CIMM Committee Meeting

     Good morning, everyone.

    I call this meeting to order.

    Thank you, everyone, for coming in early in the morning, and special thanks to Ms. Kwan, because I know it's very early in British Columbia. Thanks to all of the members for accommodating this time.

    Welcome to meeting number 16 of the House of Commons Standing Committee on Citizenship and Immigration.

    To allow our services to prepare this room for the next meeting, we should adjourn this meeting no later than 10 a.m. Given the ongoing pandemic situation and in light of the recommendations from the health authorities as well as the director of the Board of Internal Economy on January 28, 2021, to remain healthy and safe, to all of those attending the meeting in-person, please maintain physical distance of at least two metres from others. Wear a non-medical mask when moving in the meeting room and preferably wear a mask at all times, including when seated. Maintain proper hand hygiene by using the provided hand sanitizers at the room entrance and wash your hands well with soap regularly. As the chair, I will be enforcing these measures for the duration of the meeting, and I thank all of the members in advance for their co-operation.

    Pursuant to Standing Order 108(2), the committee is resuming its study of the immigration and refugee measures for the people of Hong Kong. Today's meeting is taking place in a hybrid format pursuant to the House order of January 25, 2021. The proceedings will be made available via the House of Commons website. So you are aware, the webcast will always show the person speaking rather than the entirety of the committee.

    I would like to take this opportunity to remind all participants to this meeting that screenshots or taking photos of your screen is not permitted. For those participating virtually, I would like to outline a few rules to follow.

     Members and witnesses may speak in the official language of their choice. Interpretation services are available for this meeting. You have the choice at the bottom of your screen, either French or English. With the latest Zoom version, you may speak in the language of your choice without the need to select the corresponding language channel. You will also notice that the platform “raise hand” feature is now in a more easily accessed location on the main toolbar, should you wish to speak or alert the chair.

    For members participating in person, proceed as you usually would when the whole committee is meeting in person in a committee room. Before speaking, please wait until I recognize you by name. If you are on the video conference, please click on the microphone icon to unmute yourself. For those in the room, your microphone will be controlled as normal by the proceedings and verification officer.

    This is a reminder that all comments by members and witnesses should be addressed through the chair. When you are not speaking, your microphone should be on mute. With regard to a speaking list, the committee clerk and I will do the best we can to maintain a consolidated order of speaking for all members whether they are participating virtually or in person.

     With this, I would like to welcome our witnesses. Representing VFS Global, I would like to welcome Mr. Chris Dix, head of business development, and Mr. Jiten Vyas, regional, group chief operating officer, APAC, CIS, Europe and sub-Saharan Africa.

    Mr. Dix, you have five minutes for your opening remarks. You can please start.

     Madam Chair, committee members, on behalf of VFS Global I'd like to thank you for the invitation to speak today.

    I'd like to thank the committee also for accommodating the time difference, allowing us to appear today from our headquarters in Dubai.

    Madam Chair, VFS welcomes this scrutiny. It's essential that Canadians have full confidence in the integrity and the security of their government's programs and services.

    At VFS Global the security of personal information entrusted to our care is our paramount concern. We work with a range of world-leading cybersecurity providers and also very closely with our cybersecurity consultant, Conrad Prince, to ensure a very strong cybersecurity posture.

    Mr. Prince was formerly the deputy head of the U.K. government's signals intelligence and cybersecurity agency, GCHQ. He led GCHQ's intelligence and cyber operations for seven years. After that, he was appointed the United Kingdom's cybersecurity ambassador. We work very closely with Mr. Prince and we take data security very seriously at VFS Global.

    People around the world rely on us for visa and passport application services. Since we started in 2001, we have successfully received and transferred over 220 million applications, and 64 governments trust us around the world. We operate for them in 143 countries through nearly 3,500 application centres. They trust us with the secure handling of personal information. The members of the Five Eyes intelligence alliance, and virtually all European Union and NATO governments are our clients.

    Our global operations are certified ISO 27001, 2013, the global gold standard for information and data security.

    Our Canadian government client is IRCC. Our client applies stringent personal information protection standards and these are embedded in our contracts and we follow them strictly. We conduct deep identity, credit, criminal, residency, education and employment checks on all our employees before we hire them. All operations-related email and telephone communications of our staff are monitored. We don't store any personal data related to visa applications. Data is purged from our systems 30 days following a case being closed, in accordance with IRCC regulations. IRCC also conducts unannounced audits to review the integrity of our systems.

    Madam Chair, I'd now like to address some of the specific issues that have been raised in recent weeks about our operations in China.

    First, I'd like to make clear that our Canadian visa centres in China operate according to the same tough security standards we employ around the world.

    All data servers transferring China visa applications to IRCC are located in Canada. We operate no servers for IRCC in China. All access to personal information is restricted to officials who have been authorized by the Canadian government.

    Second, recent media reports have suggested that we have Chinese ownership. This is false. VFS Global is owned and controlled by EQT, a global investment organization and publicly listed company based in Sweden.

    Third, It's been alleged that sensitive data we handle is vulnerable to abuse. This too is false. Yes, we work with Chinese-owned facility management companies, but virtually all foreign companies operating in China work with locally owned, often state-owned, facility management companies. For foreign companies, they are a fixture of the business landscape in China. Facility management companies provide us with office space and administrative staff—nothing more.

    These companies do not operate our visa centres and they do not collect visa information. They do not set up or have access to our IT systems. They have no access to any data.

    For all our centres in China, VFS Global uses the same security controls we rigorously apply globally.

    Madam Chair, with that we are now pleased to take your and the committee's questions.

    Thank you.

    Thanks for your opening remarks. You are exactly on time.

    We will now go to our first round of questioning.

    We will start with Mr. Hallan. You have six minutes for your round of questioning.

     Thank you, Madam Chair.

    Thank you to all the witnesses and to VFS for being here today.

    When did VFS Global become aware of the relationship between its subcontractor in Beijing and the Chinese public security bureau?

    Good morning, sir.

    VFS Global has been operating in China since 2004-05. BSFSC is a facility management company that has been a subcontractor to VFS Global.

    In China the regulatory environment requires foreign companies such as VFS Global and some of our competitors to have local facility management companies in order to operate. The reason for this is that these companies have the entry and exit licences—

    I understand that, sir. My question was quite direct.

    When did VFS Global become aware of the relationship, in particular with Beijing Shuangxiong and the Chinese public security bureau?

     BSFSC, Beijing Shuangxiong, has been a partner to VFS since 2005. This is a named subcontractor with all our client governments, including IRCC. Since 2005, VFS Global—

    Thank you, sir.

    Was the Canadian government made aware of that at the time?

    Mr. Hallan, can you please allow Mr. Vyas to respond?

    Thank you, Madam Chair.

    Sir, to respond to your question, as far as VFS Global is concerned, the operations and the model of operating in China were absolutely made known to IRCC and to all our client governments. Every subcontractor—that is, the facility management company that we operate with—is communicated to the respective client government, and proper due diligence processes are followed, including notification to the host government.

    Thank you, sir, for that, but you didn't answer the question about when they found out.

    When was this information given to Canada?

    The information pertaining to our operations for IRCC was—

    In particular, I am referring to Beijing Shuangxiong.

    It's been open to the knowledge of IRCC right from the time we started our operations in China.

    What year was that?

    This is from 2011, and even earlier. VFS has been operating with this and a number of other FMCs.

    Thank you very much for that.

    Other countries, including New Zealand, according to that report, said they were made aware of that. They were also saying they were made to use a subcontractor.

    Was it the same case here? Was the Canadian government telling VFS that they had to use that particular contract?

    VFS Global's operations in China—across a number of cities and the 33 client governments that we work for—are operated through facility management companies. Every single facility management company that we deploy undergoes thorough due diligence, and the respective client government approves the use of the facility management company right up front. This is a named subcontractor, and due diligence processes are followed by VFS and the respective client government.

    Sir, respectfully, again, you didn't answer my question.

    Other countries, like New Zealand, have said they were told they had to partner with Beijing Shuangxiong, so they had no other choice. Was that the same for VFS and Canada?

    As far as VFS is concerned, in delivering a solution to a client government, VFS will put forth its operating model, i.e., a facility management company, to the respective client government, and it is the government that will approve the use of a particular FMC, or facility management company. That has been the case with New Zealand and a number of other client governments, sir.

     In other words, were you told to partner with that company?

    VFS was not told to partner with the company. It's VFS's operating solution that was put forth to the client government IRCC—

    Sorry for interrupting, Mr. Vyas, can you please bring your microphone closer to your mouth.

    As far as VFS operations are concerned, sir, for every client government VFS submits a list of facility management companies in the respective cities or provinces. Following the due diligence, these are approved by the respective client governments.

    When did this happen in this particular case?

    May I make a comment here with your permission, Madam Chairman, and Mr. Hallan?

    Yes, please.

    We first started working for the Canadian government in China in 2008 with this FMC and we informed the Canadian government that it was our intention to use this FMC. On a more general note, I would just like to say we do not force any client government to use—

    Sorry for interrupting, Mr. Dix, the time is up. Maybe you will get an opportunity to come back. Now we will go on to Mr. Serré.

    Mr. Serré, you have six minutes for your round of questioning.

    You can please proceed.

    Thank you, Madam Chair, and thank you to the witnesses for your comprehensive global testimony here, it's very useful for the committee to clarify a lot of the misinformation that has been given to the committee, especially by the opposition members. The Library of Parliament says that you are the largest visa application company in the world. You mentioned about 147 centres. Can you just briefly outline how many you run on behalf of the Canadian government, and how many do you run in China, quickly please?

    Sure I can certainly do that, Mr. Serré.

    We work across the globe for the Canadian government and we operate 163 application centres in 163 cities around the world, and that's in 108 countries.

    And how many in China?

    If I can respond to that, sir, on behalf of Chris, in China VFS operates for 33 client governments. Our presence in China has been since 2004-05. Across the network in China we operate close to 380 visa application centres.

    How long have you been operating in Canada for the Canadian government? Also, the opposition has tired to paint VFS as neglectful, for a breach of security. I did some research with The Globe and Mail, the National Post and the Toronto Star, and I couldn't find one security breach that identified any individuals in Hong Kong. I just wanted to see if you could clarify the issue about the security breach. That's the core of your business.

    Thank you, Mr. Serré, I'll answer that question. We've worked for Canada for a number of years. We very much value the relationship with IRCC. We have not had any data security breach for Canada, or any other client government in China or Hong Kong.

    Thank you.

    Earlier the question by the opposition was about the Chengdong Investment Corporation. My understanding is if it was you or other companies operating in China, the law in China requires that there be a facility management company. Your parent company is worth about $6 billion. Can you just clarify in regard to the Chengdong Investment Corporation that it's about 25,000 Euros, which is about $30,000 Canadian? How is that small amount of money influencing your decisions, which it is according to the opposition?

    Yes, I think your numbers are more or less correct in terms of the size of the EQT VII fund, which is the fund that contains the VFS Global.

     For legal reasons, the identity of investors in the fund cannot be identified; however, if the investment you're referring to were to be of 25,000 euros, that would equate to approximately 0.0004% of the overall fund.

    As you can imagine, it's frankly ludicrous to say that the investor would have control of the fund. In fact, no investors of that kind have any control of the fund.

    There have been no security breaches of any individuals, and you mentioned that you don't store any Canadian data. Would you maybe take the remaining two minutes I have left to talk a bit about the process?

     You've been a contractor with the Canadian government since 2012. What is the process in terms of your security and the storing of information and how secure it is? There haven't been any breaches, so I want you to elaborate on that a bit just to assure the Canadian population—and the Hong Kong people too—about the security.

    We've actually worked with the Canadian government since 2008, and from 2012 under a global contract, which was then retendered and won by us in 2018 in a competitive tender process.

    As I've mentioned, we take data security and the protection of personal information as our most important job. We ensure that all data that concerns Canadian visa applicants is stored in Canada on servers operated there. It's a contractual requirement that we do that.

    We send all data, fully encrypted, to Canada, and it is then only accessible by authorized personnel of the Canadian government. We ourselves—

    I am sorry for interrupting, Mr. Dix. The time is up.

     We will have to now move to the next member.

    Madame Normandin will now have her six minutes for her round of questioning.

    I'd like to thank the witnesses very much for being with us and for the responses they've given.

    I'd like to make sure that I've understood what you've said. You mentioned that VFS Global has been a partner with Canada for its offices in China since about 2004 or 2005.

    Is that correct?

    Since 2008, we have been a partner with Canada in China.

    Could you confirm for me exactly how long VFS Global has been subcontracting to BSFSC?

    Madam Chair, may I respond to that?

    VFS has been operating in China since 2004-05. VFS has been operating through a number of facility management companies in China since 2004-05, and BSFSC is one of them.

    And as far as IRCC is concerned, how long has VFS Global been doing business with BSFSC?

    VFS has been working with BSFSC for IRCC since the inception—i.e., 2008—and thereafter with the global contract in 2012.

    Thank you.

    How did VFS Global come to work with BSFSC? Was this an offer that BSFSC made to VFS Global, or did VFS Global put out a request for proposal for a subcontractor?

    Madam Chair, the operating environment in China is as unique as a number of other countries, the 64 client governments that we work for across 140-plus countries.

    In China, since 2004-05 one of the prerequisites of the regulatory requisite is for companies to have an entry/exit licence. Foreign companies like VFS Global and some of our competitors are required to work with local facility management companies. It's these companies that have the requisite entry/exit licences, and that is where the requirement is to work with these companies, following a thorough due diligence process and the requisite approvals from our client governments.

    Please confirm that I've understood.

    VFS Global had no possible partners other than BSFSC.

    VFS operates with a number of facility management companies across China. BSFSC happens to be just one of them.

    Following, one, the entry/exit licence requirements, two, the requirements of our client governments, and finally a thorough due diligence process, BSFSC and our other FMCs are appointed.

    I'll clarify my question.

    For the Beijing office, were there any possible partners other than BSFSC?

    We do have other facility management companies operating throughout China. In Beijing as well, the answer is yes. In the operating environment that we follow, with the approval of our client governments, we have a number of FMCs that we operate with, the reason being to ensure de-risking our operations from a control perspective, and to ensure that we don't put all our eggs in one basket. That is, again, very important. Finally, just to reiterate, it's the approval of the client governments that we always take into account before appointing an FMC.

    How many partner applications were analyzed for the Beijing office?

    In Beijing, in our operations we work with three different facility management companies.

    Just for the IRCC office in Beijing, how many partners were analyzed?

    For the IRCC operations in Beijing, when we set the operations in 2008, we analyzed two potential facility management companies. At that point in time the priority was, of course, the due diligence processes, approvals of client governments, i.e., IRCC, and then the requirements of client governments. How soon is one required to set the visa application centre operations, what are the volumes coming through and how soon will they be able to accommodate the entry/exit licence approvals? These are some of the factors that are taken into account before identifying and approving an FMC, subject to client government approvals, of course.

    Is it possible to know which other company was analyzed?

    Madam Normandin, your time is up.

    Can I get a quick answer, please?

    Madam Chair, we have two other companies—

    I think when we get to the second round you will have an opportunity.

    We will now move on to Ms. Kwan.

    Ms. Kwan, you have six minutes for your round of questioning.

    Thank you very much.

    According to The Globe and Mail article, Britain's corporate registry...Chengdong Investment Corporation is one of the most significant contributing partners to the parent company of TT Services, which runs the visa application centres for the Canadian government in 24 countries. In China alone there are 11 locations.

    TT Services is owned by VFS Global. Is that correct?

    I will answer that question, if I may, Ms. Kwan.

    Just give a quick yes or no, please.

    No, I'm afraid I can't answer it with just a yes or no. TT Services is a subsidiary of VFS Global, or a sister company. It is owned by VFS International Investments, AG Zurich.

     Can you table for the committee the names of the parent companies, the subsidiaries, the ownership structure and subcontractors of the visa application centres for Canada in all 24 countries?

    We can provide that information to the committee.

    Thank you.

    In a different Globe and Mail article, we have learned that the subcontractor Beijing Shuangxiong Foreign Service Company is delivering VAC services in China for the Canadian government, and that company is owned by the Beijing Municipal Public Security Bureau. Is that correct?

    Beijing Shuangxiong is owned by Beijing Tongda Asset Management, which in turn is owned by the parent Beijing Sifu Enterprise Management, which is an investment of the organization. It has a number of private investments ranging from hospitality to transportation to retail.

    Are you saying that the Beijing Municipal Public Security Bureau does not have any ownership of the Shuangxiong Foreign Service Company?

    The BSFSC ownership that I just described is through Beijing Tongda Asset Management, and above that stands Beijing Sifu Enterprise Management. It is a common practice in China for private and state-owned companies to have investments in a number of organizations within the entities or the industries that I just described.

    I guess they are investments that they have within it. According to the company's own website, it was established in 1993 and is a state-owned enterprise with more than 180 employees. Is that what you found in your own due diligence?

    Indeed, it is definitely a state-owned enterprise. I highlighted in my earlier response that it is an SOE, and it is also a common practice for SOEs to have investments in private organizations.

    How many CCP members work in each of these companies?

    I would not know that offhand. As far as VFS Global employees are concerned, every employee at VFS Global undergoes thorough checks regarding employment, education, criminal and identity, and every employee of VFS is then duly approved by the respective client government. It is only then that—

    I'm sorry; I'm just going to interrupt for a second here. Can you table the information of how many of your employees are CCP members for the committee?

    Definitely we can look in to this, but just to clarify, Madam Chair, this is something that we will have to get back to you on.

    Thank you.

    Are you aware that, if there are three or more CCP members working for the company, it triggers a series of Chinese regulations?

    We are aware of the regulatory as well as the label law requirements in China. The short answer to that is yes.

    Then you will be aware that the Chinese regulations are such that they require that any state-owned company must include recognition of the Communist Party in its articles of association, and a party organ must be created in any state firm that employs more than three Communist Party members. Are you aware of that?

    It is one of the requirements exactly as you described.

    Okay.

    However, VFS Global policies are very robust right from the recruitment process approval of client governments.

    Thank you.

    According to those regulations, it further states that all major business and management decisions must be discussed by the Communist Party organ before being presented to the board of directors or management for decision. It further states that the party secretary and chairman of the board of a state firm should be “the same person” and that the general manager position within the state company must be filled by a deputy party committee secretary. It doesn't stop there. For those enterprises under the direct control of the central government, the board of directors must include a special deputy party secretary who takes no management role and is exclusively responsible for party building. The first role of the directors or executive who are party members is to—

     I'm sorry for interrupting, Ms. Kwan. Your time is up. We will have to—

    Sorry, can I just finish my sentence?

    —to execute the will of the party in performing their duties.

    Thank you, Ms. Kwan. We will have to now move on to our next member.

    Mr. Chiu, you have five minutes for your round of questioning.

    Thank you, Madam Chair.

    I appreciate the witnesses coming to the committee and providing us direct and short answers, understanding the time pressure that we are under.

    I want to continue with Madam Kwan's questioning here. If you could actually provide a response to her last question, using my time, that would be much appreciated.

    Just to reiterate once again in response to what the member who was on earlier said in reference to the Chinese law and the membership of CCP, at VFS we want to clarify that no facility management owners have any role whatsoever in the visa application process that my colleague, Chris Dix, and I, have just described.

    Also, I want to highlight that VFS Global has its own operational management structure within China. We have a chief operating officer with a very robust organization structure in China, comprising 172 employees of VFS who oversee our operations, in conformance with our client government contracts.

    Thank you.

    Just like the African Union, they were not expecting that the gift from China would have included surveillance and espionage equipment in the African Union building.

    I would like to ask what steps the VFS security department implemented to safeguard data from being inadvertently obtained by third party countries?

    Mr. Chiu, I'll take that information and that question.

    As my colleague, Jiten, has mentioned—and I have mentioned also already—no facility management company has access to our data.

    All our visa application data is fully encrypted at the entry point and transferred securely and directly to servers located in jurisdictions defined by the client government.

    For instance, in the case of a European country, that would be in the Schengen area. In the case of Canada, it's in Canada and then only government officials authorized to have access to that information have access to it. I repeat, it's fully encrypted. All of our operations are certified ISO 27001 for information security management, and that certification—

    Thank you, Mr. Dix. I appreciate that.

    Can I ask what type of computer equipment...? Have you used equipment by any Chinese state firm, such as Huawei, in your VFS network in China?

    Madam Chair, this is something, if the members permit, we should be able to come back to you on, however—

    Could you table that for the committee, please?

    We can certainly do that.

    Thank you.

    There is just one point to highlight, Madam Chair.

    All the IT hardware and the equipment is absolutely hardened within the visa application centres. What we mean is, there is no access to emails, there is no USB drive, no pen drive that can copy any data whatsoever. Access is driven through role-based, which is only to VFS Global personnel.

    As Chris Dix, my colleague, described, the servers are hosted in Canada and encrypted.

    Thank you.

    Thank you, Mr. Vyas.

    I'm sure the African Union would actually appreciate data security as well, and somehow nightly there have been downloads of data to China from Africa, so please understand that we are not conspiracy theorists here. Also, there have been media reports, specifically Global News in Canada has reported that there has been a leak of data pertaining to Italy. There was a leak.

    My first question is: has that actually happened? My second question is: has it been updated to the Canadian authority, such as IRCC?

    We all know there's a global army of aggressive hackers out there and we're constantly making sure that our systems are up to date.

    On the very rare occasion...and the incident that you referred to, Mr. Chiu, did happen—

    I'm sorry for interrupting, Mr. Dix.

    The time is up.

    We will have to now move to our next member.

    Mr. Regan is next.

    I have a point of order, Madam Chair.

    He should be able to finish his answer to the question even if the time is up so it's on the record.

    We are on a strict timeline to end at 10 a.m.

    If the other member allows, then they can go ahead.

    I can be very quick, Madam Chair.

    Okay.

    Quickly, please.

    On the very rare occasions when breaches or incidents occur, we are always entirely transparent with our client governments and we take swift action to rectify the situation. We did inform the Italian government and we also informed the U.K. Information Commissioner's office about the incident.

    Thank you.

    Mr. Regan, you have five minutes for your round of questioning.

    Thank you very much, Madam Chair.

    Thanks to the witnesses.

    I know you've stated that this arrangement in China has been in place since 2008.

    I'd like to understand the nature of your subcontracts. How many local companies in China are involved with VFS and are they subject to the same clauses and vetting processes as you are, as the prime contractor?

    Madam Chair, can I respond to that?

    Yes, please.

    In China we've been operating since 2004-2005 and we have 11 facility management companies across China. Every facility management company is required to hold the requisite entry/exit licence. All facility management companies undergo VFS Global's due diligence process and thereafter the approval of the respective client government. Of course, client governments conduct their own degree of due diligence.

    As far as VFS Global is concerned, every single facility management company has flow-down provisions from our main contracts with the respective governments. This means that every facility management company across any visa centre conforms and is required to conform to the same exacting standards that VFS Global is responsible for. The delivery of customer service and the end-to-end system remains the primary objective of VFS Global.

    That is the short response to your question.

    Thank you very much.

    You've mentioned that in order to operate in China it's a business environment requirement of the Chinese government that you work with local Chinese-owned management facility companies, and this is an unavoidable element of working in China. As I understand it, these companies provide administrative staff.

    Are these staff subject to the same security checks mentioned by Mr. Dix?

    Also, can you tell us about the security of applications of people from Hong Kong and why we should be confident, if we should, about those applications being secure?

    To respond to the first part of the question, every single employee who works at the visa application centre undergoes a two-pronged due diligence check. One is from a VFS perspective and covers, as we mentioned earlier, employment, criminal, identity and education. Client governments then conduct their own due diligence on every single employee who operates within the visa application centres. Once we have the requisite approval, only then is that employee on board operating within the visa application centre.

    On the next part of the question regarding Hong Kong, in Hong Kong VFS operates through a facility management company that is owned by a Canadian national. We've been operating there since 2011, and for IRCC since 2013, and also work with 10 other client governments in Hong Kong.

    Thank you.

    Madam Chair, I'd like to give the rest of my time to Mr. Dong.

    Thank you, Madam Chair.

    Thank you, Mr. Regan.

     I'm not a permanent member of this committee but I find today's discussion quite fascinating.

    Mr. Dix, you explained that the working relationship with the local FMC is a requirement of the Chinese government.

    Is that true?

     Madam Chair, I can respond to that.

    The requirement in order to operate a visa application centre is that companies need to obtain an entry/exit licence, which is available only to Chinese local companies.

    Thank you.

    Okay, and is that the same situation for your competitors? I don't know if you have any competitors in China, but is that the same rule that would apply to your competitors, if there are any?

    A quick, 30-second answer.

    Precisely. This rule applies to all foreign companies that run visa application centres.

    Thank you.

    Were there any concerns raised in your operation in China with regard to your working relationship with the local facility managers in terms of security breaches or privacy breaches? Have there been any concerns at all raised in the past 10 years?

    Madam Chair, since 2004-05, our operations there have been extremely robust. We work for 33 client governments in China, and we have not had any concerns whatsoever. In fact, we've seen—

    I'm sorry to interrupt, Mr. Vyas, but time is up.

    Thank you.

    We now move on to Madam Normandin for two and a half minutes.

     Please proceed.

    Thank you, Madam Chair.

    I'll pick up my question where I left off. It was mentioned that two companies, including BSFSC, had been analyzed to be a facilities management company.

    What was the name of the other company?

    I'm sorry for interrupting. I don't think there is any interpretation, so we will stop the clock.

    Mr. Clerk, could you look into it?

    Please proceed, Madam Chair.

    We will have to start again, Madam Normandin, please.

    Thank you.

    I'll go back to my last question. You mentioned that VFS Global had analyzed the applications of two companies to subcontract to them. I'd like to know the name of the other company.

    I recall this is a response pending from your earlier session. We have two other facility management companies that we operate in Beijing, Beijing Eastern Tian Show Business and Beijing Balino Investment and Consulting Company in addition to VSFSC.

    Is it possible to find out why BSFSC was chosen?

    Madam Chair, as highlighted earlier during this session, a number of operating requirements stipulate the use of a particular facility management company. Most important to note is that every facility management company is duly approved by the respective client government.

     Requirements in terms of timelines or timetables to operate or open a new visa application centre, volumes that we expect the centres to process, readiness for peak seasons, the office space availability, etc. are some of the top reasons we identify and conduct due diligence and seek approval from client governments before appointing a facility management company.

    If I understand correctly, other companies were analyzed.

    Is it accurate to say that, ultimately, VFS Global had no choice but to use BSFSC?

    Give a quick, 30-second answer.

    Madam Chair, as I highlighted earlier to the member, we operate with three different facility management companies in Beijing alone across a number of client governments. The reasons articulated earlier, operational requirements, timelines to set up a visa application centre, volumes process, and most importantly, every single FMC is duly approved by the client government.

    Thank you.

    We will now move on to Ms. Kwan.

    Ms. Kwan, you have two and a half minutes for your round of questioning.

    If I may just get a clarification, when the information of the CCP members from each of the companies, subsidiaries or subcontractors is being tabled, could you make sure that this is identified with the respective companies, please?

    To follow up on that, if the FMC hires the people who work for this company, do those people not then have access to the data information?

     Madam Chair, to the member's second point, facility management companies' employees undergo the same level of due diligence as all across China, including the approval of the client government that we operate for.

    Yes, I understand that.

    As far as the process is concerned, I highlighted earlier, all our IT equipment hardware is fully hardened. There is no access to emails and no access to USB drives. The data is fully encrypted—

    I understand that.

    I'm sorry, I'm going to interrupt here because I have limited time. The fact of the matter is, though, that the FMC hired the people and they work for the company. For them to process the application, they have access to the data in processing the information. How could it be that they don't have access to the data? They process the information. They put it into the system.

    Madam Chair, the staff processes the applications within the software that is VFS-owned and VFS-protected through and through, and this data is hosted at the servers in Canada.

    Thank you. Yes, I got it.

    I go back, then, to the requirements of the Chinese regulations. For state-owned companies, if you have three or more CCP members working for a company, they are required, by Chinese regulations, to actually have a different management structure that reports back to the Chinese Communist Party. Isn't that correct?

    You have 15 seconds.

    Madam Chair, I would not be able to comment at this stage. There is a response due to the committee. We will ensure to bring this up as well.

    Thank you.

    Okay.

    We will now move on to Mr. Hallan.

    Mr. Hallan, you have three minutes for your round of questioning.

    Thank you, Madam Chair.

    I hope the witnesses can appreciate that, as the Liberal minister has said himself, China's a lot different now than it was before, and there are a lot more threats. That's why there's so much scrutiny right now, even given some of the answers that the witnesses have given. They gave three different answers to one question. They must understand how crucial it is that they answer properly here.

    Do the U.S. embassy in Beijing and the U.S. consulate in China use VFS or visa-related administrative services?

    Point of order, Madam Chair.

    Is the motion dealing with Hong Kong? I just wanted to clarify if we're focusing on Hong Kong, and not 3,000 visa facility centres across the world on a fishing expedition.

    Point of order, Madam Chair. This definitely has a lineup of questions that relate to this.

    Thank you, Mr. Serré.

    Please, Mr. Hallan, go ahead. I'll start the clock again.

    Do the U.S. embassy in Beijing and the U.S. consulate in China use VFS for visa-related administrative services? Yes or no?

    The answer is yes. The U.S. mission in China has a different operating model—

    Mr. Vyas, can you please hold your microphone closer to your mouth?

    I'm sorry, Madam Chair.

    In response to your question, VFS does operate for the U.S. government in China where VFS is a subcontractor. However, there is no visa application centre. It's a very separate process for Chinese nationals applying to the U.S.

    Thank you.

    That's important because why, then, do they not do the same thing that VFS is doing through its subcontractor in Beijing?

    I will answer that question, if I may, Madam Chair.

    Yes.

    This actually just underlines a different working method that the U.S. government has in many other countries. It doesn't follow the same approach as most of our client governments. Very often they will accept applications directly at the diplomatic mission rather than using visa application centres.

    Department officials were asked this question about knowing about subcontractors in 2013, about VFS in China and if they had any subcontractors. At that time, they said no. According to your testimony today, where you've given three different dates between the both of you, what's the right answer? Did they know in 2013 when they gave testimony here in this committee, or is it one of the answers that one of you gave today?

     I'm sorry, Mr. Hallan—

    Give a 15-second answer, please.

    —are we talking about the U.S. government here, or the Canadian government?

     The Canadian government and the subcontract that you have with the other company.

    The Canadian government has always been aware of our operating procedures in China for Canadian government operations.

    Since what date? That hasn't been clear.

    I'm sorry for interrupting. Your time is up, Mr. Hallan.

    We will have to now move to our last member for today's panel.

    Mr. Dhaliwal, you have three minutes for your round of questioning. You may please proceed.

    Thank you, Madam Chair, and thank you to the presenters.

    Mr. Vyas and Mr. Dix, you mentioned that VFS Global and BSFSC came into a relationship in 2008 when there was a Conservative government and the Prime Minister was Mr. Harper at that time, and now it's a Liberal government.

    Can you tell me when it came into effect when Mr. Harper was in power, or today, who makes those decisions on the information that you collect?

    I'll take that question if I may, Madam Chairman.

    Mr. Dhaliwal, forgive me, I am not the greatest expert as far as dates relating to Canadian prime ministers are concerned, but also I think I should say on this point that it's not really for me to answer for the Canadian government on how they make their own internal approval decisions.

    When you take the applications, who makes the decision? Is it the BSFSC, VFS Global or IRCC officers who make those decisions?

    I'm sorry, I misunderstood your question, Mr. Dhaliwal. It is IRCC that makes these decisions. VFS Global purely performs administrative tasks. The decision-making tasks of the visa application are always the responsibility of the client government, in this case IRCC, and those decisions are made by authorized personnel who have access to the visa application material that is stored on those servers in Canada.

    Since its inception in 2008, have you had any security or privacy issues reported to IRCC in those years of your contract? Have there been any individuals negatively impacted by the potential information leak?

    Mr. Dhaliwal, I can say for sure that we have had no cybersecurity-related issues in China for IRCC since 2008. In fact, we've had no cybersecurity-related issues in China for any client government since we started work there in 2004.

    Are the information systems that you use in Hong Kong or in China similar to the ones that you use across the globe?

    You have 10 seconds.

    The systems are absolutely identical. The information is sent encrypted direct to those servers in Canada—

    I'm sorry for interrupting, Mr. Dix, the time is up.

    Thank you to both the witnesses.

    I'm sorry, Madam Chair, before you adjourn the meeting, I have my hand up on a point of order, please.

    Yes, Ms. Kwan.

    I'd like to get clarification on when the committee could receive the information that I've requested. Could I get a date, please?

    Thank you, Ms. Kwan.

    I would request both the witnesses to provide the information that has been requested by the committee member. Is there any timeline you can provide us now, or can you provide that information afterwards?

    Madam Chair, if it's okay, allow us to come back to the committee by the end of the day today to confirm the timeline by when we can provide the details requested by the member.

    Thank you, Mr. Vyas. You can let the clerk know about the date, and once the clerk has the date it will be provided to all the members.

    Thank you, Madam Chair.

    I'm sorry, I have one other point of order, if I may.

    We have to end this meeting right now. The witnesses will let us know about the timeline, when they can provide us the information. Once I have that timeline, I will communicate it to all the members.

     I understand that.

    Madam Chair, very quickly, I just want to note, in terms of the study, the limitation of the study and the timeline, that we need to receive that information before this study is over.

    Thank you, Ms. Kwan.

    That's not a point of order.

    It's not a point of order. I will have to wait for the communication from the witnesses. Once we have the information, if it doesn't fall in the timeline, then we will communicate with the witnesses.

    With that, I want to thank both of the witnesses for appearing before the committee today and providing us with this important information. Thank you once again on behalf of all of the members.

    The meeting is now adjourned.