This article is an extract from the 5th edition of Government Procurement.
In its 2022 report entitled Recommendations Regarding Call for Tenders 17- 6146 Involving the Acquisition of a Cloud Solution by Ville de Montréal, Montreal’s Inspector General found that the City of Montreal improperly awarded a $16 million cloud services contract to a non-compliant bidder. The report concluded that the winning bidder, Onix Networking Canada Inc., “should have been found non-compliant, since the company’s bid contained major irregularities on key elements of the call for tenders” and that “the bid assessment was not consistent with respect to all the bidders for a technical compliance requirement.”
More specifically, the report found that the solicitation called for a four-year service period, along with three additional two-year extension options, but that the winning bidder “added a change to the tender documents with its bid by not committing to the option years”. The Inspector General found that this constituted “a major irregularity and a unilateral change to the tender documents that resulted in Onix’s price being indeterminable for the three renewal options.”
Further, the report found that the selected solution failed to meet one of the technical compliance requirements, which “should have excluded Onix’s bid from the tendering process.” As the report detailed, the requirement in question called for a solution that would deny user access to the system after a set number of access attempts:
3.2.1.2. Requirement 48
Among the 57 requirements, Requirement 48 stated that the proposed solution should block users who were unable to access their employee account:
“The solution must deny access to any user after a set number of unsuccessful access attempts.”
This is a known feature used in several IT solutions that blocks access to any employee who is unable to log in to their account. In such a case, the employee must contact an administrator or the IT Department to “unlock” their account and enable the employee to access it again. The objective of such a feature is system security by blocking access to someone not working for Ville de Montréal.
However, during the evaluation process, City evaluators discovered that the proposed solution did not include this function:
The investigation revealed that technical committee members were unable to determine whether G-Suite met Requirement 48 in the specifications. During the assessment process, a question was sent to the Onix bidder to verify its solution’s compliance with this requirement:
“Please confirm that the G-Suite solution does not provide the possibility of denying access to a user after a number of access attempts, but does include alternative access security mechanisms.”
Below is Onix’s response to this question:
“This is correct. Although it is not possible to define a specific number of access attempts before user access is blocked, Google uses artificial intelligence to identify malicious and questionable behaviour during login and account use. Two-factor authentication is another feature offered by G-Suite that secures login attempts.”
Onix thus stated in its response that its proposed solution does not block access to a user after a defined number of attempts. Instead, the G-Suite solution includes alternate mechanisms such as artificial intelligence, which analyzes data in real time to identify potential threats of unlawful intrusion into a user’s account.
The Inspector General determined that the evaluators failed to disqualify the bidder for this technical non-compliance.
The Inspector General also found that the City treated the competing bidders inconsistently when it evaluated the browser compatibility of the competing solutions:
…the investigation revealed that the bid assessment was not consistent for all the bidders. It appears that the same thoroughness and severity in the assessment of a criterion were not consistently applied to all bidders, despite the fact that fair and ethical treatment of tenderers is a key element of public tenders and such a breach must be disclosed to prevent its recurrence in future calls for tenders.
In fact, the Inspector General found that the City improperly relied on its prior history using one of the solutions, rather than on an actual assessment of that solution’s compatibility with the stated requirement, when conducting its evaluation:
The investigation revealed that the assessment was rigorous for another bidder’s solution, but that the same rigour was not applied to Onix’s proposed solution. Although two solutions presented problems with respect to Requirement 8, Onix’s solution was found to be compliant while another bidder’s solution was found to be non-compliant.
The fact that Ville de Montréal did not experience any problems in the past three years does not change this determination, since technical compliance must be assessed at the time of the contract award.
While the Inspector General found no evidence of favouritism, the investigation “revealed breaches of the regulatory framework during the assessment of Onix’s bid with respect to the price of its bid for the option years of the contract, the assessment of the technical compliance requirements, and the consistent assessment of the bids.” The Inspector General therefore recommended the termination of the improperly awarded contract. As this case illustrates, public institutions should be careful to properly assess bid compliance to avoid unlawful awards to non-compliant bidders.
