Access delayed

In early 2017, while reviewing some records I had obtained under the Access to Information Act (ATIA), I spotted an obscure reference to a Canadian defence project to assess the vulnerability of military bases.

The reference had little information. A contract had been signed with an external consulting firm to assess bases in Halifax, Toronto, Ottawa, Edmonton and elsewhere. That was it. The open-source databases on federal contracts that I checked were silent about the mystery project.

So on April 5, 2017, I asked National Defence under the ATIA for a copy of the contract, and for all “deliverables” received to date, that is, any consultant reports.

The department responded with nothing. Citing Section 10(2) of the Act, National Defence declined even to acknowledge the existence of the records. And it said if the records did exist, they would be entirely withheld because of the defence and security exemptions (Section 15 & 16). So of course I complained to the Information Commissioner of Canada (OIC).

An investigator with the OIC contacted me last fall to say he had just been assigned my file, more than four years after I had complained. “Please allow me to apologize for the length of time it has taken to advance your complaint,” he said in a Nov. 30, 2021, email. “Your patience is appreciated.”

The investigator apparently lit a fire under National Defence because they responded to my request last month with some heavily redacted records, more than five years after I had asked for them.

The records were intriguing. National Defence signed a two-year, $1.6-million contract in August 2016 with an American firm, Watermark Risk Management of Fairfax, Va. The consultant was given detailed knowledge of the vulnerabilities at Canadian bases so it could advise on improving physical security, “to prevent injury to … personnel, sensitive assets, and operations.”

Watermark’s website lists nine U.S. government agencies among its clients, including the U.S. Space Force, and says it does work for some unidentified private firms in the Fortune 200 list. Its experts, many with military backgrounds, help spot weak points in infrastructure that may become targets of terrorists and other bad actors.

The National Defence contract got a national-security exemption from the normal rules for procurement, likely the reason I could find nothing in any database. The list of military bases that were assessed is blacked out, as are the reports Watermark produced. Yet I knew from my initial research about at least four specific locations.

But most interesting to me was the contract’s language about secrecy. Watermark was to adhere to U.S. security standards when gathering, processing and storing sensitive Canadian military information. For example, at the end of the contract all data was to be safeguarded “in accordance with the National Policies of the United States.” Only citizens of the United States, Great Britain, Australia, New Zealand and Canada could work on the project, and all must hold “a valid personnel security screening at the level of Secret, as required, granted or approved by their respective country … in accordance with the National Policies of the United States.” And so on.

There’s no evidence Watermark is anything other than a reputable firm. But I would have loved to report in 2017 about the data-sovereignty issues the contract raises, with its default to American rules and standards. Or about a U.S. private corporation’s acquisition of highly sensitive details of Canada’s military base vulnerabilities. Alas, the two-year contract has long expired, and years have passed since the project wound down. Today it seems more relevant to history than as a live issue for public debate.

And that, in a nutshell, is why Canada urgently needs to fix its broken Access to Information Act. Endemic delays of five years and more serve only to insulate governments from tough questions – and impoverish public discourse.

July 20, 2022

July 27, 2022 update: I changed paragraph four, adding that National Defence initially did not even acknowledge the existence of the records, citing Section 10(2) of the Act.