces for about 15 years now.

    That's correct.

    Thank you very much.

    What I've heard from military personnel is that they haven't had access to personal in-person service on military bases for some time now. Is it true that, when BGRS started its contract, people were physically present on military bases to provide service to military personnel, but now it's being done remotely?

    Yes. Prior to December 1, 2017, we did have personnel on military bases. With the contract that commenced on December 1, 2017, the armed forces introduced a new, modernized delivery module that combines technology with just-in-time support, which is delivered from a central location in Ottawa.

    Is it true that there's no longer a single agent assigned to each member's relocation file and that there might be several agents handling a given file?

    Yes, that is correct. In the beginning of the contract, we were not having briefings. We did change that process at the request of the Canadian Armed Forces, but the original model was what was put out to bid and what we bid on.

    Thank you very much.

     Is it true that SIRVA BGRS no longer provides policy briefings ahead of time so members know how much they're entitled to for things like renting a trailer when they move or how to save money on all kinds of things? Members now have to do their own research to see what they're entitled to.

     No, that is not correct. We offer individual briefings that any member can request, and they can request as many briefings as they would like. We also provide them with a budget at the beginning of the process that allows them to know how much they should expect to spend on each part of the process. Then, we offer them an advance of those funds so they're never out of pocket with their own money.

    Thank you very much.

    If I understand correctly, briefings are done at the member's request. In the past, were they systematically offered to members, whereas now they're only done on request? That means they need to know they can ask for a policy briefing.

    We communicate with every member who comes through the program that they have options in terms of how they would like to go through the briefing process and in terms of how they would like to communicate with us.

    Thank you very much.

    I'd like to pick up on Mr. Collins' question about surveys. As I understand it, you don't do member satisfaction surveys. Do you know if CAF members do such surveys and, if so, do you get the results of those surveys or not?

    We do not do surveys of the members ourselves. We measure pieces of the process that have been determined in collaboration with the armed forces and that would indicate a positive service experience: how quickly a member was able to schedule their briefing, how quickly we got back to them on a question and how quickly we helped them when they had an issue. All those things are tracked and those metrics are reported.

    Thank you.

    As I understand it, if a member isn't satisfied with the service, they can request adjudication, which is a kind of complaint, essentially. Are you aware of the number of complaints made, what they're about and how they're handled? Do you have information about that?

    We actually track every interaction. Each month, about 7,000 to 9,000 inquiries come in from military members. On average, we have about two per person in the pipeline in any given month, and we answer those questions. We don't look at whether something is a complaint versus a question. We just track how often someone's coming to us, what the questions are and whether we're responding to them in timely manner.

    Thank you, Ms. Normandin.

    Ms. Mathyssen, go ahead for six minutes, please.

    I appreciate your sharing your time with us today.

    I'm a little concerned, because there's some contradictory information. When Ms. Lambropoulos was asking you about whether you provide CAF members with information about how much they're allowed to use—budgets and what have you—you said no to her, but then when Madame Normandin asked the same question, you said you did provide it. Could you clarify that for me quickly?

    We do not provide them budgets for their ongoing living expenses; we provide them budgets for the actual relocation and the different pieces of that.

    Okay. Thank you so much.

    Does that clarify it?

    Yes, that clarifies it. I appreciate that.

    When we were asking about the data compiled, you said unstructured files, databases and “things like that” were compromised. That's extremely vague. Can you be more specific on that, please?

    The databases I was referring to are the databases in which we store our operating data. They were not compromised, to be very clear. Those databases that had our structured data relating to our customers and clients were not compromised.

    The data that was compromised was spreadsheets and what we and the experts refer to as “unstructured data” that was in shared drives and things like that. The difference is that the actual databases in which we have all the data we work with day to day in our systems were not compromised.

     Okay.

     After that major cyber breach was experienced, the federal government announced it would be offering services for all current or former members of the public service, the RCMP, the Canadian Armed Forces and their families who relocated with your service. It's put that back under the public service, as I understand it.

    Just so I'm clear on it, who is currently providing those services for relocation? Is it your organization or is it the public service?

    I'm not sure I understand the question.

    The relocation services that you provide were shifted, as I understand it, because of that data breach—certainly within the RCMP—but who is currently providing those services? Is it both? Is it a combination? Is it your company, or is it the public service?

    In terms of the RCMP, there's been no change to our contract and our relationship with them since the data breach. Prior to, during and now, we have a limited scope with them whereby we provide a service directory of suppliers.

    For the other contracts, with the CAF and the Treasury Board, we have provided full move consulting and we continue to do that. There's been no change in the services we provide.

    The contract we have with PSPC is to move household goods and autos. That is a separate contract, which we continue to be part of.

    From what you're saying, there is no doubling up of service.

    Not that I'm aware of.

    Okay.

     One of the major concerns that we heard about the relocation program was the fact that there's a gap for military spouses after separation. Separations are a really tough time, of course, for anyone going through them, but it's unique when a military spouse has to move away. They're already away from their support systems and may have to move back if there's a delay or a gap in that move or that relocation. That causes additional stress and problems.

    Do you have any information that you can share with us about conversations you've had with the Department of National Defence about expanding final move funding or relocation services when things like this happen within human activities?

    I am not aware of conversations that we've been involved in about changing any policies.

    We provide funding advances, as I said, to folks who are in the move process so that there are no out-of-pocket expenses. If someone comes back to us with additional services that are part of the policy and that they need additional funds for, we would give them an additional advance.

     At the end of the move, after we've collected all of the receipts from all of the customers, we would reconcile the actual supported amounts with the advances.

    When Brigadier-General Tattersall was at this committee, I asked her about the RCMP having brought a lot of the services out of your company and back into the public service.

    You're currently renegotiating your contract. Can you talk about which elements are potentially being brought back in-house, and then what your bid is currently or what the contract is being offered for?

    The contract with the RCMP has been for us to maintain a service directory of local suppliers around Canada and to negotiate, by province, the rates that they can charge. As far as I am aware, that has been consistently in place, and it is exactly what we are bidding on moving forward.

    Thank you, Ms. Mathyssen.

    We're now into the five-minute round, with Mr. Kelly.

     Thank you.

    Will you table the email that you sent to the CAF on October 4?

    I would have to get back to the committee with that, but I could do that.

    Okay. Thank you.

    You explained that “unstructured data” means a number of different ways that information can be organized in a variety of shared places. Do you even know what data could potentially be contained in this unstructured data?

    At this point, we are in the middle of going through and reviewing what is in all of those files that were copied—

    Okay. Thank you.

    This is a large undertaking, then, to even know what we're talking about. Is that why you haven't—

    Yes, we have a lot of experts who—

    Okay.

    Part of the reason why I think it's important that we have that email is that the November 17 statement from the Treasury Board says that they were notified on October 19. We know that's incorrect. We know that Mrs. Gallant informed the minister on October 6. The minister didn't seem to know. You've told the committee now that they were notified through a phone call on October 3 and an email on October 4, so I think we need to know. As parliamentarians, we have a responsibility to get to the bottom of what the government's response was for something this serious.

    Was ransom paid?

    No. Ransom was not paid.

    Okay.

    Let me be clear about the communication.

    The communication that was verbal on October 3 and October 4 related to our system being encrypted and not available. October 19 was when the data was released on the dark web. Then we communicated about the data after that event happened, so on October 19. There were two different communications that related to the two different issues. From September 29 until October 19, no data had been released, and we were working to keep that data confidential at that point in time.

    How do you know that no data was released before October 19 or that no data was taken before October 19?

    We know that on September 29 the systems were shut down. We knew at that point that there was data that was partially copied. We shut the door on the bad actors in the middle of that. On October 3, we did that verbal communication about the system being locked down. On October 4, we communicated.

    We monitored the dark web. Until October 19, we continued our conversations with the bad actors to try to keep that data confidential. There could have been some data that we were not aware of that could have been released.

    You weren't able to identify the individual you contacted by phone. You described the role, but could you also follow up with the committee when you recall or are able to tell us whom you actually called by telephone on October 3?

    Absolutely.

    Thank you.

    Were you aware that you were a target for a cyber-attack?

    No.

    Before the September cyber-attack, neither the Communications Security Establishment nor the Canadian Centre for Cyber Security warned you. Were there any kinds of warnings or signs or communications from those organizations to you?

    I am not aware of any communications from anyone outside of our organization. As it's commonplace today in the world, we were obviously aware that this was taking place in other organizations, and we were very diligent and vigilant about protecting our flanks.

    Can you characterize the response of the federal government after the attack took place?

    They expressed their concern, and they wanted to make sure that we were committed to corrective actions.

    Thank you.

    I'd just like some clarification, Mr. Olmsted. When you say that on October 3 or October 4 it was encrypted and not available, was that encryption by you, or was that by the bad actor?

     It was by the bad actor.

    Okay. Thank you for that point.

    Madame Lalonde, go ahead, please, for five minutes.

    Thank you very much, Mr. Chair.

    Thank you for being here, Mr. Olmsted. I thank you very much for being part of this conversation. Maybe I'll bring you back again on our motion on some of the roles you have had over the last 15-plus years in helping our military families to relocate.

     I would like you to talk to us and share your perspective with this committee and, I will say, the success, maybe, that you have seen in relocating our CAF members, including some of the programs, initiatives and policies that you have supported our members with when they have been required to move across the country.

    First of all, just to be personal for a second, moving military members is very close to me. I have a daughter who served in the U.S. Navy and was relocated with her family multiple times. I have been on the “dad side” in watching it happen, and it is a very complex and difficult process at times.

    We have worked collaboratively throughout the years on the contracts, working with the military on delivery and how we can improve it for members. When we went into this contract that was really modernizing the delivery and utilizing technology along with just-in-time support, we very quickly, in the first year, heard concerns around the lack of briefings taking place on the bases. We heard concerns around something called a relocation card, which was introduced with the contract. On both of those things, we sat down with the CAF, the procurement folks and the contracting officer and talked about what the different options were and what things we do in the corporate world. We have 600 corporate clients we help with relocations.

    We worked together to reinstate the option of the briefings that would allow members who wanted that time to ask questions and to have that one-on-one communication. We also reintroduced using electronic fund transfers to the members, versus the relocation card, which included making sure that we were giving the advances so that those members were never out of pocket.

     Those are a couple of examples of things that I've seen over time where the collaboration between the Canadian Armed Forces and ourselves has benefited the members. That's why I feel really good about the operational and process-related work we've done, which I feel has improved the process for the members.

    Thank you very much.

    First, on behalf of all of us here in this committee, we would like to say thanks to your daughter for serving. We're always happy to say thank you to our own Canadian military, but certainly from a dad's perspective it must be wonderful to share this story today with us.

    As you know, here in Canada, in terms of the Canadian government, the responsibility for the housing for the Canadian Armed Forces falls under the Minister of National Defence, and certainly the Minister of Housing, Infrastructure and Communities is probably not as close to that conversation. Maybe you can share with this committee some of the changes. That's why we're here, to hear what changes or improvements you would recommend to the Minister of National Defence in addressing the challenges of the lack of housing available on base.

    We share the committee's concern about housing availability, but we don't have any involvement in building or maintaining housing. With respect, we really believe that there are others who should have a bigger role in looking at those and coming up with solutions. It's just not our area of expertise.

    That's fair.

    Thank you again, sir.

    Madame Normandin, you have two and a half minutes.

    Thank you very much, Mr. Chair.

    Mr. Olmsted, if you don't mind, I'd like to go back to evaluating CAF members' satisfaction with your services. You have information about how long it takes to respond to their requests, so you can do a quantitative evaluation, but you don't have any way to do a qualitative evaluation of CAF members' experience. Is that right?

     That's correct.

    So, in a way, you have no incentive to improve your services because you don't even know your client satisfaction rate. Is that right?

    We review all of our interactions. We have team members in a quality control role, in which they can review, listen to phone calls and grade our employees. We take a lot of pride. Our team likes to say they're serving those who serve. We take a lot of pride in how we deliver those services, and our team works very hard to ensure that nobody gets off a chat or a phone call without feeling that we've satisfied their need. We actually even track how often someone's issue is resolved in the first interaction.

    We measure those things, and while they are quantitative, we truly believe that our quality assurance team ensures that the members go away satisfied with the answers and with the support they're getting.

    Even so, there's no way to see how people's satisfaction changes over time. Here's a very specific example. Would you be able to tell me how many complaints you've received about the availability of services in French in a given year compared to other years?

    We measure how often someone comes in and asks for the support in French, and we have never had less than 100% ability in any month to serve a member in French.

    Thank you, Ms. Normandin.

    Ms. Mathyssen, go ahead for two and a half minutes.

    Just to clarify, I understand that you take a lot of pride in your work, and the people who work with you also do, which is amazing, but there was a cost to the service contract that you did provide, and I believe it was $123 million at the time of this breach. The government offered those impacted credit monitoring and reissuing of passports, and that was all provided by the public service. Out of that contract and the funds, was it the Government of Canada that paid for that coverage for credit monitoring, or was it your company?

    At this point, since we do not have a list of who the impacted individuals were, we have not been able to provide support to those individuals. We are committed, once we finish the evaluation, to providing that support at our expense. About 500,000 folks have been moved over the last 25 years by us, and that number is way higher than the number of those who will actually have been impacted. We think a fraction of those people could have been impacted by this.

    Okay. So a commitment has been negotiated between you and the government that, no matter how long it takes to provide that list, the government will be compensated out of what has already been paid to your company.

    We have committed to supporting the individuals who we identify have been impacted. We have made that commitment to all of our clients, not just the government.

    That wasn't very clear. Is that a yes or a no in terms of that payment?

    Yes, we will support anyone who was impacted.

    You will support anyone who has been impacted, but are you going to pay back the money the public service has covered for services to help those families and so on who had to have information covered?

    We will if they are on the list of impacted individuals.

    Okay.

    Is that my time?

    You have eight seconds, so I think that's your time.

    That's my time.

    Mr. Bezan, go ahead for five minutes.

     Thank you, Mr. Chair.

    I want to thank our witness for being with us.

    For clarification's sake, does Sirva provide any moving services to the U.S. armed forces at any of the branches?

    I don't think I am at liberty to share information about our other clients, but it would be public information if we're taking part. I would be remiss if I said that we weren't taking part at an agent level for the moves, because it's the largest mover in the world.

    Sir, I think the question is germane based upon the data breach that happened with the Canadian Armed Forces, the RCMP and other public servants in Canada. I'm concerned if that also happened to U.S. service members and what steps are being taken. There might be a chance to replicate here in Canada what the U.S. is doing to ensure the safety of information for our service members.

    I would need to get back to the committee on that.

    Okay, please, if you could do that, we would appreciate that very much.

    Is the system that was breached the service system or is it the system that you guys acquired when you took over BGRS?

    It was the full system, both sides of the organization.

    The attack happened on which side of the system, the Sirva or the BGRS database?

    It's all one system at this point. It's all connected.

    For clarification, when you found out you were getting hacked on the 28th and you shut down the system on the 29th...or was the system still open, but you guys tried to take it off-line? Walk me quickly through exactly how you thought you stopped them from hacking in, yet data was still leaking from September 29 right through until October 19.

    The data they copied all happened during the night of the 28th and the 29th. We shut the bad actor out of the system in the middle of that process. At the same time—

    You knew on the 29th that you had been hacked, yet on October 3, you just told verbally the Canadian Armed Forces, and then again by email on October 4, that you were off-line. You didn't disclose that you had been hacked.

    We disclosed that the bad actor had encrypted our system.

    Okay, but—

    They came in and encrypted the system. At the same time, they were copying some files.

    They encrypted it so you couldn't even access your own files. They not only copied the data, but also encrypted it so you guys couldn't get back into the system.

    They encrypted a number of our systems, not all of them.

    Based upon the data that's there.... You said they're still reviewing it, but it's been three months. You said they copied the data. You said that no ransom has been paid. Can you tell us whether these bad actors are adversarial foreign states, or if it is more into the illegal crime organizations that are out there doing these hacks?

    Everything—all the evidence and all the work we've done—points to this being a financially motivated bad actor; it was not a state-related actor.

    Okay, so it's ransomware, and you didn't pay any ransom. They will then, of course, try to sell the copied data, which would be personal identity theft to generate any revenue. Is that right?

    Presumably. Again, they're criminals, and I won't try to guess what their intentions were.

    Knowing that you are handling data that is sensitive from the Canadian Armed Forces members, which includes everything from financial data to birthplaces, passport numbers and potentially security clearance information, especially for the higher-level officers you are moving, do you believe you have a liability issue here to those individuals, as well as to the Canadian Armed Forces and the Government of Canada?

    As I said, we regret that this incident took place, and we are committed to supporting any individuals who have been impacted by it.

    Thank you for your testimony.

    Mr. Chair, with the final 30 seconds I have, I'd like to resume debate on my motion that was adjourned on Monday, January 29.

    I so move.

    It's a dilatory motion.

    (Motion negatived: nays 6; yeas 5)

    The Chair: We will continue on with the final five minutes.

    Mr. Fisher, you have five minutes, please.

     Thank you very much, Mr. Chair.

    Mr. Olmsted, I want to thank you for being here. I want to thank you for being so patient with the delay for the 10 votes that we had earlier. I really appreciate that. Sometimes that just happens around this place.

    There have been some reasonably heavy questions asked of you today, but I'm going to ask you a question that's probably going to fit right into your wheelhouse.

    I just don't have the absolute structure of what a successful transition looks like. With the remaining time, can you just walk us through the components of a successful transition? What factors make it successful, i.e., the speed, the time, the different cities, the virtual services, etc.? If you can, just walk us through that, and maybe even touch on.... Do you actually help find the home? Just break it down into pieces of what it looks like when it works.

    The way a relocation with the Canadian Armed Forces and our services work is that we get in contact when the member is posted and knows they're moving. We work with them. We give them, as I said before, options on how they want to communicate with us, how much assistance they want from one of our counsellors and how much they want to do themselves on the member secure website.

    The modernized delivery that's being used by the Canadian Armed Forces during this contract is really the model that other corporations around the globe are moving towards. The younger generation doesn't want to talk to people, so for us a success in that beginning is making sure that we understand what's important to the member, what their hot buttons are for this move and how they want to communicate with us.

    We then do the briefing with them, or they do the briefing themselves online, and then we're available to answer their questions. They can come back to us at any time through chat, through email or through the phone. We will then give them a budget that shows them what the different components of a move should cost them. We then offer them an advance of funds so that they won't be out of pocket. We then give them the directory of local suppliers so that on both ends of the transaction—their departure and their destination—they have the suppliers they can pick from to use. They do that. They pay those suppliers. They arrange when the suppliers are coming to their home.

    Outside of that process, a mover is given to us, which that particular transferring member should use. We communicate that to them, and they work with that mover. That mover could be a Sirva mover, because we are one of the providers who are in that contract also. We then work with the member throughout the process to make sure they're getting the support they need from those local suppliers, and then, when they are done with the move, we collect from them all the bills and receipts that support the monies they spent. We will reconcile that to any advances they received. If they have additional funds, we will give that to them. If they've been given more, and if they've been prudent and have not spent all of their advances, we then collect those funds back from them, as they are public funds and we can let them keep only what is supported through the move.

    For us, a successful move is that someone goes through that process in a time frame that they laid out in the beginning of the move; that we've supported them and their spouse in the way they talked about or communicated at the beginning of the move; and that there were no significant issues that slowed down or disrupted the process for them.

    Thank you, Mr. Fisher.

    That brings our time to a close, Mr. Olmsted, but before I release you, just arising out of Mr. Bezan's questions, do you have any evidence that any of the information is being shopped on the dark web?

    Not that I'm aware of.

    Okay. Thank you.

    Colleagues, that does bring us to an end.

    For Monday, we have the ombudsman confirmed, and the military family centres that are invited not confirmed.

     I would like to use part of Monday to just scope out where we're going. I also need some advice for our travel submission, which is due on February 16, on what people would like to do. I know that Mr. Fillmore wants to take his space study down to NASA to get it launched, so to speak. That's really the clerk's joke. I stole it from him.

    The Latvian defence minister and foreign affairs committee chair, whom we saw when we were in Latvia, will be visiting Ottawa from May 27 to 31. We're working on the assumption that the committee would like to meet with them.

    Minister Blair is also confirmed for a week from today. It's the transparency study.

    Again, thank you, Mr. Olmsted, for your patience. We appreciate your testimony.

    The meeting is adjourned.