Bill C-26

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

Telecommunications Act

[Marco Mendicino, Liberal, Minister of Public Safety]

moved that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

Mr. Speaker, it is an honour to help kick off second reading debate of Bill C-26, an act respecting cybersecurity. I know this chamber has been anxiously awaiting the chance to advance discourse on this important legislation.

I will begin by saying that cybersecurity is national security. We need to make sure that our defences meet all of the challenges that are reflected today, and we need to make sure that both the public sector and the private sector are able to better protect themselves against malicious cyber-activity, including cyber-attacks. It is about defending Canada and the critical infrastructure we rely on, and we know that this will not be the last we hear of this issue.

What we decide now in the cybersecurity realm will help us form a launching pad for the way forward, because we know that our actions in the cybersphere are always a work in progress. We know that meeting the moment means that our actions must continually, effectively and safely provide a foundation for the way Canadians thrive in the 21st century.

Being online and connected is essential to all Canadians. Now, more than ever, Canadians rely on the Internet for their daily lives. It is about more than just conducting business and paying bills. It is also about staying in touch and connected with loved one from coast to coast to coast and indeed around the world. Our critical infrastructure is becoming increasingly interconnected, interdependent and integrated with cyber systems, particularly with the emergency of new technologies such as 5G, which will operate at significantly higher speeds and will provide greater versatility, capability and complexity than previous generations.

These technologies certainly create significant economic benefits and opportunities, but they also bring with them new security vulnerabilities that some may be tempted to prey on.

The COVID-19 pandemic showed how important it is for Canadians to have secure and reliable connectivity. The government is determined to boost security for Canada's cyberfuture.

We also know about the inherent threats to our safety and security. Cyber-threats remain a significant national and economic security issue that can threaten that safety. The Canadian centre for cybersecurity's “National Cyber Threat Assessment 2023-2024” found this:

State-sponsored and financially motivated cyber threat activity is increasingly likely to affect Canadians....

Cybercriminals exploit critical infrastructure because downtime can be harmful to their industrial processes and the customers they serve. State-sponsored actors target critical infrastructure to collect information through espionage, to pre-position in case of future hostilities, and as a form of power projection and intimidation.

These activities will not cease. Malicious actors could take advantage of increased connectivity to trigger malicious events that could also potentially have severe effects on our public safety and national security.

Large corporations and critical infrastructure providers are targeted by actors probing for vulnerabilities and opportunities for penetration, theft and ransomware attacks.

Like its allies, Canada has made efforts to address these vulnerabilities and to ensure the security of Canadians and Canadian businesses.

Canada has long recognized the importance of securing our cyber systems. In 2013, Canada established a collaborative risk mitigation framework, the Communications Security Establishment's security review program. This program has helped to mitigate risks stemming from designated equipment and services under consideration for use in Canadian 3G, 4G and LTE telecommunications networks.

Furthermore, consultations with Canadians in 2016 informed the 2018 national cybersecurity strategy. This strategy established a framework to guide the Government of Canada in helping to protect citizens and businesses from cyber-threats and to take advantage of the economic opportunities afforded by digital technology.

In 2019, the government paid $144.9 million to develop a framework for the protection of critical cyber systems.

In 2021, the government completed its interdepartmental review of 5G telecommunications security. The findings included a recommendation to work with the industry on moving forward with the current risk mitigation framework for the products and services intended for Canadian telecommunications networks.

All this work done over many years to address these known problems and to improve Canada's cybersecurity posture, including with 5G technology, brings us to the bill before us today.

The objectives of Bill C-26 are twofold. One, it proposes to amend the Telecommunications Act to add security, expressly as a policy objective. This would bring the telecommunications sector in line with other critical infrastructure sectors.

The changes to the legislation would authorize the Governor in Council and the Minister of Innovation, Science and Industry to establish and implement, after consulting with the stakeholders, the policy statement entitled “Securing Canada’s Telecommunications System”, which I announced on May19, 2022, together with my colleague, the Minister of Innovation, Science and Industry.

As we announced at the time, the intent is to prohibit the use of products and services by two high-risk suppliers and their affiliates. This would allow the government, when necessary, to prohibit Canadian telecommunications service providers from using products or services from high-risk suppliers, meaning these risks would not be passed on to users. It would allow the government to take security-related measures, much like other federal regulators do in their respective critical infrastructure sectors.

The second part of Bill C-26 introduces the new critical cyber systems protection act, or CCSPA. This new act would require designated operators in the federally regulated sectors of finance, telecommunications, energy and transportation to protect their critical cyber systems. To this end, designated operators would be obligated to establish a cybersecurity program, mitigate supply chain third party services or product risks, report cybersecurity incidents to the cyber centre and, finally, implement cybersecurity directions.

It would include the ability to take action on other vulnerabilities, such as human error or storms that can cause a risk of outages to these critical services. Once implemented, it would support organizations' abilities to prevent and recover from a wide range of malicious cyber-activities, including cyber-attacks, electronic espionage and ransomware.

The rollout of 5G technology in Canada is well under way. This technology will allow Canadians to move more data faster. It will bring benefits for Canadians and our economy, but with these benefits comes increased risk. Canada's updated framework, established in part 1, aligns with actions taken by our Five Eyes partners, particularly in the United Kingdom. I will add that I recently met with our counterparts in Washington, D.C., not too long ago.

It would allow Canada to take action against threats to the security of our telecommunications sector if necessary. Legislative measures would provide the government with a clear and explicit legal authority to prohibit Canadian telecommunications service providers from using products and services from high-risk suppliers, such as Huawei and ZTE, if required and after consultation.

Once these amendments receive royal assent, the government will be in a position to apply these new order-making powers to the Telecommunications Act.

The CCSPA established in part 2 is also consistent with critical infrastructure cybersecurity legislation established by our Five Eyes partners and would provide a consistent cross-sectoral approach to cybersecurity for Canadian critical infrastructure.

Designated operators would be required to protect their critical cyber systems through the establishment of a cybersecurity program and to mitigate any cybersecurity risks associated with supply chain or third party products and services.

Cyber-incidents involve a certain threshold that would be required to be reported, and legislation would give the government a new tool to compel action, if necessary, in response to cybersecurity threats or vulnerabilities. Both parts 1 and 2 of Bill C-26 are required to ensure the cybersecurity of Canada's federally regulated critical infrastructure and, in turn, protect Canadians and Canadian businesses.

Overall, Bill C-26 demonstrates the government's commitment to increasing the cybersecurity baseline across Canada and to help ensure the national security and public safety of all Canadians.

Cybersecurity is also essential in the context of our economic recovery after the COVID‑19 pandemic. In our increasingly connected world, we must implement the measures required to guarantee the security of our data and ensure that data is not exploited by actors, state-sponsored or not, who constantly seek to exploit our systems.

Recovery from cybersecurity incidents is both costly and time-consuming. Accordingly, when it comes to improving cybersecurity, the interests of government and private industry are aligned. Nevertheless, an administrative monetary penalty scheme and offence provisions would be established within both parts of the bill to promote compliance with orders and regulations, where necessary.

All of the actions I highlighted today form a key part of our ongoing commitment to invest in cybersecurity, including to protect Canadians from cybercrime and to help defend critical private sector systems. Like our allies, Canada has been working to address these vulnerabilities to keep Canadians and Canadian businesses safe. However, we have to be sure that we are ready for the threats that lie on the landscape.

For example, unlike laws governing other critical infrastructure sectors, the Telecommunications Act does not include any official legislative authority to advance the security of Canada's telecommunications system. Despite the existence of multiple programs and platforms enabling public and private collaboration in the telecommunications sector, participation is voluntary.

In addition, across Canada's highly interconnected and interdependent critical infrastructure sectors, there are varying levels of cybersecurity preparedness and no requirement to share information on cyber-incidents currently. Moreover, the government has no legal mechanism to compel action to protect these systems at this time. These are important gaps that the legislation introduced today seeks to address. That is why the government is establishing a strong and modern cybersecurity framework to keep pace with the evolving threats in our environment.

In short, the legislation would form the foundation for securing Canada's critical infrastructure against fast-evolving cyber-threats while spurring growth and innovation to support our economy. Cyber systems are understandably complex and increasingly interdependent with other critical infrastructure. This means the consequences of security breaches are far-reaching. It is also the reason that a consistent, cross-sectoral approach to cybersecurity is built into this legislation.

Bill C-21, which we have tabled and are now debating, would protect Canadians and the cyber systems they depend on well into the future. Significantly, this legislation can serve as a model for provinces, territories and municipalities to help secure critical infrastructure outside of federal jurisdiction. It is an essential addition to Canada's already robust arsenal, which is there to protect us and our economy against cyber-threats. It would allow us to continue taking even stronger action against threats to the security of our telecommunications sector and ensure Canada remains secure, competitive and connected.

I encourage all members to join me in supporting this landmark cybersecurity legislation, Bill C-26, today.

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Mr. Speaker, I thank the Minister of Public Safety for his speech.

I have a question about the impact of this bill on Crown corporations that are considered to be critical infrastructure companies. What impact will this bill have on Crown corporations?

What are the impacts of this bill on provincial Crown corporations?

I am referring to Hydro-Québec and Manitoba Hydro, for example. What impact will this bill have on Crown corporations?

[Marco Mendicino, Liberal, Eglinton—Lawrence, ON]

Mr. Speaker, I would like to thank my colleague for her very important question.

The goal of Bill C-21 is to build a bridge, a collaborative effort between the government, critical infrastructure sectors and the private sector. We developed an approach that includes excellent lines of communication in order to effectively identify the cyber-threats to critical infrastructure that might jeopardize national security and the economy.

In answer to my colleague’s question, we will work with all federal regulators to create a system to protect all critical infrastructure sectors against all cyber-threats.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Mr. Speaker, I think we are happy to see the government finally tackle the issue of cybersecurity. I am not necessarily saying that it is too little, too late, but I can say that we have waited a long time. We applaud the idea of forcing Internet providers to adopt better practices, and to that we say kudos. We all agree on that.

However, why does the federal government always have to react rather than be proactive?

We have been talking about 5G and Huawei for years. Hydro-Québec has been fending off daily computer attacks for years. We have known for years that China has been gaining power and interfering more and more. In short, we have known for years that Canada is extremely vulnerable in terms of cybersecurity.

How is it that, in this postnational system, everything always happens reactively, not proactively?

[Marco Mendicino, Liberal, Eglinton—Lawrence, ON]

Mr. Speaker, with all due respect for my colleague, I would like to point out that the government is always vigilant when it comes to any type of threat, including cyber-threats.

For example, in 2018, we created the national cyber security strategy. That is what I was talking about in my speech. The pillars of this strategy, which is used to respond to all risks, include resilient security systems, an innovative cyber ecosystem and Canadian leadership here and around the world.

We have taken concrete action to protect against the risks posed by certain actors that are not aligned with Canadian interests. We are now prepared to take the next step by introducing this bill to better protect our critical infrastructure. This excellent and effective measure will be implemented in collaboration with all federal regulators and the private sector.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Speaker, folks would find that it is pretty easy to get agreement here on the idea that there is more to do in respect of cybersecurity. Where some of us may part ways is on the extent to which the government, while increasing its power to act, has not built into the bill corresponding checks and balances on its authority. Indeed, many of the orders it would give itself the power to issue under this act are secret orders. It has exempted itself from some of the normal reporting requirements.

I want to test the minister today on his openness to amending the bill at committee to ensure that there are appropriate checks and balances commensurate with the new and quite wide-ranging powers the government is proposing to grant itself in Bill C-26.

[Marco Mendicino, Liberal, Eglinton—Lawrence, ON]

Mr. Speaker, I look forward to collaborating with the hon. member and other parliamentarians on the debate of this important bill, including at committee stage. Without question, whenever the government takes decisive action to meet the threats posed in the realm of cybersecurity, there does need to be corresponding transparency and an articulation of the reasons we are taking that action.

He is quite right to underline that there would be new authorities contained in this bill. However, those new authorities we would propose to create are in direct response to the gaps that currently exist, as I outlined in my speech. We need to do both in lockstep: address the gaps posed on the landscape of national security in the context of cybersecurity but also be transparent about that.

I point out that there are independent bodies, for example NSICOP and NSIRA, so that where the government is taking steps that implicate national security, there can be accountability. This is the way we can achieve both objectives. It would ensure the confidence of all Canadians that this is an appropriate measure to seize the opportunities there, as well as to manage the risks manifested in our landscape.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, I wonder if the minister can provide additional comments on the importance of the Five Eyes nations, the countries we work closely with, and give a different perspective on what he believes and why he believes it is important that we walk in step with those Five Eyes nations.

[Marco Mendicino, Liberal, Eglinton—Lawrence, ON]

Mr. Speaker, this question allows me to highlight how Canada is co-operating with like-minded democracies around the world, both in the context of the Five Eyes relationship as well as the G7. I had a chance to meet with both counterparts very recently, one in Washington, D.C., and then, about two weeks ago, in Germany. It is without doubt that all the democracies within these multilateral forums are thinking very hard about how to manage threats in cyber, including ransomware, including the spread of disinformation and including the efforts of hostile actors to engage in cyber-espionage and the like.

The way we are advancing that collaboration is through information and intelligence sharing as much as possible, so that we can push back against efforts to attack our economies and to attack Canadian interests, etc.

Even as we present Bill C-26 for debate, to take decisive action here at home domestically by addressing the current gaps within our cyber-realm, we are also collaborating very robustly with partners around the world who are like-minded in managing these threats.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Mr. Speaker, I just have a couple of quick points.

First, I would correct the minister. He referred to it as Bill C-21 a couple of times earlier in his speech. I think that maybe it is on his mind. He knows that there are great changes that need to be made or scrapped out of that bill.

As for the references he talked about in his speech, to Huawei and 5G, obviously the government finally decided to ban Huawei from our 5G network just in May.

Why did it take the government so long? It was tabled here. A motion was passed in the House a year and a half prior to its making that decision.

I am just interested to know why it took the government so long to make such a critical national security decision.

[Marco Mendicino, Liberal, Eglinton—Lawrence, ON]

Mr. Speaker, I embrace the urgency of my hon. colleague's question. I also want to thank him for the legislative title correction. Obviously, I am managing a number of priorities, as he well knows.

There is no dispute that we need to advance this debate and to do so thoughtfully and deliberately and urgently. As he will know, we took very decisive action against the risks posed by Huawei and ZTE as they relate to 5G, 4G and 3G networks, and we are going to continue to be vigilant about them.

If he shares that sense of urgency in moving forward, he really ought to study the bill along with his colleagues in the Conservative Party and support it.

At the end of the day, this bill would address those gaps and potential vulnerabilities so that we can manage the risks and, at the same time, leverage the innovative opportunities that lie in wait when it comes to technology.

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Mr. Speaker, it is an honour to speak today in the House about Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making other consequential amendments.

This is a critical bill, and I am very happy to see the debate being undertaken today in the House. I do know that cybersecurity is important to the Minister of Public Safety, so I will give him credit for bringing this bill forward. It should be something that is important to all government ministers of every level of government. It is very important that we are having this debate today.

I was provided a briefing from cybersecurity experts from the minister's department just under a year ago. It was very informative about the risk Canada faces in terms of cybersecurity. Just to speak simply, I asked them what would be, in the worst case scenario, sort of a Pearl Harbor moment for Canada. They responded that it would be a cybersecurity attack on our electrical infrastructure or our pipeline infrastructure in the middle of winter. If there were a cyber-attack or a ransomware attack on the infrastructure that keeps Canadians warm in the middle of winter, that would be absolutely devastating, specifically in our coldest provinces, regions and territories in Canada.

Just to give Canadians an idea of the gravity of what we are talking about today and how important it is, not only that we bring forward cybersecurity legislation that builds capacity, but also that it be done right. There was a series of questions before my remarks that outlined a number of the issues in this bill.

I will just outline a number of recent cybersecurity attacks in Canada and also in the United States of late. We know that the Canada Revenue Agency was attacked in August 2020, impacting nearly 13,000 Canadians who were victims of that. There was also a hospital in Newfoundland, in October 2020, where the cybersecurity hackers stole personal information from health care employees and patients in all four health regions, as well as social insurance numbers belonging to over 2,500 patients. Very deeply personal and private data from these hospitals was stolen by cybersecurity hackers.

Global Affairs also most recently was attacked in January 2022, right around the time that Russia engaged in the illegal invasion of Ukraine. It was reported that it may have been Russian, or Russian state-sponsored, actors who were responsible for the cyber-attack on Global Affairs.

That was a very serious attack on another government department. The government is certainly not immune to these types of cybersecurity attacks.

Most famously, I would say, there was a ransomware attack on critical infrastructure in the United States back in May 2021. Pipeline infrastructure was attacked. President Biden issued a state of emergency. Seventeen states issued these states of emergency. It was very serious, and it just shows the capabilities of some of these cyber-threat actors, and the threat they pose to Canadians in their everyday lives and to Canada as a whole, as well as the threat to our allies.

This bill is coming forward in light of the government announcing most recently, in the past year, that it would ban Huawei from our 5G infrastructure. Conservatives and the House of Commons, in fact, have been calling on the government to do that for quite for some time. This legislation would help enable the practical implications of that ban. Again, it is certainly a very long time coming. Had this been done years ago, it would have saved our telecommunications and thereby the everyday users of our telecommunications companies, a lot of pain and a lot of money. I am concerned about the financial impact, although this is critical, that waiting so long to bring it forward would have on everyday Canadians and their cellphone bills, just as an example.

I am the vice-chair of the public safety and national security committee. I championed a study we are undertaking, which is in the process of being finalized right now, of Canada's security posture in relation to Russian aggression. A large part of that study was about cybersecurity. The experts we brought in repeatedly sounded the alarm that cybersecurity is of the utmost importance. It is something that the Government of Canada, the private sector, provincial governments and, frankly, municipal governments must take extremely seriously. It is rapidly evolving. I am going to give some quotes from a few of the experts to the lay the stage of what we are facing as Canadians.

Professor Robert Huebert of the University of Calgary said:

With regard to other cyber threats, we also know the Russians have shown an increasing capability of being able to interfere in various electronic systems and cyber systems of other states. We've seen this with their ability to influence the Ukrainian electrical system prior to the onset of the war in 2014.

This is the other war it engaged in over the last number of years. He also said that we are seeing this in other locations across the globe.

He went on to state:

Once again, it's hard to know exactly how well-defended [Canada has] become in being able to harden that part of cyberwarfare. There's no question, whatsoever, that the attention the Russians and the Chinese are giving this is increasing....

He compared that to the reports we are hearing from our American and British friends and allies who are saying the Chinese and Russians are extremely active on the issue of cybersecurity and involving state-sponsored actors launching attacks against countries like Canada and the United States.

We also had a woman named Jennifer Quaid, who is the executive director of the Canadian Cyber Threat Exchange, which is a private company that supports various companies to help boost their cybersecurity. She talked a lot about cybercriminals. This is an important piece. Even the minister talked about this as well.

First and foremost, she flagged that the Minister of National Defence of the current government said, “Cyber security is one of the most serious economic and national security challenges we face.” Therefore, it is quite a serious issue we are talking about today.

Ms. Quaid went on to say, “cyber-threats are becoming more sophisticated and are increasingly pervasive. Driven by the growth and global adoption of innovative technologies, cybercrime pays.”

She meant that cyber-threat actors can be grouped roughly into two categories, nation states conducting espionage and statecraft through the Internet, and criminals engaging in cybercrime for financial gain.

She went on to say, “It's this criminal element that has commercialized cybercrime”, meaning that cybercriminals and cybercrime have now become a thriving industry. She pointed out that the barriers to entry, the technical expertise needed to be a hacker, so to speak, is increasingly low. She said that several countries now are allowing cybercriminal groups to operate within their borders.

She also named something called a “hacktivist”, an activist hacker, of all things. We may have someone, in the name of social justice, hacking into a fossil fuel company, for example. Imagine if that happened in Canada in the middle of winter to our gas pipeline infrastructure. It would be devastating and deadly, so we have to keep an eye out for hacktivists, as she said.

She also pointed out that 25% of organizations in Canada have reported a cyber-breach. One in four. That is pretty significant. She said that the small and medium-sized enterprises that make up 98% of our economy are also being impacted. Almost 100% of our economy is being attacked in some form or another.

This is really important when we think of big banks and big, wealthy corporations that have pretty good cybersecurity infrastructure and have the money to do so. What feeds them is third party suppliers that may provide the various components or various mechanisms to undertake their important parts of the industry that company is engaged in. They are also at risk. Therefore, if a lower third-party provider of a major telecom is attacked, for example, that may seriously impact the ability of that telecom to deliver its services adequately to Canadians.

She mentioned that 44% of SMEs, small and medium-sized enterprises, do not have any defence. Almost half of our small and medium-sized enterprises, which dominate our economy, do not have any sort of defence and are not even thinking about cybersecurity. That is why today's discussion and this bill are important to be debated and have experts weigh in.

I will also quote Dr. Ken Barker, who is a professor at the Institute for Security, Privacy and Information Assurance at the University of Calgary. He talked a lot about the impact of cybersecurity on critical infrastructure. He mentioned that, in general, it is very vulnerable because it is built on legacy systems that, in essence, predate the Internet. As our legacy systems are getting online, this creates, as he explained, some gaps that hackers can take advantage of, which again puts our critical infrastructure at risk. That came up over and over at committee. He pointed out that our large private companies and our banks are investing a lot in cybersecurity, but again, as he and Ms. Quaid pointed out, it is their SMEs that are the most vulnerable.

I will conclude my quotations here with Caroline Xavier, who is the director of the Communications Security Establishment, which falls under the Department of National Defence. It is the part of government responsible for cybersecurity. Therefore, that she is the head of government cybersecurity is a simple way to look at it.

She said, “cybercrime is the most prevalent and most pervasive threat to Canadians and Canadian businesses. Cybercriminals trying to probe Canadian systems have been found in Russia, Iran and China, among others. [They] use various techniques such as ransomware”. They are specifically focusing on our critical infrastructure, and they certainly pose, as she said, “the greatest strategic threat to Canada.”

The bill before us would do a number of things. It is quite a large bill, so I will not go into every detail of what it would do, but in essence there are two parts. One would amend our existing Telecommunications Act. Of particular importance, it would give very broad and sweeping powers to the minister of industry to do a number of things. What has been criticized by a number of organizations is a specific part of the bill, which is in the summary, that says it would allow the minister and the Governor in Council to “direct telecommunications service providers to do anything, or refrain from doing anything”.

Those are very broad powers to be given to one minister, so that should immediately put up red flags for all of us. No one should have such vast sweeping powers over our telecoms. Again, I have built the case that we need better cybersecurity, but there is a big question mark here of whether we are giving too much power to one minister, one person, in all of Canada.

The bill also has a whole financial issue involved in it. To do anything, as it said, could have massive financial implications. Big companies such as Telus may be able to afford that, but our small telecoms may not be able to so much. It might bankrupt them. That is not great news, and there would be no financial component, in terms of compensation, for any of these losses, so there is a big question mark there as well.

Also, something of importance I find quite concerning is the way the bill is structured would result in a significant exchange of a lot of information from telecoms to the minister, which he could pass on to various ministers and government agencies. Is that very confidential information? It is certainly the cybersecurity plans. Does that include state secrets? Is it safe that we would be asking our telecoms this?

The second part of the bill involves all critical infrastructure companies in Canada, as was outlined by the minister, including provincial and Crown corporations, and the like, so the bill would really establish the process that all of these companies would have to provide their cybersecurity plans, and there would be a very strict reporting mechanism. We are talking about days, if not a few weeks, to get together these plans and provide them to the minister. There would be annual updates required. If a big company were to change a third-party provider, it would have to, in essence, immediately report that to the minister of industry.

There is a whole host of very cumbersome reporting mechanisms, and I do believe we need some of these, but a question remains, as I have outlined earlier, and the government is not immune to being hacked by cybercriminals. I just outlined three or four incidents when that happened. The bill would take all of our critical infrastructure, and all of companies' cyber-defence plans, along with countless other pieces of personal data of Canadians and others, and we would give that to the government. An argument could be made that this is needed, but where are the protections for that? Where is the defence of government to ensure that this would not end up in the wrong hands or that information is not hacked by cyber-actors?

That is a significant threat that needs to be addressed by the minister, and I was not assured from his remarks that this is something that is front and centre in his objective through the bill.

I would also say that there is a number of civil liberty organizations that have raised serious alarm as well. There was an open letter written to the minister from the Canadian Civil Liberties Association, the Canadian Constitution Foundation, the International Civil Liberties Monitoring Group, Leadnow, Ligue des droits et libertés, OpenMedia, and the Privacy and Access Council of Canada. All of the leaders of research and discussion of our civil liberties, all such major organizations in Canada, were quite alarmed by the bill in many ways and wrote an open letter to the minister that outlined a number of things.

In essence, they said the bill would grant the government sweeping new powers, not only over vast swathes of the Canadian economy, but also in intruding on the private lives of Canadians. To sum it up, and I think they said really quite well, “with great power must come great accountability.” There is great power in the bill, but the accountability side is lacking.

Before I go on to detail some of their concerns, I do want to outline what some other countries are doing. If we look at the U.S. and the EU, they have established similar bills in the past year or so. The EU actually has greater and more significant fines in many ways, and the U.S. provides more prescriptive and strict reporting mechanisms, such as, if a U.S. critical infrastructure company has a ransomware attack, the legislation outlines the company must report it to the government within 24 hours.

That actually might be something we may want to consider for the bill. If we are going to go there, we might as well have it in line with our American allies and make it tight. I do think that a reporting mechanism is one of the most important parts of this bill.

I want to go back to the civil liberties issue. With the government's track record on Internet regulation bills, such as Bill C-11 and others, a lot of people have their backs up about their personal freedoms online and their data, rightfully so. The civil liberties associations are raising some of the concerns that have not been assuaged thus far by the government or the Minister of Public Safety.

In the open letter, they mention that this, “Opens the door to new surveillance obligations”, which is quite concerning. In their view, and this has not been proven, “Bill C-26 empowers the government to secretly order telecom providers ‘to do anything or refrain from doing anything’”, as I mentioned. They believe that, if there was an abuse of this extreme power, it could be utilized by a government with ill intent, not to say that is the Liberal government's intent, but it could be utilized to survey Canadian citizens. It is quite concerning.

They go on in that realm to outline that the powers in this bill allow the administrative industry to terminate who telecoms work for, for example. They believe that could also be applied to individual citizens. They are looking at this and thinking, if a government wanted to punish a group of people, it could call up Telus, and this is very blunt and not overly academic in the way I am explaining it, to direct Telus it cannot do business with these people, cut off their access to the Internet and cut off their cell phones.

It is an extreme worst-case scenario, but it is worth flagging that there may be a bit of a backdoor in this bill that would allow that, should an evil government ever come along that is looking to abuse the civil liberties of Canadians. I would like to see that addressed and have safeguards put in place to prevent that type of abuse, should it ever happen in an extreme circumstance.

They also talk about how it “Undermines privacy” and that there are “No guardrails to constraint abuse”. Again, I think this is an area where opposition parties, in particular, and hopefully government members on the committee, can come together to ensure that there is an ombudsman put in place or an oversight body. We need something where the rights of companies, and more importantly of citizens, are protected from the abuses I have outlined, and there are many others.

There were also a lot of concerns from the Business Council of Canada. It wrote an open letter to the minister on behalf of large companies, and also small and medium-sized enterprises. In essence, what we are seeing is the red tape is extremely high, so we are worried that will impact our small and medium enterprises.

The business community, in general, has said that it seems that this bill, to sum it up bluntly, is all stick and no carrot. It is all hard-hitting. It is going to be super hard on us, and we better comply. I can hopefully go into more details about that in the question part of this debate, but there is no incentive structure built in.

There is no incentive to have companies share best practices with each other. I think the government should be a leader in encouraging the open sharing of best practices and experiences that protect the confidentiality of companies but allow them to share information, so other companies can be better equipped, and we can all work together as one big happy, cyber-secure family.

The Conservative Party of Canada is, first and foremost, concerned about national security and ensuring the federal government takes that leadership role in ensuring that Canada, as a whole, is secure against any possible threat, every eventuality, as the Minister of National Defence likes to say.

We are seeing serious gaps in our military. We can have stronger alliances in our Five Eyes intelligence sharing and other agreements. Certainly, that involves cybersecurity. Canada is vulnerable, like many countries in the world. In fact, most countries are dealing with these problems. The Conservative Party of Canada wants to see a more robust framework to incentivize and enforce reporting mechanisms to ensure our cybersecurity is protected, and to make sure there is not a ransomware attack on our pipelines in the middle of winter, which could kill thousands of Canadians from the cold, for example.

We will be looking to support this bill in going to committee, but I want to make it very clear that, if the issues in this bill, and I have outlined a few of them concerning privacy and impacts to business, are not addressed, the Conservative Party is ready to pull its support immediately and put up a very strong defence to stop this bill from going beyond committee. I want to make that very clear to the minister and the Liberal government.

We will get this to committee to hear from experts because we believe that is important, but it must be fixed. There are serious issues that need to be addressed and amendments that need to be made. I would ask Liberal members on the committee to get to work with us, so we can make this bill what it needs to be and make it better to ensure cybersecurity is protected in Canada today and for years to come.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, I do not think there is anyone in society who does not recognize the potential harm of cybersecurity. The issue is how do we ensure we are well positioned to address vital threats to our critical infrastructure. The member opposite says her concern is that we are giving too much power to one individual.

Does the Conservative Party have an alternative to ensure that particular issue is addressed in the form of an amendment? Does the member have any suggestions on that point?

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Mr. Speaker, the member is also from Winnipeg, so he is a fellow Manitoban.

As I outlined it in my remarks, it is not just the Conservative Party. We were alerted to this by every major civil liberties organization in the country. They wrote quite an in-depth open letter with over two dozen different concerns that they had, give or take, so we are using the information we are getting from the organizations specifically tasked with protecting civil liberties and privacy and freedoms of Canadians. That is who alerted us to it.

We would like to bring them before committee to make their recommendations. They have made recommendations in open letters. Various organizations with technical expertise have also recommended various amendments to this bill. Again, I am not an expert in cybersecurity, but I do understand Canadians' need to protect their privacy. Therefore, at the committee stage, we will be bringing forward these experts to help us craft amendments. I mentioned in my remarks that perhaps there could be an ombudsman or a specific oversight committee that is built into this.

One last thing is that there is no annual reporting mechanism in this bill, where government would be responsible for tabling a report to Parliament that would outline and give Canadians an idea of what the government has been doing with this bill and what the threat assessment of Canada in the impacts of what the bill has done and what it has seen in the reporting mechanisms from companies. I would say it needs annual reports to Parliament, and we have to craft those amendments with expert witnesses' testimony at committee. I look forward to those discussions.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Mr. Speaker, I have so many questions.

We agree on the principle of the bill, but I do have to wonder about the precautionary principle. Since 2017, the Chinese government has required Chinese companies to hand over any information they collect to its intelligence service. Despite this, the federal government continues to award contracts to Chinese companies like Nuctech, for example.

That was a very important contract, I might add. Nuctech was being asked to install x-ray machines in embassies, precisely where our information must be protected. Information from the embassy could have easily been passed on.

My question for my colleague is this. We currently have an interesting bill before us, although it needs improvement. Should the precautionary principle not be applied more systematically, along with the recommendations made by the Standing Committee on Government Operations and Estimates in its June 2021 report?

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Mr. Speaker, the member's question is quite a technical one. The member does mention China and what it has done. I am deeply concerned about Chinese state-sponsored actors who are conducting espionage and looking to steal data and very important national security information from various government departments and individual citizens. That is the reason that all of our Five Eyes allies, with Canada being last, banned Huawei from our 5G infrastructure, because of any possible back-door element.

Because, with all companies that are owned by China, there is, to put it bluntly, an ability for them to direct, for example, Huawei to take all their information. That is why Five Eyes allies, put quite simply, called on Huawei to be banned. They did that before us, and we took a very long time.

I will look more into the specifics. The member was not too familiar with what she talking about. Suffice it to say, the Conservative Party of Canada has been very clear: We need to be very clear-eyed on China, in particular when crafting this bill. It needs to be crafted in a way that offers the most defence for Canadian critical infrastructure against Chinese sponsors, state actors or others.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Speaker, there is a lot to think about in what the member for Kildonan—St. Paul had to say, and I agree with many things she said, including her concern about the oversharing of Canadians' personal information between government departments. I know that was a significant issue in the 41st Parliament with Bill C-51, when the government of the day introduced security legislation at that time.

I wonder if the Conservative Party today is in a mood to actually protect Canadians against the oversharing of information between government departments and if we might try to find an opportunity in the course of this bill's passage through the House to correct, as we go, some of the defects in that legislation from many years ago.

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Mr. Speaker, I appreciate the question from my colleague, who is also from Winnipeg and a fellow Manitoban.

I take the member's point regarding former pieces of legislation that need work. The leader of the official opposition, the member for Carleton, has been very clear in his desire to protect data and the rights of Canadians, especially if we are looking at Bill C-11, which is the Liberal government's attempt to control and regulate the Internet, so to speak. He put forward the very first, very public and very well executed defence of Bill C-11, so I would say that the capability for data sharing between departments and between ministers, which is a large part of this bill, raises a lot of significant privacy concerns of the data of individual Canadians.

We have been very clear that our intentions with this bill and others are to protect those freedoms and that privacy of Canadians. Therefore, that will be the underlying theme of our approach, certainly to this bill during the committee process and in the days and weeks to come.

[Larry Maguire, Conservative, Brandon—Souris, MB]

Mr. Speaker, I want to thank my colleague for Kildonan—St. Paul for taking part in the Manitoba debate that is going on here.

The member commented on SMEs, noting that half of them had no defence and were the most vulnerable. As with the bill I was able to get through last year on SMEs and small businesses, it is very important they have the abilities and rights to protect themselves on this as well. In response to the last question, the member also talked about transparency, which is so important.

Could the member expand on those two areas?

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Mr. Speaker, I am enjoying this Manitoba debate. There are a couple of things I would say.

The government, in the last budget of 2021-22, announced about $700 million for cybersecurity. It seems that it is all going to the Communications Security Establishment, which, as I mentioned in my speech, is the government's sort of cybersecurity agency under the Minister of National Defence. It is great. We do need more resources at the government level for CSE. However, I asked the minister if any of that funding was being provided for our small and medium-sized enterprises so they could boost their cybersecurity. The minister never did get a response to my email.

Again, when we are looking at small companies, it is easy for Telus, big banks and others to afford some of these things. However, if we are looking at small telecom providers, like a small Internet provider in northern B.C., the cost to meet the red tape in the bill might put them out of business. Why not take a little of that funding the government has announced and provide it to our SMEs to help them get to the level we need them to be to protect our critical infrastructure? Perhaps we can get a bit creative and look at our tax system to see if there is some sort of capital expense tax write-off or something we can provide our SMEs to help them get there, because we really need to, as I made the case in my remarks, as I am sure others will as well.

I have not heard a response to that. The government is spending the money anyway. It is spending more money than any government in history. Why not provide a little of that to our SMEs to ensure that critical infrastructure is up to par?

[Alexis Brunelle-Duceppe, Bloc, Lac-Saint-Jean, QC]

Mr. Speaker, we are talking about cybersecurity. This means that there is a lot of foreign interference conducted through cyber-attacks.

Speaking of foreign interference, is my colleague not concerned that, in 2016, after giving a Chinese bank a business licence, the Prime Minister received $70,000 in donations to his riding of Papineau within 48 hours? Is that not interference? In 48 hours, he received donations from outside his riding, specifically from Toronto and British Columbia. Is that not evidence of foreign interference?

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Mr. Speaker, I appreciate the investigative work done by the Bloc Québécois on this issue.

We are just learning about the details of this. I am very concerned about the allegations being made, as everyone should be if there is proven to be a connection and it is proven to be true. We are monitoring this quite closely.

I imagine the Parliamentary press gallery and other media sources across the country are digging into this very quickly and as closely, as they should. It is something we are closely monitoring as we learn the details of any possible payoff to the Prime Minister from the Chinese government or other actors from China.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, an interesting debate is under way thus far on such an important issue with which we all have to come to grips. As changes in technology take place, we have to take that into consideration. I suspect that legislation dealing with privacy or cyber-attacks will be ongoing. Once the bill goes to committee, I am sure there will be a great deal of dialogue. I anticipate a great diversity of witnesses will come forward with ideas on the legislation.

I will pick up on the point I raised with the member opposite about the concern that the minister had too much power under this legislation. Often, when government brings forward legislation, opposition members bring forward concerns about how power is enhanced through the minister's office.

I have had the opportunity to briefly go through the legislation and I genuinely believe there is the right amount of balance. That is why I posed the question for the member. She suggested of reporting mechanisms, whether through an annual report or a report to a standing committee, and that has merit. I say that because I know there has been a great deal of effort in formulating this legislation. If there are ideas that would enhance or make the it that much stronger, we should be looking at that. I do believe the ministry is open to that.

When the member was quoting, I wondered where those quotes were from. She used those to amplify fears that one might be challenged to justify. For example, the member referred to an “evil government” based on quotes she had received. I am not saying it is her opinion, but she has raised it, saying this is a quote from some third-party organization and if we believe in that quote, it could lead to an evil government. We have witnessed that a great deal from the Conservative opposition on a variety of different issues, as if there is some sort of conspiracy. There is no conspiracy, contrary to what the member said, at least in one part of her speech. The government is not out to spy on Canadians.

The government takes the issue of the privacy of Canadians very seriously. We have brought forward legislation to that effect. This government has spent tens of millions of dollars on cyber threats. The government has had working groups and advisory groups dealing with cyber threats. We recognize the changes in technology and the impact they have had on society. I have said in the past that if we were to look at technological advancements, we would be challenged to find an area that has been as advanced as computer Internet technology. Just the other day, I was speaking to a private member's bill, saying that 10 or 20 years ago there were no such things as iPhones.

I note the member for Winnipeg South Centre is listening. He will recall that when we were first elected back in 1988, there was a big computer purchase of $5,000 made through Reg Alcock. We had a wonderful computer with a laser printer, which came with a keyboard and a mouse. At the time, when logging into the Internet with that wonderful and beautiful computer, the first thing we would hear was a dial tone. Then we would hear that stupid clicking sound, which meant we were actually connected to the Internet. We were all fairly impressed with that computer, and there were about 20 of us at the time.

We can compare that to where we are today. People can buy a laptop for $500 that has abilities and technological advancements more than tenfold of what we paid $5,000 for, with that long dial-up connection. In fact, people can purchase something brand new for $250 that is hooked into the Internet and running at a rapid speed. It is not even comparable to what it was.

There is so much advantage to technological change, but with that change comes risk, which is the essence of what we are debating through Bill C-26. Even though society has benefited immensely, we need to recognize there is a significant risk factor. That risk factor not only applies for the individual who might be surfing the net today, but it also applies to military operations taking place in Ukraine today.

Computers today are not optional. The Internet is not optional. They are essential services. That is why the Prime Minister, or one of the other ministers, just the other day made reference to the percentage of Canadians who were hooked up with high-speed connections and how we had literally invested billions to ensure that Canadians continued to get that access, with a special focus on rural Canada. We recognize that because it is no longer optional; it is an essential service.

The digital economy varies significantly. If we want to get a sense of this, we can turn to Hollywood and like-minded productions found on Netflix, CBC or the more traditional media outlets. We can look at some of the movies and TV shows out there. The other day I was watching an episode of a show called The Blacklist, which is all about cyber-attacks. I suspect a number of my colleagues might be familiar with that show.

One member talked about hydro. Manitoba, in fact all of Canada, should be concerned about our utilities. Through Hollywood productions, we are better able to envision the potential harm of cyber-attacks. A well focused cyber-attack can deny electricity to communities. It can shut down things that should never be shut down.

We talk about the sense of urgency. One would expect there will be mischievous lone individuals working in their basements, or wherever it might be in society, challenging systems. However, we also have state-sponsored cyber-attacks, and we should all be concerned about that.

In fact, that is why it was comforting when the minister made reference to the Five Eyes. I caught on right away that there are like-minded nations. Canada is not alone. There are like-minded nations that understand the importance of cyber-attacks and the potential damage that can be caused.

I will get back to the international side of things later, but when we think of what is at risk, think of digital data. Digital data comes in many different forms. One of the greatest collectors of data is Statistics Canada, an organization that invests a great deal in computers and technology to protect the data it collects from Canadians. Statistics Canada is actually respected around the world for its systems. It has absolutely critical data, and that data is provided to a wide spectrum of stakeholders, obviously including the national government.

Let us think of health organizations, the provinces and the collection of health records, or motor vehicle branches and passport offices. All of these government agencies have, at the very least, huge footprints in data collection.

Those are government agencies. We could also talk about our banking industries or financial industries. We can think of those industries and the information that is collected from a financial perspective when people put in an application for a loan. All of the information they have to provide to the lender, such as their history, is going into a data bank.

There is also the private sector. The other day we were talking about apps. One example is Tim Hortons. We were talking about it, as members might recall. The Tim Hortons app is fairly widely downloaded, and there is a lot of critical information within it. Canadians need to know, whether it is a government agency or private agency, that governments at all levels, in particular the national government, have their backs. That is the reason I started off by giving a very clear indication that even though Bill C-26 is before us today, we have been investing substantial financial resources through other types of legislation to provide assurances to Canadians so they know their information is in fact being protected.

There are actions on the Internet today related to our small businesses. The member opposite made reference to this and asked how the government is supporting small businesses. If a person has a small business today, chances are they are on the net. More and more consumers turn to the net for widgets and a multitude of different services.

As a result of that, there has been a great demand on small businesses. That is why we have a Minister of Small Business who looks at ways to not only provide tax relief but provide support. Sometimes it is done directly through financial measures and sometimes it is done indirectly by providing resources. However, let there be no doubt that there is support coming from the government. Whether it be a small, medium or large business, the government has a vested interest. We will do what we can. A good example of that is the individual who uses an ATM card when they make a small or large purchase at a small business.

The attacks we are talking about today can take many different forms. The digital economic side is definitely one of them, but there is also a social component to the Internet. When I think of the social component, I think about issues of privacy and of communications through, for example, social media. Again, Canadians have an expectation that the government is going to be there for them. Cyber-attacks take place in areas we all need to be concerned about. As I said, the more advanced we become, the more risk there is.

There are a lot of things that take place on the net that we need to be aware of and take action on. The exploitation of children is an example. That needs to be taken into consideration.

In the legislation, there is a very strong compliance component. As I raised, the minister would have the authority to make some things happen with our telecommunications companies and tell them to stop. I think that sort of action is necessary at times.

There is also a financial component so we can ensure a penalty is put in place as an incentive for people to abide by the legislation and the regulations, which are all there for one purpose and one purpose alone: to protect Canadians and institutions from risk. That is why we are investing in cybersecurity, ensuring respect for the privacy of Canadians and supporting responsible innovation.

We will continue to protect Canadians from cyber-threats in an increasingly digital world. This legislation is one aspect of what the government is doing to accomplish that. I believe that state-sponsored cyber-threats are one of the greatest concerns and one of the reasons we need to work with allied countries. I made reference to the Five Eyes. There are democratic, free, allied countries that recognize the potential harm of cyber-threats sponsored through governments. This legislation really sinks its teeth into that.

I hope that all members will get behind this legislation so we can ultimately see its passage to the committee stage. An official opposition member has indicated there is a great deal of interest in reviewing the legislation, the idea being to come up with ways to ultimately make the legislation better.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, I am frustrated with this bill given the fact that it does not lay out a lot of specifics. It states that there is a problem, and I think we all agree with that, but the government's solution to that problem is to hand the minister a lot of power so the minister can do amazing things. Is the member not concerned that the bill does not have the details we need to prevent some of the very things he was talking about?

I think about Ski-Doos and Bombardier, which is an iconic Canadian company. It has been the victim of one of these targeted cyber-attacks. I do not think there is anything in the bill that would have prevented that or held the people who perpetrated it to account.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, I do not necessarily know the details of the case the member has referenced, but what I can say is that even the Conservative critic acknowledged that certain aspects of the legislation would ensure there are financial penalties and opportunities for the minister to virtually stop an action from taking place. Am I concerned that there is overreach? I do not personally believe there is, but I think there is some merit in having that discussion at the committee stage.

I posed a question to the member: If the concern is that there is too much power for the minister, what would the Conservatives do differently? I recognize the fact that in a cyber-attack, often it is necessary to take fairly strong action in an immediate fashion. I think all members recognize that fact. The issue is whether there is something the Conservatives would like to see to provide an additional sense of security.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Mr. Speaker, I thank our colleague for his speech, which was a real voyage of discovery. One moment we were in Hollywood, and the next we were at Tim Hortons.

I will do him one better. I will take us on a journey across the Pacific all the way from China to the riding of Papineau. I worry about interference, as does our colleague, I am sure, because he supports a cybersecurity bill to reduce digital vulnerability.

Is my colleague concerned about the fact that, within the same time period, the federal Liberal association for the Prime Minister's riding of Papineau received donations from China and a Chinese bank got permission to set up shop in Canada?

I have a second question. Does the member believe in chance and coincidence?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, I think Bloc members are hanging around the Conservatives too much. It is usually the Conservatives who go under all the rocks and have conspiracy theories.

I, for one, see the legislation for what it is. It is an attempt by the government to ensure that we can effectively deal with the threat of cyber-activities, whether they are state-sponsored or from individuals. That is a very strong positive and is absolutely not unique, as other countries around the world are doing likewise in bringing forward legislation of this nature.

In terms of the member's conspiracy theory, I will leave that for another member on another day.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Mr. Speaker, I think we all agree that Canada is ill-prepared to deal with cybersecurity threats. I am comforted to hear that we are all on the same page. However, we are falling far behind other similar jurisdictions, such as France and the U.K. Their ability to intercept and respond to cybersecurity threats is much more enhanced to protect their countries.

Again, we are glad to see this moving forward, but I am a bit concerned about the government granting ministers so much broad power, especially the Minister of Public Safety and the Minister of Industry. I just want an assurance for Canadians that these powers would not be applied unjustly to them. Also, would the member and his party be willing to work with the NDP to bring forward amendments at committee to make sure there are protections for everyday Canadians?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, I suspect there would be a great deal of will to continue working with the New Democrats in the House in a minority situation. The NDP has taken a very responsible approach to dealing with the government-sponsored legislation. Where there are changes that make sense, I suspect the ministry would be open to how we could address concerns.

Having said that, it does not mean we are looking for NDP amendments. As it has been pointed out, whether it is the official opposition or the Bloc, this is legislation that we brought in today at second reading. We hope it will pass at some point so it can go to committee stage, where I expect there will be a great deal of interest from coast to coast to coast on this legislation.

I look forward to the contributions of others and their ideas and thoughts going into it, like the member for Kildonan—St. Paul had regarding an annual report that comes from the minister and how that might be incorporated into the legislation. The sooner we can make the ministry aware of some of those ideas, the better it is.

Ultimately, it will go to committee, and there will be representatives from the minister's office there. It will be a wonderful opportunity to get the feedback we are all looking for. If there are chances to make it a healthier and stronger legislation, I am sure the government would act on that.

[The Deputy Speaker, Conservative, Chris d'Entremont]

The hon. member for Saint‑Hyacinthe—Bagot on a point of order.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Mr. Speaker, that is twice now that my colleague has accused me of subscribing to conspiracy theories. With all due respect, I would ask that he withdraw his remarks.

[The Deputy Speaker, Conservative, Chris d'Entremont]

I understand the member for Saint‑Hyacinthe—Bagot's request.

The hon. parliamentary secretary.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, I will withdraw the comment.

[Élisabeth Brière, Liberal, Parliamentary Secretary to the Minister of Mental Health and Addictions and Associate Minister of Health]

Mr. Speaker, 85% of Canada's critical infrastructure is owned by the private sector, provinces and non-governmental agencies.

Does my colleague think Bill C-26 will help standardize cybersecurity practices to better protect systems and services pertinent to Canada's cybersecurity?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, as the member highlights, when we talk about infrastructure, the whole digital economy and what government does, it would be negligent not to recognize the significance of the private sector and how the private sector feeds into it. In fact, it is a major player of 80% plus. That is why, when we talk about the government's role, ensuring that the national infrastructure is safeguarded against cyber-threats is of the utmost importance. That is the essence of the legislation, along with ensuring that Canadians', business's and governments' interests are well served.

[Larry Maguire, Conservative, Brandon—Souris, MB]

Mr. Speaker, in regard to my colleague from Kildonan—St. Paul's speech, she talked about how the government has brought this bill forward with a lot of sticks in it and no carrots. I am looking for incentives that would improve it.

Is the government open to amendments on this particular bill? If so, what would be its theme to bring forward some issues to improve the bill's transparency?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, I have made reference to the idea, and I hope it will be discussed at committee stage in terms of a reporting mechanism. I get the sense, based on questions for both me and the minister, that there is some concern related to that. We will have to wait and see if that comes forward through committee.

At the end of the day, I think it would be nice to see the legislation pass at some point, where the committee is given the opportunity to provide its recommendations and thoughts on the legislation.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Speaker, before I begin my remarks, I request that you seek unanimous consent for me to split my time with the member for Windsor West.

[The Deputy Speaker, Conservative, Chris d'Entremont]

Is there agreement for the member to split his time?

[Some hon. members]

Agreed.

[The Deputy Speaker, Conservative, Chris d'Entremont]

The hon. member for Elmwood—Transcona.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Speaker, with thanks to the chamber, I am pleased to rise today to speak to Bill C-26.

Cybersecurity is a topic that is very much on the minds of many Canadians. It is something that many of us have had experience with in our personal lives, or we know somebody who has. Certainly, as MPs, we hear from folks who have fallen prey to various kinds of cyber-attacks online. We know it is a burgeoning criminal industry to take advantage of people online, grab their information and impersonate their identities. Canadians deserve to be protected from this kind of crime.

We also heard about the impact that cybersecurity attacks have had on our commercial industries. One of the examples that stands out in my mind of particular concern was the 2017 cyber-attack on Equifax, where the personal and financial information of thousands of Canadians was obtained illegally. It is an obvious concern for folks when they find out that a company they trusted with their personal information has been subject to this kind of attack.

We also know that our government has not been immune from these kinds of attacks. Hospitals and Global Affairs Canada have been the object of successful cyber-attacks. Earlier this fall, the House of Commons had a cyber-attack. MPs were warned about changing their email passwords for fear of information in their work accounts being exposed to outside eyes and ears that would find out what was going on in those accounts.

There is no question that it is a real issue. There is also no question, when we talk to experts on the file, that Canada is a laggard in respect to cybersecurity. There have been many debates in this place about the role of Huawei, for instance, in our 5G infrastructure. The government did finally take a decision on Huawei, I think the right decision, although late in the game with respect to our other Five Eyes allies. The idea with this legislation is that the government needs more legal authority in order to implement that decision. Of course, there are a number of ways it can do that.

The bill, as it stands, is not ready to go, but New Democrats are happy to send it to committee where we can hear from experts and try to improve it. When I say it is not ready to go, in my view, it is that for as long as it took for the government to reach a decision on Huawei, it clearly was not doing any work alongside its deliberations on Huawei to prepare for banning it. This legislation would largely give a broad, sweeping power to the Minister of Industry to decide later what exactly the government will have to do in order to ban Huawei and respond to other kinds of cyber-threats.

There is not a lot of detail in the legislation, and that is something we have seen from the government on other fronts. We have seen it on unrelated items, like the Canada disability benefit. It drafted a bill that had no content on the program. The attitude is “trust us and we will get it right later”. However, we also see a litany of problems with the way the government manages its business, whether we go all the way back to the SNC-Lavalin affair and the question of deferred prosecution agreements or other ethical issues that have come up in the context of this government.

I think Canadians are right to have a certain distrust of the government. The answer lies in mechanisms that impose accountability on the government, and those are very clearly absent from this legislation. In fact, not only are they absent from the legislation but the government also very explicitly exempts itself from some of the current types of accountability that do exist.

For instance, it exempts itself from the Statutory Instruments Act, which would make it possible for the parliamentary regulations committee to review orders that the minister may issue under the new authority granted to him in this act.

Therefore, not only would there be no new accountability measures commensurate with the new powers the government would be giving itself, but it would also be exempting itself from some of the accountability mechanisms already there. The government is also explicitly letting Canadians know its intention in the legislation to give itself the legal authority to keep those orders secret. Therefore, we have to contemplate the idea that there will be a whole branch of secret orders and laws that govern the telecommunications industry that Canadians will not know about, and the telecommunications companies may not have an adequate awareness of them.

Where I would like to go with this is to talk a bit more broadly about the Internet and about privacy rights on the Internet. When the new Canada-U.S.-Mexico trade agreement was signed, there was a number of provisions in that agreement that went too far in shoring up the rights of companies to keep their algorithms secret, for instance. There are other kinds of IP protections, or protections that are sold as IP but really mean that it is harder to get a transparent accounting of how companies operate on the Internet and of the artificial intelligence they use to navigate the Internet.

There is a way of dealing with the Internet that prioritizes secrecy for commercial purposes, but that same secrecy also breeds more opportunity for malignant actors on the web to go about their business and not have to worry they will have to expose what it is they are doing. Whereas, if we look to the European Union as another model, for privacy and conducting business on the Internet, there are a lot more robust protections there for the private information of consumers on the Internet, and there are a lot more reporting requirements for actors on the Internet.

The problem with the bill as it is written here is that it would be trying to fight secrecy with secrecy. When firefighters show up to a house that is on fire, they do not usually show up with a flamethrower. They show up with something else that can fight the fire instead of accelerating it.

I do not think Canadians, who are concerned about malignant actors on the Internet and the ways that they are able to exploit the dark corners of the Internet and the back doors of software, also think that the way to fight that is to let the government do it in secret without any reporting. Canadians are not thinking that, with less information available about actors within the digital space or government actions against cybersecurity threats, they are better off if they do not know what the actors on the Internet are doing, and they do not know what the government is doing about it.

The problem with the bill as written is that it would double down on the approach that we saw in CUSMA. It was about privacy for actors on the Internet and privacy for the government in how it deals with it. Instead, it could take a more open-source approach to say that the way forward on the Internet has to be that digital actors have to be upfront about the kind of business they are conducting on the Internet, the ways they do it and the algorithms they use. Governments, likewise, could then be pretty transparent about how they would deal with people who were non-compliant or who were breaking the rules.

New Democrats are concerned to see, along those broad lines, an approach to the Internet that says transparency and accountability, both for private actors and for public actors, is the way forward. Digital consumers deserve to have this information at their fingertips, so they understand what people are going to be doing with the information they enter on their computer, whether that is to purchase a book, get a loan or whatever kind of business they are doing on the Internet. They should have more rights to know how that information is handled, and the role of the government in keeping that information secure, rather than being told not to worry about it, because commercial interests have their best interest at heart, the government has their best interest at heart, and they do not need to know what is going on.

That is why the bill should go to committee, to be sure, because Canada does need its government to have the authority to implement the decision on Huawei and to do better in respect of cybersecurity. There is a lot of good work for committee members to do there, and a lot of amendments that ought to be made to the bill in order for it to pass in subsequent readings.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, I share a number of the hon. member's concerns, but I want to ask him about some of the major threats we have seen in cybersecurity. I am frustrated because the government has a lot of the tools already at its disposal to go after people who are threatening our cybersecurity. We have seen the shutdown of pipelines and major companies across this country. Rogers Communications was shut down.

Is the member not at all concerned about the lack of ability of law enforcement to chase down the bad actors that are pursuing some of this stuff?

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Speaker, there are only so many things that can be fixed with legislation. Legislation is a necessary component of the solution, but it is not sufficient on its own. We see that in many areas. Despite the fact that we have made good laws in this place against certain kinds of crime, nevertheless, those kinds of crimes persist, so of course enforcement is an important part of that question and requires the attention of and resources from government. When those resources are not made available, it matters very little the kinds of laws we pass in this place, because the other necessary component is on the enforcement side.

I share the member's concern for proper enforcement of the laws we pass in this place.

[Xavier Barsalou-Duval, Bloc, Pierre-Boucher—Les Patriotes—Verchères, QC]

Mr. Speaker, we are talking about Bill C‑26, which deals with national security, and discussions about national security inevitably include the issue of interference from elsewhere, from other countries. Security threats can be internal as well as external.

With respect to external threats, there is a lot of talk right now about the possibility that China interfered in our elections. Earlier, some of our colleagues mentioned that, a few years ago, the Prime Minister received nearly $70,000 in donations immediately after a bank that offers services specifically to Chinese Canadians set up shop in Canada. The donations, which were mostly from people with Chinese names, were made on the same day and within hours of the bank being authorized to open.

Does my colleague find that strange? Is he concerned that there might have been some kind of interference? It is hard to believe that this happened by accident and that it was all just a fluke.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Speaker, I thank my colleague for his question.

I think that type of coincidence is always a concern. We have mechanisms in place to launch investigations when warranted. I would encourage my colleague to submit his evidence to the authorities who could look into this, because that is the most appropriate way to ensure that the wrongdoing that the member mentioned in his comments has not taken place.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Mr. Speaker, my hon. colleague spoke during his intervention about the need for greater government accountability in the bill, and I am wondering if he could provide the House with an example.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Speaker, at the very least there has to be some kind of accounting for and public disclosure of the number of orders the government is making under these new powers. That is just one example, a very minimum reporting threshold.

The idea that any number of these orders could be made and Canadians would not even know they have been made or how many have been made is not acceptable. There has to be some reporting of the extent to which these powers are used, or there will be no factual basis upon which to evaluate whether the powers have been appropriate or adequate, or whether they need to change in the future.

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, I am please to speak today to Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

It is really important to acknowledge that we are severely behind with regard to our protections in this matter. I am going to quote from myself, from when I once engaged the government and asked them this. “I am very concerned that we are not doing enough in Canada to protect the digital privacy of Canadians and am calling on the government to develop stronger frameworks and guidelines to improve cyber security in Canada. These are critical issues that must be addressed”. They must be addressed for the benefit of Canada, as our economy and commerce are currently under threat, as is our personal privacy.

When did I do that? That was in 2016. From 2016 to today, with the digital changes we have had, is a lifetime of change.

I got a response from the government at that time, basically saying it would refer matters and let them play themselves out in court.

One of the most famous cases that came forward at the time involved the University of Calgary, which had reportedly paid $20,000 in compensation to a group of organizations we do not know to protect the breach they had.

What has taken place over several different cases and also in our current laws has shown that it is okay to pay out crime and it is okay to pay out these types of requests for extortion and not even refer that matter back to the people whose privacy has been breached. We do not even have to report it as a crime to law enforcement agencies. It is very disturbing, to say the least. Getting this legislation is something, but it is still a long way off.

As New Democrats, we recognize very much that there needs to be balance in this. This is why I also wrote at that time to the then privacy commissioner of Canada, Jennifer Stoddart, about the cyber-attacks and data breaches.

There is concern about the amount of data and one's rights and one's protections and the knowledge one should have as an individual in a democracy. I do not think it is a conspiracy theory to have those kinds of concerns.

I would point to a simple famous case. As New Democrats are well aware, and I think other Canadians are as well, our number one Canadian champion of health care, Tommy Douglas, was spied upon by his own RCMP at that same time. That was in relation to bringing in Medicare. This is very well documented. We still do not have all the records. We still do not have all the information, and it is a very famous case.

Bringing in our number one treasured jewel, health care, led to a case where our own system was spying on an elected representative who was actually declared Canada's greatest Canadian by the public. We do not want to forget about those things because, when we are introducing laws like this, there is a real concern about one's ability to protect oneself and one's privacy, as well as the expansive conditions that are going to change, often with regard to personal privacy.

What also took place after that was that I was very pleased, in 2020, to put a motion forward at the House of Commons industry committee, where we studied, for the first time in Canadian history, fraud calls in Canada.

There are a lot of cyber-attacks through this type of operating system, and we need to remind ourselves that using this type of system, being our Internet service providers and the telecoms sector, is something that is done by giving up the public infrastructure and a regulated system of industry.

We have built a beast, in many ways, that has a low degree of accountability, and we are finally getting some of that restored. There are also some new programs coming in, like STIR/SHAKEN and other types of reporting that is required.

I want to point out that since we have done that, we have another report that will be tabled, or at least a letter. We have not decided yet, and there is still work going on, but we have had a couple more meetings in the industry committee about it and we have really heard lots of testimony that showed that there is more work that can and should be done.

A good example from the previous report that we did was recommendation number five, which went through sharing information between the RCMP and the CRTC. We have not seen the government act on it.

It is important to note that with this bill there has been a lot of talk about the types of things we can do internationally, as well. One of the things I would point out that I have been very vocal on, because I have had Ukrainian interns in my office for a number of years, is that we could use a lot of our leverage in terms of cybersecurity and training to help them to deal with the Russian hacking and other nefarious international players. That would not only help Ukraine right now in the war with Russia. It would also help with the other activity that comes out of this subsequently, which would help the world economies by having trained, solid professionals who are able to use their expertise and battle this with regard to the current state of affairs and also the future. This would be helpful, not only for the Ukrainian population but also for the European Union, Canada, North America and others, who will continue to battle more complex artificial intelligence and other cyber-attacks that take place.

One of the things I want to note is that in the bill, a proposed new section 15.2 of the act would give the Minister of Industry and the Minister of Public Safety the authority to make several types of orders. It relates to guiding TSPs to stop providing services if necessary. This is a strong power that we are pleased to see in this type of legislation.

What we are really concerned about, as the member for Elmwood—Transcona noted, is that there is no general oversight of the type that we would normally see on other types of legislation. Scrutiny of regulations was the one referred to. For those who are not familiar with the back halls and dark corners of Parliament, there is a committee that I was one of the vice-chairs of at one point in time. The scrutiny of regulations committee oversees all legislation passed in the House of Commons and ensures that the bureaucratic and governmental arms, including that of ministers, whatever political colour they will be of at that time, follow through with the laws of the legislation that is passed. Making this bill not have to go through that type of a process is wrong. I would actually say it is reckless, because the committee has to do a lot of work just to get regulatory things followed on a regular basis. It can be quite a long period, but there is that check and balance that takes place, and it is a joint Senate and House of Commons committee. It is unfortunate that the legislation tries to leave that out.

The legislation also does not have the requirement to gazette information in terms of making it public for the different types of institutions. That is an issue, and it also has a lot of holes when it comes to information that can be withheld and shared.

Why is that important with regard to confidence in the bill? It all comes down to the fact that many of the institutions at risk of being targeted involve not only the private sector, where we have seen not only abuse of customers themselves, or businesses with lax policies that do not protect privacy very well, but also others that have used abusive techniques and processes. Even right now, it is amazing when we think about the information in the process that is going on in the United States. The U.S. Senate is going to oversee the issue with regard to Taylor Swift tickets and Ticketmaster again. That is another one that has had a nefarious past with regard to privacy, information and how it runs its business. People can go back to look at that one, with Live Nation and so forth. At any rate, the U.S. is also involved in this.

I raised those things because it also comes from the soft things like that, which are very serious with respect to credit cards and to people's personal information that is shared. However, across the world and in Canada we also have municipal infrastructure and government institutions that are constantly under attack. That is very important, because it is not just the external elements with regard to consumer protection and business losses, which are quite significant and into the billions of dollars. It is also everything from water treatment facilities to health care facilities in terms of hospitals and utilities for power and hydro. All those elements can be used as targets to undermine a civilian population as well, and one of the things we would like to see is more accountability when it comes to those elements. There is definitely more to do.

One of the things I do not quite understand, and which I am pleased to see the government at least bring to committee, is what we could do to educate the population.

Our first intervention on this bill as New Democrats was several years ago, and it is sad that it is just coming to fruition now.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Madam Speaker, I am a little concerned with some of the elements in Bill C-26 that seem overly broad. They give the government powers to secretly order providers to do things or refrain from doing things, without any transparency. Does the member share my concern?

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I do. For us to get fully engaged in this, we want full accountability, clarity and a playbook so everybody understands the rules. We want to deal with some of the stuff and provide some leverage for law enforcement and investigations to take place, but there has to be a set of rules and that needs to be backstopped by parliamentary oversight. Where it stands right now, it is not backstopped by parliamentary oversight.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I would like to follow up on that question. When the minister is called upon to instruct a provider to take a specific action, that would often be required because something has happened in the environment. If the minister does not have that authority, then the opposition might be somewhat critical of the minister not taking action.

I wonder if the member feels that it is necessary in the legislation, or does he believe we should have it, but we need to amend it in some fashion to ensure it is not abused. Is that what I am hearing from the member?

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, absolutely, but if we are going to give some flexibility in power for the minister to act, it has to be responsibly met with oversight, and that has to be heavy oversight. That will provide the confidence.

That is why I wrote to the Privacy Commissioner right after I challenged the government back in 2016 to act on this. We have seen how long it has taken for it to act on this now, so we need to have that confidence. It is a two-way street. If we have the confidence of privacy and protection for people, with oversight, then I think people will be more willing to accept that there could be some changes with respect to how investigations take place.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, a group of organizations, including the Canadian Civil Liberties Association, OpenMedia and Leadnow, have written an open letter calling for improvements to Bill C-26. One of the items they call out is that secrecy undermines accountability and due process.

The member for Windsor West spoke a bit about this in his speech. Could he share more about the suggested improvements that would ensure better public reporting as part of Bill C-26?

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I have a book that we use for privacy protection and it is available to everybody. It was written by Kevin Cosgrove. It is a playbook for people on how to protect themselves and their families from a whole bunch of different issues, whether it be WiFi, online banking, shopping, social media, a whole series of things. The reason I use that as a specific example is that a ton of education has to be done. That has to be done for this bill as well. There needs to be a defined playbook of accountability, like going to the Standing Joint Committee for the Scrutiny of Regulations and ensuring there is oversight for the minister. All those things have to be really enhanced to build the confidence so we all buy into this.

[Bonita Zarrillo, NDP, Port Moody—Coquitlam, BC]

Madam Speaker, I want to thank the member for Windsor West for all his hard work on this. Definitely, when it comes to protecting Canadians, he is the right person to do it.

I wonder if he would expand on clause 15.2 with respect to no general oversight and what the risk is to Canadians if that is not in place.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, It has been fun to work with my colleague on some of these issues. We need a lot of public education related to this going forward.

That section again is just too weak. It provides too many holes. There should be a way to get back to a process of ensuring the minister is held to account. That is one of the things where we are looking to expand powers, but, again, we really need a lot more public education with respect to cybersecurity.

I know it is one of those issues that when we hear it, our eyes fog up, or they roll back in our heads and we think it is just too complicated for us, that there is always something happening, but we really need to engage Canadians on this. That includes engaging the government to ensure it understands that it has to teach residents about the bill and its repercussions as it goes forward.

[Julie Dzerowicz, Liberal, Davenport, ON]

Madam Speaker, I will be sharing my time with the hon. member for Vaughan—Woodbridge.

It is a true privilege for me to add my voice to the debate on Bill C-26, an act respecting cybersecurity, on behalf of the residents of my riding of Davenport, many of whom have written to me through the years about their concern around cybersecurity and the need for additional protections at all levels of government.

This bill represents the latest step in the government's constant work to ensure our systems, rules and regulations are strong and as up-to-date as possible. That is especially important when dealing with a topic as fluid and rapidly evolving as cyber-technology. We have known for quite some time we would need to be constantly vigilant on this issue.

In 2013, the government established the security review program operated by the Communications Security Establishment. In 2016, we conducted public consultations on cybersecurity. In 2018, we released the national cybersecurity strategy. In 2019, we allocated $144.9 million through budget 2019 to develop a critical cyber systems framework. In 2021, we completed an interdepartmental 5G security examination, which recommended an updated security framework to safeguard Canada's telecommunications system.

A cornerstone of the updated framework is an evolution of the security review program. It would allow for continued engagement with Canadian telecommunications service providers and equipment suppliers to ensure the security of Canadian telecommunications networks, including 5G. As a result of this multi-year work, to address these identified concerns and improve Canada's cybersecurity posture, including in 5G technology, we introduced Bill C-26.

The bill is intended to promote cybersecurity across four federally regulated critical infrastructure sectors: finance, telecommunications, energy and transportation.

Bill C-26 consists of two very distinct parts. Part 1 introduces amendments to the Telecommunications Act that would add security as a policy objective and create a framework that would allow the federal government to take measures to secure the telecommunications system. Part 2 introduces the critical cyber systems protection act, which would create a regulatory regime requiring designated operators in the finance, telecommunications, energy and transportation sectors to protect their critical cyber systems.

As I mentioned, 5G has the potential to be a transformative technology for Canadians. It promises to bring lightning-fast Internet speeds that are unlike anything we have experienced so far. The benefits of instant and real-time connectivity will be immediate and far-reaching for Canadians and Canadian businesses.

The COVID-19 global pandemic has underlined the importance of this connectivity, whether it is for virtual classrooms, work from home or keeping in touch with loved ones, but we need to be absolutely sure this technology is safe and secure as the technology is rolled out in Canada.

Canada already has a system in place to mitigate cybersecurity risks in our existing 3G and 4G LTE wireless telecommunications network. Since 2013, the Communications Security Establishment's security review program has helped mitigate risks stemming from designated equipment and services under consideration for use in Canadian 3G, 4G LTE telecommunications networks from cyber-threats.

Like previous generations, 5G technology will have new risks and vulnerabilities that will need to be addressed so Canadians can realize its full potential. 5G is considered more sensitive than 4G because it will be deeply integrated into Canada's critical infrastructure and economy, and will connect many more devices through a complex architecture. The deep integration, greater interconnection and complexity increase both the likelihood and potential impact of threats. That is why an examination of emerging 5G technology and the associated security and economic considerations continues to be very important.

The technical agencies of the Government of Canada, within the Department of Innovation, Science and Economic Development, and the safety and security agencies that fall within the Public Safety portfolio, Global Affairs Canada, National Defence and others, are all involved in the federal government's efforts to develop a made-in-Canada approach to ensuring the secure rollout of 5G wireless technology. Moving this bill forward will further that vital work.

In the meantime, our world-class national security and intelligence agencies continue to protect our country from a wide range of threats. As we know, those threats include a growing number of targeted attacks from state and non-state actors, including cybercriminals.

Canada's two main national security organizations, CSIS and CSE, which is short for Communications Security Establishment, are working tirelessly to mitigate these threats.

CSIS provides analysis to assist the federal government in understanding cyber-threats and the intentions and capabilities of cyber actors operating in Canada and abroad who pose a threat to our security. This intelligence helps the government to improve its overall situational awareness, better identify cyber vulnerabilities, prevent cyber espionage or other cyber-threat activity and take action to secure critical infrastructure.

For its part, the CSE is always monitoring for threats that may be directed against Canada and Canadians. The CSE is home to the Canadian centre for cybersecurity, which was established as a flagship initiative of the 2018 national cybersecurity strategy. With the cyber centre, Canadians have a clear and trusted place to turn to for cybersecurity issues. It is Canada's authority on technical and operational cybersecurity issues, a single, unified source of expert advice, guidance, services and support for the federal government, critical infrastructure for owners and operations, the private sector and the Canadian public. It helps to protect and defend Canada's valuable cyber assets and works side by side with the private and public sectors to solve Canada's most complex cyber issues.

For example, the cyber centre has partnered with the Canadian Internet Registration Authority on the CIRA Canadian Shield. The shield is a free protected DNS service that prevents users from connecting to malicious websites that might infect their devices or steal personal information. With the passage of the National Security Act in 2019, Canada's national security and intelligence laws have been modernized and enhanced.

As a result, CSIS and the Communications Security Establishment now have authorities they need to address emerging national security threats, while ensuring that the charter rights of Canadians are protected.

These updates are in line with CSIS's mandate of collecting and analyzing threat-related information concerning the security of Canada in areas including terrorism, espionage, weapons of mass destruction, cybersecurity and critical infrastructure protection.

The passage of the National Security Act also established stand-alone legislation for the CSE for the first time ever. With the Communications Security Establishment Act, the CSE retained its previous authorities and received permission to perform additional activities.

For example, the CSE is now permitted to use more advanced methods and techniques to gather intelligence from foreign targets. Under the CSE Act, CSE is mandated to degrade, disrupt, influence, respond to and interfere with the capabilities of those who aspire to exploit our systems and to take action online to defend Canadian networks and proactively stop cyber-threats before they reach our systems. It is also permitted to assist DND and the Canadian Armed Forces with cyber operations.

As Canada's national police force, the RCMP also plays a very important cybersecurity role. It leads the investigative response to suspected criminal cyber incidents, including those related to national security.

Cybercrime investigations are complex and technical in nature. They require specialized investigative skills and a coordinated effort. That is why, as part of Canada's 2018 national cybersecurity strategy and as a second flagship initiative, the RCMP has established the national cybercrime coordination centre, or NC3.

The NC3 has been up and running for over a year now. It serves all Canadian law enforcement agencies, and its staff includes RCMP officers and civilians from many backgrounds. Working with law enforcement agencies, government and private sector partners, the NC3 performs a number of roles, including coordinating cybercrime investigations in Canada.

All of this is backed up by significant new investments in the two most recent budgets. In budget 2019, we provided $144.9 million to support the protection of critical cyber systems and we later invested almost $400 million in creating the Canadian centre for cybersecurity, the national cybercrime coordination unit and increased RCMP enforcement capacity.

Whether it is nationally or internationally, I have full confidence in the abilities of all those in our national security and intelligence agencies who are working hard day and night to safeguard our cybersecurity and protect us from harm online. I am confident that Bill C-26 will go a long way to continue doing that.

[Eric Melillo, Conservative, Kenora, ON]

Madam Speaker, I appreciate the comments from the government member across the way.

In the debate today, a number of concerns have been brought forward around some of the ministerial powers included in Bill C-26, as well as the lack of accountability mechanisms. I think we have heard from all parties about the desire to bring forward amendments and improvements at the committee stage.

Does the member opposite have a willingness to work with members of the House to ensure that we improve this bill and make sure it achieves the results it intends to?

[Julie Dzerowicz, Liberal, Davenport, ON]

Madam Speaker, I think our Minister of Public Safety was very clear this morning. Without question, every time the government takes additional, decisive action and puts additional measures in place, there has to be corresponding transparency and accountability. We absolutely need to make sure there is enough of that in Bill C-26 so we have the confidence not only of the House but of Canadians with regard to having the proper accountability and transparency in place.

[Louise Chabot, Bloc, Thérèse-De Blainville, QC]

Madam Speaker, I thank my colleague for her speech.

This bill still raises some serious concerns. The Bloc Québécois is prepared to support it so that we can examine and improve it in committee.

In 2021, in Canada alone, one in four businesses reported being the victim of a cyber-attack. We are the G7 country that has done the least in this regard. We spent $80 million over four years for research and development, which is not much. Canada is lagging behind in that department. Cyber-attacks on businesses can be sudden and unexpected, and not every business has the money to invest in cybersecurity or protection mechanisms.

What will this bill actually do to help with and improve cybersecurity?

[Julie Dzerowicz, Liberal, Davenport, ON]

Madam Speaker, I want to point out that we have been providing significant investment in critical cyber systems and cybersecurity. We did this in budget 2019 by providing $144.9 million for the protection of our critical cyber systems in the areas of finance, telecommunications, energy and transport. We also invested almost $400 million in the Canadian centre for cybersecurity, in the creation of the national cybercrime coordination unit and to increase our RCMP enforcement capacity.

The hon. member did a wonderful job in asking how we are going to make sure we work with the public and private sectors. The Minister of Public Safety was very clear this morning: This legislation is about filling in the gaps and providing a bridge for all of the different actors, both in the private sector and in the public sector, so we can work together to create more resiliency against any cyber-attacks in the future.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, I think we all agree that the protection of Canada's cybersecurity needs to be improved. However, as we are hearing from the opposition, there are concerns around the broad powers the minister would have through this bill and concerns about everyday Canadians possibly being surveilled by their own government.

We have not heard assurances from the government as to how it will address that to ensure Canadians do not feel they will be victims of government overreach through powers given to the minister.

[Julie Dzerowicz, Liberal, Davenport, ON]

Madam Speaker, this question has come up all morning. I think it is a very big concern, not only for the opposition but for this side of the House.

We want to make sure we get this right. We must ensure that we have very strong protections against cyber-attacks and have cyber-attack resiliency in this country. We also have to be very transparent about the additional powers and how they will be used.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I say good morning to all of my hon. colleagues, and I thank the hon. member for Davenport for her insightful discussion of this bill.

I am thankful for the opportunity to weigh in on Bill C-26, an act respecting cybersecurity, as we continue debate at second reading. Bill C-26 will take great strides to enhance the safety of our cyber systems and will make changes to allow for measures to be taken within our telecommunications system.

There are two parts to this act. Part 1 amends the Telecommunications Act to “promote the security of the Canadian telecommunications system” as a policy objective. An order-making power tied to that objective would be created for the Governor In Council, or GIC, and the Minister of Industry. That power could be used to compel action by Canadian telecommunications service providers if deemed necessary. With these authorities, the government would have the ability to take security-related measures, much like other federal regulators can do in their respective critical infrastructure sectors.

The bill would enable action against a range of vulnerabilities to these critical systems, including natural disasters and human error. The Department of Innovation, Science and Economic Development would exercise regulatory responsibilities, and an administrative monetary penalty scheme would be established to promote compliance with orders and regulations made by the GIC or Minister of Industry. Once amendments to the Telecommunications Act receive royal assent, GIC or ministerial orders could be issued to service providers.

Part 2 of the act would create the critical cyber systems protection act, or the CCSPA. The CCSPA would be implemented collaboratively by six departments and agencies: the departments of Public Safety; Innovation, Science and Economic Development; Transport; Natural Resources; and Finance, as well as the Communications Security Establishment. They will all play a key role. Indeed, across the Government of Canada, there is a recognition that cybersecurity is a horizontal issue, and it should be addressed through a streamlined government response across sectors, all rowing in the same direction.

Schedule 1 of the act would designate services and systems that are vital to the national security or public safety of Canadians. Currently, schedule 1 includes telecommunications service and transportation systems. It also includes, in the finance sector, banking systems and clearing and settlement systems, and, in the energy sector, interprovincial or international pipeline and power line systems and nuclear energy systems.

Schedule 2 of the act would define classes of operators of the vital services and systems identified in schedule 1, as well as the regulator responsible for those classes. Operators captured in a class are designated operators subject to the act.

In line with the responsibility to exercise leadership in matters related to national security and public safety, the Minister of Public Safety would have overall responsibility for the legislation and would lead a number of CCSPA-related processes.

Decision-making by GIC under the CCSPA would ensure that a broad range of relevant factors, including national security, economic priorities, trade, competitiveness and international agreements and commitments, are considered when making decisions that have an impact across sectors. The CCSPA would also leverage regulators' expertise and relationships with entities they already regulate under existing legislation.

The Canadian centre for cybersecurity, or the cyber centre, is responsible for technical cybersecurity advice and guidance within Canada, and that would be no different under the CCSPA. It would receive resources to provide advice, guidance and services to designated operators in order to help them protect their critical cyber systems; regulators in support of their duties and functions to monitor and assess compliance; and public safety and lead departments and their ministers, as required, to support them in exercising their powers and duties under the act.

The CCSPA would require designated operators to establish a cybersecurity program that documents how the protection and resilience of their critical cyber systems will be ensured. CSPs must be established by designated operators within 90 days of them becoming subject to the act, that is, when they fall into a class of designated operators published in schedule 2 of the act.

Once established, the CSP must be implemented and maintained by the designated operator in order to keep it up to date and responsive to changing threats and evolving technology. CSPs must include reasonable steps to identify and manage organizational cybersecurity risks, including risks associated with an operator's supply chain, and the use of third party products and services. They must also protect their critical cyber systems from compromise, detect cybersecurity incidents that affect or have the potential to affect CCS and minimize the impact of cybersecurity incidents affecting critical cyber systems.

This legislation would also help confront supply chain issues. With the increasing complexity of supply chains and increased reliance on the use of third party products and services, such as cloud-based data storage and infrastructure as a service, designated operators can be exposed to significant cybersecurity risks from those sources.

When a designated operator, through its CSP, identifies a cybersecurity risk to its CCS in relation to its supply chain or its use of third party services or products, the CCSPA would require the designated operator to take reasonable steps to mitigate those risks. Taking reasonable steps to mitigate risk is understood to mean reducing the likelihood of the risk materializing by, for example, securing a supply chain by carefully crafting contractual agreements to gain more visibility into equipment manufacturing, or by choosing another equipment supplier. It can also mean reducing the impact of a risk that materializes.

Under the CCSPA, there would also be a new obligation to report cybersecurity incidents affecting or having the potential to affect critical cyber systems to the Communications Security Establishment, for use by the cyber centre. A threshold defining this reporting obligation would be set in regulations. This would provide the government with a reliable source of information about cybersecurity threats to critical cyber systems. The availability of incident reports would enhance visibility into the overall threat for the cyber centre. Findings from the analyses of incident reports would make it possible for the centre to warn other designated operators and any operator of a cyber system of potential threats or vulnerabilities, and it would help to inform Canadians of cybersecurity risks and trends, allowing one organization's detection to become another's prevention.

The CCSPA would also create a new authority for the government. Under the act, the Governor in Council would be allowed to issue cybersecurity directions when it decides that specific measures should be taken to protect a critical cyber system from a threat or known vulnerability. Directions would apply to specific designated operators or to certain classes of designated operators. They would require those designated operators to take the measures identified and to do so within a specific time frame. Failure to comply with directions could be subject to an administrative monetary penalty or an offence that can lead to fines or imprisonment. The CCSPA would also includes safeguards to ensure that sensitive information, such as information that was obtained in confidence from Canada's international allies, is protected from disclosure.

All of this provides an overview of strong new legislation, which I hope I have adequately described in two distinct parts. I look forward to our continued debate of this landmark bill, and I encourage all colleagues to join me in supporting Bill C-26 today.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Madam Speaker, I certainly agree that something needs to be done about cybersecurity in this country, but I am increasingly alarmed when I see that the bills continually coming from the Liberal government say ministers would have all powers to do whatever they want. There is no transparency because there is no public record. Then they say not to worry about what the government is really going to do because the Governor in Council, which is really cabinet, will decide afterward with no parliamentary oversight what will be done.

Does the member agree that the government needs to have parliamentary oversight and at least have this subject to the scrutiny of committees?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, of course, fundamentally I believe in the oversight of government and ensuring that there are checks and balances.

When bills proceed to committee, obviously members within the pertinent committee should bring forth ideas to strengthen them, and that includes Bill C-26. Our main priority as MPs is to bring forth good legislation, to improve it and to protect the security of Canadians, whether it is their cybersecurity or health and safety. Bill C-26 would take us down that path.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, clause 2 of the bill would enable the government to issue orders to force users of telecommunications services to use products or services that do not come from certain providers, including Huawei.

Does that mean that a person who has already bought a Huawei cellphone, because that is a product, will not be able to use it anymore and will have to buy a new phone much sooner than they expected?

What is more, since decisions will be made by order, does that mean that, under this bill, the government will be using orders to govern in this area instead of going through parliamentarians?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I thank my colleague from Quebec for her question.

In the preliminary version of the Library of Parliament's assessment of the bill, there is a reference that the bill specifies that no one would be entitled to any compensation from the federal government for any financial losses resulting from these orders. I am not certain if these orders pertain to exactly what the member was speaking to, but I do believe so. I would have to get back to the member on that specific question, because it is a pertinent question.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, we are all in agreement here. We know that Canada needs to strengthen protections when it comes to cybersecurity to protect Canadians and Canadian businesses.

One thing we are all unified on over on this side in the opposition parties is that we need to have some assurances for everyday Canadians that these sweeping powers, broad powers that are going to be given to the minister, are not going to be applied to everyday Canadians in terms of surveillance.

I know we keep hearing from Liberal colleagues that they will get it to committee and will answer these questions. However, does my colleague not agree that the minister failed in bringing forward this legislation without addressing some of these concerns at all? This is fairly substantial legislation, and the Liberals have not been able to address any of the concerns we brought forward today around these very real concerns.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, we must always protect the civil liberties and rights of Canadians. Any legislation brought to the House needs to pass that means test, if I can call it that.

With reference to Bill C-26, it is definitely required that we update our cybersecurity laws to reflect the ongoing changes in technology that have happened over the last number of years and the increasing use of cybersecurity, cyber-threats, increasing digitization that has been going on in the world, and the fact that Canadians are increasingly interconnected in this world.

We need to maintain checks and balances within the system and ensure that individual rights of Canadians are protected.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Madam Speaker, I will be splitting my time with the member for Sherwood Park—Fort Saskatchewan, a good friend of mine.

Today I get to address Bill C-26, and right off the top I will say that I think this is dumb legislation. Why do I say that? I say that because I do not think that it has attempted to do what it has stated it would do. Generally I find that this is another piece of legislation, probably the third or fourth that I have spoken on in this session of Parliament, where I am frustrated with the government in that it does not seem to do the hard work of governing.

Governing is a matter of balancing the interests and coming up with a statement or something that is clear. On the rule of law, we would anticipate the public and anticipate what the rules ought to be and then look at the law, read the law somewhere and say, “Oh, that is what we are supposed to be doing.”

Again, here we have a piece of legislation where there is a clear, identifiable problem. Canadians have seen a number of issues around the country and around the world where cybersecurity is under threat. Canadians are asking the government to govern, to set some parameters and guidelines as to what the expectations are around who gets to participate in cyberspace and how we ought to operate in cyberspace.

We see in this piece of legislation the classic attitude of “We're the government. We're here to help. Trust us. We got this.” We do not trust the government. Particularly, the Conservatives do not trust the government to do the things it needs to do. We have seen it try to hand out billions of dollars to its friends. I mentioned the WE scandal. We have seen it hand out money to its friends over at Baylis Medical. We have ample evidence of why we should not trust the government.

When it comes to cybersecurity, it is also an area where I do not trust the government. The government has been in power for seven years, and we have watched it drag its feet with an inability to come to a decision, for a whole host of reasons, around the Huawei situation. Was a particular company allowed to participate in the building of the infrastructure of our Internet architecture?

This is a major issue. We told the government that we don't think this Chinese Communist Party government-controlled company should be able to participate in the Canadian Internet infrastructure. We called on the government to ban the use of Huawei technology in our Internet infrastructure, yet it could not do it. It took the government years of dragging its feet, wringing its hands and doing a whole host of things. When the Liberals come forward with a bill like Bill C-26 and say to trust the minister and that they will get this right, I am sorry, but we do not trust the minister to get this right.

We have seen a number of security threats challenging our basic infrastructure. One we should really take note of, which was fairly recent, is the shutdown of a particular pipeline. We saw a dramatic spike in fuel prices across North America because the cybersecurity of a particular piece of pipeline infrastructure was not to the state that it should have been. This, again, comes to the fact around trusting the government to do its job, particularly this government.

One of the key roles of government in Canada and anywhere is the maintaining of peace and security, and we have a military, a police force and a judicial system for that. A growing area where we need to be concerned about peace and security is in cyberspace.

We should be able to feel that our property should not go missing. We should be able to own property, and it should be able to be maintained by us, all of these kinds of things. We expect the government to put forward registries so we can register our property, so that, if it goes missing, the government has a registry of it and we can use that to get our property back. It cannot just be expropriated from us, all of these kinds of things.

In the same way, that is increasingly a part of cybersecurity. The ownership of things in cyberspace, the ownership of websites and the ownership of even our own Twitter handles, for example, are increasingly things that are deemed to be cybersecurity.

The government seems to be lacking in the ability to protect Canadians' cybersecurity.

There is an iconic Canadian company, Ski-Doo. I do not know if people are snowmobilers, but I do enjoy snowmobiling, and Ski-Doo is an iconic Canadian company.

I do not know if people know this but, recently, Ski-Doo has been the victim of a cyber-attack and has lost control of its entire dealership network. Its own computer system has gone down. It has not been able to get it back. Somebody else has control of it now and it has not been able to get it back.

These are the types of things that I think are crucial. When one is going to bring in a bill that talks about cybersecurity, these are the kinds of things the government should be trying to keep secure. This is Canadian property. These are Canadian identities. These are Canadian brands. These are the things we need to ensure we can prosecute, that we can track these people down who are doing this kind of thing and that we can ensure cybersecurity.

I guess that is where I get a little frustrated with a bill like this. It says a lot of nice things at the top of it. The government comes here with a blanket statement around how it is going to defend cybersecurity, how cybersecurity is important and how we should all vote in favour of this particular bill. I imagine that we will.

However, the bill does not necessarily tell us what we are going to do. The banning of Huawei is not necessarily laid out in this. There are no criteria as to what the expectations are for companies to operate in this space, in terms of what they can be tied to and what they should not be tied to. It is just, “Trust us. We are the government and we are here to help.”

In addition, we have seen over the last number of years the opportunities for the government to put resources into law enforcement's ability to track some of this down. We can see changes to the Criminal Code, to ensure that some of these malware attacks or ransomware attacks could be tracked down and prosecuted here in Canada. This is a major concern for companies looking at investing in the world. They look at a country's ability to protect them from a cyber-attack but then also to prosecute those cyber-attacks.

I have a friend who works for the Calgary city police. He works in cybercrimes. He often works with police forces from around the world to track down folks who are using ransomware on Canadian companies.

He tells me they rarely, if ever, prosecute in Canada because our laws are so non-distinct around this that it is impossible to prosecute. Because these are multi-jurisdictional crimes, they will often take the prosecution of this to a jurisdiction that has better laws. He says he will work with 23 law enforcement organizations and they will bring a case in Europe, in eastern Europe or in Israel, because those places have much better laws to protect cybersecurity.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I am glad the member will be voting in favour of the legislation going to committee. Hopefully many of the concerns he raises on the issues surrounding the worthiness of the legislation, will be addressed at that stage.

The legislation would empower the minister to be able to take actions. It would allow for financial penalties. It would allow for us to deal with cyber-attacks from a legislative perspective. That does not necessarily mean that this is the only thing we have done over the last number of years. There has been a great number of financial resources, individuals, committees and so forth ensuring our industries are protected.

This is yet another step forward in dealing with cyber-attacks, keeping us consistent with other allied countries. I am wondering if the member would acknowledge the importance of moving forward with allied countries in dealing with things, such as cyber-attacks?

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Madam Speaker, I am hopeful that this bill would get us in line with other countries from around the world because, increasingly, Canada is left out of the discussions around cybersecurity.

We are no longer invited to some of the many important forums that do take place in battling this. If that is what this bill is attempting to do, to bring us in line with some of these other countries, I hope that is the case. However, I would note, I was talking to my friend with the Calgary Police Service who said that Canada is increasingly not the jurisdiction where they pursue these prosecutions because we are so lacking in good legislation to protect our cybersecurity.

[Alexis Brunelle-Duceppe, Bloc, Lac-Saint-Jean, QC]

Madam Speaker, I thank my colleague for his speech.

He talked about trust in the government or perhaps a lack of trust. In the current global context, there is interference by countries like China. We know that the RCMP has launched investigations into 11 electoral candidates. In fact, we also know that on July 7, 2016, the Prime Minister authorized a Chinese bank to do business on Canadian soil. At the same time, on July 6 and 7, 2016, the Papineau Federal Liberal Association received more than $70,000 in donations in 48 hours.

Is that not a reason to lose trust in the Prime Minister and the government?

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Madam Speaker, that is another prime example among many of why Canadians do not trust the Liberal government, whether it this particular case of accepting interesting money for an approval; the Huawei decision that needed to be made; the WE Charity scandal, where the Prime Minister was trying to give an organization $1 billion, an organization that had funded nearly half a million dollars to his personal family; or the sweetheart deal with Baylis Medical.

Over and over again, we see that the government is not trustworthy. When it comes forward with bills that do not have a lot of details and that just give blanket permission to cabinet ministers, I am sorry, but we do not trust it.

[Bonita Zarrillo, NDP, Port Moody—Coquitlam, BC]

Madam Speaker, today in the House we have heard the NDP speak about its concerns, also about its concerns with oversight.

Are Conservatives also in support of those changes around oversight?

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Madam Speaker, yes, that is for sure the case. We are in support of more oversight. We would like to see a detailed bill, not a bill that just says that it would give the minister broad powers to do all the things.

That is not governing. That is not providing legislation. That is basically saying, “We love puppies. You should support us because we love puppies.”

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, I appreciate the opportunity to speak in the House today to a very serious subject, cybersecurity and the security of our country in general.

I will say, on a lighter note, that my friend from Peace River—Westlock spoke about snowmobiling companies and cyber-attacks. I have some personal experience with snowmobiling at his house, and I would say that the government's approach to security is the equivalent of driving a snowmobile over a four-foot retaining wall, which may or may not have happened the last time I tried to drive one of those machines.

The situation of security in this country is very much worth the House taking note of. For much of the time that I have been engaging with and following politics, the primary area of security we would talk about would be concerns about our readiness for and our response to the threat of terrorism. However, it is important to take stock of how things have changed and the fact that, while there are still concerns about terrorism and how we respond to potential acts of terrorism, the primary security threat we face as a country, and indeed that the western world faces, is the threat of foreign state-backed and directed interference in our national affairs. Our abiding concern should be the reality that various foreign states are trying to shape and interfere with our democratic life to try to bend not only our government institutions, but also our civil society institutions, toward their desired objective.

Members of the government have said that the purpose of this interference is to cause total chaos and confusion. We should acknowledge that there are some cases of foreign interference that are aimed at causing chaos, but very often it is about simply trying to subvert and control the direction of institutions toward the will and the interests of that particular foreign power. We have discussed how the Chinese Communist Party is the biggest player when it comes to foreign state-backed interference, but it is far from the only player.

We have seen reports about Chinese government interference in our elections. There have also been recent reports about death threats from the Iranian regime targeting individuals in Canada. There are various other countries that CSIS and other organizations have identified as being involved in this activity of trying to interfere with, subvert and direct Canadian institutions, government really at all levels, as well as civil society organizations, universities and the like, toward their objective.

This kind of invisible, or sometimes a little more visible but often hard to detect, interference in the direction of our national life toward objectives that are not consistent with the objectives Canadians have established is a great threat to our security and our sovereignty. It is something that we should all be seized with and working to respond to.

Part of the context as well is that we are in what some analysts have described as a second cold war. Of course, there are many features of the current conflict between democratic and authoritarian values that are different from the last Cold War, but we have this reality of intensifying global competition between two different value systems that are represented by different countries at different times, and we have countries that are in the middle that are being pulled in different directions.

I tend to think that kind of cold war frame is a reasonably useful way of understanding the current tensions we face in the world. In the context of those tensions, we see how powers with political values that are fundamentally different from ours, where governments are trying to protect their own position, are trying to project their influence around the world. Again, this requires vigilance. It requires a strong response from Canada.

I have been struck by some of the recent comments from the Prime Minister on these matters. I think he has been showing a real lack of transparency around acknowledging what he knew when, and refusing to answer direct questions from the opposition about foreign interference, but he has also stated quite openly the reality that we have a serious problem with foreign interference. This is a reality that opposition members, in particular in the Conservative Party, have been raising for years. We have been asking the government to do more. We have been calling for strong legislative frameworks to respond to the problem of foreign state-backed interference.

We have also sought to elevate the voices of victims of foreign interference, people who have faced threats and intimidation from foreign state actors to try to silence their advocacy, which those foreign state actors see as contrary to their interests. It has been widely reported some of these victims really struggle to actually get proper support. They often get the runaround.

They go to their local police force, which does not necessarily have the capacity to handle a foreign state-backed organized campaign of threats and intimidation. Do they go to Global Affairs? Do they go to CSIS? Do they go to the RCMP? There can be a bit of confusion and passing of the buck concerning support for these victims of foreign state-backed interference.

We have a lot of work to do in legislation and policy, and our preparedness in general and our understanding of these issues. It is critical that we step up to strengthen our understanding of and response to the threats facing our country.

One thing we need to see more from the Prime Minister and the government is transparency because being transparent about this reality can help to counter the impact of that foreign interference. If we know it is happening, if we know what it is directed toward, then we can respond more effectively.

This is not only a responsibility of the federal government to respond to. Provincial and municipal governments need to be aware of the issues of foreign interference. Our universities need to step up as well. Private companies need to be aware of the risks around interference, theft of technology and the ways in which certain things may have a dual military use. There needs to be a broader awareness of this threat to the national interest, a threat to our values across all sectors of society, and a broader response to it.

The government has an important role to play in leading the response and making changes at the national level. We have been far behind, as far the national government goes, in responding to these threats. The Conservative opposition has been calling for a response to foreign interference for years. Now we are seeing the government start to talk about it a bit more.

I noted in some of the language in the Indo-Pacific strategy, for example, the government is starting, or trying, to sound a bit more like Conservatives in the way it talks about some of the challenges confronting us and the steps we need to take in the Indo-Pacific region. While the government is adopting some of that language, it is failing to substantively adjust its approach.

We have a bill in front of us today that deals with one avenue where we need to be engaged with and responding to the problem of foreign state-backed interference, and that is the issue of cybersecurity. I will be supporting this legislation at this stage to see it go to committee, mainly because we clearly need a new cybersecurity bill. We clearly need a new framework. The committee study will identify some of the significant gaps we see in the legislation right now, the ways the legislation needs to be improved and possibly the many additional steps required. I will just note that it is far past due that we have some kind of proposal for a framework on cybersecurity that, in a way, gives the committee the opportunity to add to and build on what the government has initially put forward.

This is really the first time we see any kind of legislation proposed by the government that substantively touches on this emergent problem of foreign state-backed interference. We need a much broader range of responses from the government. We need so much more to be done to counter this major security threat.

This is about preserving our country. It is about preserving the integrity of our institutions. It is about defending the principle that the direction of our democracy and the direction of our society should be shaped through the open deliberation of Canadians, not by foreign powers who have particular interests that may be contrary to our interests who are trying to push and pull that discussion in their preferred direction.

Having this framework that opens the door for the committee to discuss further, fill in some of the gaps and try to push the government to have greater specificity in the framework around what they are going to do provides us with the opportunity to do that. This is late, lacking in detail and really a small piece of the much broader picture that is required.

The government has been so delayed. I mentioned the decision around Huawei. We were way behind all of our allies in making the decision. It is important now, finally, at this late stage where the government is starting to mention the problem, that we actually see concrete action. Conservatives will be pushing the government to act in line with some of the words it has been saying.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I would just correct the member. Yes, this legislation is very important and we hope to see it get to the committee stage where it will no doubt be well discussed and debated. There will be presentations where members can digest information and see if there are ways in which we can improve upon the legislation. However, to try to give an impression that this is the only thing the government has done on the issue of cyber-threats is a bit of a false impression.

Not only have we been seeing a great deal of dialogue and actions from different departments to date in the form of formalized advisory groups, but we have seen literally tens of millions of dollars, not to mention the other incentive programs that were there, for the private sector, for example.

I wonder if the member would not agree that this issue is not new and this is just one very important aspect in taking a step forward.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, the member is correct that this is not a new issue. That is precisely why I think the government is very late in coming to the table. The issue of foreign interference, which is part of the context of the cyber-threats we face, is also not a new issue. Again, we have been calling for action from the government, but we have not seen other action from it. The member says that the Liberals have done all these other things, such as maybe giving some money over here or over there, but he evidently could not articulate specific measures that the government had taken.

We are behind when it comes to defending our security. We are behind what we should have known much earlier. We are behind our allies. We were the last of the Five Eyes and very late to step up on recognizing the risks associated with Huawei.

When it comes to foreign interference, I will challenge the government on one point: Why has the government not expelled foreign diplomats involved in interference and intimidation in Canada? That would be a simple step and the government has not taken it.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, the bill before us seeks to reinforce our security systems and may affect critical infrastructure in Quebec such as Hydro-Québec. I always think about the Conservatives and their famous great energy corridor. That is the type of project in which the federal government could appropriate provincial responsibilities and critical infrastructure in the name of national security. This sets off major alarm bells in my mind.

Can the member reassure me about the Conservatives' intentions? Can he assure me that if they come to power some day, they would not misuse legislation like this piece of legislation?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, the member asked what we would do if we were in government. We would make the right decision on every one of those.

With respect to the particulars the member raises with respect to what powers the federal government would have in intervening with provinces, this is an important issue for the committee to look at. I am supporting this legislation because we need to have a cybersecurity framework in Canada. It is important that this goes through to the committee and that those issues be looked at there.

I did not have time to go into it, but there are a significant number of problems in the legislation that do have to be worked out by the committee. No doubt there has to be a role for federal leadership around security, but it has to be a constructive, collaborative relationship, because there are steps for other levels of government. We see foreign interference at the very granular local level, so that collaboration across levels of government is really important.

[Larry Maguire, Conservative, Brandon—Souris, MB]

Madam Speaker, this morning my colleague from Kildonan—St. Paul made an excellent presentation on this bill. She talked about the transparency that may be lacking in certain areas and the effects on small businesses and how they may not be able to afford the cost like a larger company. I wonder if my colleague could expand on that.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, that is an excellent point. I did not have a chance in my remarks to talk specifically about the transparency issues. Again, we need to support this bill through the second reading stage out of agreement with the general principle that we need to do more on cybersecurity, recognizing how far behind the government has been.

However, there are significant issues with respect to ensuring transparency. There are significant issues on whether the bill is clear and specific enough about the steps that are required, instead of just leaving it, as we see often with the government and legislation, and giving an open-ended blank cheque to the government.

There are definitely issues. This requires a detailed committee study. I hope Conservative proposals will be adopted and we will be able to strengthen the bill as a result.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I will begin by saying that I will be sharing my time with the hon. member for Abitibi—Témiscamingue.

I am pleased to speak to this bill, which, I must say, was eagerly awaited by my party.

The Standing Committee on Public Safety and National Security had the opportunity to study the issue of cyber security. We heard from experts in this field, who told us what they think about Canada's cyber security preparedness or posture. The idea came from my Conservative colleagues, and it was a very good one.

Given what is happening in Ukraine with the Russian invasion, we know that there are still military threats in the 21st century. However, we are also dealing with the emergence of new technologies that pose non-military threats. I had the opportunity to talk about these non-military threats at the Organization for Security and Co-operation in Europe Parliamentary Assembly last week in Warsaw, Poland. I discussed non-military threats and how different countries must prepare for or guard against them.

What the Standing Committee on Public Safety and National Security heard is how difficult it is to prepare for these threats, because they are evolving so quickly. No one had anything particularly positive to say about Canada's preparedness.

I think that the willingness is there, and that is what the experts told us: Canada is trying to prepare for and guard against potential cyber-attacks. I said “potential” cyber-attacks, but they are already happening. We know there have been cyber-attacks on various infrastructure and companies in Quebec and Canada, especially in the private sector, in the past. Canada is not as prepared as it could be to face these attacks, but we were told that it may never be totally prepared. The same is true for all countries because, as I said, the technology is changing so rapidly.

For this reason, I think that adopting a cybersecurity framework is an extremely positive step. That is what the government promised. In its national cyber security strategy, it pledged to better regulate cyber systems in the federally regulated private sector. The 2019 budget earmarked $144.9 million to develop a new framework to protect critical infrastructure. That is exactly what the two main parts of this bill do. They are aimed at strengthening the security of the Canadian telecommunications system.

Part 1 of the bill amends the Telecommunications Act to add the promotion of security, authorizing the government to direct Internet service providers to do anything, or refrain from doing anything, that is necessary to secure Canada's telecommunications system. Part 2 enacts the new critical cyber systems protection act to provide a framework for the protection of critical cyber-infrastructure and companies under federal jurisdiction.

The act is essentially a regulatory framework. As my colleague from Abitibi—Témiscamingue mentioned earlier in his question to our Conservative colleague, we will have to see what impact this bill could have on Quebec, especially companies and organizations like Hydro-Québec, since it designates interprovincial power line systems as vital services and vital systems. More on that later.

We will also have to see in committee whether the vast regulation-making powers provided for in Bill C-26 are justified or whether they bypass Parliament for no reason. Certain groups that raised concerns in the media have contacted us as well. Their concerns about this bill are well founded. I will get back to this a little later on.

I would say that it is important to proceed carefully and properly with this bill. Any amendments made to the bill will have a direct impact on every transmission facility in Quebec, including those that will soon be built in my riding to offer adequate cell service to those who are still waiting. Some Canadian ridings are unfortunately still without cell service in 2022. Since my riding is one of them, the bill will have a significant impact.

Local telephone service providers, IP-based voice services, Internet service providers, long distance providers and wireless services will be subject to the amendments to the act.

This means that the amendments would allow authorities to secure the system if there is reason to believe that the security of the telecommunications system is under threat of interference, manipulation or disruption. In that case, telecommunication service providers could be prohibited from using or supplying certain goods or services.

As I understand the wording of the bill, which is rather complex, telecommunication service providers could even be prohibited from supplying services to a specific individual. It is important to realize that these are vast powers, and I hope that, when the bill is sent to committee for study, it will be detailed enough to include the factors that will be taken into account before such powers are granted.

As I was saying earlier, the act will make it possible to designate certain systems and services under federal jurisdiction as critical to national security or public safety. The new Critical Cyber Systems Protection Act will protect critical cyber systems in the private sector.

What, then, is a critical cyber system? I found it difficult to find a clear definition in French of what a critical cyber system is, but the government defines the term itself in the bill. It appears that it is a “system that, if...compromised, could affect the continuity or security of a vital service or vital system.”

The bills lists six vital services and systems in its schedule. These obviously include telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems that are under federal jurisdiction, banking systems, and clearing and settlement systems.

These are the areas this bill addresses. That is a lot to verify, and several actors are involved. Several ministers will be involved in the regulatory process after that, so it is important to study the bill carefully.

At this stage, a number of questions arise. For example, what impact will the bill have on certain interprovincial infrastructures, such as power lines and power grids? The act could impact Hydro-Québec and other non-federal infrastructures, such as aluminum smelters. As I understand it, the bill itself would designate interprovincial power lines as a vital service. That could have an impact.

In principle, the bill is not a problem for my party. When we call experts to testify before the committee, we will be able to determine whether or not it will have a positive impact. I think it could be very positive, but we need to look at its scope.

The Bloc Québécois has often supported the government in its efforts to ensure stricter control of broadcasting for certain vital infrastructures that could be in the crosshairs of foreign nations. Let us consider China and Russia, as I mentioned earlier. There is the Huawei saga and the development of the 5G network. The government's indecision for so many years proves that it would have been better to act beforehand rather than to react to the current situation. China's increasing power and its attempts at interference on several occasions, as well as Canada's vulnerabilities in terms of cybersecurity, are real. For example, we know that Hydro-Québec has been a potential target for Chinese espionage. The same could happen directly in our infrastructures. I think that this bill is relevant. We are very happy that the government introduced it. That is why the Bloc Québécois will vote in favour of sending the bill to a parliamentary committee so that we can hear what the experts have to say.

I would like to take these final moments to talk about the concerns voiced by certain groups. Professor Christopher Parsons of the University of Toronto said that the bill was so imperfect that authoritarian governments around the world could cite it to justify their own repressive laws. That is a worrisome statement. I will elaborate during questions and comments.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Madam Speaker, I thank the member for her speech.

My question is the following. Is the member concerned that this bill gives too much power to the federal government and the minister?

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, yes, that is a concern.

It was mentioned by the University of Toronto professor I cited earlier and certain groups that seek to protect individual freedoms. This bill may give too much power to the minister. We will have to properly study it in committee.

We must bear in mind that this bill seeks to secure and protect Canada's critical infrastructure. I believe that the government is acting in good faith. It is prepared to authorize the circulation of some information so we can help one another and safeguard businesses from potential cyber-attacks. I believe it is a good objective. We will have to ensure that there is nothing sinister about wanting more information.

[Bonita Zarrillo, NDP, Port Moody—Coquitlam, BC]

Madam Speaker, my question for the member is around protection of seniors. I wonder if the member has some comments on how the bill would protect vulnerable groups, like seniors, from scams.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, that is an excellent question.

Based on what I have seen of the bill so far, I could not say. Quite honestly, I have no idea if this bill will do more to protect seniors from scams.

I know these kinds of scams are happening in my riding in the Lower St. Lawrence region. People call seniors, posing as grandsons in custody or living in another country. They ask their victims to transfer money because they need it right away, and some seniors fall for it.

I have no idea if this bill will help with that kind of thing. If not, the government really should do something to put a stop to it.

[Monique Pauzé, Bloc, Repentigny, QC]

Madam Speaker, I thank my colleague for her excellent speech. Her understanding of all these things is much greater than mine.

The member talked about interference and disrupting essential infrastructure, of course, as well as cyber-attacks from other countries or even individuals. My colleague also shared what experts told the committee. To hear them tell it, Canada's security system is a long way from being secure.

I would like my colleague to comment on that.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, indeed, the committee has heard from several experts on this subject. They told us that there is currently nothing to force companies, whether they are federally regulated or not, to report when they are victims of cyber-attacks, for example. They can just not report it and try to work through it on their own, even though there are authorities in place to help them through these kinds of events.

The experts were telling us that it might be worth having a framework that forces companies to work with the government or cybersecurity bodies to report and help prevent attacks so that a solution can be found. My understanding of the bill is that it would create a framework to compel federally regulated companies to do exactly that. I think that is a very good idea. It follows through on what the experts were proposing in committee.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I am pleased to rise to speak to Bill C-26, which will strengthen the security of critical infrastructure and Canada's telecommunications system.

Since June, many experts have been working to learn more about the provisions of this act and assess the value of what the government is proposing.

First, this bill is not structured in the usual way. I see that the urgent need to manage cybersecurity has been taken into account. This bill would give the minister new responsibilities, but the Governor in Council would also be able to act. The law is essentially a regulatory framework that will enable the government to make regulations to ensure the security of critical cyber systems.

I want to focus on the second part of the bill, because passing it will create a new law, the critical cyber systems protection act, which will provide a framework for the protection of critical cyber-infrastructure or businesses under federal jurisdiction. The affected sectors of our economy are identified as designated operators. It is easy to determine which businesses and organizations are affected.

The government has done well to specify who will must comply with the obligations: persons, partnerships or unincorporated organizations that belong to any class of operators set out in schedule 2 of the new law. Those classes will be identified by order.

Each class of operators will be assigned a corresponding regulator, such as the Minister of Innovation, Science and Industry, the Minister of Transport, the Office of the Superintendent of Financial Institutions, the Canadian Energy Regulator, the Bank of Canada or the Canadian Nuclear Safety Commission.

Schedule 1 of the new act sets out the vital services and vital systems that will form the basis of these designations, which may be added at a later date: telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems that are within the legislative authority of Parliament, banking systems, and clearing and settlement systems.

I would like to draw my colleagues' attention to Hydro-Québec. An important part of the bill that has the Bloc Québécois concerned is the part on vital services and vital systems, which could potentially involve interprovincial power lines and distribution networks. It is of paramount importance that this section of the bill be studied and clarified in committee to assess whether this will affect Hydro-Québec and, if so, how.

However, we are not against the underlying principles and objectives of securing and protecting interprovincial infrastructure. Hydro-Québec reportedly suffers more than 500 cyber-attacks a year, or roughly 41 attacks a month. That is more than one attack a day. This could jeopardize our power grid, putting the life and economic health of every Quebecker at risk. It could also jeopardize customers' personal information, although that is generally a secondary target in any attack against a publicly owned energy corporation.

Although Hydro-Québec has managed to fend off these cyber-attacks and protect itself by investing in systems, firewalls and employee training, why should we not take proactive measures? Not only is it very time-consuming for businesses like Hydro-Québec and Desjardins to protect themselves and react to the constant onslaught of cybersecurity attacks, but it is also very expensive. Hopefully, this bill will help prevent or limit these attacks by taking a proactive approach and regulating and promoting new cybersecurity frameworks among Internet service providers. This is particularly important in light of the increased threat to our infrastructure from bad state actors such as Russia or China.

Hopefully, unlike today, businesses will have resources they can consult for information about cyber-attacks.

This is also a national security issue. These states have become emboldened not just by the Canadian government's passive reaction, but also by the regulatory void. We need only think of Huawei and the threat it represents, as well as the damage it has caused to the national security of countries around the world, especially in Africa. The examples are quite striking. China has passed a law forcing all businesses to contribute to the advancement of the objectives of Chinese intelligence services, which is particularly alarming when we consider that this country uses coercive diplomacy, blatantly disregarding international standards.

Even though the federal government has finally banned Huawei technology, the decision was preceded by many years of uncertainty because of the pressure, power and influence that China could unfortunately bring to bear on us.

This decision showed how vulnerable we are to malicious actors on the world stage. That is why we need a regulatory framework, a way to respond to cybersecurity threats, particularly from foreign powers that are in a position of power and use the weakness of others to advance their own positions.

I met this morning with representatives from Shakepay, a Quebec-based financial technology company that operates a platform dedicated entirely to bitcoin, with over one million Canadian customers. One of the things that struck me in that meeting was the importance they place on security and customer protection. Of course, I had Bill C‑26 in mind. They told me that all customer funds are held in a trust at a ratio of 1:1 with Canadian financial institutions and leading cryptocurrency depositories. I learned that they are continually working to improve and promote the implementation of cybersecurity measures to protect their systems.

In preparing for my remarks today on Bill C‑26, I started thinking that we need to examine how we can build on the security standards of Quebec companies like Shakepay and that we need to determine whether the bitcoin and cryptocurrency industry should also be considered in Bill C‑26. Whether we like it or not, technology and customer habits may be leading us in that direction.

I would like to discuss cyber-resilience. I understand that the bill will not be studied by the Standing Committee on Industry and Technology, on which I sit. However, I see issues that affect industries that are in that niche of protecting systems from cyber-attacks. There are two things to keep in mind here: The attackers go after data using methods that were previously unimaginable, and they tend to favour methods that significantly delay the ability to resume operations. The desired consequences are financial and reputational damage.

The inherent complexity of the systems currently in place requires increasingly specialized resources. Innovation, research and development must be encouraged, in short, the entire ecosystem of this industry that works on the cyber-resilience of very high-risk systems. We need to ensure to attract the best talent in the world. The government must carry out its responsibilities at the same pace as it introduces these changes. Let us not forget, as the opportunities for cyber-attacks keep increasing, that we are always one incident away from our continuity of operations being disrupted.

Is there an urgent need for action? Yes, clearly. Is the government on the same page as the people involved in this industry? Unfortunately, it has fallen behind.

For the past year, the Standing Committee on Industry and Technology has been studying topics that enabled it to get to the heart of the advanced technologies used in the industries covered by this bill. The inherent complexity of the environments in which those industries operate expose critical data and system configurations to greater risks than ever before, so much so that we are no longer assessing the likelihood of a successful cyber-attack, but instead how to recover. In fact, as IT infrastructure has become increasingly complex, cyber-attacks have become increasingly sophisticated too.

I dare not imagine what will happen in the coming years, when AI reaches its full potential and quantum computing becomes available. What I am hearing is that hundreds of pieces of users' electronic data are stored each day on international servers. They cannot be thoroughly processed using currently available technology, but what will happen when quantum computers are able to process those data? Maybe we will be very vulnerable as a result of actions we take today by casually agreeing to things in an app or allowing our data to be collected. In short, in five years' time, we may be paying for what we are giving away today.

In conclusion, the Bloc Québécois supports the bill. We want it to be sent to committee to be studied in detail, as my colleague from Avignon—La Mitis—Matane—Matapédia said. I also welcome forthcoming opportunities for specialists in Quebec industries who are renowned for their expertise.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is encouraging when we get support for legislation. This legislation goes a long way in recognizing that cyber-threats are something on which we do need legislation to come forward and be voted upon. This legislation would allow for financial penalties and for the minister to take direct action. I wonder if the member could provide his thoughts on the importance, once we get into committee stage, of listening to what presenters have to say. I understand there are some concerns with regard to the legislation.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, that is indeed essential, and it is also essential that the act have more teeth. In my opinion, it is vital that the act provide for a mechanism for issuing sanctions or fines in order to enforce compliance with orders and regulations aimed at securing telecommunications.

Let me give an example. We have learned that China maybe funding elections, meaning that there must be a network out there that is a threat to our country. Our national security and our ability to decide for ourselves who will lead our country are being influenced by foreign money. That is something that really worries me.

As a result, our systems need to be strengthened and penalties need to be imposed. Before that, however, we must know what happened, diagnose the problem accurately and be transparent. That is just one example of many, but that is how the problems should be resolved, particularly with respect to cybersecurity.

[Colin Carrie, Conservative, Oshawa, ON]

Madam Speaker, I want to thank my colleague for a very thoughtful speech. He was very good at pointing out some of the issues with this that we have heard from stakeholders. We have heard from privacy and civil liberties groups about the secrecy that could impair accountability, due process and public regulation.

The government orders issued under this bill may be made in secret without public reporting requirements, making it impossible for rights groups and the public to monitor and challenge how power is exercised under the bill. The secrecy of this could be very concerning.

I wonder if the member and the Bloc had any thoughts, once this goes to committee, about anything that could be added to improve the required balance between civil liberties and secrecy.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Sorry for the delay, Madam Speaker. I was waiting for the interpreter to finish. In passing, I want to thank the interpretation team. The fact that we can count on excellent interpreters when we are working on complex bills like this one is a strength of our democracy. I want to thank them.

Ultimately, we are here to protect the people we represent. I am very concerned about this, but I do not profess to be an expert. However, as intermediaries and legislators, we have access to the real experts. It is essential that they appear in committee to tell us how we can strengthen these bills. It is very clear that we need to make decisions today that will protect us against future attacks, which will come in forms that we cannot even fathom right now.

As I said, we have no way of knowing right now how much quantum computing will change our lives, by allowing the attacks to become increasingly sophisticated and rendering our existing defence systems obsolete.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, because it is the holiday season I will not slight the government for taking so long to bring legislation like this forward. We know that France and the U.K. are far ahead of us in terms of addressing cybersecurity issues. I will give credit to the minister for at least starting to move this process forward.

Our shared concern with the Bloc is that the minister is going to have these extra powers. We are disappointed that this legislation has come forward without ensuring that Canadians will not be unjustly examined or that this is not going to be applied to ordinary Canadians.

Maybe my colleague could speak about how important it is, when government brings forward legislation, that these things are presented in the initial piece of legislation, rather than assuming it will go to committee and get improved upon there. There should be some effort from the government to address these areas at the beginning.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I will simply say that I agree with my colleague.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Madam Speaker, it is a pleasure to rise today to speak to Bill C-26 on cybersecurity. I will be sharing my time today with the member for Edmonton Manning.

Canadians recognize that we need to do something in the area of cybersecurity. We have all experienced hackers. Myself, when I have bought something online, the next thing I know is my credit card is hacked and then all the pre-authorized transactions need to be changed. It is very time-consuming. I have been hacked numerous times on Facebook, as I am sure many have, as well as on Instagram and other places. Those are small examples that Canadians are seeing.

Let us think about the more serious cyber-hacking we are seeing, whereby government systems are hacked and breaches of information are happening. Businesses are experiencing this. I have a friend who is an anti-cyber hacker. For $2,500 a day, he goes around the world, helping companies that have been hacked to improve their protections.

Something needs to be done. I would like to talk today about what needs to be done, and then how the bill does or does not meet that need.

First, we have to identify what the critical systems are. What are the things we want to protect? If somebody hacks my Netflix account, it is not earth-shattering. However, there are things that are important, and I think everyone would agree that databases that protect our identity or have information about our identity are critical.

Financial institutions and people's financial information are critical. On our medical information, we have spent a lot of time on legislation and regulations on protecting medical privacy. Those, to me, would be three of them, but certainly, the critical systems need to be identified.

We need to make sure there are adequate protections in place. Not every business and level of government has the same amount of protections and technology in place. There is a journey of defining what adequate protection is and helping people get there.

In the case of breaches and having them investigated and addressed, the bill gives very broad powers to the minister. It allows the federal government to secretly order telecom providers to “do anything or refrain from doing anything...necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.”

Those three terms are not well defined, so I think there is some work to be done to define those better, but I do not really believe we want to give the government power to do anything it wants. Certainly, shutting down a system for protection is important when there is an actual threat and not just a potential future threat or a possible threat. In the case of a threat, the government needs the ability to act, but certainly we have to tighten up the language in the bill on that.

After there has been a breach, there needs to be preventive and corrective action. Preventive action would be additional technology walls or additional controls that are put in place to ensure that we have enhanced protection in the future. Corrective action is fixing the holes that people got into in the first place and punishing the hackers. It does not seem like any of that is happening today. The bill does not address that, but there should be some measures there to take corrective action.

I talked about the overarching powers and my concern with them. We cannot have the government continually coming up with bills in which it has not really defined what it is going to do but it tells us not to worry about it because the Governor in Council, after the fact and without any parliamentary oversight, will determine what we are going to do.

The Governor in Council means the Liberal cabinet ministers. I think we are at a place where people have lost trust in the government because there is no transparency. The bill allows the government to make orders in secret, without telling people what is done. The public cannot see it and is suspicious, because people have seen numerous examples of the government hiding things.

We have just come through a $19-million emergency measures act situation in which the Liberal cabinet ministers and the Prime Minister knew they were never going to disclose the documents that would prove or disprove whether they met the threshold, because they were going to hide behind solicitor-client privilege.

They have done it before, hiding behind cabinet confidence, like on the Winnipeg lab issue. Look at the documents we tried to get hold of there. The Liberals even sued the Speaker in order to hide that information from Canadians.

In the SNC-Lavalin scandal, we saw them hiding behind cabinet confidence. In the WE Charity scandal, we saw them hiding behind cabinet confidence. I am a little concerned, then, to find that in this cybersecurity bill, the Liberals are saying the government can make secret orders that the public is not going to ever know about. I think that is very dangerous. This is one of the reasons we are seeing an erosion of trust in Canada.

A recent poll posted by The Canadian Press showed that if we look at the trust index in Canada, only 22% of Canadians trust the government or politicians. That means four out of five Canadians do not trust the government or politicians, and it is partly because of what has gone on before, when things have been done such as people's banks accounts frozen and drones surveilling citizens. People have lost trust, so I do not think they are going to be willing to give a blank cheque to the government to do whatever it wants for cybersecurity, to control enterprises outside the government to get them to stop operating, for example. The riverbanks need to be much tighter on that.

People are concerned about their civil liberties, and I know there has been a lot of conversation about the lack of privacy protection in this country. We have regulations like PIPA and PIPEDA. My doctor cannot reveal my medical information; my employer cannot reveal my medical information, but various levels of government in the pandemic made it so that every barmaid and restaurant owner could know my private medical information and keep a list of it, which is totally against the law. Therefore, when it comes to cybersecurity we are going to have to make sure the privacy of Canadians' information is better protected, and I do not see that element here in the bill—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I have a point of order from the hon. member for Timmins—James Bay.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Madam Speaker, it is important that we not use disinformation in the House. The member mentioned that restaurant waitresses were breaking the law by asking for vaccine information. That is a falsehood. Could the member correct that?

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I would say that the information the hon. member is trying to share is more of a point of debate.

The hon. member for Sarnia—Lambton has just under three minutes.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Madam Speaker, I have no problem clarifying. Several of the places I went into were following provincial orders, to be clear, and they were to record who showed up and whether or not they were vaccinated. That is what was done, and that is against PIPA and PIPEDA.

I will turn to the government's record on protecting us in terms of cybersecurity, and talk about Huawei.

In 2018, our Five Eyes partners were concerned about Huawei's connection to the Chinese communist government, and they were not going to allow Huawei into their networks. However, the Canadian government delayed a decision for four years. The Liberals waited until 2022 to ban Huawei. Why did they do that? It was so Bell and TELUS could implement Huawei technology, 4G technology, across the country. That is hardly a protection from a cybersecurity point of view, and it again speaks to why Canadians have lost trust in the government.

However, I will support the bill to go to committee. I have said that we need to do something for cybersecurity, and I have outlined what I think we need to do. I do not think we can leave these huge gaps that have been cited by numerous institutions.

The University of Toronto has written letters to the government, talking about what is wrong with the bill and what it would like to see. If members have not seen the report it did with the Munk School, called “Cybersecurity Will Not Thrive in Darkness”, there are a number of recommendations in the report that talk about what needs to be done to Bill C-26 to fix it. I would encourage the government to look at that, and I would expect it to become the substance of amendments that would be brought at committee.

Also, we should look at what the constitutional and civil liberties lawyers are saying. They are very concerned about the parts of the bill that would surveil Canadians, so I think we need to make sure we listen to what they have to say. They have written an open letter to the government, and I would recommend that the government take a look at that as well.

Finally, on accountability, due process and public regulation, there is potential for abuse. I would encourage the government to take a look.

I look forward to more discussion at committee.

The House resumed consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Mr. Speaker, we live in a world where every person is increasingly concerned with cybersecurity. So much of our lives is stored on our personal devices, protected by passwords and multi-factor authentication in the hopes of keeping our most private information secure.

Corporations are increasingly at risk. It seems as if every day we hear a new report of companies’ computer systems being hacked and their data held for ransom by thieves who have managed digital anonymity. Law enforcement officials say many such cybercrimes go unreported, with companies paying quietly and privately so as to avoid publicity.

Our public institutions are not immune either. Hospitals have had their computer systems attacked by intruders, putting patients' lives at risk. Emergency services have been attacked, as have the parliamentary computer systems.

Cyber-threats remain a national security and economic issue that threatens the safety and security of Canadians. Government and industry alike have highlighted the need for regulation in cybersecurity. There has been a lot of talk, but not much else.

Currently the Canadian government does not have a legal mechanism to compel action to address cyber-threats or vulnerabilities in the telecommunications sector, yet cybersecurity has become one of the primary issues each person and institution has to address. I am pleased that the government has introduced this legislation to allow us in the House to examine the cybersecurity concerns and needs of our nation.

Bill C-26 would amend the Telecommunications Act as well as other related acts. The intention would be to amend the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything that is necessary to secure the Canadian telecommunications system.

I do not think there is anyone in the House, indeed in the country, who would disagree with the objective. As I have already pointed out, there is a problem with cybersecurity in our society, and government has an important role to play in protecting Canadian individuals and institutions. Some may wonder about giving such power to the Governor in Council and the Minister of Industry, but there are rules for the judicial review of those orders and applications. This is not a granting of absolute power, but of limited power subject to the checks and balances needed in a democracy.

The bill would also enact the critical cyber systems protection act to provide a framework for the protection of the cyber systems of services and systems vital to national security or public safety. This, among other things, would authorize the Governor in Council to designate any service or system as a vital service or vital system. It would require designated operators to establish and implement cybersecurity programs, mitigate supply chain and third party risks, report cybersecurity incidents and comply with cybersecurity directions.

One would think that such cybersecurity measures should be common sense and not need to be mandated by government. Is it right to compel private corporations and organizations to use their own resources to invest in cybersecurity? It would seem to me that well-run businesses would put cybersecurity first. Not every aspect of a business generates income, and smart business managers and owners know that. As the cliché goes, they have to spend money to make money.

Implementing cybersecurity measures comes with a cost. There is no doubt about that. It would seem to me, though, that the cost would be considerably less than the cost of dealing with criminals holding their data for ransom after they have invaded their computer system and locked them out of it.

Cybersecurity makes common sense for business. However, given that implementing cybersecurity measures comes with a financial cost with no corresponding revenue, do we really want to rely on those who might put short-term profits first, or does it make more sense in this case for government to step in to save some business owners from themselves?

As someone who has spent most of his life working as a businessman, I am reluctant to suggest that business owners need to be saved from themselves, but as a Canadian I know that sometimes such action is necessary.

We have only to look at the history of one of Canada's most successful companies: Nortel. It is a company that might still exist if those running it had taken cybersecurity more seriously. With more than 94,000 employees worldwide, Nortel was a high-tech leader until its headquarters were bugged, its computer systems breached and its intellectual property stolen. Now it is just a memory. We will never know for sure, but perhaps if cybersecurity had been a higher priority at Nortel, it would still be providing jobs, products and services for Canadian people. If anyone ever asks why we would take cybersecurity seriously, the one-word answer is “Nortel”.

Though I am a little uneasy that this bill would almost certainly increase regulations and red tape, maybe there are ways that some of the excessive paperwork that seems to be beloved by the Liberals can be made reasonable. Certainly there is a need to ensure a level playing field of regulatory burdens for small and medium-sized businesses and organizations. If there is not, then I can see companies being forced into bankruptcy by the cost of implementing government-mandated cybersecurity procedures. I know that is not the government's intention, but as we have seen in the past, sometimes not all the impacts of government rule-making are foreseen. The Minister of Industry especially needs to ensure that the rules are workable and provide protection against attacks by criminals and malicious states.

Indeed, it is perhaps malicious states that we should be concerned about the most. The interconnectedness of computer systems and their use in controlling and maintaining our infrastructures mean we are increasingly vulnerable to a devastating attack. An enemy that could seize control of our electricity grid or our banking system could bring our nation to its knees without firing a shot. The nature of warfare has changed, and as a result we must change our defences.

Canada's national security requires being prepared for the security warfare threats that we face. The government has been slow to address cyber-threats and has seen a number of serious incidents occur, with no substantive legislative response for seven years. I am pleased that the government has finally chosen to act, and I am hopeful that we in the House can help improve this legislation. Cybersecurity is of paramount importance in the modern world. Canada cannot neglect it.

[Martin Champoux, Bloc, Drummond, QC]

Madam Speaker, I want to congratulate my colleague on his speech.

Cybersecurity is essential, and it is also a race against time because hackers are becoming better and better organized. They are fast, equipped, cunning and, on top of that, dishonest. That gives them an advantage over us presumably honest people.

The government has been slow to act, legislate and get aggressive with cybersecurity.

Does my colleague think that there is still time to take the lead in this race, or are we going to continue to fall behind international hacker organizations?

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, I mentioned at the end of my speech that the government was very late in putting forward such a bill. It is a very tough question to answer as to whether or not we can catch up. We know the existing wars and challenges and future wars are mostly around cybersecurity. It will be important in this motion of the House, with this bill, to assess how prepared Canada is for facing future threats.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, within the legislation there is consideration given to how financial penalties would empower the minister to take strong action to ensure that providers are keeping up with what they need to keep up with.

My question to the member is this. Would he agree that when we take a look at the issue of cyber-attacks, they are not something unique to Canada? It is happening around the world. We are working with allied countries and others. This is one part. It does not stop here. There is a need to continue, as we have for the last number of years, investing tens of millions of dollars and putting people to the task of protecting us against cyber-threats.

Could the member just provide his thoughts in terms of the broader picture of cyber-threats?

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, I will answer the end of the question and go back to the beginning of what the hon. member asked.

We are still not there in terms of assessing our preparedness and our cybersecurity position. I do not know if we have enough understanding of those challenges, what our position is and how prepared we are. That is a very important task for the government.

As far as financial penalties on businesses, I mentioned in my speech that such things could put some businesses into bankruptcy, because they would not be able to afford the services that would provide the protection needed for them not to end up in such a disastrous situation.

Therefore, a balance is needed, and this has to be done by working together with the industry. If we are truly prepared, the financial penalties should be less, because the government should have done more in the last seven years, or even the years before that, in terms of looking to the future.

It all remains in the hands of the government that is putting this bill forward. We hope to get some answers.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Madam Speaker, that was a very interesting intervention. I am not a specialist in cybersecurity, so I am finding this debate very informative.

I guess one of the questions I have is about how we balance the need for cybersecurity with the need for transparency. That is really what the big question is for this. How do we make it effective but also adhere to the Canadian values of transparency, human rights and whatnot?

I wonder if the member has anything to say about the fact—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

I have an hon. member with a point of order, and I think I know what the hon. member is going to say. The hon. member asking the question does not have her headset, and we do not allow members to speak without a headset. That is on me, with my apologies.

I will have to interrupt the hon. member right now and give the hon. member for Timmins—James Bay a very short question, please.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Madam Speaker, cyber-threats are not new. In 2011, Canada's two main financial centres in government, Finance and the Treasury Board, were pushed off-line for days by hacks from Chinese operators, yet the Harper government did nothing about that. It did not want to talk about it because it was busy selling off sections of the oil sands and Nexen to Chinese state-owned operators and then signing a free trade deal with China, the deal that would allow it to take on Canada outside of the court system.

I find it kind of special that the Conservatives are suddenly concerned about cybercrime now, when they did nothing to take on China's state threats to Canada under Harper.

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, the NDP member always wants to politicize things. This is a very serious issue, and there is not one party that is more serious about this than others. I wish he had stayed within the non-partisan notion of this bill. Let us talk about facts. Let us talk about logic and stop the attacks.

[Ryan Turnbull, Liberal, Whitby, ON]

Madam Speaker, before I begin, I will just say that I will be splitting my time with the member for Kingston and the Islands.

It is an honour to rise today in the House to debate the second reading of Bill C-26, an act respecting cybersecurity. To me, cybersecurity is essential, and it certainly relates directly to our national security.

When we consider the challenges and opportunities we face in this field, the theme of collaboration underpins and needs to underpin all that we do.

The prevalence of cybercrime in an increasingly online world, improving cyber-defence posture in an unstable global environment, deep thinking about what the future holds in a world where innovation and change are exponential, a critical look at whether our policies and laws are up to the task, and the protection of content and intellectual property as data becomes one of the world's most precious resources: These are just some of the reflections that we have to have when considering this bill.

In Canada, being online and connected is essential. Now, more than ever, Canadians rely on the Internet for their daily lives. It is about more than just conducting business and paying bills. It is also about staying connected with loved ones across the country and around the world. We should be able to do all these activities safely and securely.

I would like to offer a few words about what we are doing here in Canada to get that balance right, and I would like to reinforce the importance of our commitment to protecting the cyber systems that underpin our critical infrastructure.

We can take the emergence of new technologies, such as 5G, as one clear reason we need to redouble our efforts. We think about our increased reliance on technology in light of the COVID-19 pandemic. We think about international tensions amidst Russia’s unprovoked and unjustified ongoing invasion of Ukraine, with threats ranging from supply chain disruptions to state and non-state malicious cyber-activity.

Through all of these remarkable events, the government has been working tirelessly to keep Canadians safe. We recognize that, now more than ever, secure and reliable connectivity is a necessity for our daily lives and our collective safety and security. It underpins the delivery of critical services, such as energy production, financial transactions, safe transportation and emergency communications.

As part of his mandate, bestowed by Prime Minister Trudeau, the Minister of Public Safety is seized with the opportunity and challenge of developing a renewed national—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

The hon. member for Battle River—Crowfoot is rising on a point of order.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, as was pointed out by the parliamentary secretary to the government House leader yesterday, the use of the Prime Minister's name is not an accepted practice of this place.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

The hon. member is correct. We do not use the names of current members of Parliament.

[Ryan Turnbull, Liberal, Whitby, ON]

Madam Speaker, as part of the mandate bestowed upon him by the Prime Minister, the Minister of Public Safety is seized with the opportunity and challenge of developing a renewed cybersecurity strategy. We need to make sure we articulate Canada’s long-term plan to protect our national security and economy, deter cyber-threat actors, and promote norms-based international behaviour in cyberspace.

The Government of Canada is working to enhance the cybersecurity of the country’s critical infrastructure. The work to identify cyber-threats and vulnerabilities, and to respond to cyber-incidents, is around the clock and ongoing. Unfortunately, we have seen that malicious actors continue to attempt to take advantage of the current environment to exploit certain sectors. I would like to use one example that is relevant for my riding and the region I come from.

My riding is the riding of Whitby, and Durham District School Board is the public school board in our area. On Friday, November 25, just very recently, there was a cyber-incident at the Durham District School Board. It resulted in online classes being cancelled. They were forced to postpone scheduled literacy tests. They have had phone lines down and email service down. They even do not have access to emergency contacts, and they are trying to limit this incident so it does not impact payroll for the over 14,000 Durham District School Board employees. There are 75,000 students who go to school across our region.

They have notified police of the attack. Their investigation is said to be very complex and time consuming, and they will be assessing the privacy impacts, but we can just imagine how this has impacted students and employees at Durham District School Board.

This is a really serious topic. I think we all need to give it the weight it deserves, and this legislation is trying to ensure we do our utmost to protect against these cyber-threats in the future.

However, we are not starting from scratch to tackle these threats. Since 2018, the Government of Canada has invested a total of approximately $4.8 billion in cybersecurity. Through the national cybersecurity strategy, the Government of Canada would be taking decisive action to strengthen Canada’s defence, preparedness and enforcement against cyber-threats. The strategy was paired with the largest investment in cybersecurity ever made by the Government of Canada, totalling close to $800 million in the 2018 and 2019 federal budgets.

In the 2021 budget, the government allocated an additional $791 million to improve and defend cyber-networks, enhance data collection and protect taxpayer information, and in the 2022 budget, another $852.9 million was committed to enhance the Communications Security Establishment and its ability to conduct cyber-operations, make critical government systems more resilient, and prevent and respond to cyber-incidents on critical infrastructure.

Under the strategy, two flagship organizations were established. One is the Canadian centre for cybersecurity, otherwise known as the cyber centre, under CSE, and the other is the national cybercrime coordination centre under the RCMP.

The cyber centre is a single, unified team of government cybersecurity technical experts. The centre is the definitive source of unique technical advice, guidance, services, messaging and support on cybersecurity operational matters for government, critical infrastructure owners and operators, the private sector, and the Canadian public.

The NC3 coordinates Canadian police operations against cybercriminals and established a national mechanism for Canadians and businesses to report cybercrime to police. In the example I mentioned in my riding of the Durham District School Board, it would report the cybercrime to the local police, and that would go up through NC3 as well.

Public Safety Canada’s Canadian cybersecurity tool also helps owners and operators of Canada’s critical infrastructure to evaluate their cyber-maturity against established benchmarks and by peer comparison. It offers concrete guidance on how they can become more cyber-resilient.

Public Safety Canada also coordinates and delivers cyber-based exercises for the critical infrastructure community to test and develop capabilities to respond to and recover from malicious cyber-activities. More broadly, the department, as the federal lead on cybersecurity policy, promotes communication and collaboration to raise awareness of cyber-threats and risks, including with our international partners. Public Safety Canada works closely with the Communications Security Establishment’s Canadian centre for cybersecurity to enhance the resilience of critical infrastructure in Canada. The cyber centre, in addition to providing public advisories, shares valuable cyber-threat information with Canadian critical infrastructure owners and operators.

Today I am very proud to say that we can begin to debate a new piece of legislation to further strengthen what we have built as a government. Today we are debating Bill C-26 for the second reading, and this legislation's objective is twofold.

The first part proposes to make amendments to the Telecommunications Act, which include adding security as a policy objective, adding implementation authorities and bringing the telecommunications sector in line with other critical infrastructure sectors. This would allow the government, when necessary, to mandate any action necessary to secure Canada’s telecommunications system, including its 5G networks. This would include authority to prohibit Canadian telecommunications service providers from using products and services from high-risk suppliers.

The second part introduces the critical cyber systems protection act, or CCSPA. This new act would require designated operators in the federally regulated sectors of finance, telecommunications, energy and transportation to take specific actions to protect their critical cyber-systems, and it would support organizations' ability to prevent and recover from a wide range of malicious cyber-activities, including malicious electronic espionage and ransomware.

[Denis Trudel, Bloc, Longueuil—Saint-Hubert, QC]

Madam Speaker, I am not a cybersecurity expert either.

A few weeks ago, I attended a demonstration in Montreal with 10,000 people to support the people who are fighting for their freedom in Iran, which, as we know, is not a democratic state. I have also strongly supported people from the Uighur community, who I have met with many times here in Ottawa. We know that they are facing genocide in China. The small white square that I am wearing is a sign of support for people who, at this time, are rising up against the health measures in China, as well as the people in Russia who are protesting against the war in Ukraine.

I want to know if there are concrete measures in Bill C‑26 that would prevent Iran, China and Russia from carrying out cyber-attacks on social networks and, for example, hacking my account and interfering in my life as an MP? I would like my colleague to clarify that.

[Ryan Turnbull, Liberal, Whitby, ON]

Madam Speaker, I share the member opposite's ethical concerns with other state-sponsored actors, disinformation and ensuring that our cyber-infrastructure and our lives as MPs are also protected from the attacks and incidents that are too often affecting some of our institutions and even us, as individuals.

This bill really looks to strengthen the work the government has been doing year over year to invest in protections against cyber-attacks in our critical infrastructure and to ensure that we are enhancing those tools and investments, and leveraging them to the best degree possible to protect against the kinds of threats the member opposite identified.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, cybersecurity cannot be underestimated in its importance, especially in the world in which we live.

One of the concerns that has been highlighted to me, as I listened to security experts surrounding this issue, is how far behind Canada is in taking action on cybersecurity, whether that be the decision regarding Huawei, or how Canada lags behind its Five Eyes partners. Taking action is essential in ensuring that we are on the same playing field.

I am wondering if the member from the government would be willing to expand as to why, after years of being in government, this is only now being debated in the House of Commons.

[Ryan Turnbull, Liberal, Whitby, ON]

Madam Speaker, I am not really sure how we get these types of critical remarks coming from the opposite side of the House given that in my speech I gave very tangible examples of two agencies that have been set up and some pretty significant investments that have been made since 2018. The $4.8 billion for cybersecurity is no small amount. We are making investments and setting up the systems and tools.

I have been briefed, as a member of the procedure and House affairs committee, on our House of Commons cyber-infrastructure and cybersecurity. Although those briefings were in camera, I know full well that very strong and resilient systems have been set up to identify and neutralize threats ahead of time to ensure our critical infrastructure in the House of Commons is protected. I think that extends right across Canada with the work that our government has been doing.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Madam Speaker, I want to take a moment to apologize to the interpreters for when I completely forgot my headset previously. I am not feeling my best, and I am obviously not on my game.

I want to thank my colleague for his intervention today. It was very interesting. I agree with my colleagues from the Conservative Party that we are very late to the game, but I think it is vital that we get it right. It is just so important that we do that balance.

One of the concerns we are hearing from the stakeholders we have spoken to is that this bill has orders that will be exempt from the Statutory Instruments Act. Therefore, it would be unable to be reviewed under scrutiny at the regulations committee. Could the member speak to why the government made that decision?

[Ryan Turnbull, Liberal, Whitby, ON]

Madam Speaker, as I am not sure of the specific details the member opposite is referring to in her question, I would have to say, in good faith, that I will get back to her on that after doing a bit more research on why that decision was made.

What I can tell her is that the key provisions in this act really do further the overall objectives of protecting our critical infrastructure. It specifically adds to the Telecommunications Act the objective of the “promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to”—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

I must interrupt the hon. member. We are way over time.

Resuming debate, the hon. parliamentary secretary to the government House leader, Senate, has the floor.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Madam Speaker, I thank the member for Whitby for sharing his time with me.

It is very important that we talk about such an important piece of legislation that has been brought forward, Bill C-26. The reality is that the changes in technology are happening so incredibly quickly. At times, it seems a daunting task to keep up with them and to make sure that we are always ahead of those actors out there, whether state or non-state, who are trying to engage in activities that could seriously cripple our economy or other aspects of society in Canada.

It seems as though it was just yesterday that we did not have the Internet. I remember vividly when I signed up for my first Internet connection, a dial-up connection, and having access to the Internet. That was when I was a computer engineering student at a local college in Kingston back in 1995 or 1996. Downloading something as simple as a single image sometimes would take two or three minutes to get the full image on the screen.

[Philip Lawrence]

What did you download?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, it was not an image of the member opposite who is asking.

The point here is that things are evolving so quickly, and we have come so far in such a short period of time in terms of our ability to utilize, perfect and, for lack of a better term, exploit everything that the Internet has to offer. We have seen it change commerce. We have seen it change how we engage with each other. We have seen it change just about every aspect of our lives. Unfortunately, with that comes new opportunity for people to try to affect what we do in our day-to-day lives. They are trying new forms of fraud, theft, harassment, intimidation and influencing elections, which are all nefarious manners in which people are trying to now utilize the Internet.

Of course, cybersecurity is a huge part of any government operation now, and every government should be seized with doing everything it can to secure it, because when we think about it, everything is connected. There could be a cyber-attack on a utility company, on a functioning parliament, a democracy. There could be an attack on just about every aspect of our lives, and it is critical that we have legislation in place to ensure that we can properly safeguard those things.

I have heard individuals in the House, and in the last two questions, one from the Conservatives and one from the NDP, suggesting that this is taking way too long and that we are behind other countries. I would caution members on that and suggest that it is not entirely accurate. For example, the United Kingdom has a very similar bill to this one that is being studied right now by its members of Parliament, a Conservative government, I might add. They are going through the exact same process as we are now. I think it is always easy to say, and it is one of the things we hear quite a bit from opposition parties, why is this taking so long?

I have my own opinion on why things take so long in this House, but the reality is that I do not believe we are significantly trailing behind other countries. Yes, some countries have done more than us. I am not going to disagree with that, but I disagree that we are significantly behind. I will come back to the United Kingdom where a Conservative government has introduced a very similar piece of legislation to what we have. This brings me to the legislation that we are debating today.

This bill has two primary parts to it. The first part would amend the Telecommunications Act to add the objective of the promotion of cybersecurity of the Canadian telecommunications system to Canadian telecommunications policy.

It also authorizes the Governor in Council and the Minister of Industry to direct telecommunications service providers to secure the Canadian telecommunications system. I think that is incredibly important. In this process, we have to remember that a huge part of what we need to do is work with private partners and the various telecommunications services that are out there. We need, from a policy or government perspective, to put in place some of the things that they need to do.

The reality is that in a competitive business environment where various different telecommunications companies are fighting to be more competitive and more efficient to maximize profit, which we all appreciate is important in the capitalist environment we live in, we have to respect the fact that in order to ensure that some of these safeguards are in place, we are going to need to make sure that the legislation is there to make sure companies are doing what they need to be doing to create those safeguards. Otherwise, it might not happen to the degree it needs to because of the nature of the competitive environment they are in.

The other aspect of this bill is that it enacts the critical cyber systems protection act to provide a framework for the protection of critical cyber systems that are vital to national security and public safety. Of course, this is key because this is what everything else is built on in terms of our national security and the systems that we have. We need to make sure we can properly safeguard those. In that regard, it authorizes the Governor in Council to designate any service or system as a vital service or vital system. Just think about that.

When I was in college studying computer engineering and I went to get my first dial-up connection, who would have thought that a mere 25 years later we would be talking about designating some of these services as being vital to national security or public safety? The reality is that is where we are now. As we rely so heavily on these systems, we rely so heavily on ensuring that we have the systems in place that we do in order to protect our security as it relates to cyber-threats.

I appreciate the opportunity to talk about this very important piece of legislation. I get the sense it is being widely supported in the House. I hope we can move this along so we can get to the next steps, continue to move forward and get what we need into place in order to properly protect our cyber systems from a security perspective.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague from Kingston and the Islands for his speech, which was informative as always.

However, I would like to know how this bill will enhance public trust in the Internet. What mechanism in Bill C‑26 will help guarantee public trust?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, as I said in my speech, one of the things the bill does is it specifically directs what the various telecommunications providers need to do in order to maintain that security. That is what we do from a policy perspective. We establish what those requirements are that are required of the telecommunications systems in order to ensure that security is there. What we will see coming out of this is that the telecommunications systems, in a unified fashion, will promote these particular policies and safeguards that will be put through those directives.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Madam Speaker, one of the things that has become very clear, particularly since the Russian invasion of Ukraine, is how destabilized our world is and how many bad actors are out there at the state level trying to undermine democracy.

My concern is about the ability of the federal government to withstand cyber-attacks. Earlier today, I talked about 2011 when actors out of China were able to shut down finance and the Treasury Board for days on end with relentless attacks. With the amount of financial information for Canadians that is in those departments, that is very serious.

We know that in the immigration department, which has turned into an absolute nightmare for anybody trying to navigate it, the system is breaking down. Staff in the department cannot access information files because the system is not up to speed. This will require a major investment to protect people, but also to deal with dark forces, whether they are Russians, the Chinese or any other non-state actor.

Has the government put in a credible plan to ensure we get our federal systems up to speed to be able to withstand hackers?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, this is the basic fundamental principle to having our full and complete autonomy over our nation.

We need to ensure that these systems are secure—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Order. The hon. member's microphone is causing an audio problem that is interfering with the interpreter's audio.

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

I apologize, Madam Speaker. It is not my first day. I should not have let that happen. I apologize to the interpretation staff, through you.

Getting back to what I was saying, in order to maintain that autonomy which we must have as a country, we need to make sure that the proper investments are in place to do that. The member indicated there would need to be a major investment. My own personal perspective is that we should spare no expense to ensure that security is absolutely robust.

Will there be penetrations or will there be times when it might be challenging to maintain that? Yes, but we learn from those. With regard to his example from 2011, I believe we learned from that and we made our systems even better as a result.

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Madam Speaker, I can attest that this is not the gentleman's first day. It seems like I have spent a year staring into his eyes here.

In the legislation, there is a fair bit of gray area with respect to definitions. Will the government be releasing additional information on such undefined terms as “cyber- incidents”?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, I am flattered to hear that the member has been staring into my eyes for a year.

In all seriousness, the member asks a good question. I do not have the answer to that. I am certainly not in a position to be able to provide to him what the government would release later. When the government tables a bill or releases information to Parliament, it does so in a fashion that allows every member of Parliament access to that at the same time. The member's access to that would be no different from mine.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, I will be sharing my time with the member for Battle River—Crowfoot.

I am proud to rise on behalf of my constituents in the not-quite-fully-connected riding of Renfrew—Nipissing—Pembroke. As the longest-serving member of the national defence committee, I fully appreciate the need for Canada to secure critical cyber systems.

For too long, the government remained indifferent while Canada's telecom companies were being infiltrated, robbed of intellectual property and sabotaged. It took the collective pressure of our Five Eyes allies before the government put up any resistance to the Huawei expansion throughout Canada’s telecom infrastructure.

Only after having been thoroughly shamed and threatened with being cut off from critical security intelligence has the government finally responded with legislation. However, as is so often the case with all governments, having finally been shamed into action, the executive branch overreacted. It now falls upon Parliament to moderate the executive overreach.

Cybersecurity is not a partisan issue. No party ran on a platform to make Canada insecure again. The Conservatives support sending this bill to committee for carefully considered amendments. I hope my colleagues across the aisle will be open to working in a collegial way to ensure that we as parliamentarians strike the right balance. This legislation must balance security with privacy and transparency. It must balance expeditiousness with efficiency and effectiveness.

I appreciate that the members opposite will place greater trust in this government than most Canadians will, but what about the next government or the one after that? Our duty as parliamentarians is to keep in check not just this government but future governments as well. To that end, I encourage all parties to work together at committee and bring back a bill that we can all support.

There are four main issues that need high-level scrutiny. However, as we saw with the invocation of the Emergencies Act, even when Parliament gives clear definitions, the executive branch believes it can extrapolate or simply opt for an overly broad interpretation. While the government has been forced to defend its decision on the use of the Emergencies Act in a public inquiry, Bill C-26 lacks any significant accountability measures while granting even more extraordinary powers, including issuing secret orders.

It should not fall upon the operators of critical cyber systems to guess what the government means by “immediately”. The bill currently grants the government the power to order telecom providers to do anything necessary to secure the telecommunications system. Granting the executive the power to do anything would be a dereliction of our duty as parliamentarians. To give the government the power to do anything while enabling those things to remain secret would be an outright betrayal of our duty.

It is understandable and reasonable that some secrecy is required to combat foreign espionage, but there must be clearly defined limits. There must be avenues for operators to appeal and for Parliament to scrutinize the government’s actions. By “Parliament” I mean Parliament. I do not mean some government committee of parliamentarians but a parliamentary committee.

This bill grants the government the power to deny services to any company or person by secret order. Had this law already been in place, there would be nothing to stop a government from cancelling the Internet and phone service of protesters the government disagrees with.

Granting the government the power to deny services to individuals using secret orders clearly violates the legal rights of Canadians. I do not want to trust the government with that kind of power. I expect my Liberal colleagues would not trust that kind of power when the Conservatives form government, hopefully very soon.

To paraphrase a great comic character, with great power must come great accountability. There are serious cyber-threats and those threats are growing. The government must have the tools to respond quickly and decisively, yet when governments move quickly, mistakes are made. That is why it is all the more important for there to be a robust set of measures to review their actions and ensure accountability when the government makes a mistake.

This legislation takes the extraordinary step of placing personal liability on individual employees of critical infrastructure operators. We threaten people with jail time to ensure they are accountable for their companies' cybersecurity, yet we do not hold government employees or ministers to the same standard. Just as the House must find the appropriate balance between security, secrecy and accountability, so too must we find the balance between privacy and transparency.

The government learned first-hand the public’s reaction to its undisclosed use of mobility data from millions of cellphone users. Canadians had demonstrated a willingness to abide by public safety measures, even extraordinary measures, but the minute the government started tracking our cellphones, even for a public health purpose, Canadians reacted strongly. Even Canadians who supported forced vaccination and punishing the unvaccinated drew a line at cellphone tracking.

The legislation before us would grant even more power to collect data from telecom providers with no restrictions on distributing it to other departments. Even if this data was held by the CRTC, Canadians would be concerned about their privacy. However, it would not be the CRTC doing the data scoop; it would be the Communications Security Establishment.

I appreciate the government feels the CSE is best equipped for countering cyber-threats, but the main purpose of the CSE is collecting intelligence from abroad. The CSE does not report to the public safety minister, who is responsible for keeping Canadians secure. The CSE does not report to the industry minister, who is responsible for telecoms regulations. The CSE reports to the defence minister. It is a fundamentally different type of organization from CSIS or the CRTC.

The legislation would fail to place sufficient limits on what the CSE can do with the data it can secretly order telecoms to provide. In no way is this meant to disparage the work done by the CSE, but as we expand the powers of the CSE, we must also constrain the scope of what it can do with those powers.

These are just some of the trade-offs we must consider when the bill goes to committee. Groups such as the Canadian Civil Liberties Association, the Citizen Lab and the Business Council of Canada have raised several more. However, the one area none of these groups have touched on, at least to my knowledge, is the role private citizens can play in securing Canada against cybersecurity threats. Parliamentarians have studied this both at the defence committee and with our fellow legislators at the NATO Parliamentary Assembly. Canada can take a lead role internationally in cybersecurity by enlisting the aid of ethical hackers, commonly referred to as “white hats”.

White hat hackers represent an untapped resource for a country as large as ours. Our critical infrastructure spans a continent. The job of securing it exceeds the capacity of the federal government and infrastructure operators. If we can develop a framework that protects and incentivizes white hat hackers, we may have a solution. As with the measures already in the legislation, such a framework would involve trade-offs. Even an ethical hacker could unwittingly cause significant cyber-disruption and damage, but they can just as easily expose flaws and gaps.

Regardless of whether the government acknowledges the existence of ethical hackers, they will continue to operate, and it is better for critical infrastructure operators, public servants and the Canadian public if we find a way to incorporate them into our defence strategy. We need to enlist ethical hackers because we simply do not have the resources as a nation to confront the threats.

Globally, cybercrime costs reached over $600 billion U.S. in 2021. Investments in cybersecurity were only $220 billion U.S. last year. Between criminals, terrorists and authoritarian states, the potential for significant damage is accelerating. Our enemies are going to match the best cyber-defences in the world. We do not have the resources to match the United States or the EU. That is why we must be even smarter than our adversaries and our allies.

The legislation is all stick and no carrot. Governments are quick to punish because it is easy. If company X fails to properly secure a critical system, they get a fine, but what if the company innovates and not only prevents an intrusion into their system but detects the source? The bill would require companies to immediately report intrusions, but what about failed attacks? If Bell, Telus and Rogers were to all successfully fend off an attack on the same day, would that not be something we would want the CSE to know about? Punishing failure is an important deterrent, but rewarding success is a powerful incentive.

In this cyber age, we need data to flow both ways. We can enhance our cybersecurity by taking both a carrot and a stick approach. We must pass robust cybersecurity legislation, but it must not compromise the rights of Canadians. We need a cyber-shield and a cyber-sword. As a vast, underpopulated nation full of remote critical infrastructure, we must be smart and creative in how we utilize every possible resource available, including enlisting white hats.

[Chris Bittle, Liberal, Parliamentary Secretary to the Minister of Canadian Heritage]

Madam Speaker, it was interesting to follow that speech, with all the conspiracy theories laid in, but I will note the most bizarre part of it. We hear the Conservatives talk about corporate welfare a lot, but it seems the hon. member wants to give money to Bell, Rogers and Telus for doing their job. That is an interesting part of her solution to this problem, which she seems to acknowledge, even though she also suggests that members of our armed forces will do wrong by the new powers they are given.

I am wondering why the member wants to focus on giving Bell, Rogers and Telus more money to help solve the issue of cybersecurity.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, first of all, I in no way insinuated that the people who serve in the Canadian Armed Forces would do any wrong intentionally. They have to be given the proper direction, and that is why we have to get the legislation right.

Furthermore, when the Liberals talk about conspiracy theories, that only tells us they do not have an answer to the point that we are making. It is just something they throw out when they do not have an explanation for something or they cannot deny it.

[Denis Trudel, Bloc, Longueuil—Saint-Hubert, QC]

Madam Speaker, I thank my colleague for her speech, in which she mentioned something very interesting.

She said that giving too much power to the executive would undermine the work of parliamentarians. I found that quite odd because Bill C‑11, which is exceptionally important for the discoverability of francophone content and for supporting francophone culture in Canada, is currently being held up in the Senate, where Conservative senators have been filibustering it for months.

Does the member think that her friends in the Senate are currently undermining the work of parliamentarians?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, Bill C-11 is a terrible bill. It seeks to censor, and there is no rationale to have such a bill in place. It would do no good for any freedom-loving, law-abiding citizen in this country and it must be struck down.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Madam Speaker, I am not nearly as old as I look. When I came here I was much younger, but then I had to sit through eight years of the Harper government and my hair turned white. I feel like I am one of the few who remember what actually happened then, and I watch this cultural amnesia play out day after day.

I remember Bill C-30. Stephen Harper decided that he wanted a law allowing the police to check people's phones any time they wanted for whatever reason, and the Conservatives insisted that the telecoms put in a back channel so they could spy on and listen in to ordinary Canadians. That was before we knew there were conspiracy theories, and the Conservatives have a million over there. They would think this had something to do with promoting vaccines, but this was Stephen Harper's attempt to criminalize ordinary people without a warrant.

I want to ask my hon. colleague about that. She talks about, God forbid, the Conservatives coming back. I do not know what would happen to the rest of my hair if that happened. Are they going to continue to promote the kinds of tactics that Stephen Harper used, which criminalized ordinary Canadians in their private homes by listening in to what they were talking about?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, the member opposite does not have to worry about a previous prime minister coming back to power, because right now what he noted is already happening. With Bill C-21, the police could come into people's homes. They are made into paper criminals just by virtue of the Liberals' declaring that certain firearms are now prohibited. It is already happening, and he does not have to wait for the best prime minister this country ever had to return.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Madam Speaker, I honestly thought the member for Timmins—James Bay dyed his hair Arctic chill. I did not realize, but there is a Clairol product that he can get at the—

[Charlie Angus, NDP, Timmins—James Bay, ON]

Madam Speaker, on a point of order. I retract my previous comment. I do dye my hair so I look smarter than I am. I have been called out, so I have to admit it. I dye my hair.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Madam Speaker, the government has proven itself to fail on multiple fronts in delivering multiple projects and multiple bills.

What concern does the member have as far as delivering on this bill?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, this bill gives the government of the day boundless opportunities to abuse our privacy and to issue secret orders.

One can only imagine what would have happened during the lockdowns with secret orders going forth. For even a peaceful demonstration coming to Parliament Hill, imagine the types of punishments, accusations and jail time, not just freezing bank accounts and taking money from lawful people.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, it is an honour to enter into debate in this place, especially when it comes to issues that are so very pressing in relation to national security and some of the challenges that our nation is facing. I would suggest the whole discussion around cybersecurity is especially relevant, because we are seeing highlighted, each and every day, a drip of new information related to foreign interference in our elections.

It highlights how important the conversation around cybersecurity is. It is often through computer and technological means that these malicious, foreign state actors will attack Canadian infrastructure. It is particularly relevant that I rise to debate Bill C-26, relating to the Liberals' recently introduced bill on cybersecurity, and I would like to highlight a couple of things.

The first thing is about seven years of inaction. I find it interesting, after seven years, how it was heard at the ethics committee from a whole host of experts in the field, including on cybersecurity and a whole range of issues, that the government is missing in action. It is not just about the government's inaction, but it is missing in action when it comes to some of the key issues surrounding things like cybersecurity. It has the direct consequence of creating uncertainty in terms of the technological space in the high-tech sector, which has massive opportunities.

We hear the Ottawa area referred to as silicon valley north. We have the Waterloo sector that has a significant investment in the high-tech sector. In my home province of Alberta, there is tremendous opportunity that has been brought forward through innovation, specifically in the Calgary area where we are seeing massive advancements in technology, but there is uncertainty.

Over the last seven years, the government has not taken action when it should have been providing clear direction so that industry and capital could prosper in our country. That is on the investment and economic side, but likewise, on the trust in government institutions side, we have seen an erosion of trust, such as the years-long delay on the decision regarding Huawei.

I and many Canadians, including experts in the field, as well as many within our Five Eyes security partners, were baffled about the government's delay on taking clear and decisive action against Huawei. Even though our Five Eyes, a group of countries that shares intelligence and has a strong intelligence working relationship, sees how inaction eroded the trust that these other nations had in Canada's ability to respond to cyber-concerns and threats. There is the fact that a company, a state-owned enterprise, has clear connections to a malicious foreign actor.

That delay led to incredible uncertainty in the markets and incredible costs taken on by private enterprise that simply did not have direction. Imagine all the telecoms that may have purchased significant assets of Huawei infrastructure because the government refused to provide them direction. There were years and years of inaction.

I will speak specifically about how important it is to understand the question around Canadian institutions. I would hope that members of the House take seriously the reports tabled in this place, such as from the public safety committee, which in the second session of the last Parliament I had the honour of sitting on. There is a whole host of studies that have been done related to this.

Then there are the CSIS reports tabled in this place containing some astounding revelations about foreign state actors and their incursions and attempts to erode trust in Canadian institutions. Specifically, there was a CSE report for 2021, which I believe is the most recent one tabled, that talks about three to five billion malicious incursions in our federal institutions a day via cyber-means. That is an astounding number and does not include the incursions that would be hacks against individuals or corporations. That is simply federal government institutions. That is three to five billion a day.

There are NSICOP reports as well. The RCMP, military intelligence and a whole host of agencies are hard at work on many of these things. It highlights how absolutely important cybersecurity is.

I find it interesting, because over the last seven years the Liberals have talked tough about many things but have delivered action on very few. Huawei is a great example. Cybersecurity is another. We see a host of other concerns that would veer off the topic of this discussion, so I will make sure that I keep directly focused on Bill C-26 today. The Liberal government is very good at announcing things, but the follow-through often leaves much to be desired.

We see Bill C-26 before us today. There is no question that action is needed. I am thankful we have the opportunity to be able to debate the substance of this bill in this place. I know the hard work that will be done, certainly by Conservatives though I cannot speak for the other parties, at committee to attempt to fix some of the concerns that have been highlighted, and certainly have been highlighted by a number of my colleagues.

The reality is Canadians, more and more, depend on technology. We saw examples, when there are issues with that technology, of the massive economic implications and disruptions that take place across our country. We saw that with the Rogers outage that took place in July. Most Canadians would not have realized that the debit card system, one of the foundational elements of our financial system, was dependent upon the Rogers network. For a number of days, having disruptions in that space had significant economic implications. It just speaks to one of the many ways Canadians depend on technology.

We saw an example in the United States, so not directly in Canada, when the Colonial Pipeline faced a ransomware attack. A major energy pipeline on the eastern seaboard of the United States was shut down through a cyber ransomware attack. It caused massive disruptions.

Another Canadian example that has been reported in talking to some in the sector was Bombardier recreational products. The Quebec company is under a cyber-lockdown because of hostile actions. There are numerous other examples, whether in the federal government or in the provinces, where this has been faced.

There are a number of concerns related to what needs to take place in this bill to ensure that we get it right. It needs to align with the actions that have taken place in our Five Eyes allies. We need to ensure that the civil liberties question is clearly answered.

We have seen the government not take concern over the rights of Canadians to see their rights protected, their freedom of speech, whether that is Bill C-11. I know other parties support this backdoor censorship bill, but these are significant concerns. Canadians have a right to question whether or not there would be a civil liberties impact, to make sure there would not be opportunity for backdoor surveillance, and to ensure there would be appropriate safeguards in place and not give too much power to politicians and bureaucrats as to what the actions of government would be.

As was stated by one stakeholder in writing about this, the lack of guardrails to constrain abuse is very concerning. In Bill C-26, there is vague language. Whenever there is vague language in legislation, it leaves it open to interpretation. We have seen how, in the Emergencies Act discussion and debate, the government created its own definition of some of the things that I would suggest were fairly clearly defined in legislation. We have to make sure it is airtight.

Massive power would be given to the Minister of Industry in relation to many of the measures contained in this bill.

I look forward to taking questions. It is absolutely key we get this right, so Canadians can in fact be protected and have confidence in their cybersecurity regime.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Madam Speaker, I heard the member talk about Huawei quite a bit. I could not help but reflect on the fact that the former contender to the current leader of the Conservative Party was actually on the legal team to support Huawei through its initiative to try to get onto the 5G network in Canada. I cannot help but wonder why on earth, if the Conservatives are so against Huawei and treat this threat so seriously, the Conservative Party of Canada would green-light—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

The hon. member may know it is not the business of the House to deal with leadership issues of the different parties. I understand what the hon. member is trying to say, but try to keep it to the legislation.

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, Jean Charest was a lawyer for Huawei. The member brought up Huawei. Jean Charest is a well-known Conservative who ran in the leadership. Why would they have allowed Jean Charest to run in the leadership had that been the case?

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, I will suggest this has direct relevance to the debate at hand. It has direct relevance because the victor of that race was not the individual the member referred to, but rather the member for Carleton, who I was proud to support and who will be so pleased to ensure we, as a majority Conservative government after a future election, have the opportunity to get things right and get this country back on track.

[Caroline Desbiens, Bloc, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Madam Speaker, I thank my colleague for his speech.

I would like my colleague to reassure people who are watching, people in our communities who are worried about a device that is in their hands for much of the day. These people live with this device in their home. They use this device to share anecdotes, conversations and occasionally intimate secrets, believing that it all belongs exclusively to them.

Since our colleague does not seem interested in better control of cyber-attacks, how does he expect to reassure the public without moving toward tighter cybersecurity?

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, I cannot hold up my cellphone, but what is absolutely key to the whole conversation we are having is the fact that all of us in this place carry an incredibly powerful computing device that only a few years ago would have been something we would not have seen even in the most futuristic sci-fi novels and movies. The space in which we are discussing cybersecurity has evolved so rapidly.

Specifically to the question the member asked regarding privacy, it is a very important one. It is one that, as a member of the Standing Committee on Access to Information, Privacy and Ethics, we need to make sure the legislation we have in this country, including privacy legislation both on the application of government and the privacy of all Canadians in terms of corporations and that whole space, reflects the modern realities. In many cases, decades old legislation needs to be updated to reflect the realities of today.

[Bonita Zarrillo, NDP, Port Moody—Coquitlam, BC]

Madam Speaker, when we talk about the updated realities of today, persons with disabilities rely heavily on these technologies and this access. If I think about persons with disabilities who rely on technologies for everyday barrier reduction interactions in their lives, how can their rights to access be protected?

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, the right to access is absolutely key. We have seen some incredible technological advancements that have helped those who face disabilities in a wide variety of things. Outside of the context of what Bill C-26 directly addresses in terms of cybersecurity, there is a particular connection, because if we do not have things like secure networks, if we do not ensure that our telecoms have consistent and stable networks that we can trust as a country, then access becomes a real issue. Malicious foreign-state actors could take advantage of that, which would disadvantage all Canadians, but specifically those who depend on technology to mitigate things like disabilities.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Order. It is my duty, pursuant to Standing Order 38, to inform the House that the questions to be raised tonight at the time of adjournment are as follows: the hon. member for Bow River, Taxation; the hon. member for South Okanagan—West Kootenay, Post-Secondary Education.

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Madam Speaker, I will be sharing my time with the fantastic member for Lac-Saint-Louis.

It is with great pleasure that I rise to discuss Bill C-26, an act respecting cybersecurity. I will address elements in the legislation that deal with securing Canada's telecommunications system.

As Canadians rely more and more on digital communications, it is critical that our telecommunications system be secure. Let me assure this House and in listening to the debate today I think we all agree that the issue of cybersecurity is of utmost importance. The Government of Canada takes the security of this system seriously, which is why we conducted a review of 5G technology and the associated security and economic considerations.

It is clear that 5G technology holds lots of promise for Canadians for advanced telemedicine, connected and autonomous vehicles, smart cities, cleaner energy, precision agriculture, smart mining, and a lot more. Our security review also made clear that 5G technology will introduce new security concerns that malicious actors could exploit. Hostile actors have long sought and will continue to seek to exploit vulnerabilities in our telecommunications system.

CSIS, the Canadian Security and Intelligence Service, acknowledged this in its most recent publicly available annual report. The report states:

Canada remains a target for malicious cyber-enabled espionage, sabotage, foreign influence, and terrorism related activities, which pose significant threats to Canada's national security, its interests and its economic stability.

The report states that “[c]yber actors conduct malicious activities to advance their political, economic, military, security, and ideological interests. They seek to compromise government and private sector computer systems by manipulating their users or exploiting security vulnerabilities”.

The CSIS report also highlighted the increasing cyber-threat that ransomware poses. The Communications Security Establishment has similarly raised concerns about threats like ransomware in recent public threat assessments. We have seen how such attacks by criminal actors threaten to publish a victim's data or block access to it unless a ransom is paid. However, it is not just cybercriminals doing this. CSIS warned that state actors are increasingly using these tactics, often through proxies, to advance their objectives and evade attribution.

To be sure, Canadians, industry and government have, to this point, worked hard to defend our telecom system, but we must always be on the alert, always guarding against the next attacks. This has become more important as people now are often working remotely from home office environments.

5G technology is adding to these challenges. In 5G systems, sensitive functions will become increasingly decentralized in order to boost speeds when required.

Cell towers are a familiar sight in our communities and along our highways. The 5G networks will add many smaller access points to increase speeds. As well, the number of devices that the 5G network will connect will also grow exponentially.

Given the greater interconnectedness and interdependence of 5G networks, a breach in this environment could have a more significant impact on the safety of Canadians than with older technology. Bad actors could have more of an impact on our critical infrastructure than before.

The security review we conducted found that in order for Canada to reap the benefits of 5G, the government needs to be properly equipped to promote the security of the telecommunications system. We need to be able to adapt to the changing technological and threat environment. For these reasons, we are proposing amendments to the Telecommunications Act. The amendments will ensure that the security of our telecommunications system remains an overriding objective.

This bill will expand the list of objectives set out in section 7 of the Telecommunications Act. It will add the words “to promote the security of the Canadian telecommunications system”.

It is important for those words to be in the act.

It means government will be able to exercise its powers under the legislation for the purposes of securing Canada's telecommunications system.

The amendments also include authorities to prohibit Canadian telecommunications service providers from using products and services from high-risk suppliers in 5G and 4G networks if deemed necessary and after consultation with telecommunications service providers and other stakeholders.

It would also give the government the authority to require telecommunications service providers to take any other actions to promote the security of the telecom networks upon which all critical infrastructure sectors depend.

We have listened to our security experts; we have listened to Canadians; we have listened to our allies and we are following the right path. We will ensure that our networks and our economy are kept secure. A safe and secure cyberspace is important for Canada's competitiveness, economic stability and long-term prosperity.

It is clear that the telecommunications infrastructure has become increasingly essential. It must be secure and it must be resilient. Telecommunications presents an economic opportunity, one that grows our economy and creates jobs. The amendments to the Telecommunications Act accompany the proposed critical cyber systems protection act. This bill will improve the ability of designated organizations to prepare, prevent, respond to and recover from all types of cyber-incidents, including ransomware. It will designate telecommunications as a vital service. Together, this legislative package will strengthen our ability to defend the telecommunications and other critical sectors, such as finance, energy and transportation, that Canadians rely on every single day.

The legislation before us today fits within the Government of Canada's telecommunications reliability agenda. Under this agenda we intend to promote robust networks and systems, strengthen accountability and coordinate planning and preparedness.

Canadians depend on telecommunications services in all aspects of their lives, and the security and reliability of our networks has never been more crucial. These services are fundamental to the safety, prosperity and well-being of Canadians.

We will work tirelessly to keep Canadians safe and able to communicate securely. This legislation is an important tool to enable us to do that. I look forward to working with members in this House to getting this right and making sure that our telecommunications system is as strong as it can be.

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Madam Speaker, in earnest, the government has had significant failures when it comes to procurement. I would point to shipbuilding, where we are years behind. It has also had significant failures with respect to IT. I point to the Phoenix pay system.

Given these failures, what has the government learned, and how can the Canadian public believe the government will be able to deliver on this legislation?

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Madam Speaker, I had the opportunity to sit on the defence committee during my first mandate, and I had the opportunity to work closely with the then minister of national defence on “Strong, Secure, Engaged”. We are going to be reviewing “Strong, Secure, Engaged” in terms of our defence spending, including what we are going to be doing on procurement.

A lot of things have changed in the last seven years in terms of defence, like what is happening across the way in terms of Ukraine and Russia, cyber and how significantly things have changed. We absolutely need to invest in cyber and make sure we get our defence procurement projects completed.

[Denis Trudel, Bloc, Longueuil—Saint-Hubert, QC]

Madam Speaker, I thank my colleague for her speech.

There are people from the Fédération des communautés francophones et acadienne du Canada on the Hill today. They met with the Minister of Official Languages. The House is working on Bill C-13 because we know that the French language is declining in Quebec and Canada, so efforts to promote French must be made.

My colleague represents a riding in which 80% of the population speaks French as their mother tongue. She just delivered a speech that was about 80% in English. Does that not make her a bit uncomfortable? Does she not think that a clearer message could be sent here in the House?

Her government could also send a clearer message by giving speeches more openly in French.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

The hon. member's question is a little off topic.

I will nevertheless give the hon. member for Longueuil—Charles-LeMoyne a chance to respond.

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Madam Speaker, if the member wants to ask a question about the subject matter of the bill we are debating, I would be pleased to answer.

With respect to language, I speak both official languages and am very proud to do so.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Madam Speaker, the question of Canada's ability to deal with our situation in an increasingly unstable world raises serious questions about priorities. For example, we are years behind on the frigates that are supposed to be brought forward by the navy. The cost overruns are staggering, yet we have just seen in Ukraine that the Russian flagship, Admiral Makarov, was taken out by drones.

Do we need to completely reassess our thinking? This is the 21st century. We are investing, often, in 20th-century solutions in a world of warfare, cyberterrorism and cyber-power that is completely transforming the nature of warfare and democracy's ability to defend itself.

Does my colleague think we need to do a larger rethink across the board in terms of our strategies and our ability to defend ourselves?

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Madam Speaker, I want to thank the member for that question, because that is one area of our domain awareness that we have not focused on a lot. When we think about the air force, army or navy, we usually talk about those three domains, but we do not talk a lot about cyber. We know that is the fourth domain that we need to focus on.

In terms of our NORAD modernization, I know cyber is top of mind in working with our Five Eyes partners and other partners. We need that modernization to take place so we can make sure this fourth element of our national defence is also included.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, I know the member for Longueuil—Charles-LeMoyne has heard some of the debate today, not just from other MPs but from civil society organizations that have raised concerns with respect to secrecy as it relates to addressing cybersecurity.

I am curious to hear her reflections on potential improvements she thinks could be made to the bill in order to better balance the need to improve cybersecurity while holding on to accountability and transparency.

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Madam Speaker, unfortunately I do not sit on the public safety committee, so I will not be the person debating it when it eventually gets to committee, but obviously there are opportunities for improvement in any piece of legislation. I look forward to seeing the recommendations that might come from our colleagues in the House when it gets to committee.

[Francis Scarpaleggia, Liberal, Lac-Saint-Louis, QC]

Madam Speaker, it is an honour for me to rise at second reading stage of Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts.

When we consider the opportunities and challenges before us in this area, we see that the theme of collaboration underpins all that we do. Take, for example, the prevalence of cybercrime in an increasingly online world, improving cyber-defence posture in an unstable global environment, deep thinking about what the future holds in a world where innovation and change are exponential, a critical look at whether our policies and laws are up to the task, and the protection of content and intellectual property as data becomes one of the world's most precious resources.

In Canada, being online and connected is essential. Now more than ever, Canadians rely on the Internet for their daily lives. It is about more than just conducting business and paying bills. It is also about staying connected with loved ones across the country and around the world. We should be able to do all these activities safely and securely.

I would like to offer a few words about what we are doing here in Canada to get that balance right. I would like to reinforce the importance of our commitment to protecting the cyber systems that underpin our critical infrastructure.

The emergence of new technologies such as 5G is one clear reason we need to redouble our efforts. Think about our increased reliance on technology in light of the COVID-19 pandemic. Think about international tensions amidst Russia's unprovoked and unjustified invasion of Ukraine, with threats ranging from supply chain disruptions to state and non-state malicious cyber-activity.

Through all of these remarkable events, the government has been working tirelessly to keep Canadians safe. We recognize that, now more than ever before, secure and reliable connectivity is a necessity for our daily lives and our collective safety and security. It underpins the delivery of critical services, such as energy production, financial transactions, safe transportation and emergency communications.

As part of his mandate, bestowed by the Prime Minister, the Minister of Public Safety is seized with the opportunity and the challenge of developing a renewed national cybersecurity strategy. We need to make sure we articulate Canada's long-term plan to protect our national security and economy, deter cyber-threat actors, and promote norms-based international behaviour in cyberspace.

The Government of Canada is working to enhance the cybersecurity of the country's critical infrastructure. The work to identify cyber-threats and vulnerabilities, and to respond to cyber-incidents, is ongoing. Unfortunately, we have seen that malicious actors continue to attempt to take advantage of the current environment to exploit certain sectors.

However, we are not starting from scratch in our fight against this threat. Since 2018, the Government of Canada has invested a total of approximately $2.6 billion in cybersecurity. Through the national cyber security strategy, the Government of Canada is taking decisive action to strengthen Canada's defence, preparedness and enforcement against cyber-threats.

The strategy was paired with the largest investment in cybersecurity ever made by the Government of Canada, totalling nearly $800 million in the 2018 and 2019 federal budgets. In the 2021 budget, the government allocated an additional $791 million to improve and defend cyber-networks, enhance data collection and protect taxpayer information.

In the 2022 budget, another $852.9 million was committed to enhance the Communications Security Establishment, or CSE, and its ability to conduct cyber-operations, make critical government systems more resilient, and prevent and respond to cyber-incidents on critical infrastructure.

Under the strategy, two flagship organizations were established. One is the Canadian Centre for Cyber Security, under CSE, and the other is the National Cybercrime Coordination Centre, or NC3, under the RCMP.

The Canadian Centre for Cyber Security is a single, unified team of government cybersecurity technical experts. The centre is the definitive source of technical advice, guidance, services, messaging and support on cybersecurity operational matters for government, critical infrastructure owners and operators, the private sector and the Canadian public.

The NC3 coordinates Canadian police operations against cybercriminals and established a national mechanism for Canadians and businesses to report cybercrime to police.

Public Safety Canada's Canadian cybersecurity tool also helps owners and operators of Canada's critical infrastructure to evaluate their cyber-maturity against established benchmarks and by peer comparison. It offers concrete guidance on how they can become more cyber-resilient.

Public Safety Canada also coordinates and delivers cybersecurity exercises for the critical infrastructure community to test and develop capabilities to respond to and recover from malicious cyber-activities. More broadly, the department, as the federal lead on cybersecurity policy, promotes communication and collaboration to raise awareness of cyber-threats and risks, including with our international partners.

Public Safety Canada works closely with CSE's Canadian Centre for Cyber Security to enhance the resilience of critical infrastructure in Canada. The Canadian Centre for Cyber Security shares valuable cyber-threat information with Canadian critical infrastructure owners and operators, in addition to providing public advisories.

Today, I am very proud to say that we can start debating a new bill to further strengthen what we have built. Today we are starting the debate on Bill C‑26, an act respecting cyber security. The objective of this bill is twofold.

First, it would amend the Telecommunications Act to add security as a policy objective, bringing the telecommunications sector in line with other critical infrastructure sectors. This would allow the government, if necessary, to mandate any action necessary to secure Canada's telecommunications system, including its 5G networks. This includes authority to prohibit Canadian telecommunications service providers from using products and services from high-risk suppliers.

Second, it introduces the new critical cyber systems protection act. This new act will require designated operators in the federally regulated sectors of finance, telecommunications, energy and transportation to take specific actions to protect their critical cyber systems, and it will also support organizations' ability to prevent and recover from a wide range of malicious cyber-activities, including electronic espionage and ransomware. Cyber-incidents involving a certain threshold will be required to be reported.

The bill will also give the government a new tool allowing it to take action in response to threats and vulnerabilities with respect to—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Order. The hon. member's time has expired.

The hon. member for Drummond.

[Martin Champoux, Bloc, Drummond, QC]

Madam Speaker, I want to congratulate my colleague from Lac-Saint-Louis on his speech. He obviously has an excellent grasp of the file.

I put this question to another colleague earlier, after a speech, and it is something that really concerns me. I am asking it again because I do not know if the member was here earlier.

We cannot begin to imagine how organized hackers are. They have such a big head start that it will be hard to catch up to them, even if we invest all the energy and knowledge we can in our systems to protect ourselves against cyber-attacks. We have seen companies like Desjardins and Bombardier fall victim to these hackers, who demand endless ransoms. How many other companies have fallen victim to these attacks without us even hearing about it?

My question is this. Has Canada been too slow to act? It took Canada a long time to decide Huawei's fate, for example. Does the fact that the government seems to have dragged its feet before finally tabling a cybersecurity plan that appears to have some teeth not mean that we will always be one step behind those countries and organizations that are attacking the computer systems of businesses and governments around the world?

[Francis Scarpaleggia, Liberal, Lac-Saint-Louis, QC]

Madam Speaker, I know that the Huawei case has been studied extensively with the involvement of our security agencies. I would like to think that the government and security agencies have learned a great deal. They have learned lessons that they can apply in the future to better protect Canadian businesses and critical infrastructure.

In terms of catching up, yes, technology moves so fast that often governments and society have to react, but it is better to react than to do nothing.

[Richard Lehoux, Conservative, Beauce, QC]

Madam Speaker, I thank my colleague for his speech.

I have a question about publicly owned corporations like Hydro-Québec. How will the bill provide a framework for this, while still allowing companies like Hydro-Québec to be proactive about cybersecurity? How will the bill ensure there is no interference? Will there be support? I would like to hear my colleague's point of view on this issue.

[Francis Scarpaleggia, Liberal, Lac-Saint-Louis, QC]

Madam Speaker, I dare to believe and hope that a publicly owned corporation as big as Hydro-Québec has the resources to protect itself properly. Obviously, it provides a critical service. I think I said that in my speech. We hope that this bill will also serve as a model for other levels of government.

I think that, just like protecting the environment, cybersecurity is a team effort. We have to work with partners in other governments to come up with a solution that is watertight, well aligned and effective.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Madam Speaker, my colleague and I spent a lot of the day together today. We had an excellent event this morning, which he organized, so I would like to thank the member for Lac-Saint-Louis for that.

There is one question I do have with regard to the bill. It has been written in such a way that secret orders could be issued, and they could be kept from being publicized or published in the Gazette. Why was that choice made? Why was the decision made to have that level of secrecy in the legislation?

[Francis Scarpaleggia, Liberal, Lac-Saint-Louis, QC]

Madam Speaker, I would also like to thank the member for taking part in a panel in front of about 40 students from the Max Bell School of Public Policy this morning. It was wonderful to have her perspective as a westerner, and as a parliamentarian generally.

I would imagine that, when we are dealing with matters of national security in cybersecurity and systems that are key to our well-being, there might be a need in certain cases to be a little more circumspect. I would hope, believe and expect, because every bill that is introduced to the House has to go through a charter analysis, that any such measure the member refers to would pass the test of the charter.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, I will give my speech in French. I will be sharing my time with my esteemed colleague from Trois‑Rivières, who will no doubt be able to give a more relevant speech than me. I am pleased to share my time with him.

Ottawa is finally proposing a law to deal with the issue of cybersecurity. We are pleased to see that the government is finally addressing this issue. I will not say that it is too little, too late, but I will say that we waited a long time for this.

The purpose of the bill is to force Internet service providers to adopt better practices, something on which we all agree. We commend the government for that.

However, why is Ottawa always in reaction mode? We have been talking about the 5G network and Huawei for years. Hydro-Québec has been experiencing cyber-attacks on a daily basis for years. We have known for years about the rise of China, a country that is interfering more and more. In short, we have known for years that Canada is extremely vulnerable and that it is basically a sieve in terms of cybersecurity.

How can it be that, in this postnational system, everything happens reactively, not proactively? That is all I am going to say about that, because there is no changing the fundamentals of a country that is impervious to reform. Instead, we are going to get out. I just wanted to put that out there.

We support the bill in principle, but there are some grey areas that need clarification. That is what committees are for. The legislation is essentially a regulatory framework that, first and foremost, enables the government to make regulations to ensure the security of critical cyber systems. We have to look at the impact this bill could have on Quebec, especially Hydro‑Québec, because it lists interprovincial power line systems under vital services and vital systems. The committee will also have to look at whether the vast regulatory powers provided for in the bill are justified and ensure that they do not needlessly circumvent Parliament.

The threats that weigh on cybersecurity are likely to increase. They are the future, but they are also very much part of our present. In fact, a number of experts on the matter in Quebec talk to us about it. There is someone I really liked to watch when he was on television, although he stopped appearing when he became a deputy minister. I am talking about one of my constituents, Steve Waterhouse, who is always very interesting to listen to. His work helped raise our awareness and raise public awareness. He is from Sainte‑Madeleine, which is in the incredible riding of Saint‑Hyacinthe—Bagot.

Cyber-threats are already a part of our daily lives. Hydro-Québec is attacked every day by what are referred to as denial of service attacks. These are less sophisticated cyber-attacks and are the easiest ones to deal with, but they can cause major disruptions.

Look at Aluminerie Alouette, on the North Shore, which was the victim of a major cyber-attack that led to a serious outage. A Russian group claimed responsibility. Last summer, during the Rogers outage, which also had a serious impact on debit card transactions, a cyber-attack was the first thing that came to mind.

The objective of the bill is to mitigate the risks upstream. The legislation could certainly help Quebeckers, for example by imposing certain standards on Internet service providers, such as the obligation to avoid using products from suspect companies like Huawei.

In 2020, Parliament adopted a motion to force the government to make a decision about Huawei and Chinese interference in general. Recently, Ottawa finally blocked Huawei after years of dithering. What a waste of time. As Proust wrote, we are in search of lost time.

Madam Speaker, please tell my colleagues that they can let me know if I am disturbing them. I would not want to prevent them from having their conversations.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I ask that members who wish to have conversations leave the chamber to do so.

The hon. member for Saint‑Hyacinthe—Bagot may continue.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Thank you, Madam Speaker. I see that they are no more interested in what you have to say than what I was saying, so I do not take it personally.

The 5G network is a new communications technology with bandwidth that is 10 to 100 times greater than that of current networks. The technology stands out for more than just its speed. It stands out for its extremely low latency, which is the time it takes for one computer to communicate with another and receive a response.

This opens the door to many possibilities in different areas, but to achieve performance, 5G uses a multitude of pathways. To simplify, let us say that something that is sent from Montreal to a computer in Paris could have a portion pass through New York, another through London, another through Barcelona, and so forth. This makes the technology particularly vulnerable because it becomes difficult to track the path that the data takes.

Huawei has already been implicated in the scandal involving China spying on the African Union headquarters. In 2012, China offered the African Union a fully equipped ultramodern building. Africa is known to be an extremely important location for Chinese investment. China supplied everything: networks, computers and telecommunications systems. After a few years of operation, in 2017, African computer scientists realized that the servers were sending out huge amounts of data at night, when nobody was working in the building. They discovered that the data was going to servers in China, which was spying on all staff and political leaders. Huawei was the main supplier of the network infrastructure. Microphones were also found in the walls and tables.

China passed a new national intelligence law in 2017. One thing is clearly set out in their law. All Chinese companies must absolutely participate in China's intelligence efforts. It is a form of economic and commercial patriotism, and we could also add digital. In other words, all the private players are being mobilized to say that they are going to participate in the construction of the great digital wall of China. This includes military intelligence and civilian intelligence. For instance, a company can be called upon to spy on behalf of another Chinese company in order to place China in an advantageous position on the world stage.

At this very moment, a genomics company called BGI, which works with genes, is still supplying medical equipment to Canadian hospitals. Its machines collect data, and only the company's technicians are authorized to carry out the monthly maintenance. They are the only ones with access. It turns out that this company has close ties to the Chinese military.

There is also Alibaba, a publicly traded Chinese company similar to Amazon that was founded by businessman Jack Ma. It derives its income from online activities, including a public market designed to facilitate transactions between businesses, payment and retail sales platforms, a shopping search engine and cloud computing services.

Another example is Tencent, a company founded in 1998 that specializes in Internet and mobility services and online advertising. Tencent's services include social networks, web portals, e-commerce and multiplayer online games. Tencent manages and operates well-known services, such as messaging services Tencent QQ and WeChat, and the qq.com web portal.

Today, China is the champion of data collection. This rising power requires new practices, new barriers and new ways of doing things. We should not think that the U.S. does not have their own giants that collect data, but just in China there are 800 million Internet users. That is more than the U.S. and India put together and one-quarter of all Internet users in the world. This number of users will give public and private Chinese actors, which have a close relationship, access to large sources of data that they can mine at will.

China has built a formidable digital system. There is a reason why it is constantly increasing its data storage. There is no doubt that the issue of cybersecurity is at the centre of the current international economic war that is engulfing an increasingly multipolar world. We need to acknowledge this. We need to act.

We support this bill because it is well-intentioned, but we have to find a way to put some meat on the bones.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I appreciate very much the Bloc's tentative support of the legislation to go to committee, recognizing that this legislation empowers the minister to take direct, specific actions to protect Canadians and businesses. As the member pointed out so accurately, there is a very real cyber-threat out there. It also ensures that there can be financial penalties.

Would the member not agree that this is just one step? We have had literally tens of millions of dollars invested in cyber-threats over the years. We have had all sorts of group discussions and meetings to make sure that the government is keeping up. There are a number of stakeholders with the responsibility of fighting cyber-threats today.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, should that not just be one step? The answer is: of course it should.

I believe we said we are in favour. We are not even sure that this step will be enough, but it is a step in the right direction, and that is why we support it. It is great that there is going to be money for this, but now the real work starts.

I feel there are a lot of areas to consider. We will have to look at industrial espionage and economic espionage too. Regimes have all kinds of legal and digital techniques for acquiring competitors' data and trade secrets.

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, what does the member propose for a solution? What are the immediate steps needed to be taken to deal with the pressing issue of cybersecurity attacks we are facing in the country?

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, Bill C‑26 does contain some good solutions and some interesting elements.

The only thing is, we will have to look at the details and see what is next. Are we giving the minister too much power? At the same time, we may have to think twice about giving more power to the minister at the expense of Parliament when we are not sure whether the minister will fulfill his commitments. There have been promises followed by waffling in the past. There are definitely things that need to be looked at, yes, but at least this bill is motivated by good intentions. For that alone, it deserves to be supported at this stage.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Madam Speaker, my colleague's intervention today was very interesting. He seems to know the subject very well. Looking at this legislation, we have been talking about how it has been a long-time coming, and how we would have liked to have seen this legislation before us sooner.

I wonder if, as he studied this bill, he had an opportunity to look at legislation from other countries, and if there is legislation from other countries that we could be emulating and looking at as we try to improve this bill. After second reading, I think all parties want to make sure this bill improves.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, as I said at the beginning, I was a bit critical. Unfortunately, in this country, in this Parliament and in this postnational system, it is clear that there is much hemming and hawing in far too many files.

Take a look at the general political culture of other countries like the United States. It did not take them long. Consider the example of Huawei; it took no time at all. They looked at it, concluded that it was preposterous and they put an end to it.

Why has it taken Canada years? This is still something to keep an eye on.

The European Union is also starting to take action. It is starting to move on this front by setting up institutes to monitor interference, the extraterritoriality of certain practices, and so on. There are certainly practices that should be monitored.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague from Saint‑Hyacinthe—Bagot, who said he wished that we could talk a bit about what is being done proactively, and that is what I intend to do.

As members know, we cannot discover new worlds until we have the courage to not see the shore. Those who know me know that I would rather talk about the “why” than the “how”. I like to clearly define what we are talking about.

Let us start with the word “security”. Security is an absence of worry. It is peace of mind, a form of safety. It is rather easy to define.

Now, what is the definition of the prefix “cyber”? Cybersecurity is a word that is used in all kinds of ways. We want to combat cybercrime with cybersecurity. We want to prevent cyberstalking. Sometimes it can be confusing. What is the meaning of the prefix “cyber” that is used everywhere?

The origin of the word will help us to understand it. It was coined after the Second World War by an American researcher named Norbert Wiener. This brilliant mathematician was hired by the Massachusetts Institute of Technology, or MIT, to work on a research project on new types of weapons. More specifically, he was asked to develop missiles that could take down V‑1s and V‑2s, the unmanned German aircraft filled with explosives that were causing so much damage in England.

To that end, Professor Wiener had to model the behaviour of a pilot who knew he was being chased in order to better understand the decision-making mechanisms of humans in general. We will use the term human so as not to offend anyone. In 1948, Norbert Wiener named this field of research “cybernetics”, a new area of science that studies the mastery of machines. He was inspired by the Greek term kubernao, which means to pilot and from which the terms “government” and “governance” are also derived. It means “to steer”.

In 1949, Wiener's book was deemed one of the most important works of the 20th century. The New York Times praised it and predicted that cybernetics would be a leading branch of science in the future, which has come to pass. This book still contributes practical knowledge to today's world because one of the main concepts underlying this new theory is that of regulation. That is what we are discussing today.

With the Internet, everything becomes cyber, but the societal challenge is huge because in cyberspace we no longer know what is the cause and what is the effect. We are no longer certain who governs and who is governed. We no longer strive to determine if the chicken came before the egg or if the egg came before the chicken. In cyberspace, we cannot make sense of the chickens and the eggs.

When we talk about the Internet, we are talking about space and time. Space and time are concepts that, throughout history, have allowed us to place and understand ourselves. In philosophy it is said that nothing exists without space and time because everything is always somewhere in space and in a given moment, it is situated in time.

However, the Internet is everywhere and nowhere. In fact, when we talk about the web we picture an entanglement of threads without a centre. Humans, with their neurolinguistics, have a hard time placing themselves when there is no centre. We are always looking for the end. The Internet does not have one. In space, there is no centre and time is eternal. The Internet is always, never, and in perpetuity. It is therefore very hard to understand and associate with the cyber point of view.

Bill C‑26 is divided in two parts. In the first part, it says that it seeks to reinforce the security of the Canadian telecommunications system. Then there are indications of how it will change this and how it will change that. In the second, it says it will create the new critical cyber systems protection act to do this or that. I am summarizing the bill.

I noticed when I read Bill C‑26 that there is a lot of “how” and not a lot of “why”. What is the “why” behind Bill C‑26? In my opinion, there is just one reason why and that is to ensure that citizens can trust in the mechanism that protects them in the area of cybernetics and cyberspace.

Trust is complicated because it is not something that is easily granted. I will use the example given by my colleague from Saint‑Hyacinthe—Bagot. I know him and he is conspicuous in his absence, even though I am not allowed to say that. I do not have eyes in the back of my head.

It is pretty easy to build up trust between two individuals. However, trusting an entity, a company or a government is harder. Trust means having peace of mind, without needing supporting evidence. It is difficult to achieve in the public sphere. It is essential, however, and I think that is what Bill C-26 seeks to accomplish.

Trust begins with education and insight. Since this has been explored in speeches throughout the day, I will not dwell on it, but the geopolitical world is changing these days, and the balance of power is shifting. In addition, it is hard to know where the centre is, as I explained a little earlier.

The Canadian government's foreign policy is vague at best. It took years for the government to acknowledge that there was a problem with Huawei. It was the only Five Eyes nation that did not see the inevitable, that did not see the evidence right under its nose.

I am talking about education, but the bill does not contain any provisions for education in cybersecurity. I am talking about education in terms of privacy and facial recognition. Education would help people avoid the temptation to commit the act that we are trying to prohibit here.

We also know that we are stronger together. It is interesting to see who has already thought about these issues. One of our colleagues said that other institutions have thought about this. Yes, there is a concept known as cyber diplomacy, which involves co-operation and dialogue between nations. Moreover, to answer a question that has not been asked, which is the nature of philosophy, the Council of Europe could offer some very interesting answers and solutions in this matter.

This brings me to another question. Despite the many measures, there are quite a few things I do not see in this bill. I do not see measures that would prevent our devices from being taken over by malware, for example, or by a foreign power. Device takeover is something we recently studied at the Standing Committee on Access to Information, Privacy and Ethics. It is not the stuff of science fiction; it is actually happening now.

Also, I do not see how this bill prevents intellectual property infringement. I could name 200 other things I do not see in this bill, but I will mention just one more. I do not see how we are going to regulate what is known as the dark web. However, the bill names six organizations that will have the power to act as regulators.

However, I would like to ask the following question: Do these organizations have the necessary knowledge to do that? It is not always clear. In previous bills on other subjects, we were told, for example, about the CRTC, which was responsible for implementing some provisions. We saw that the CRTC was an outdated organization. The organizations in question now are not much better.

Cybersecurity is not something that is easy to regulate. That is why it is a good idea to look up and try to see a little further. I agree that the bill is well-intentioned, but intention without courage is meaningless.

A poet that I recently met in Montmartre told me that there is no love, only shows of love. It is the same thing here, except that we are talking about shows of courage, and so I hope that the government will show courage with Bill C‑26 and turn its intentions into action.

Let us send Bill C‑26 to committee as soon as possible.

The House resumed from December 1, 2022, consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[Gerald Soroka, Conservative, Yellowhead, AB]

Madam Speaker, I will be splitting my time with the member for Kootenay—Columbia.

I am pleased to rise in the House today to speak to Bill C-26, the critical cyber systems protection act, introduced in June 2022 and split into parts 1 and 2. The former aims to amend the Telecommunications Act to include:

the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.

The latter outlines the introduction of the critical cyber systems protection act, which would create a new regulatory regime requiring designated critical infrastructure providers to protect their cyber systems.

I would like to emphasize that the safety and security of our telecom industry, with particular reference to foreign adversaries such as the Beijing Communist Party, has been a broad theme in communications lately. This is especially concerning the controversial Bill C-11, the online streaming act, or, should I say, government censorship, and new revelations from the Canadian Security Intelligence Service, CSIS, flagging election interference from those involved with the Beijing Communist Party.

We Conservatives believe it is of paramount importance to defend the rights and interests of Canadians from coast to coast to coast. Thus, Canada's national security should be strongly well equipped to be prepared for cyberwarfare threats that could be presented by emerging digital technologies, intelligent adversaries or authoritarian artificial intelligence.

The NDP-Liberal government has had a long record of denying Canadians the truth. Instead of protecting their rights and freedoms, the government uses deflection tactics to divide Canadians, pitting them against one another to distract from the real issue: that the NDP-Liberal government has been too slow to address cyber-threats. For this critical lack of action, Canada has seen several serious incidents occur with no substantive legislative response for over seven years. After years of chronic mismanagement and utter failure, it is time for the government to step aside and let the Conservatives turn Canadians' hurt into hope.

We support the stringent and thorough examination of this legislation. We will always defend and secure the security of Canadians, especially with regard to cybersecurity in an increasingly digitized world. There is a pressing demand to ensure the security of Canada's critical cyber-infrastructure against cyber-threats. Let us not forget that these very systems lay the foundation of the country as a whole. It is these cyber systems that run our health care, banking and energy systems, all of which should be guarded against the cybercriminals, hackers and foreign adversaries who want to infiltrate them.

Akin to several other Liberal ideas, a number of aspects of this bill require further review, and it should thus be sent straight to committee where it can be further dissected and refined to ensure that all flaws are addressed. One can only imagine the disaster that a hospital system crash would add to the already horrible wait times in emergency rooms and shortages of medical professionals thanks to the NDP-Liberal government. The results would be disastrous. Furthermore, disruption of critical cyber-infrastructure in health care can bring severe consequences, such as enabling cybercriminals to access confidential patient health care information.

While we understand that it is imperative to provide the resources necessary to effectively defend against cyber-threats, it is still equally important to ensure that the government does not overreach on its specified mandate through Bill C-26. A research report written by Christopher Parsons called “Cybersecurity Will Not Thrive in Darkness” highlights some recommendations to improve Bill C-26. Among these recommendations is an emphasis on drafting legislation to correct accountability deficiencies, while highlighting amendments that would impose some restrictions on the range of powers that the government would be able to wield. These restrictions are critical, especially concerning the sweeping nature of Bill C-26, the critical cyber systems protection act, as outlined in parts 1 and 2, which I have explained in my opening statement.

The sweeping nature of this legislation is not new, particularly for the Liberal government. It even goes back to Bill C-11, the online streaming act, which essentially placed the Liberal government as the online content regulator controlling what Canadians see or listen to online. If members ask me, the government policing what Canadians view online is a cyber-threat in its own way, but I will not get into that right now.

There are other flaws in Bill C-26 that I would like to highlight, which brings us back to having Bill C-26 closely reviewed in committee.

In terms of civil liberties and privacy, some civil liberties groups have flagged serious concerns regarding the scope and lack of oversight around the powers that may be granted to the government under Bill C-26. In September last year, the Canadian Civil Liberties Association, along with other groups, released a joint letter of concern regarding Bill C-26, highlighting that the bill is “deeply problematic”, like several other questionable Liberal policies. They went on to further explain that Bill C-26 “risks undermining our privacy rights, and the principles of accountable governance and judicial due process”.

From an economic perspective, the bill lacks recognition of foreseeable impacted enterprises, such as small and medium-sized businesses, which will undoubtedly bring forth unintended consequences. According to the Business Council of Canada, some concerns include the lack of transparency seen through the one-way sharing of information. This brings about serious concerns. Operators are required to provide information to the NDP-Liberal government, yet those same operators are not entitled to receive any information back from the government or other cyber-operators. This whole information-sharing regime is lacking and, simply put, completely misses an opportunity to implement a transparent information-sharing system that would benefit all parties involved.

There is also concern regarding government overreach. Considering what powers would be granted to the government to order what a telecommunications provider has to do under Bill C-26, I would have expected to see sufficient evidence to support this overreach. However, that was not addressed at all, if not vaguely, in this bill. This, on top of blatant disregard for the recognition of privacy and other charter-protected rights, proves how the government only cares about granting itself more and more power, even in the face of blatant transparency and accountability concerns like election interference or the Bill C-11 censorship bill.

I only highlighted a few of the several highly valid concerns regarding this critically flawed bill. Obviously, it is important to defend national cybersecurity and defend against cybercriminals or foreign threats. However, there is a fine line between upholding the best interests of Canadians and just using another faulty bill as a power grab for the NDP-Liberal government, despite concerns regarding cyber systems, privacy and security infrastructure.

We Conservatives believe that it is of paramount importance to truly defend the rights and interests of Canadians from coast to coast to coast. One of the best ways this can be done is by securing Canada's cyber-infrastructure from attacks. While we welcome the idea of protecting the interests of Canadians in terms of cybersecurity, we want to flag that Bill C-26 has some highly concerning content that should be closely reviewed and discussed in committee to correct flaws and prevent potential overreach from the NDP-Liberal government. In the interest of protecting Canada's cyber-infrastructure, we must also guard against the sweeping government powers outlined in the critical cyber systems protection act.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, on the one hand, the member says that he is really concerned about cybersecurity, and then on the other hand, the member is saying that the government is doing too much and that he is concerned about overreach and is very skeptical. Then he uses examples of health care and talks about waiting lists and so forth. I am a bit confused about exactly where the Conservative Party is with respect to the legislation.

Would the member not agree that, at the very least, many of the issues or concerns he raised might be somewhat irrelevant to the debate and that parts of his comments would probably be better served if the bill went to committee? He seems to give me the impression in his comments that the Conservative Party supports the principles of the legislation. Does the member believe that he will be voting in favour of the bill so that it can go to committee?

[Gerald Soroka, Conservative, Yellowhead, AB]

Madam Speaker, yes, I think we will be voting in favour of the bill. The problem is that although the bill would address the fact of cybersecurity as a very important thing we need to deal with, it seems like every type of legislation the Liberal government puts forward would also take away our rights and freedoms as Canadians. The Liberals always try to make sure the government is in charge, controlling what we can or cannot do. I think that is quite evident in this legislation when they start talking about one-way sharing of information.

[Denis Trudel, Bloc, Longueuil—Saint-Hubert, QC]

Madam Speaker, I agree somewhat with my colleague. Sometimes, the Conservatives want their bread buttered on both sides, especially when it comes to cybersecurity or Internet bills. They support the principle, but oppose the intervention. It is difficult for them to find the right balance.

My colleague did not address the concerns. He spoke instead about Bill C-11, which is a very important bill for the promotion of French content on the Internet, but which was blocked by my Conservative friends.

Over the past two break weeks, I spoke with many Quebec artists. The Union des artistes fervently hopes that Bill C‑11 will pass so that French content will be promoted on line. It is extremely important. However, the Conservatives are stonewalling. They did so in committee, and even now, they are delaying the work in this place.

How does my colleague feel about the fact that all Quebec and francophone artists across Canada are against his party?

[Gerald Soroka, Conservative, Yellowhead, AB]

Madam Speaker, I think there is some confusion as to what we do and do not stand for. I believe there are a lot of opportunities in Canada when it comes to online streaming and how we can get our products out to market. However, when we start talking about Bill C-11, we start talking about censorship and what can or cannot happen here in Canada. Everyone talks about how we are going to protect the rights of our artists, but I am very concerned about the time when the censorship starts taking place and Canadians actually start understanding there is going to be content that would not be allowed to be viewed. I sure hope the member is right that there will not be such censorship, but I am afraid he could be mistaken.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I am pleased the member is going to vote in favour of the legislation. Could he provide a specific example within the legislation that he would say is government overreach?

[Gerald Soroka, Conservative, Yellowhead, AB]

Madam Speaker, that was probably the briefest time I have ever heard the member speak in the House; it is shocking. I will do my best as well.

When we start talking about information sharing, all these companies have to provide information as to what they are doing to make cybersecurity safe in Canada. However, the government is not reaching out to the same companies and people to say what it is hearing about and what it is understanding. That is one of the biggest problems; it would not be a two-way sharing system but only a one-way sharing system. Once again, the government is trying to control what Canadians can or cannot do.

[Rob Morrison, Conservative, Kootenay—Columbia, BC]

Madam Speaker, it is always an honour to rise in the House, especially when I can talk about safety and security.

I always try to enhance safety and security for Canadians at home and abroad, for our corporations that are major contributors to our economic base, and of course, for government institutions. Today, discussing cybersecurity in Canada is an opportunity to enhance our country's ability to protect us from cyber-threats.

Security is a significant concern for all Canadians. Lately, with the rise in organized crime and gang offences to the tune of a 92% increase in gang crime, I have to wonder when the government will be led by evidence, or in other words, provide evidence-based action. It is extremely important for our country to have cybersecurity to protect itself from threats, and I welcome Bill C-26. However, I am apprehensive about how successful this bill may be since accountability is a question that the opposition brings up every day in this House.

Bill C-26 is basically divided into two parts. The first part aims to amend the Telecommunications Act to promote the security of the Canadian telecommunications system. It aims to do this by adding security as a policy objective to bring the telecommunications sector into line with other infrastructure sectors.

By amending the Telecommunications Act to secure Canada's telecommunications systems and prohibit the use of products and services provided by specific telecommunications service providers, the amendment would enforce the ban on Huawei Technologies and ZTE from Canada's 5G infrastructure, as well as the removal and termination of related 4G equipment by 2027. Of concern is the time it took the government to react to enforce the ban on Huawei.

The second part aims to enact the critical cyber systems protection act, the CCSPA, which is designed to protect critical cybersecurity and systems that are vital to national security or public safety or are delivered or operated within the legislative authority of Parliament. The purpose of the CCSPA is to ensure the identification and effective management of any cybersecurity risks, including risks associated with supply chains and using third party products and services; protect critical cyber systems from being compromised; ensure the proper detection of cybersecurity incidents; and minimize the impacts of any cybersecurity incidents on our critical cyber systems.

The effects of this bill will be far-reaching, and there are some points to consider: The government would have the power to review, receive, assess and even intervene in cyber-compliance and operational situations within critical industries in Canada. There would also be mandatory cybersecurity programs for critical industries, as well as the enforcement of regulations through regulatory and law enforcement with potential financial penalties.

Under both provisions, the Governor in Council and the Minister of Industry would be afforded additional powers.

If any cybersecurity risks associated with the operator's supply chain or its use of third party products and services are identified, the operator must take reasonable steps to mitigate these risks. While the bill does not indicate what steps would be required from the operators, such steps may be prescribed by the regulations during a committee review.

The act also addresses cybersecurity incidents; a cybersecurity incident is defined as an:

incident, including an act, omission or circumstance, that interferes or may interfere with

(a) the continuity or security of a vital service or vital system; or

(b) the confidentiality, integrity or availability of the critical cyber system

touching upon these vital services. It does not indicate what would constitute interference under the act.

In the event of a cybersecurity incident, a designated operator must immediately report the incident to the CSE and the appropriate regulator. At present, the act does not prescribe any timeline or indicate how “immediately” should be interpreted. Again, there is an opportunity to address this at committee.

There are some concerns with Bill C-26 as it is presently drafted. What the government might order a telecommunications provider to do is not clearly identified. Moreover, the secrecy and confidentiality provisions of the telecommunications providers to establish law and regulations are not clearly defined.

As has been brought up today, potential exists for information sharing with other federal governments and international partners, but it is just not defined. Costs associated with compliance with reforms may endanger the viability of small providers. Drafting language needs to be in the full contours of legislation, and that could be discussed at committee as well. In addition, there should be recognition that privacy or other charter-protected rights exist as a counterbalance to proposed security requirements, which will ensure that the government is accountable.

Some recommendations, or ones derived from them, should not be taken up, such as that the government should create legislation requiring the public and telecommunication providers to simply trust that the government knows what it is doing. Of course, this is a challenge. Telecommunications networks and the government must enact legislation to ensure its activities support Canada's democratic values and norms of transparency and accountability.

If the government is truly focused on security for Canadians, should we not be reviewing our gang and organized crime evidence? Our present policies have failed. Should we not look at the safety and security of our bail reform in an effort to prevent innocent Canadians from becoming victims?

Bill C-26 is a step in protecting Canada from cybersecurity threats. What is the review process to ensure compliance and effectiveness, as well as that goals are met?

In terms of bail reform, even though the evidence clearly shows that Bill C-75 has failed, we see that the NDP-Liberal government is not interested in reviewing bail reform. Cybersecurity is important to our country's security; so are victims of crime after their safety and security has been violated.

I am concerned that the government is struggling with evidence-based information to review Bill C-26, as it has with Bill C-75 and Bill C-5. These bills are not supported by evidence. In fact, offenders and criminals have a higher priority than victims do. My concern is as follows: If Bill C-26 requires amendments and review, will the government follow up? It is so important to be flexible and to be able to address changes, especially in a cybersecurity world, which changes so rapidly.

Bill C-26 proposes compliance measures intended to protect cybersecurity in sectors that are deemed vital to Canadian security. Therefore, although late out of the gate, Bill C-26 is a start. However, since this bill proposes compliance measures intended to protect cybersecurity in sectors that are deemed vital to Canadian security, I would like to see individuals, corporations, and most importantly, the government held accountable. There should also be measures to ensure that the objectives of the bill are met and that there is a proper review process.

As I have stated, government accountability has not been a priority. For the proposed bill to succeed, there have to be processes for review and for updating the critical cyber systems protection act.

The failure of Bill C-75 on bail reform is clear with recent violent acts by murderers and individuals who should never have been out on bail. Today we are debating Bill C-26, and I would hope that there are lessons learned from our failure to review Bill C-75. In addition, we can learn from the failure of Bill C-5, as gang violence and organized crime rates are up 92%. Surely the government will open a door for review and making required changes to Bill C-26 on cybersecurity.

I am thankful for the time to speak on the responsibilities related to cybersecurity.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, we have seen an explosion in the impact of the digital world around the globe. Here in Canada, our systems are very complex, and we have some that are absolutely critical, which need to have the proposed protection.

We have a progressive government that is looking at this in a very serious manner. This is why we are bringing forward this legislation and recognizing the impact of cybersecurity threats. The opposition seems to support the principle of the legislation.

The member has recognized a number of areas in which he would like to see better definition and more details. I would suggest to the member that much of what he is looking for could best be had at the committee stage. If we get the bill to committee, could we look at what he is talking about in more detail? What are his thoughts on that?

[Rob Morrison, Conservative, Kootenay—Columbia, BC]

Madam Speaker, the member is right. When we get to committee, we can iron out some of the flaws that we have seen in Bill C-26. It is going to be important to focus on accountability and the member did not address that. That is where this bill can either succeed or fail. We need to ensure there is an accountability process for the government, so when it follows through with Bill C-26, we have a process and we can go back and say we need to tweak or change something because cybersecurity changes so fast.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, we have been hearing details about the impact this bill could have. I would like to hear my colleague's thoughts on the following question. Why are we always in reaction mode?

In 2019, the Standing Committee on Access to Information, Privacy and Ethics was looking at how to separate information pertaining to social insurance numbers in order to protect citizens' privacy.

What message does this bill send? Yes, a structure exists. Yes, there are correspondents, organizations and individuals who will have more power and potential accountability, but what is behind all of this? Are the Liberals trying to clear their conscience for all the scandals of the past few years?

I would like to hear my colleague's thoughts on that.

[Rob Morrison, Conservative, Kootenay—Columbia, BC]

Madam Speaker, I am not too sure what the specific scandals were, but this bill certainly opens the door for information sharing and, as was brought up, intelligence sharing, and, through accountability, we can cover those. We can actually be accountable in how we share information safely and we can protect the rights of Canadians.

[Terry Dowdall, Conservative, Simcoe—Grey, ON]

Madam Speaker, I want to thank the hon. member for his speech today and for his many years in law enforcement. He certainly knows a lot about this file. Throughout the member's speech, the number one word he used, and we can check Hansard, was “accountability”, and also the frustration with the Liberal government on a lot of the bills that have been passed.

How does he feel on this particular bill on accountability?

[Rob Morrison, Conservative, Kootenay—Columbia, BC]

Madam Speaker, in the last several months, we have seen accountability raise its head here in Parliament with Bill C-5, Bill C-75 and Bill C-11. Without accountability, it is as though the government does not actually care what we are doing because with a majority government, the NDP and Liberals can make decisions based on what they think is right and there is no accountability.

With Bill C-5, the evidence is not there. Bill C-21, taking legal guns from legal gun owners, is another non-evidence-based process. With Bill C-26, which we are talking about today, it is time that we start building in some processes for accountability so the government is actually accountable for what it is doing.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, I am very pleased to be joining the debate today to offer some of my thoughts and perspective on Bill C-26, a much awaited bill on a cybersecurity infrastructure.

Bill C-26 is a good reminder to members that the Department of Public Safety and its subject matter is so much bigger than just firearms, because, of course, firearms and Bill C-21 have been dominating the news cycle for the last couple of months. That bill, in particular at the public safety committee, has occupied so much time and wasted so many resources. Bill C-26 is a good reminder that with cybersecurity we have so many other agencies that are dedicated to national security under the umbrella of public safety. Cybersecurity is a big subject matter. We also have Bill C-20, which is an important bill on oversight and accountability for both the CBSA and RCMP.

Today, we would not find many members in the House of Commons who are arguing against the need for better cybersecurity. All of the evidence out there points to this being a new and evolving threat. Artificial intelligence systems offer some interesting advantages, but with those advantages come threats and with those threats come actors who are determined to use them in nefarious ways that will harm and have harmed Canada's interests. We need a whole host of options to counter this threat. We need our national security agencies to take these threats with increased importance. We also need legislation to fill in the gaps and make sure that all of Canada's laws are up to date.

I have spent a lot of time on the public safety committee. We did a couple of reports that directly touched on this area. One of our first reports identified violent extremism. Our most recent study looked at the threat posed by Russia. We know that since Russia conducted its invasion of Ukraine, which has recently passed the one-year anniversary, it has also increased the threats that it offers to Canada and to like-minded countries. One of those areas is cybersecurity.

Our committee has not yet tabled its report, which should be tabled in the House of Commons soon so that members of the House and the public can not only see the results of the deliberations, but also see the important recommendations that the committee is going to make. However, we heard a lot of testimony during those committee hearings on the cyber-related threats from Russia. Many witnesses identified that those are among the most serious and relevant for Canada's public safety and national security, particularly in relation to critical infrastructure.

I want to set this table before I get into the nuts and bolts of what Bill C-26 is offering, but also set some of the problems that are in evidence with this first version of the bill.

We have to understand a few basic terms. The Government of Canada refers to critical infrastructure as the “processes, systems, facilities, technologies, networks, assets and services essential to the health, safety, security or economic well-being of Canadians and the effective functioning of government”, whether that is the federal government, the provincial governments or our municipal governments. Because so many of those pieces of critical infrastructure are now tied into computer systems that are vulnerable to attack, a bill like this becomes quite necessary.

I could go on and on about all of the critical systems in our modern society and the range of sectors, from our energy production to our food distribution systems to our electricity grid and transportation networks and how our ports and our banking system work. If one were to interrupt any one of those services, it could create absolute havoc within any Canadian community or countrywide.

One of the witnesses we had during our public safety meetings on the topic of the threats posed from Russia, and this was just talking about the cyber-threat more broadly, was Jennifer Quaid, Executive Director of the Canadian Cyber Threat Exchange. She reminded our committee that there are nation-states that are conducting espionage and statecraft through the Internet, but there are also criminals who are engaging in cybercrime for financial gain.

In some cases, those criminal groups and the nation-states are working together. There is evidence of this not only in Russia but in places like North Korea and China, where it is almost like the policy that was in place back in the 1700s and 1600s, where privateers would go out and do a nation-state's bidding. In this modern-day version of that policy, there are criminal organizations that are working hand in glove with some nation-states to give them some plausible deniability, but the systems they are using do pose a very real threat to Canada.

One of our key witnesses during the study was Caroline Xavier, Chief of the Communications Security Establishment. She was not able to go into much detail or specifics, given the very sensitive nature of the topic, but she was able to assure the committee that cybercrime is absolutely the most prevalent and most pervasive threat to Canadians and Canadian businesses. She observed that the state-sponsored cyber programs of China, North Korea, Iran and Russia posed the greatest strategic threat to Canada, and that foreign cyber-threat activities have included attempts to target Canadian critical infrastructure operators, as well as their operational and information technology.

Leaving aside the government, it is important for members to realize that most of Canada's critical infrastructure is, by and large, in the hands of the private sector. This is going to underline some of the important elements of Bill C-26.

We also had testimony from David Shipley, Chief Executive Officer of Beauceron Security. He was relaying the same stuff about Russian criminal organizations working in tandem with the government, and saying that criminal gangs have crippled Canadian municipalities. They have gone after health care organizations. The range of malicious cyber-activity has absolutely extended to many small and medium-sized enterprises.

When we look at the reporting requirements of Bill C-26, one of the biggest gaps that we have in our system is the fact that many businesses, private enterprises, are loath to report the fact that their systems have experienced a cyber-attack. They may be threatened to not do so. There is also a very real concern about the institutional harm that could come from the public release of said information. A large corporation that relays to its customers that it has experienced a cyber-attack may find people are loath to do business with it if they are unsure that its systems are up to par.

I also want to highlight a recent example from 2021, where the Government of Newfoundland and Labrador experienced a health records cyber-attack on October 30. The investigation revealed that over 200,000 files were taken that contained confidential patient information.

One can just imagine that in a province the size of Newfoundland and Labrador the fact that over 200,000 files were taken, that is a shocking theft of personal and confidential information. It really underlines just how important addressing this is.

I also want to touch briefly on the topic of artificial intelligence. I want to read a quote from a recent Hill Times article. This is from Jérémie Harris who is one of the co-founders of Gladstone AI, which is an artificial intelligence safety committee. He says:

But perhaps more concerning are the national security implications of these impressive capabilities. ChatGPT has been used to generate highly effective and unprecedented forms of malware, and the technology behind it can be used to power hyperscaled election interference operations and phishing attacks. These applications—and countless other, equally concerning ones also enabled by new advances in AI—would have been the stuff of science fiction just two years ago.

He goes on to say:

...ChatGPT is a harbinger of an era in which AI will be the single most important source of public safety risk facing Canada. As AI advances at a breakneck pace, the destructive footprint of malicious actors who use it will increase just as fast. Likewise, AI accidents—now widely viewed by AI safety specialists as a source of global catastrophic risk—will take more significant and exotic forms.

Something all members of the House really have to be aware of is how, just in the last two years, AI has advanced so quickly. We can think about what AI will be capable of two years or a decade from now. Just as Mr. Harris said, what it is doing right now was inconceivable just two years ago. The fact that AI is now being used to generate unique code for malware indicates there is no telling what it can be used to do and how it could be used to wreak havoc. That underlies just how important this issue is and how seriously we, as parliamentarians, have to take it as we serve our constituents and do the important work of equipping our nation with the tools it needs to keep Canadians, and the critical infrastructure they depend upon, safe.

When I was a member of the public safety committee, I had a chance to speak with Mr. Harris. I actually put a motion on notice that the committee should be undertaking a study on the range of threats posed to Canada's public safety, national security and critical infrastructure, specifically by AI systems. I hope one day the committee can take that study up, but it is a committee with a very heavy workload. It is still trying to find its way through Bill C-21. It is waiting for Bill C-20 to arrive on its door and, of course, this bill, Bill C-26, would also keep committee members quite busy.

I would like now to turn to the specifics of Bill C-26 and what it is attempting to do. It is separated into two main parts. According to the summary of the bill:

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.

There are a number of orders that the Minister of Industry could issue. For example, he or she could prohibit a TSP from using any specified product or service in its networks or facilities; direct a TSP to remove a specified product from its networks or facilities; impose conditions on a TSP’s use of any product or service; subject a TSP’s networks or facilities, as well as its procurement plans for those networks or facilities, to a specified review process. Those are just a few examples of how the minister's orders could be issued. The bill does require the Governor in Council or the Minister of Industry to publish these orders in the Canada Gazette, but there is an allowance in the bill to allow these provisions to be prohibited, so the government can prevent the disclosure of these orders within the Gazette if they feel they need to be kept secret.

Part 2 would enact a brand new statute of Canada, a critical cyber systems protection act, which would “provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety”. In schedule 1 of the government's bill there is a brief list. Vital systems and services can include telecommunication services, interprovincial or international pipelines and power line systems, and nuclear energy systems. Those are a few examples. A really important point is that the Governor in Council, through this bill, would be able to establish classes of operators and require designated operators to establish and implement cybersecurity programs.

This is where the bill would affect the private sector and make sure those cybersecurity programs are in place, especially when that private sector is involved in critical infrastructure. As a brief outline, with those cybersecurity programs, the expected outcomes would be that they could identify and manage any cyber-risk to the organization, including supply chain risks; prevent their critical cyber systems from being compromised; detect cybersecurity incidents; and limit the damage in the event a cybersecurity incident did occur.

I want to talk about concerns with the bill, because there are a lot of concerns. I have had the chance to speak with a number of organizations, but first and foremost was OpenMedia. I had a great conversation with the people there. There is a section on its website that specifically deals with Bill C-26. OpenMedia absolutely realizes that new cybersecurity protections are needed to protect Canada's infrastructure, but it believes they have to be balanced by appropriate safeguards, and this is to prevent their abuse and misuse.

We rely on these essential services, and their protection is important, but Bill C-26, as it is currently written, would give the executive branch huge sweeping powers. In my reading of the bill, there would not be enough accountability and oversight; there would not be enough review mechanisms for Parliament to check the power of the executive, and I think this is a critical point. I think, in principle, we have a good idea with the bill, but a lot of work will be needed at committee to ensure that this executive power would be checked and that it would fit within the parameters of the law. We absolutely must have that kind of parliamentary oversight.

I also know of the Canadian Civil Liberties Association, which said:

The problems with the Bill lie in the fact that the new and discretionary powers introduced by C-26 are largely unconstrained by safeguards to ensure those powers are used, when necessary, in ways that are proportionate, with due consideration for privacy and other rights. The lack of provisions around accountability and transparency make it all more troubling still.

I think, at this stage, we want to ensure, with the minister's powers to order or direct service providers, and the requirement to comply with these orders, that these powers are being subjected to the appropriate safeguard mechanisms. They are quite broad, as currently written.

In conclusion, I want to see a bill that protects vulnerable groups from cyber-attacks. So many Canadians rely on these critical systems, and we know so many have been targeted and are being targeted as we speak, and we know these dangers are going to multiply and get worse the longer we go on. We want to make sure they are protected, but we want to make sure that we do not have broad unchecked ministerial powers with no public oversight. That is the balance that must be achieved.

I must express, in my closing minute, my personal frustration with how the Liberals draft their bills. The idea behind Bill C-26 is a good one, but the problem with how the Liberals drafted the bill is that it would give huge sweeping amount of power to the executive branch. I just wish they would have had the foresight to understand that, of course, these provisions would be met with opposition. It seems the Liberals are putting the work on committee members to fix the bill for them, rather than having had the foresight and intuition to understand that these are problematic elements of the bill.

I think a lot more work could have been done on the government's side to have presented a better first draft. I guess we have what we have to work with, but a lot of work is going to be needed to be done at committee, and I look forward to seeing members do that work.

I also look forward to voting for the bill at second reading and sending it to committee. I welcome any questions or comments from my colleagues.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, Bill C-26 would assist in empowering our laws and legislators to ensure there is a higher sense of Canadian confidence in the digital world, given the importance of the critical systems that are at work. Whether they are in health care services or consumer purchases, we have witnessed a great deal of advancement over the last number of years in cyberspace.

I am wondering if the member could provide his thoughts on why it is so important that legislation is brought forward to support Canadian confidence and protect privacy at the same time, and deal with the issue of the security of our Internet.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, it is quite clear that legislative gaps exist. Many of my remarks were focused on detailing the threat landscape out there.

The good people who work at CSIS, CSE and Public Safety Canada are dedicated professionals who treat this threat very seriously. Every day they go to work, they are determined to keep Canadians safe. The problem lies in the fact that so much of our critical infrastructure, those systems that our society relies on every single day, lies in the private realm. We want to ensure that the government is there as a partner to help them beef up their cyber systems so that, if any one of them is attacked, we can pool resources, address the threat and also learn from it to prevent ones in the future.

There is a need there, but again the crux of my comments is that we have a good idea in this bill. There is a need. It is just the details and specifics that need to be hammered out.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I am going to build a little on the last question to the member. I know he sat on the public safety committee for a while. From his viewpoint, what does he think is the greatest cyber-threat to Canadians?

I would ask him to speak again to why getting this legislation right is so important, but I am interested in his take on what he perceives to be the greatest cyber-threat to Canadians.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, in my opinion, based on what I have heard, it is artificial intelligence and its capabilities in the hands of nefarious actors.

We heard from Caroline Xavier, the chief of the Communications Security Establishment, at committee. She identified China, Russia, Iran and North Korea as countries that are actively trying to undermine Canada's national security. If we combine that with what Mr. Jérémie Harris has identified as what AI is capable of now and what it could be capable of, I am very concerned that those countries that are actively trying to undermine Canada's national security interests will use this emerging technology to construct malware, the likes of which we have never seen.

That is why a bill such as Bill C-26 is important, but it is important that we get it right. We absolutely must make sure that our critical systems are beefed up and secured against not only those particular nation states, but also others that are actively trying to undermine our interests.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, I heard loud and clear what the bill is missing. It lacks teeth and, of course, accountability mechanisms.

I heard my colleague opposite talk about the purpose of this bill, which could restore some degree of public trust. It is safe to say that trust is being undermined at the moment. My colleague is concerned not only about the fact that people's safety must not be compromised, but also about the impact on democracy and the need to ensure that it is not undermined.

Does my colleague agree that this bill has been crafted well enough to deal with the serious problems we are facing in terms of cyber-attacks and interference in our elections?

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, the hon. member has a point. I would identify the system that deals with our democratic process, including all of the actors involved, as being a critical system. It is probably the most critical system. However, while I do acknowledge there are definitely state actors who are trying to undermine our system, they are trying to undermine democratic systems all over the world. We see evidence of that.

I have a lot of confidence in the public servants who work at Elections Canada and who work for the office of the Commissioner of Canada Elections. They are doing their utmost to protect the sanctity of our democratic system. That being said, we cannot rest on our laurels, and it is up to us, as parliamentarians, to acknowledge these evolving threats and to equip our dedicated public servants with the tools they need to counteract these threats actively.

I would agree with the member's saying that these threats are real. They do need to be acknowledged. We owe it to ourselves to get Bill C-26 right so our public servants have the tools to counteract those threats.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, given that there are concerns about our privacy rights being infringed upon and that Bill C-26 is not doing enough to protect our privacy rights, I would like to hear what the member thinks needs to happen to make sure this bill is improved.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, a 20-minute speech does not give a lot of time to go over the multitude of concerns with Bill C-26. Yes, there are a lot of privacy concerns with this bill. We have had those concerns outlined not only by the Canadian Civil Liberties Association, but also by OpenMedia.

The way we allay those concerns is that we empower committee members on the public safety committee to give this bill a thorough going-over, and to make sure those expert witnesses are brought forward so they can identify the specific clauses of this bill that are problematic. We need to give members of the committee enough time to draft the amendments.

What I ultimately want to see when this bill is reported back to the House is an acknowledgement that there is a very real threat; that the bill would empower the government to counteract that threat; and that the bill would also provide a very important layer of parliamentary oversight and accountability, which I think should include some of our dedicated public servants, like the Privacy Commissioner and others.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, the member for Cowichan—Malahat—Langford shared some concerns in his speech. I am sure he saw the open letter from eight groups, including the Canadian Civil Liberties Association, the National Council of Canadian Muslims and OpenMedia. One of their concerns is power without accountability for the CSE, or Communications Security Establishment, our cybersecurity agency.

Can he share more about what could be done to address this concern in Bill C-26?

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, there have been serious concerns about how, within the telecommunications infrastructure, Bill C-26 would allow Canada's national security and spy agencies to permanently implant themselves within that infrastructure, have access to all kinds of sensitive data and possibly share it.

I do not know what the specifics are at this point. I think the committee will be empowered to look at that. I want to make sure that, everywhere in Bill C-26 where ministers are able to issue these types of orders, or if they are kept secret, there would be accountability mechanisms built into the bill.

Can we give the standing joint committee on regulations the ability to review those orders, since they could be prevented from being published in the Canada Gazette? That is one particular example, but there are many others.

I agree with the premise of the member's question in that there is a lot of work that needs to be done with Bill C-26 at committee.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I am pleased to be able to rise in this place today and speak to Bill C-26, a bill that we as Conservatives are supporting to get to committee.

I have a lot of concerns around the bill itself, in terms of making sure that the government did not make a number of errors in judgment in putting it together. These concerns are based on the feedback we have received from Canadians and from organizations, especially on the issues surrounding privacy and the costs that have been offloaded to the private sector.

I also have to raise my concerns. Here we are, eight long years under the Liberal government, and we know that, when it has come down to cybersecurity, it has been slow in responding. A good case in point was banning Huawei from our critical infrastructure, our 5G network. We know that the Liberals sat on their hands and tried to do nothing for most of the past seven years, before they were finally forced to act after a great deal of pressure was brought upon them by our allies, especially within the Five Eyes.

Cybersecurity and national defence go hand in hand. When we talk about our national defence and national security, we know that hybrid warfare has evolved.

It is now about more than just targeting military assets; it is about targeting the entire government as it is at play. All we have to do is look at what is happening in Ukraine today, as well as what has happened to a number of other allies we have, through NATO, in eastern Europe.

We see the troll farms in St. Petersburg constantly attacking, on Facebook and on Twitter, the military individuals, the soldiers and troops, serving there. They also attack things like critical infrastructure in countries where Canadians are currently deployed, like Latvia. As we have witnessed in Ukraine and Estonia, they have not just gone after them through direct kinetic means to take out critical infrastructure, but they have also gone through cyberwarfare as well.

The Russians have done this very effectively in knocking down financial systems, knocking down transportation systems, and taking out power and water infrastructure in places like Estonia. As a prelude to the war in Ukraine, before they had actually started bombing these civilian targets in Ukraine, they were attacking them on cyber. It is part of hybrid warfare and it is the evolution of war.

There is a responsibility upon the Government of Canada to ensure that we are protecting not just our national infrastructure and the Government of Canada, that we are not just using CSE, or Communications Security Establishment, to protect national defence, but that we are also using a plethora of capabilities to ensure that our infrastructure here in Canada is protected.

That includes preventing our adversaries from going after our soft targets. That is what I think Bill C-26 is trying to accomplish, to ensure that telecommunications companies in Canada are stepping up to do their share to protect Canadians from cyber-attacks. We know that cyber-attackers have gone after things like our health care systems. They have gone after the medical records of Canadians. They have gone after the education records of students at schools and at universities. They go after retailers. They can go in through a retailer's back door, harvest all sorts of personal data, especially credit card information, and then use that for raising money, for transnational criminal gangs or for ransomware, as we have witnessed as well.

We must remember that we have a number of a maligned foreign actors at play here in Canada now and against our allies. It was just reported, again, that the People's Liberation Army was found guilty of hacking into U.S. critical infrastructure.

We know that the People's Liberation Army, under the control of the communist regime in Beijing, continues to attack cybersecurity assets around the world, including trying to break through the Canadian cybersecurity walls of our government and national defence on a daily basis.

As I mentioned, Russia has become very good at this. That does not mean that it is concentrating only on its near sphere of influence, NATO members in eastern Europe like Estonia, Latvia and Lithuania, but it is also targeting Ukraine. We know that it is targeting Moldova. We know that it has gone after countries like Romania, but it also does cyber-attacks here in Canada and in the United States.

Russia continues to be an adversary and we have to stand on guard to protect Canadians from those attacks.

We know that Iran, the regime in Tehran, is continuing to be a government that attacks its neighbours and attacks Israel and Canada through cyber-means. North Korea has developed an entire cybersecurity and cyberwarfare unit and continues not to just wreak havoc with the democratically elected, peaceful South Korea, but has also gone after Japan and the Phillippines, and is going after U.S. infrastructure as well. Therefore, we have to take the necessary steps to make sure we can deal with transnational criminal organizations, with nefarious foreign states and with those who are trying to get rich through ransomware.

Here in Canada just a couple of years ago, we saw a situation in regard to the Royal Military College in Kingston, which the member for Kingston and the Islands is certainly aware of. The Department of National Defence stated that RMC had been a target. It originally called it a mass phishing campaign, but a month after the incident, it was established that the phishing campaign was actually a cyber-attack going after financial information and personal data of cadets. These had been compromised and published on the dark web, and were made available to a lot of people who participate on the dark web to profiteer from that information.

According to several observers who looked at the hack of RMC Kingston, it was attributed to a cybercriminal group called DoppelPaymer that did not seem to be connected to a nation-state actor. There are criminal organizations out there that are going about their criminal activities in such a way as to extract dollars from governments, retailers and private citizens, as well as from other corporations, to line their pockets and continue doing other nefarious things that sometimes go beyond the cyberworld.

I have said in the past, when we have talked about other legislation here dealing with cybersecurity, that we not only need the ability to defend, but also that the government has the responsibility, especially under national defence, to attack using cybersecurity. We cannot just be here deflecting the arrows; sometimes we have to be able to shoot down the archer. The way we do that is by having a very robust cybersecurity system. We need the best capabilities and the best personnel who are able not only to sit here and defend, that is to put up shields and fight off the attacks, but also are able to go out there and take out the adversaries, to knock out their systems, so that we are safer here at home.

With regard to some of the criticisms that have come out, I know that letters have come in from the Canadian Civil Liberties Association, and the Business Council of Canada wrote a very detailed brief, as did the Citizen Lab in looking at the bill. When we read through the documentation, we see that one of the concerns that has been raised, especially by the Business Council of Canada, is that there seems to be an imbalance. We are telling members of corporate Canada to go out there and make sure they have the proper cybersecurity systems in place, but at the same time we realize that it is not just up to them to do the defending. What we see is that the corporations are saying that either they have to do it or we are going to fine them up to $15 million or five years of jail time, and that the individuals who work for them could also be held criminally responsible for not doing enough.

Sometimes resources are not available. Sometimes there are new companies that may not have the ability to put in place the proper security systems. I look at a lot of the Internet service providers that we have, for example. They are covered under the Telecommunications Act, yet, as new start-ups, they may not have the personnel or the equipment to properly defend their networks. Would we go ahead and fine these companies up to $15 million? Then what would we do in regard to jail time and fines for those criminal organizations that are profiteering through cyber-attacks? Where is the balance in this? That is one of the concerns we have and one of the things we have to look at through our study at the industry committee when it brings this forward.

A huge concern has been raised, especially by the Canadian Civil Liberties Association, on how this would be implemented and how it may affect the privacy rights of Canadians at the individual level. Corporations have broader responsibilities and do not necessarily fall under the charter, but their clients who they are going to protect and the information they are going to be required to share with the Government of Canada could very well be violations of their clients' privacy rights.

When we look at section 7 of the Charter of Rights, we have to balance the right to life, liberty and security of a person with section 8 of the charter which says that we have freedom from search and seizure. When we drill down on section 8 and go to some of the legal analysis of our charter, as all the rights and freedoms are laid out, it tells us that the underlying values of freedom from search and seizure when it comes to individual privacy is the value of dignity, integrity and autonomy. Again, I think we are all concerned that when we look at Bill C-26 at committee, we ensure the bill balances those rights of the individual to be both secure and safe from cyber attacks, but do it without compromising privacy rights and charter rights as described in freedom from search and seizure. The way we do that is through warrants.

We know that through National Defence, the Communications Security Establishment, or CSE, which has a long-standing history of defending the Canadian Armed Forces, has to comply with the charter. It has to comply with all Canadian legislation and it cannot do indirectly what it is prohibited doing directly. Therefore, CSE cannot go to the National Security Agency, or NSA, of the United States, say that it is concerned that a Canadian maybe talking to a terrorist organization offshore and ask the agency to spy on that individual because CSE is prohibited from spying on the person and listening in through the Communications Security Establishment. CSE cannot go to the NSA and ask it to violate Canadian law on its behalf to find out what is happening in the same way CSIS cannot go to the FBI or the CIA and ask it to spy on Canadians. It cannot do indirectly what it is prohibited from doing directly under Canadian law. The way to get around that is to apply for warrants.

Judicial appointments are made to have supernumerary justices over these organizations to ensure that charter rights are protected, even when conversations take place inadvertently. In the past, CSE has listened in on people who may have been in Afghanistan funding the Taliban or al Qaeda. They may have family in Canada and were talking back and forth about something that had nothing to do with operations on al Qaeda or the Taliban. However, because it involved a Canadian citizen, it had to go through the proper processes to ensure that his or her charter rights were protected by getting a warrant to listen to those conversations. Whether they were listening electronically or through wire taps, it is all mandated to watch that we do not trip over the rights of Canadians under legislation.

Bill C-26 would not address this like we have under the National Defence Act, under the Criminal Code and under the whole gamut of cybersecurity that has been in place up to date. The privacy rights are paramount.

To come back to Bill C-26, the Supreme Court of Canada said in 1984, as well as in 1988, that privacy was paramount and was “at the heart of liberty in a modern state”. Again, did the Liberal government ensure the bill was tested first to ensure those privacy rights were protected? This is what we will have to find out when we get Bill C-26 in front of committee.

We can look at information that has come from places like the Business Council of Canada. One of the concerns it raises goes back to this whole issue of huge fines on Canadian corporations, as well as the employees of those corporations, if they are found to have been not responsible enough to put in place proper security protocols to protect their clients from cyber attacks. Because it goes against individual employee as well, we will create another brain drain from Canada.

We are unfairly targeting Canadian employees who are going to be working for these cybersecurity firms, working in the telecommunications sector and in our financial institutions. If they are found to have erred, which a lot of times it is by error or by a lack of resources, then they are held criminally responsible and they are fined. The question becomes why they would want to work in Canada when they are afforded better protections in places like the United States, the European Union, the United Kingdom or Australia, which was held up by the Business Council of Canada as the gold standard we should be striving to achieve, and what it has done through their own cybersecurity protocols.

We want to ensure that we protect critical infrastructure, but we do not want to chase away very good Canadian employees and force them, with their skills, to go offshore where they have better protection and probably better pay. We want to ensure we keep the best of the best here. We want to ensure we do not go through a brain drain, as we have witnessed before when the Liberals have targeted professionals in Canada, such as lawyers, accountants, doctors or anyone who set up a private corporation. Now I fear the Liberals are going after individuals again who we need in Canada to protect us here at home, that they are creating a toxic work environment and those individuals will want to leave.

The Citizen Lab wrote a report entitled “Cybersecurity Will Not Thrive in Darkness”. It brought forward a ton of recommendations on how bad this bill was. It suggested that there needed to be 30 changes made to the act itself.

We realize that the government has not done its homework on this. We need to ensure we get experts in front of us who are going to look at everything, such as there is responsibility upon government to help corporate Canada ensure we have the proper security mechanisms in place to prevent cyber attacks. We have to ensure that those corporations are not being coerced into sharing private information with the Government of Canada that could be a violation of private rights, which may be a violation of the Personal Information Protection and Electronic Documents Act, PIPEDA. We want to ensure that privacy rights will be cohesive, but, at the same time, collectively, we need to balance all federal legislation that is in contravention of each other.

We need to bring in the legal experts. The Canadian Civil Liberties Association needs to be before committee. The Citizen Lab, which is very concerned about individual privacy rights, has to be front and centre in the discussion. We need to ensure the Business Council of Canada, the Canadian Chamber of Commerce and others are brought forward, along with the department officials who were responsible for drafting this bill at the direction of the Liberal government.

I will reiterate that I will be voting in favour of the bill to ensure it goes to committee and the committee can do its homework. I would hope that the government will allow the committee to do a thorough investigation, as well as a constructive report with recommendations on how to change and amend the legislation.

Finally, I would remind everyone that the Supreme Court of Canada said, “privacy is at the heart of liberty in a modern society”, and we have to take that to heart to ensure we protect Canadians from cyber attacks, as well as to ensure they have their privacy, dignity, integrity and autonomy respected.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, when look at Bill C-26, I want to assure the member that the government has made very clear the importance of privacy rights. In fact, it was a Liberal administration that brought in the Charter of Rights, understanding and appreciating just how important privacy rights were. The legislation, which the Conservative Party is voting in favour of, and I grateful for that, is there to protect the integrity of the system. As we move more and more into that digital world, cyber-threats are very real and can have a profoundly negative impact. That is why we have to bring forward the legislation.

Given the potential threats to things such as the delivery of health care services to interactions on the net by Canadians, would the member not agree that it is important that legislation of this nature continue not only to deal with the threats but to build confidence in the system with Canadians?

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I have a lot of trouble putting any confidence in the Liberal government. It took seven years for it to ban Huawei. It is a government that sat on its hands and did nothing about cybersecurity for the past several years. I know this is a government I cannot trust. When I look at Bill C-11, the Liberals are now trying to censor Canadians online. They are trying to control what people see online, which violates charter rights, especially when it comes down to freedom of expression, freedom of association and the ability to actually have discourse online about our political situation in Canada and around the world. When the Liberals try to put veils over certain parts of our information system, I have to be very concerned.

I look at Bill C-21 and how the Liberals have gone after responsible firearms owners like hunters, sport shooters and farmers. To me, that builds no trust in the government to get the job done.

[Yves Perron, Bloc, Berthier—Maskinongé, QC]

Madam Speaker, I thank my colleague for his speech. It was eminently sensible, and he made some good points. I am glad the Conservatives are going to vote in favour of the bill so that it can go to committee, and I hope we will all approach that work in good faith, as we should.

Over the past few weeks, I have had the opportunity to serve as a substitute at the Standing Committee on Public Safety and National Security. I had a chance to question a witness, and one of the things we talked about was quantum computing, a new and rapidly evolving technology that Canada is absolutely not ready for. My sense is that it will take a massive investment up front to prepare the country for future cyber-attacks by systems that could crack passwords at lightning speed.

Does my colleague see this as a priority issue? Does he think that the committee should discuss making a massive investment in R and D and creating a technical team to get ready for these new technologies?

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, we all have to be concerned about the rapid deployment of new technologies and how they can be used nefariously to attack Canadians. This comes back to Bill C-26 as well. Again, the government would be putting all the onus on corporate Canada to protect us, but at the same time, I wonder who will do the R&D, who will step up to ensure our technology and our ability to defend ourselves is deployed across the spectrum, whether it is government agencies, government departments, our provincial and territorial partners or corporate Canada. How are we going to ensure the safety of Canadians when it comes down to their personal information and ID, especially if we are seeing new malware out there that will harvest and hack passwords in a matter of seconds?

We have to be investing in R&D. The government has a responsibility and role to get it done, but we do not see that in Bill C-26.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, I agree that there needs to be better privacy protections to ensure our rights are not violated. I wonder if the member could share with us whether he agrees there needs to be greater parliamentary oversight built into the bill.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I agree. Right now, this will be studied only at the industry committee, but it involves a huge component of national security and national defence. I hope that as legislation comes forward, we will see other studies come into play that look at the impacts of it as it applies not just to industry but to our national security. One would hope that the public safety committee would also undertake a study. There might be a requirement to split this bill, and perhaps OGGO, the government operations committee, needs to look at this as well.

There are multiple departments within the Government of Canada, like Shared Services Canada, but how do we make sure that they are fully up to scale with all of the technologies that are currently available and that they are developing the new technologies needed to defend Canadians here at home? We know that the Government of Canada already collects a pile of personal information from Canadians and that they have been targeted by nefarious foreign actors, transnational criminal organizations and cybercriminals right here in Canada.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Madam Speaker, this is a very interesting debate and something we should be discussing thoroughly here in the House.

As my colleague has spent a lot of years as a defence critic and in the defence milieu, he is knowledgeable, so I want to ask him a bit about the People's Liberation Army's units 61486 and 61398. We know from public reports that these units have thousands and thousands of people working for them. The entire Canadian Armed Forces is somewhere around 60,000 to 70,000 people, so we would be outnumbered by their cyber-divisions alone.

Given the fact that AI is now in the public domain, does the bill go far enough in addressing the legitimate concerns that foreign actors create in everyday life here in Canada? What could be improved upon in the legislation?

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, my colleague is dead right that the People’s Liberation Army in Beijing has established a number of different cybersecurity units and that their whole goal is to cyber-attack. Canada is not an ally of China, so we have been attacked by the regime in Beijing. It will continue to attack us here and attack NORAD, as we just witnessed with the high-altitude balloons going around doing surveillance on military installations across North America.

We have to be ready, and the cybersecurity command we have here in Canada has been slow to get off the ground under the leadership of the Liberals. We need more resources. We need to use our reserves to find the right type of personnel out there, who are currently working in the private sector. Maybe we can also put them to work part time to defend Canada's interests so that both the corporate world and our national defence will be under better control and better command, with ultimately better protection for all Canadians.

[Denis Trudel, Bloc, Longueuil—Saint-Hubert, QC]

Madam Speaker, I had some interesting discussions with many people last week in the wake of the TikTok ban. Obviously, one of the reasons that the platform was banned was because the Chinese state could take advantage of the personal information that goes along with using that platform. Someone was telling me that Facebook and Instagram are already doing it, yet no one seems to be concerned.

Of course, the concern with TikTok is that it is the Chinese state that could use the information. However, Facebook's business model is to take our information and give it to private companies that then use it to sell products. I have a bit problem with that.

I think we have all had the experience of talking openly about a product with someone and seeing an ad for that product two minutes later on our phone. Obviously, there are all kinds of ways to avoid that, but I think a lot of people have no idea how to go about it. We could create legislation to try to tighten up the use of these platforms.

Does my colleague agree?

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, my colleague from the Bloc was spot on when he started talking about Canadians being very trusting. All consumers are very trusting when using social media like Facebook, TikTok and Instagram. When I was at the ethics committee, we looked at Clearview AI, which scraped images off of Facebook and Instagram to build up its databases to profile criminals. On top of that, we found out that it was racialized.

As Canadians and as consumers, we have to be very diligent with where we are sharing our information. I agree that we have to ask questions around social media platforms like Facebook, not just TikTok.

[Ted Falk, Conservative, Provencher, MB]

Madam Speaker, it is my pleasure to rise in the House today to share my thoughts and those of my constituents on Bill C-26. I am very pleased to have this opportunity.

Bill C-26 is a risky and tricky piece of legislation. On the one hand, we have serious and growing issues of cybersecurity, and on the other hand, we have the importance of personal privacy. We also have questions related to government accountability and oversight. I am sorry to say that the government has not done a stellar job on either one of those fronts to date. I am hopeful that members of this House can work together collaboratively to craft a piece of legislation around what has been proposed in Bill C-26 that balances both of those vital yet often competing priorities.

I grew up in the 1960s under the spectre of the Cold War. When I was a kid, the threat of foreign attack came from the air above us, from nuclear missiles from Russia or China. While our adversaries remain the same and current events have sadly brought the spectre of nuclear disaster to the forefront again, the method of attack to which we are most susceptible today is far more sophisticated and far more insidious.

Rather than bombs from the air above us, the weapons of our enemies are in the air all around us: Men and women are sitting at computers in dark rooms, in government agencies or at the local library sending out digital viruses. These cancers attack the Internet, telecommunication waves and the platforms we have become reliant on to what I would consider to be an unhealthy degree.

That is where I will pause for a moment, because I think the best thing we can do, the first step to securing our national security and the well-being of Canadians, is what nobody wants to do, which is to take a little step backwards to take a look at this. We need to divest ourselves of our all-consuming reliance on digital platforms, devices and infrastructure, and ensure that our most vital infrastructure always has a physical fail-safe to fall back on.

Let me give an example. Let us talk about digital currency for a second. Digital currency exists. Most Canadians have a credit card, a debit card and online banking. I do and I use them; it is convenient. However, that is not to say for a minute that I think progress demands that we do away with hard currency. It is exactly the opposite. Canadians have become more reliant on digital currency, forms of digital ID, smart phones, smart cars, smart homes, smart cities, smart bombs, smart banking and smart hospitals, and the really smart thing to do is ensure that we always maintain physical infrastructure and ensure we are in control and not crippled by the worst that could happen.

Nothing is impenetrable. No matter how good or amazing the technology that we create is, no device, no platform and no code has been created that cannot be hacked. Anything people make, people can break, and if they cannot, they will develop a machine that can break it.

I was reminded of a story last week of a military computer virus called Stuxnet. Stuxnet single-handedly destroyed one-fifth of Iran's nuclear centrifuges. Actually, that is not totally correct. The worm that Stuxnet was caused these sophisticated machines to self-destruct. It got into their systems, learned how they operated and then caused the powerful turbines to spin in reverse, shredding the machines. We have artificial intelligence so advanced that it can make decisions, and the people who created the technology do not even know how the decisions came about. It cannot even tell them. It is a little scary.

Digitized records are important. We have all come to rely on them, but I believe keeping a hard copy is also important. Ensuring that we maintain a hard physical currency is very important too, as is recognizing the value of currency produced by the Royal Canadian Mint. We need to ensure that our power grid still has a physical switch and that our hospitals and banking systems cannot be crippled by a bright kid with a laptop or a foreign actor with a more malicious intent.

The government has been very slow to address cyber-threats. Under its watch, the CRA was hacked. It said 5,000 accounts were affected, yet that number turned out to be 50,000. It did not address the issue. There were lots of excuses from the minister, but what really happened? One year later it happened again, and another 10,000 Canadians had their personal data accessed by hackers. Last year, the National Research Council was hacked.

I am sure that after this past week, the government is tired of talking about foreign interference in our elections, so I will not belabour that point, except to say that we did have foreign interference in our elections. The Prime Minister knew about it and he did nothing. Worse than that, he still refuses to tell Canadians the truth about what he knew and when he knew it. Like everything else, he refuses to take responsibility. I wonder sometimes just how much longer those on the government benches will allow him to do so. I would bet that right now the Reform Act is looking pretty attractive to them.

Last year, Rogers' network went down suddenly. Canadians could not access their banking. Businesses could not function. Emergency services were affected. Rogers and the government said it was a glitch, a hack. We will probably never know for sure, but the effect was the same: chaos. That is what our enemies want, and we do have enemies, both foreign and domestic, people who want to see anarchy and to cause chaos, fear and division. It sounds eerily familiar.

What legislative response have we seen from the government to date? I am seriously asking, because when I think back over the past seven years that the Liberals have been in power, I am not aware of any substantive action, either proactive or reactive, that they have taken to address our cybersecurity and the glaring vulnerabilities that exist with respect to it. To that end, I am glad that we are now finally having this important discussion. We need to beef up our security systems, beef up our cybersecurity system and keep Canadians safe.

As the government always says, Canadians have a right to be safe and to feel safe. The obvious irony is that it only says it when it is clear that Canadians are neither safe nor feeling safe. Canadians should be able to feel safe, should be safe and should have confidence in the cybersecurity system they rely on.

My time is almost gone, and that is a shame because there are so many things we need to talk about with respect to this bill, although I am confident that my colleagues will be able to further articulate some of the concerns. However, I do want to say one word about privacy.

Many Canadians are concerned about the ever-increasing size, scope and reach of government in this country. The Prime Minister has increased the size of government by some 30%, and this bill gives such sweeping powers to the government that it has prompted numerous civil liberties groups, including the Canadian Civil Liberties Association, the International Civil Liberties Monitoring Group and the Privacy and Access Council of Canada, in addition to several other groups and academics, to express their very serious concerns about this legislation. They call it “deeply problematic” because it “risks undermining [the] privacy rights [of Canadians], and the principles of accountable governance and judicial due process”. That is a lot to unpack in just one sentence.

Had this legislation come forward three years ago, I would have probably said that it was a no-brainer and that we should get it done as national security trumps personal privacy. However, after the violations of civil liberties, even basic liberties, that we have witnessed over the past three years from the government, I would not be so eager to say that we should just get it done. There is also the government overreach, the control and the abject absence of even a semblance of accountability.

As vital as our national security is, the government, the ministers and the Prime Minister simply cannot be trusted with more power, and that is what this bill does. It gives the government of the day more power through the Governor in Council and through its agencies to establish regulations and to further limit and restrict the freedoms and privacy of individual Canadians.

It is my hope that as members in this House, we can strike the right balance after hearing from all sides and craft a piece of legislation that accomplishes everything we want and need in it. However, as it stands, Bill C-26 gives way too much power to a government that has proven time and time again that it is unable and unworthy to wield it.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Madam Speaker, I am glad the member brought up the issue of foreign interference and the rhetoric the Conservatives have been spreading the last little while. I want to read a quote from Fred DeLorey, who was the Conservative Party's 2021 campaign manager. He said, “I can confirm, without a shadow of a doubt, that the outcome of the election, which resulted in the Liberals forming government, was not influenced by any external meddling.”

Can the member comment on that quote, given the context and the comments he made during his speech?

[Ted Falk, Conservative, Provencher, MB]

Madam Speaker, this is an important question. Some time ago, I did a term on the National Security and Intelligence Committee of Parliamentarians, and what I learned there was that we have phenomenal security agencies in this country. One of those is the CSE, the Communications Security Establishment, which monitors cybersecurity. It does phenomenal work.

I was coming back from a meeting one day, driving down the highway. It happened to be a Friday, and I noticed vehicles pulling campers and boats, with roof racks and bicycles attached to their bumpers. I thought, is it not wonderful that we live in a country where we have absolutely no idea about the existential cyber-threats that are out there? Why is that? It is because our security agencies are doing a phenomenal job at keeping us safe and providing this kind of environment.

The obligation of the government, when it gets advice from our security agencies, is to act on it.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, unfortunately, we have seen that, when it comes to everything that affects all citizens, the government is ignoring security issues and the threats that foreign interference can pose. We are seeing partisanship everywhere. We are talking here about cybersecurity. We want our electoral system to be airtight. We also do not want democracy to be affected.

Is this the right time for this bill? Is it designed well enough that we can do the same as our Five Eyes colleagues who took the bull by the horns far in advance?

[Ted Falk, Conservative, Provencher, MB]

Madam Speaker, this is a very relevant question. Is it the right time for a bill like this? I would like to give a very brief answer: Yes, it is absolutely the right time for this. Is it the right bill yet? No, it is a good starting point. That is how we can look at this bill. I am happy to vote in favour of this bill, to get it to committee. I am hopeful, from the comments I have heard from members of the Bloc and the NDP, that they are eager to give this bill a robust study and make the necessary amendments that will address the cybersecurity requirements in our country to keep critical infrastructure and our citizens safe, but also to respect the privacy of Canadians. Those are equally important elements. I am looking forward to the study on this bill.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, I would like to thank the member for his very informative intervention, where he very clearly stated his concerns with the broad powers the government seems to want to grant itself.

Can the member talk about what concerns regular Canadians might have, regular Canadians who have not done anything wrong, and how they may be impacted by the extreme ministerial powers that might emerge from this bill if it is not changed?

[Ted Falk, Conservative, Provencher, MB]

Madam Speaker, I am just going to read an excerpt from the bill, because it really encapsulates the answer to the member's question. It states the bill would authorize the Governor in Council, which is cabinet, “to designate any service or system as a vital service or vital system”. It would also authorize the Governor in Council “to establish classes of operators in respect of a vital service or vital system”. It also “provides for the exchange of information between relevant parties”.

We cannot currently do that. Our security and law enforcement agencies cannot transfer information without a judicial warrant. Why would we allow the government and cabinet to do that?

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, it is an honour, as it always is, to rise in the House of Commons of the Canadian people and speak to Bill C-26, an act respecting cybersecurity, which seeks to amend the Telecommunications Act and make subsequent amendments to others acts.

I want to say from the outset that cybersecurity is a critically important issue. For those of us who have been watching the news, we have even seen bookstores like Indigo impacted by ransomware, and we know that no Canadian, business or government agency is immune to cybersecurity threats. As Conservatives, we obviously support taking robust action on cybersecurity and we look forward to the bill going to committee, where we can hear from stakeholders who have expressed uncertainty about what the impact of the bill is going to be. Certainly, I hope we can work across lines to make a better piece of legislation and address the very real challenges we are facing in this cybersecurity age, in this cyber age that we are facing.

I am going to go into a bit of background on the bill, because my constituents might not have heard of this legislation. For their benefit, I am going to give a bit of summary of what I understand the changes to be.

The threat of malware in our telecommunications sector and critical infrastructure does pose a serious threat to Canada. It is important that we respond to these threats proactively, in light of the inevitable future attacks that will happen in our cyberspace. As I said, Conservatives will support legislation to defend our telecommunications sector and our other critical infrastructure from threats, the likes of which, as I stated earlier, have been levied against Canadian individuals, corporations and government agencies repeatedly.

In order to evaluate this legislation, I would like to take some time to consider how the proposed bill might impact our economy, our national security and our commitment to protecting the civil rights of Canadians. Although legislation relating to cybersecurity threats is now long overdue, we should remain vigilant to protect the rights of Canadians and our domestic corporate actors, who could be seriously impacted by the unintended consequences of this legislation. Notably, I am somewhat concerned by the sweeping discretionary powers that are granted to the minister and the Governor in Council in this legislation. I would also like to talk about some of the objectives of the bill and then describe how this current proposed legislation could fail in achieving its intended purpose.

The bill is presented in two parts. The first would amend the Telecommunications Act to promote the security of the Canadian telecommunications sector, and the second part of the act would enact the critical cyber systems protection act. The amendments to the Telecommunications Act are intended to protect against ongoing threats of malware, which poses a threat to the Canadian telecommunications system, and the critical cyber systems protection act aims to strengthen the cybersecurity systems that are so vital to our national security and public safety, and it would allow the government to respond to these cyber-threats.

The aim of this legislation would implicate operators in a broad variety of fields, including the finance, telecommunications, energy and transportation sectors, just to name a few, all critical parts of our infrastructure. With these aims in mind, it is important to consider how expansive the government powers being talked about here are, new powers to the government, how these new powers will affect all these sectors that affect our day-to-day lives, and whether these new measures are proportionate and necessary to be implemented.

To begin, the powers afforded to the minister present economic and financial risk for critical systems operators and telecommunication system providers. The first consideration is the minister's ability to direct telecommunication service providers to comply with an order to prohibit a provider from using or providing certain products or services to a specific individual or entity. Those are pretty broad powers. The bill would implicate the operations of private telecommunications organizations, and therefore the legislation requires safeguards to protect the economic viability of these companies. The bill would also allow the minister to compel telecommunications companies to obey government directives or face the consequences of significant monetary penalties.

In giving the minister such expansive powers, the government may have failed to consider the potential economic impact of these unchecked provisions on service provisions. Telecommunications revenues contribute over $50 billion to Canada's GDP, yet the government has not provided clear and adequate safeguards in this legislation to limit the extent to which or the frequency with which it might use these service provisions and how they might be restricted under the instance of even a minor cyber-threat.

Large, medium and small regional market players would be impacted by this legislation if appropriate safeguards are not adopted in the amendment stage. Large telecommunications service providers make up about 90% of the market share, and any directive to suspend a service by these large market players could impact a significant amount of the Canadian population. Although we hope that such orders will seldom be issued, the vagueness of the language in the bill does not guarantee this.

Meanwhile, we see small and medium-sized players who disproportionately service under-serviced areas in Canada; I am thinking of rural and remote communities. These small and medium-sized players often have trouble dealing with the regulatory complexity and the financial investments needed to meet regulatory thresholds, and we could see these small and medium-sized players just fold up or get bought out at a fraction of what their value would have been. We would really see this as a consequence for rural and remote communities, which are struggling, even today, to get access to basic services like high-speed Internet.

For these reasons, the overbroad provisions in the bill do not lend themselves to a standard of proportionality.

A stakeholder group, Citizen Lab, released a research report on Bill C-26 from the Munk School, authored by Dr. Christopher Parsons. The report outlines, in its recommendations, that the legislation should be amended to allow telecommunications service providers to obtain forbearance and/or compensation for orders that would have “a deleterious effect on a telecommunications provider’s economic viability”.

The Business Council of Canada is likewise concerned about the CCSPA requiring that all critical systems operators undertake the same precautionary actions to protect themselves from cyber-threats. The Business Council of Canada notes that the legislation would require a singular standard of all service providers “irrespective of their cyber security maturity”. We know that there are highly funded firms with a lot of resources that have highly superior cybersecurity systems, and then we have our more infant, junior tech companies that are trying to grow so that they can attract capital. These regulatory requirements of holding them to the same standard could have a negative effect on growing the tech ecosystem here in Canada.

Moreover, the Business Council of Canada notes that the legal threshold for issuing the directives is too low. The low threshold to issue these orders to an operator would allow the possibility of lost revenue for operators because of an absence of due diligence on the part of the government, a government that has had its own cybersecurity problems. I have serious reservations that a government that is unable to run its own IT systems will have a better capability of telling private companies how to run their IT systems.

The council further notes that the monetary penalties are unduly high and are not proportionate, given the benefits of compliance in the event of a perceived or actual cyber-threat. These companies in Canada want to live by the rules. They want to work with the Canadian government. Their reputations are at stake, yet the government is treating them like they are bad actors by putting these fines in place, when maybe we should be looking at working and engaging more with our telecom sector to have a more friendly relationship on this issue.

Another group, Norton Rose Fulbright, noted that there is still considerable uncertainty as to how detailed the cybersecurity plans must be and how it would alter industries' existing policies and agreements. Clearly, there is a lot of uncertainty about this, but it is too important to let it go aside, so I am looking forward to this coming to committee, where we can have some of these stakeholder witnesses come and talk about things so that we can clear up the uncertainty and we can have targeted cybersecurity measures that actually result in benefits to Canadians.

Other technical experts, academics and civil liberties groups have serious concerns about the size, scope and lack of oversight around the powers that the government would gain under this bill. Civil liberties groups are particularly concerned about the government's ability to direct telecommunications providers to do anything needed by secret order. While the legislation lists what might be included by the minister or Governor in Council, the ambiguity of the wording leaves open the possibility of compelling a telecommunications company to do more than is officially stated. This is particularly noteworthy because of the significant monetary penalties that can be levied against these companies, to the tune of up to $10 million a day.

Liberals, in many cases, have perhaps neglected to consider the privacy of Canadians through this legislation.

Bill C-26 would allow the government to bar any person or company from receiving specific services, which raises concerns about the discretion the government has in making these decisions. Again, it is very unclear. This is too important. We should bring the bill to committee and vote on it, but there are lot of things we need to get right in the legislation. We look forward to looking at that.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Mr. Speaker, my colleague had a very insightful speech and talked a bit about how there are some concerns related to the oversight that would be associated with the wide and sweeping powers the government may be granting itself in the bill. I am wondering if he could expand a bit more on why it is important that, through the processes of debate in this place and through committee work, we ensure that we have the appropriate balances in place to ensure we get that oversight side of things right.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Mr. Speaker, Parliament exists to defend the rights and liberties of the Canadian people. Oftentimes, I find this legislation is highly technical. The technical legislation is often where we see the biggest changes that would impact people's lives. When the government proposes to give sweeping powers to the minister to have control over sectors that impact every facet of Canadian lives, we need to do our due diligence as parliamentarians. We need to bring forward the stakeholders, the witnesses and the civil liberties advocates to ensure that the rights and liberties of Canadians are protected.

The House resumed consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[Kyle Seeback, Conservative, Dufferin—Caledon, ON]

Madam Speaker, it took eight long years for the Liberal government to recognize that cybersecurity threats exist in this country and around the world. Congratulations to them for coming to the party a little late.

The Liberals have now presented a bill to try to address issues of cybersecurity in the country. As I said, it took them eight years to get there, but I have to say I am pleased that the Liberals have decided to finally do something. I look forward to this bill being passed so that it can be extensively studied at committee.

There are some things in this bill that are good. I know praising the Liberal government is strange territory for me, but I will say that the bill would give the government some tools to respond quickly to cyber-threats. There is currently no explicit legislative authority in the Telecommunications Act to ensure that telecom providers are suitably prepared for cyber-attacks. This is a good reason why this bill should probably move forward to committee to be studied.

The challenge I have, though, includes a whole number of things. My issue with the government is trust. While I do want this legislation to go to committee, I have extraordinary concerns about this bill. Many of these concerns have been raised by many groups across the country, and I do want to speak to some of those in the probably somewhat whimsical hope that the government will listen and take some of these amendments seriously.

There has been a very bad track record of the government responding to concerns from the opposition or from outside organizations with respect to legislation. There is a view that the Liberals are going to do what they want to do on pieces of legislation and that they really do not care what other people have to say. I am very concerned that the government is not going to listen to the very serious concerns that have been raised about this bill.

I have my own concerns when I look at how the government has behaved with respect to other pieces of legislation. We have to look at Bill C-11. There has been a multitude of organizations that have said the bill needs further amendment. Margaret Atwood has said that she has grave concerns about the legislation, that she supports the intent but has grave concerns about the implementation and how it is going to affect artists and content creators. We have had folks who compete in the YouTube sphere who have raised all kinds of concerns about Bill C-11, and the government's response has been that it does not care what they have to say, and that it is going forward with the legislation as it is.

The Senate has made a number of amendments to Bill C-11. I suspect the government's attitude is going to be the same, which is that it does not care what the amendments are and that it is going to proceed with the bill as it sees fit.

We also have only to look to Bill C-21 as well. We had the minister clearly not aware of what constituted a hunting rifle and a hunting gun. The Liberals introduced amendments at committee, and it took extraordinary push-back from Canadians from coast to coast to coast to get them to wake up and withdraw those amendments that they had put in at the last minute.

What it speaks to is that, despite having at its disposal the entire apparatus of the Canadian government, the Liberals are still unable to get legislation right. It takes an enormous amount of effort and hue and cry across the country saying that this has to stop and that this has to be changed. If there is not a massive uprising, the government tends not to listen to the legitimate concerns of other constituents or other groups when it introduces legislation.

With that context, it is why I have real concerns that the government is not going to listen to some of the serious concerns that have been raised with respect to Bill C-26. I am going to go through some of those.

The Canadian Civil Liberties Association has some very serious concerns. It has issued a joint letter that says that the bill is deeply problematic and needs fixing, because it risks undermining our privacy rights and the principles of accountable governance and judicial due process. This is a big bell that is going off, and I hope the government is listening. As I have said, I do not have a lot of faith, given other pieces of legislation where thoughtful amendments have been put forward and the government decided not to do anything with them.

I want to enumerate a few of the concerns from the Canadian Civil Liberties Association. On increased surveillance, it says that the bill would allow the federal government “to secretly order telecom providers” to “do anything or refrain from doing anything necessary...to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption”.

That is a pretty broad power. Where is the government putting the guardrails in that would limit the effects of this or protect the privacy rights of Canadians? That is something I think is incredibly concerning.

On the termination of essential services, Bill C-26 would allow the government to bar a person or a company from being able to receive specific services and bar any company from offering these services to others by secret government order.

Where are we going to have the checks and safety checks on this? Unfortunately, I am not in a position where I think I can trust the government to do the right thing on these things. We have seen it through vaccine mandates, in the legislation on Bill C-21 and in how the Liberals are trying to push through Bill C-11 without listening to reasoned amendments. If reasonable concerns are raised about Bill C-26, I just do not have faith the Liberals are going to take those concerns seriously and make the amendments that are necessary. I really hope they do.

On undermining privacy, the bill would provide for the collection of data from designated operators, which would potentially allow the government to obtain identifiable and de-identified personal information and subsequently distribute it to domestic, and perhaps foreign, organizations. When someone takes the de-identified personal information of Canadians and does not say how they are going to deal with it or what protections they have in place to make sure it is not misused, what happens in the event that they take that information and somehow there is a government breach? Where does that information go? These are things I think we should be extraordinarily concerned about.

There was also an analysis provided with respect to this by Christopher Parsons, in a report subtitled “A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act”. Parsons raises concerns about vague language. The report notes that key terms in the bill, such as “interference”, “manipulation” and “disruption”, which trigger the government's ability to make orders binding on telecom service providers, are unidentified.

Where are the guardrails in the legislation to prevent government overreach and therefore protect Canadians? This is something that I think all Canadians should be watching and be very concerned about. They should be letting their voices be heard by the government on this.

The report talks about how the minister of industry's scope of power to make orders is also undefined. We would be giving a whole host of undefined powers to the minister and the government that would allow them to have all kinds of sensitive information. These are things that may be necessary, but I do not know. They are highly concerning to me. They should be highly concerning to Canadians, and I hope the government will hear from real experts at committee.

Let us not have a two-day committee study where we think Bill C-26 is perfect as it is and bring it back to the House of Commons, bring in time allocation or closure and pass it through. We have seen that story before, and we do not want to see it with the piece of legislation before us. My really big hope is that the government is going to take the time to really consider the seriousness and breadth of Bill C-26 and make sure we have the ways to protect Canadians.

I just want to add that the Business Council of Canada has released its own letter to the Minister of Public Safety, expressing its incredibly deep concerns with respect to the bill: there is a lack of a risk-based approach, information sharing is one-way and the legal threshold for issuing directions is too low.

There are three reports, right there, that are outlining significant concerns with Bill C-26, and I, for one, just do not believe the government is going to listen or get it right. It does not have the track record of doing so, but I am hoping it will, because cybersecurity is incredibly serious as we move toward a digital economy in so many ways. I really hope the government is going to listen to these things, take them seriously, do the hard work at committee and bring forward whatever amendments need to be brought forward, or, if the amendments are brought forward by the opposition, listen to and implement those amendments.

[Bonita Zarrillo, NDP, Port Moody—Coquitlam, BC]

Madam Speaker, the NDP sees the growing threat of cybersecurity, and we also see that Canada is far behind. However, we have concerns about transparency, and I know that the NDP member for Cowichan—Malahat—Langford has been instrumental in strengthening and making bills that the Liberals have brought to the floor more appropriate, so I have more than enough confidence that the NDP will ensure Canadians get the transparency and protection they believe in.

My question for the member is whether he could speak to the point that the government legislation before us would allow for a complete exemption from the Statutory Instruments Act. That would mean such orders could not be reviewed by Parliament through the scrutiny of the regulations committee. I wonder if I could get some comments on that.

[Kyle Seeback, Conservative, Dufferin—Caledon, ON]

Madam Speaker, I would just add that to the list of things I am concerned about with this particular piece of legislation. I am glad and encouraged that the member has stated that New Democrats are going to try to strengthen this piece of legislation. I hope they do that. They talk about wanting transparency and I hope they are going to work really hard for transparency on this.

Conservatives would love to see transparency at a different committee, where we are trying to get someone to come and testify. Maybe the New Democrats can bring their love for transparency to that other committee and we can have PMO officials testify there.

[Randy Hoback, Conservative, Prince Albert, SK]

Madam Speaker, one of the things I have heard in talking to universities and different groups is that one of the faults of this piece of legislation is that they have to share this information with the government when they have been attacked, but it is a one-way street. When they see an attack happen, they share it with the government, but there is no information given to other businesses to help them protect against attacks similar to that in nature.

Could the member talk about why it is important and what it means to companies when they are attacked and how it can hurt not only their bottom line? Indigo, for instance, would be a good example of what happens when there is a cybersecurity attack.

[Kyle Seeback, Conservative, Dufferin—Caledon, ON]

Madam Speaker, everyone here knows how serious cyber-attacks are. I often get a notification from Google that says it believes one of my passwords was exposed in a hack of some other organization and that I should take steps to make sure the password is not used in any other applications. We know that the threat of cyber-attacks exists and we know the damage caused.

What I go back to is that we know we need to do something, and I am glad that the government is doing it. It has taken it eight years, but it is finally here trying to deal with this issue. What it has to do is make sure that every voice on this is heard, whether it is industry saying it needs some information back, or whether it is others saying the threshold for some of these things is too low or asking what guardrails are put in place on some of the things.

The government has a lot of work to do and I hope it is willing to do it at committee.

[Don Davies, NDP, Vancouver Kingsway, BC]

Madam Speaker, I think everybody in the House agrees that we need to up our game in this country to protect Canadians and our society from cyber-attacks.

My specific question has to do with certain specific vulnerable groups. I am thinking of young people, particularly teenagers between the ages, say, of 13 and 19. Even more particularly I am thinking of young girls and women who may be subject to all sorts of cyber-bullying and other offences, as well as seniors who can be victims of cyber-fraud.

I am wondering if my hon. colleague has any thoughts as to how Bill C-26 might impact those particularly vulnerable groups and what suggestions he may have legislatively to help protect them.

[Kyle Seeback, Conservative, Dufferin—Caledon, ON]

Madam Speaker, that is a pretty tough question to answer in about two minutes.

As the father of a 16-year-old daughter, I am constantly worried about what is going on in the cybersphere for her, whether or not there is an instance of bullying going on. There have certainly been episodes of bullying in her real life. I know that at one point she was eating her lunch in the bathroom because she was being bullied by some folks. Online harassment and bullying are serious problems. I do not know enough about this particular piece of legislation to know if it would actually deal with that, but if not, I really hope that it would.

We have a lot of work do for seniors who are vulnerable to these things. This is something the government has to take on. Whether or not it is just waking up to it now as part of this bill, we need to educate seniors. I host events like this with seniors, where we let them know about the threats of cybersecurity and other things. The government needs to pick up the ball on that a little more as well.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Madam Speaker, I am proud to rise in the House today to speak to this important legislation on behalf of the good people of Barrie—Springwater—Oro-Medonte. I am pleased to see Bill C-26 come forward in the House. Improving the resiliency of our critical infrastructure is of the utmost importance to our national security and the everyday safety of Canadians.

This legislation consists of two separate parts. The first portion, among other things, would give the Governor in Council powers to order telecommunications providers to secure their systems against threats and to remove malicious actors from our telecommunications infrastructure. The second portion would create the critical cyber systems protection act, which would establish a cybersecurity compliance framework for federally regulated critical infrastructure operators. This would specifically regulate the sectors of finance, telecommunications, energy and transportation.

I believe that in principle, this legislation appears promising. I think we can all agree that we need a robust cybersecurity framework in Canada. However, it is worth noting that under the current government, we have done the least to bolster our resilience to cyber-attacks compared to all other Five Eyes partners. We lag behind our western allies in national security, and as such, Canada has failed to secure our critical infrastructure against complex and ever-evolving cyber-threats in the modern world. Therefore, before I get into the specific merits and deficiencies of this legislation, I want to speak about the emerging threats to our critical infrastructure and the pressing need to protect our national security.

Threats to our critical infrastructure are real and imminent. In fact, Caroline Xavier, chief of the Communications Security Establishment, or CSE, recently testified before the public safety and national security committee and stated, “cybercrime is the most prevalent and most pervasive threat to Canadians and Canadian businesses.” She also noted, “Critical infrastructure operators and large enterprises are some of the most lucrative targets.”

While there are several forms of cyber-attacks that our critical infrastructure operators are vulnerable to, the Canadian Centre for Cyber Security has noted in its most recent annual national cyber-threat assessment that ransomware is the most disruptive form of cybercrime facing Canadians and that critical infrastructure operators are more likely to pay ransoms to cybercriminals to avoid disruption. For example, in 2018, cybercriminals deployed a malicious software and successfully held the city hall of a municipal government in Ontario hostage, which resulted in that government paying $35,000 to the hackers to avoid disruption. However, this is not always an effective strategy. A survey of Canadian businesses found that only 42% of organizations that paid ransoms to cybercriminals had their data completely restored.

In 2021, the CSE stated that it was informed of 304 ransomware incidents against Canadian victims, with over half of them in critical infrastructure. However, it acknowledged that cyber-incidents are significantly under-reported, and the true number of victims is much higher.

The enormous economic toll that these cyber-breaches have on Canadian companies is worth noting. According to IBM, in 2022, the average cost of a data breach, which includes but is not limited to ransomware, to Canadian firms was $7 million. There is currently no framework to ensure that companies report when they are victims of these attacks. I will acknowledge that the legislation before us takes steps to address this pervasive issue that Canadians are facing; however, it is certainly an overdue effort.

We saw the damage a cyber-attack of this magnitude can cause in May 2021, when a U.S. energy company was subject to a ransomware attack carried out by a Russian-based criminal group that successfully extorted roughly $4.3 million in coin-based currency. As members may remember, this attack disrupted the largest fuel line in the U.S. for five days and led to President Biden calling a national state of emergency. In 2021, at the U.S. Senate committee on homeland security, the CEO of that company testified that he had no emergency preparedness plan in place that specifically mentioned “ransom or action to ransom”. This incident underscores the fact that we as a country must enhance preparedness and improve the resiliency of our critical infrastructure in order to avoid similar incidents.

Therefore, I am pleased to see this proposed legislation come forward. However, it is worth noting that this is the first substantive legislative response to this issue during the government’s tenure, despite a steady increase in cyber-threats over the years.

The entirety of our federally regulated critical infrastructure is connected to the Internet in some way, and it is extremely important to prevent malicious actors from setting up on our infrastructure and attacking it. Previously, there has been no mechanism for the government to formally remove a company from our telecommunications networks.

The clearest example of the need for this mechanism would be the controversy surrounding Huawei, a company that was part of the design of our 5G networks despite glaring national security concerns related to its activities and relationship to the Communist Party in Beijing. It is a significant move that this company will be kicked off our servers, but it is a delayed one. We know that under China's national intelligence law, the CCP has the authority to instruct any company to hand over information to support, assist and co-operate with state intelligence work. Accordingly, we ought to be cautious and avoid contracting with companies that could potentially compromise the security of our critical infrastructure.

It is certainly positive that Canada will be able to kick malicious actors such as Huawei off our networks. However, many have noted that we lessened our credibility among the Five Eyes nations due to our delayed response to this issue. Indeed, the United States lobbied Canada for years to exclude Huawei from our 5G mobile networks and warned that it would reconsider intelligence sharing with any countries that use Huawei equipment.

In some respects, this legislation is a positive step toward establishing a baseline standard of care for organizations whose functions are integral to our critical infrastructure. As I have previously mentioned, incidents of cyber-attacks often go unreported or under-reported. This legislation's mandatory reporting mechanism, which specifies that a designated operator must immediately report an incident to the CSE and the appropriate regulator, is a welcome step toward addressing this issue. However, the act does not prescribe any timeline or give any other information as to how “immediately” should be interpreted by an operator.

As I have just laid out, there are aspects of this legislation that my Conservative colleagues and I fully support. However, I have concerns with several elements of the bill.

First and foremost, there is a complete lack of oversight over the sweeping new powers afforded to the cabinet ministers, regulators and government agencies mentioned in this legislation. Alongside a lack of oversight, there is little information on the breadth of what the government might order a telecommunications operator to do.

It is evident that this bill draws on much of Australia's legislative model, which was first introduced in 2018 and eventually amended. However, we did not follow suit in terms of the oversight measures Australia included in its critical infrastructure protection act. Notably, Australia introduced political accountability mechanisms alongside its legislation, including a requirement for regular reporting, an independent review and the production of a written report. The Conservatives would like to see annual reporting from the minister on what actions have been taken and a public disclosure of the orders that the government is making under these newly afforded powers.

In terms of concerns from the public, we have heard from a number of organizations that are concerned that elements of this legislation undermine the privacy rights of Canadians. In September of last year, several privacy rights organizations signed an open letter to the Minister of Public Safety, which laid out their concerns with Bill C-26. For example, they were concerned about the sweeping new powers this legislation would give to the government over access to the personal data of Canadians and the data of companies. They noted that Bill C-26 “may enable the government to obtain identifiable and de-identified personal information and subsequently distribute it to domestic, and perhaps foreign, organizations.”

I think we can all agree that while enacting measures to improve the resilience of our critical infrastructure is of the utmost importance, civil liberties and privacy must be fully respected when drafting those measures. On the other hand, we have heard from stakeholders who are concerned about the regulatory burden this legislation may have on businesses, especially small and medium enterprises.

Many stakeholders have noted that the high costs and business impacts of a cyber-incident already incentivize companies to ensure rigorous cybersecurity protocols. Recent statistics released by Statistics Canada found that in 2021, Canadian businesses spent over $10 billion on cybersecurity, a 41% increase compared to 2019. Many stakeholders have noted that the proposed penalties related to this act, which reach up to $15 million and five years of jail time, are touted as being intended to promote compliance rather than to punish. However, I think we can all agree that a $15-million fine would indeed be unduly punitive on a small business that may be subject to this act. Therefore, we must ensure that fines and compliance costs are distributed evenly so as not to stifle competition and endanger the viability of small and medium enterprises in our critical infrastructure sectors.

Finally, we face a problem related to definitions and the scope of this bill. Various terms are not defined, including what constitutes a cyber-incident, and it is not immediately clear how the government will determine who is subject to this legislation. I look forward to receiving an explanation from the government to demystify some of the vague language found within it.

To conclude, a threat to our critical infrastructure is a threat to our national security. I think all parties agree that the government must take strong and immediate action against cyber-attacks. We support this bill in principle, but we believe that it needs to be amended significantly to ensure greater transparency and accountability from the government and future governments. I look forward to studying and amending this bill at the public safety committee with my colleagues across all parties.

[Don Davies, NDP, Vancouver Kingsway, BC]

Madam Speaker, like my colleague, I think we are broadly supportive of the aims and principles of this bill but have some significant concerns about many of the details. This includes that the bill would open the door to new surveillance obligations; would allow the termination of essential services, perhaps without due process; may undermine privacy; lacks guardrails to constrain abuse; and has some relatively disturbing secrecy provisions that would obviate the minister from having to be accountable to Parliament by publishing the measures he takes.

Among the many concerns expressed about the bill, which ones does the member find the most troubling that he would like addressed at the committee stage?

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Madam Speaker, all of those are legitimate concerns that we will be addressing at the public safety committee if and when this bill gets there. I do not know if I can rank them today, because I think they are all significant. Everybody has different issues that come to mind based on what is most important to them. Obviously, privacy is one of the most important things to people.

What I mentioned in my speech was the ability for companies to still manage themselves once these fines have been imposed. We do not want to put out of business the small and medium-sized companies that have already had cyber-attacks, and then give a fine on top of that.

There are many things we need to address in committee. I am looking forward to studying the bill with my colleagues from all sides when it gets there.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, there has been a lot of talk about TikTok and the fact that it could be used as a tool for interference. In fact, I closed my account at that time and, like everyone else, removed the app from my device.

What does my colleague think about apps like WeChat, which are known to be spying platforms? What does he think about the fact that a G7 parliament, like Canada's, has been using Zoom for years, a Chinese app that once interrupted a live meeting of Chinese dissidents? It is disturbing, to say the least.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Madam Speaker, to be quite candid, I have two teenage boys who are always kidding that I am a bit of a dinosaur when it comes to different social media platforms. I have never had TikTok. I do not know much about it, but I understand there have been a lot of issues with it. I think with all of our social media platforms, we need to stop, review them and look at who is taking information from them, because a lot of information can be gleaned from them.

We jumped into this new media method many years ago without knowing the direction and road it was going to take. Now that we are well down it, I think it is time we looked at all these different platforms and realized what information is being taken from them.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Madam Speaker, it is with great pleasure that I rise to discuss Bill C-26, an act respecting cybersecurity. I will be addressing elements of the legislation that deal with securing Canada's telecommunications system.

As Canadians rely more and more on digital communication, it is critical that our telecommunications system is secure. Let me assure the House that the Government of Canada takes the security of that system seriously. That is why we conducted a review of 5G technology and the associated security and economic considerations. It is clear that 5G technology holds lots of promise for Canadians: advanced telemedicine, connected and autonomous vehicles, smart cities, clean energy, precision agriculture, smart mining, and lots more.

However, our security review also made it clear that 5G technology will introduce new security concerns that malicious actors could exploit. Hostile actors have long sought and will continue to seek to exploit vulnerabilities in our telecommunications system. The Canadian Security Intelligence Service recognized this in its most recent public annual report. The report said, “Canada remains a target for malicious cyber-enabled espionage, sabotage, foreign influence, and terrorism related activities, which pose significant threats to Canada’s national security, its interests and its economic stability.”

The report said that cyber-actors conduct malicious activities to advance their political, economic, military, security and ideological interests. These actors seek to compromise government and private sector computer systems by manipulating their users or exploiting security vulnerabilities. The CSIS report also highlighted the increasing cyber-threat that ransomware poses.

The Communications Security Establishment has similarly raised concerns about threats like ransomware in recent public threat assessments. We have seen how such attacks by criminal actors threaten to publish victims' data or block access to it unless a ransom is paid. It is not just cybercriminals doing this. CSIS has warned that state actors are increasingly using these tactics, often through proxies, to advance their objectives and evade attribution.

To be sure, Canadians, industry and government have worked hard to this point to defend our telecom system, but we must always be alert and always be guarding against the next attacks. This has become more important as people are now often working remotely from home office environments, and the challenges are accentuated by the 5G technology. In 5G systems, sensitive functions will become increasingly decentralized to be able to be faster where speed is needed. We all recognize cell towers in our communities and along our highways, and 5G networks will add a multitude of smaller access points in order to increase speeds. The devices the 5G network will connect to will also grow exponentially. Given the greater interconnectedness and interdependence of 5G networks, a breach in this environment could have a more significant impact on the safety of Canadians than with the older technology. Bad actors could have more of an impact on our critical infrastructure than before.

The security review we conducted found that, for Canada to reap the benefits of 5G, the government needs to be properly equipped to promote the security of the telecommunications system. We need to be able to adapt to the changing technology and the threat environment.

Now, for these reasons, we are proposing amendments to the Telecommunications Act. The amendments would ensure that the security of our telecommunications system remains an overriding objective. This bill would add to the list of objectives set out in section 7 of the Telecommunications Act. It would add the words “to promote the security of the Canadian telecommunications system.” It is important to have these words specified in law. It would mean that the government would be able to exercise its power under the legislation for the purposes of securing Canada's telecommunications system.

The amendments also include authorities to prohibit Canadian telecommunication service providers from providing and using products and services from high-risk suppliers in 5G and 4G networks if deemed necessary after consultation with the telecommunications providers and other stakeholders. They would also give the government the authority to require telecommunications service providers to take any other actions to promote the security of the telecom networks, upon which all critical infrastructures depend.

We have listened to our security experts, Canadians and our allies, and we are following the right path. We will ensure that our networks and our economy are kept secure. A safe and secure cyberspace is important for Canadian competitiveness, economic stability and long-term prosperity.

It is clear that the telecommunications infrastructure has become increasingly essential, and it must be secure and resilient. Telecommunications present an economic opportunity, one that grows our economy and creates jobs.

The amendments to the Telecommunications Act accompany the proposed critical cyber systems protection act. This bill will improve designated organizations' ability to prepare, prevent, respond to and recover from all types of cyber incidents, including ransomware. It will designate telecommunications as a vital service.

Together, this legislative package will strengthen our ability to defend telecommunications and other critical sectors, such as finance, energy and transportation, that Canadians rely on every single day.

The legislation before us today fits with the Government of Canada's telecommunications reliability agenda. Under this agenda, we intend to promote robust networks and systems, strengthen accountability and coordinated planning and preparedness.

Canadians depend on telecommunications services in all aspects of their lives, and the security and reliability of the network has never been more crucial. They are fundamental to the safety, prosperity and well-being of Canadians.

We will work tirelessly to keep Canadians safe and able to communicate securely. This legislation is an important tool to enable us to do that.

[Andréanne Larouche, Bloc, Shefford, QC]

Madam Speaker, I thank my colleague for his speech. In January, I requested a meeting with the Université de Sherbrooke, which has a research chair in cybercrime. I learned a lot about how behind the times Canada is.

This bill is good, but it comes at a time when we are at greater risk than ever before. The federal government does not seem to be taking cybercrime seriously, yet many European countries have other models and have made headway against cybercrime. How can we address the fact that we need to catch up?

We have to act faster to protect ourselves from cyber-attacks. There is also the whole issue of Hydro-Québec and the fact that those are interprovincial lines. How are the authorities going to be able to manage all that given the agreements and the importance of respecting Quebec's and the provinces' jurisdiction over certain types of critical infrastructure?

It is high time this critical infrastructure was included in a bill to protect it. I would like to hear my colleague's thoughts on that.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Madam Speaker, I share the member's sense of urgency in making sure that we advance opportunities to make the networks safer. The technology has developed very quickly in recent years, so it is important that we stay ahead of that technology.

On the relationship between the provinces and the federal government, I think it is important that we develop reliable agreements where appropriate, but telecommunications is the responsibility of the federal government, and we are not going to shirk from our responsibilities in making sure that the network is safe for our citizens.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, I too reiterate the thoughts of my Bloc colleague that we are quite behind in this with respect to what other countries are doing.

However, my concern has to do with the broad scope of powers being granted to the minister in this bill. It was specifically written so that some of these orders were not published in the Gazette, so I would really love to hear from the hon. member why the bill was crafted specifically to keep that public piece of information out.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Madam Speaker, we all realize how important security is. In some cases, it may be necessary to act without making the information available so that the perpetrators of fraud against the cyber-network understand what is being accomplished. There are situations where information needs to be maintained securely. A responsible government will do so on the basis of being accountable and transparent to the extent that is appropriate, and I believe the government will do that.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I will build on that last question a bit because I think the member took it out context, though I may be wrong.

The question is around specific cyber-incidents or transgressions that need to be dealt with by the appropriate authorities. The issue is the legislation itself and how the power would be used by our security establishments. One of the criticisms that needs to be fleshed out at committee is how this bill and the legislation get reported back here to the House of Commons and to Canadians.

Would the member agree that it would be an important addition or amendment to the legislation to include the requirement for an annual report back to Parliament on how this legislation is progressing and what key changes our national security organizations have made so that Canadians can understand how their lives are being impacted in the cyber-realm?

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Madam Speaker, I believe that transparency, to the extent that is possible without jeopardizing security, is important. Committees will contribute a significant amount of improvements, and the government will listen to reasonable solutions, amendments and additions to protect the safety of Canadians. That is a value that we all share.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, I want to continue the line of questioning of other members on balancing the need to address cybersecurity and privacy at the same time.

One group that has shared some concerns is the Citizen Lab. It has put together a report called “Cybersecurity Will Not Thrive in Darkness” and has offered 30 recommendations for the governing party to consider at committee.

I wonder if the member has seen this report and if there are any recommendations in the report that he sees worthy of going ahead with. He may not see them all as worthy of going ahead with, but are there some recommendations that he thinks we should pursue?

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Madam Speaker, no, I have not seen those recommendations, but it would be appropriate for those recommendations to be presented to the committee for consideration.

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, six years ago Statistics Canada found that more than one-fifth of all Canadian businesses were impacted by cybersecurity incidents, a sobering statistic in its own right. That was six years ago.

What we need to understand is that cyber-technology moves at a mile a minute. What is groundbreaking one year can become ordinary or obsolete even just a year later. I do not doubt that cyber-defence systems in Canada, both by the government and by private businesses, have become much more sophisticated throughout the last several years, but the technology used for cyber-attacks, whether by foreign or by domestic actors, has developed even more quickly.

We are seeing this play out in real time. Just a month ago, Indigo fell victim to a ransomware attack. Online purchases became impossible. In-store purchases could still happen, but only if one was carrying cash. Most alarming of all, information about the chain's employees was accessed. The situation continues to drag on, Canada's largest bookstore chain held for ransom. The emergency that Indigo finds itself in is terrible, but back in January the Russia-tied group that carried out this attack, LockBit, did something far more cruel when it hacked the SickKids Hospital in Toronto.

Those are just two examples of how cyberwarfare transpires in Canada, amongst thousands of other examples every single year. Today, particularly at a time when we know foreign powers are actively seeking to undermine Canada, its institutions and its critical infrastructure, it is time for the government to step in and put forward a cybersecurity strategy. It almost goes without saying that in this digital age, online systems run just about everything that keeps this nation up and running, including hospitals, banking and the energy that heats our homes.

What the government has failed to realize until now is that as these systems become more digitized, so too do they become more vulnerable. This was on full display when SickKids was hacked. Lab results, imaging results and the hospital's phone lines were wiped out for days before order was finally restored. Just in 2020, CRA was hacked, compromising the accounts of 13,000 Canadians. Bold action is what is needed to fight against attacks of that scale, and it is Parliament's job to provide that action.

When I look at a bill like Bill C-26, I start by thinking about what it would let the government do and whether that would be an improvement on our existing cybersecurity regime. In that regard, there is actually a lot to like here. Now more than ever, cyber-attacks can take place in little more than the blink of an eye. An attacker could dig its claws into a company's online system, inflict all the damage it wants, take all the information it wants, and it might be hours later than the affected company realizes what it is being done to it.

Having a rapid response to those incidents is absolutely critical. It is clear to me that the type of broad, sweeping powers contained in this bill would allow the government to provide that rapid response. It would also bring some much-needed cohesion to the link between the state and telecom providers. Right now, telecoms can decide to work with the government and prepare for a cyber-attack, but this is entirely voluntary. They can share information with the government, but only if they really feel like it.

As far as having a unified cybersecurity strategy goes, ours is laughable. It is about time that we act accordingly and fall in line with our Five Eyes allies. This bill covers such an important policy area, yet in so many ways it just does not get it right. It is another page in that long Liberal book entitled, “Having the right intention and making the wrong move”. I should not have to say this in a room full of parliamentarians, but here we are: the written text of a law actually matters.

A law needs to be clear. It needs direction. It needs guardrails. That is why it is so strange to come across a bill that lets a minister go up to a telecom provider and make them “do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.” All the power goes to the minister with nothing in the way of guardrails constraining their power.

When I read this part of the bill, I was reminded of one of my favourite Abraham Lincoln quotes. Abraham Lincoln said, “Nearly all men can stand adversity, but if you want to test a man’s character, give him power.” That is what this section does, it provides immense power to the Minister of Industry, which is not abridged or protected in any way.

There is nothing wrong with a law that gives the government new powers, but in this case, with the cyber-threats that we are currently facing, that type of law is exactly what we need to get right now.

The problem here is that we are debating a bill today where those new powers are not specified and are not restricted whatsoever. Alongside the Canadian Civil Liberties Association, I am seriously concerned about the way that Bill C-26 would infringe on the privacy rights of Canadians.

This bill would allow the government to collect data from telecoms. With guardrails in place, this would actually make a lot of sense. The government might want to see the weak spots in a company's cybersecurity system, for example. With the government being able to get these companies to do anything, we do not have a clue what it will demand to collect.

As it stands now, there is no way of stopping them from collecting personal data and juggling it between various departments. Foreign affairs, defence, CSIS, anyone could take a look if the state decides that it is relevant.

At the minister's discretion, the data could even go to foreign governments. Again, this all comes back to the problem of unchecked power. With zero restraints in place, we can only assume the worst. Like so many bills under the Liberal government, what we are seeing here is a government-knows-best approach.

I am really not sure how it can defend this level of information sharing. “Well, yes, we could share one's personal information, but we definitely will not do that.”

It wants Canadians to give it the benefit of the doubt. The government is well past the point of being given the benefit of the doubt.

The Canadian Civil Liberties Association says that the bill is “deeply problematic and needs fixing”, because “it risks undermining our privacy rights, and the principles of accountable governance and judicial due process”.

A number of organizations and individuals have raised red flags. The Business Council of Canada wrote to the Minister of Public Safety, expressing the business community's concerns about Bill C-26, including the potential of brain drain, as the result of personal liability and unduly high monetary and criminal penalties.

The council also expressed concerns that information sharing is one-way. Operators are required to provide information to government but receive nothing back from government.

The bill misses the opportunity to implement an information-sharing regime that could benefit all operators subject to the law.

Aaron Shull, managing director of the Centre for International Governance Innovation said that Ottawa should deploy a wide range of strategies, including tax breaks to individual small businesses, to take cybersecurity more seriously.

The Munk School issued a report on Bill C-26 where they itemized a series of deficiencies including that “the breadth of what the government might order a telecommunications provider to do is not sufficiently bounded.”

There are massive, glaring issues in Bill C-26.

What is so unfortunate about this is that I think that enhancing Canada's cybersecurity is something that all parties can get behind. I am willing to see this bill move forward but it is going to need some major amendments in committee, amendments that protect civil liberties and constrain abuse.

There needs to be a threshold test, providing that an order being given by the government is proportionate, reasonable and, above all else, necessary. The minister should have to table reports, annually perhaps. How many orders did they issue in a given year? What kinds of orders, broadly speaking?

If the government mishandles someone's personal information, which it likely will, this bill needs to make it clear that those people will be compensated.

We find ourselves debating another highly important, poorly crafted bill, courtesy of the Liberal government.

I want to see this bill go to committee so that experts, especially those with a focus on civil liberties, can help make this bill work.

To be clear, if the issues in this bill concerning privacy and impacts to businesses are not addressed, the Conservative Party is ready to pull its support immediately and put up a very strong defence to stop this bill from going beyond committee.

After all, if the Liberals cannot manage Canada's cybersecurity, they can just get out of the way and let Conservatives handle it.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I understand that the Conservative Party is going to actually be voting in favour of the legislation. I am glad to hear that because we recognize that it does not matter which political party one is of, the issue of cybersecurity is something that we all need to take seriously.

Listening to the debate today, Conservatives come up and say, yes, they support the bill and it is a bill that they want to see go to committee.

Given the member's comments, does the Conservative Party actually have any amendments that it is prepared to share, through the House of Commons, with Canadians? What tangible amendments would they like to see made to the legislation that he could share with us prior to it going to committee?

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, I want to thank my colleague from Winnipeg North. It is always nice to get a question from a fellow Winnipegger. I love the Prairie pragmatism of his question on what amendments might we put forward.

The purpose of my speech and the speeches we have heard from our side of the House today is to point out the flaws in the bill. We will support the bill to get to committee stage and it is at committee stage where we can have a fulsome discussion with the experts about these flaws and come up with serious, practical amendments that make this bill even stronger. I think my colleague from Winnipeg North would agree it is in everybody's interest to make this bill as strong as possible.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, I thank my colleague for his riveting speech.

I would like to ask him what he thinks about the government's strategy on Huawei and 5G. It seems to me that there were a lot of about-faces, that it took a long time and that there was a lot of dilly-dallying.

I would like to hear my colleague's thoughts on that.

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, I do not have a lot of comfort that the government will get it right given how many years it dragged its feet on Huawei. I think we have every reason to be concerned that this bill might come out of committee without the necessary amendments.

One of the things I am particularly concerned about is the sentence I referred to from the bill that a minister can do or refrain from doing anything necessary to secure the Canadian telecommunication system. That statement needs to be measured against section 7 and 8 of the charter, which is the right to life, liberty and security of person and to be secure against unreasonable search and seizure.

We need to make sure that this bill can stand the scrutiny of the courts in case any business or individual affected by it decides to bring a charter challenge. I think there are serious concerns around the idea of giving a minister unfettered power, as one of my political heroes, Abraham Lincoln said, who I mentioned earlier in my speech.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, just before the hon. member's speech, we heard from a Liberal member. One of the things the member spoke about in his speech was specifically that the government knows best and to just trust the government on this and we will be fine. That came out of one of the answers to a question I asked.

Can he expand on that in terms of the concern we have with the answers we are hearing today, and in terms of the transparency and accountability required in this bill?

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, there is every reason to think that the government will mess this up. For example, this morning, there was a story about the CBC taking the personal, private information of its employees and posting it online against their will and without their consent.

My colleagues across the way might say the CBC is an independent body, but the reality is the CBC is mandated as a Crown corporation under federal legislation and has to report to the Minister of Canadian Heritage on an annual basis. The government has some culpability in this. If we see the CBC messing this up, how can we trust the government to get it right?

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Madam Speaker, it is a pleasure to rise on behalf of the good people of Central Okanagan—Similkameen—Nicola.

I welcome this debate because essentially what the government has put forward in the bill is two words: “Trust us”. We should trust the government and give it all these powers for the Telecommunications Act, expanding it drastically. We should trust the government when it comes to designating cybersecurity systems as being of such importance that a whole host of new rules should be put upon them. That is what the government is asking us to do.

This is the same government that took years to answer the question of whether we will allow Huawei in our 5G infrastructure. It is a question that has infuriated our allies because they expect Canada to be a trustworthy party in the Five Eyes' intelligence and sharing. It has also infuriated the companies themselves, as many had hoped to utilize the technology. Now, I was against the use of Huawei, but these enterprises are in a competitive venture and will take any particular opportunity to compete and try to lower their prices. However, this government wasted years for that infrastructure to be procured. I believe this also infuriated many Canadians who wanted a simple yes or no on Huawei.

I think the government went through three public safety ministers who said that an answer was coming. Finally, it said no, answering Conservative calls for “no way to Huawei”. However, now it has put forward a bill that would essentially give the power to the government. For example, the government would be able to bring forward an order that could not be reviewed by Parliament. In fact, the Statutory Instruments Act is being exempted from both the telecommunications component in Bill C-26 and the new cybersecurity part, the critical cyber systems protection act.

I am the co-chair of the Standing Joint Committee for the Scrutiny of Regulations, which is a committee tasked by the House and the other place to ensure that when the government creates an order or regulation, it does not exceed the authority granted to it by Parliament. We are able to make sure that when a department or ministry is charged with a delegated authority that it does so justly, and in light of the legislation, that it does not, ultra vires, exceed it.

However, in the legislation before us, the government is effectively saying that it gets to place secret orders that cannot be reviewed by Parliament. Now, members may say that they can go to a justice to be able to have a case heard in court. Again, who can be designated under this proposed bill is an open question. Someone could go in front of a justice, but guess what, Madam Speaker? The government reserves the right to actually make its accusations in a closed-door fashion where a person or company does not have to be there to defend themselves against the evidence that is brought to the court. There, a person or company may be subject to an order that is so secret that it cannot even be said within a closed hearing with an independent judge.

Now, some may say, “Well, so what? It is for national security.” However, we actually do not know. There are so many different organizations that can make powers here. Everyone from the responsible minister to the appropriate regulator, the minister of foreign affairs, the minister of national defence, the chief of the defence staff, the chief or an employee of the Communications Security Establishment, the director or an employee of the Canadian Security Intelligence Service or any other person or entity that is prescribed in the regulations can exert power.

“Trust us”, says the government. The government wants us to give it this power, and it will choose who can use it on whom; Parliament will never know anything about it. Even if a person or company protests, they will not be able to hear the evidence in court as to why they must comply.

Granted, I believe that, within Canada's interests, we should have the ability to work with providers around concerns, but I have great reservations on this. This bill says, “Trust us.” The government says this repeatedly. When we ask questions about foreign interference or share concerns about Huawei, the answer is, “Trust us.” This is not a respectful way to do it.

Let me tell everyone about a respectful way to do these things. Having brought forward a bill, it would perhaps be respectful to bring it to the committee stage first. There is a process where a committee can have hearings on potential legislation before it comes to this place for second reading. This offers the committee the flexibility to begin hearings and mould whether those powers are going to be broadly met in this House. In a minority setting, that would have been ideal.

However, that is the past; the government has brought forward this bill and we are at second reading. What would have been even better is to look at the example of Australia, which decided to hold a number of different inquiries over a period of years. I know the government is very sore around the subject of inquiries these days, but these commissions were set up and asked what information government should have, as well as how and with what kinds of regulations data should be regulated by government. Essentially, it took the approach that someone's personal data is their own, and they should be able to direct it.

Over a series of commissions, some with 800-page reports, they decided on a process for making changes. They would focus on privacy, deciding what the government could keep and could not keep, and they went through that legislative process. Then they said they were going to regulate industry by industry. We should notice that the proposed critical cyber systems protection act casts such a wide net that it could be anything from pipelines to sewage water treatment plants or air transit systems.

We do not know because the government just says to trust it. However, I know, and I am sure others know as well from experience, that every industry uses different technology. Therefore, a one-size-fits-all, big, bossy government, as the member for Carleton would probably call it, does not have the touchpoints or the understanding. All we know is that these orders can be placed on any industry at any time and that those orders will never be looked at by Parliament. To me, the government is asking for too much.

Again going to the Australian model, Australia said it was going to start with data privacy rights in telecommunications, energy systems and banking. It picked the industry that it was going to focus on and made sure it got it right before putting forward the new rules that allowed for a steady process. Instead of a holus-bolus process where everything gets thrown into Bill C-26 with the government telling Canadians, members of Parliament and members of the other place to just trust it, we could have had smart legislation that would be reviewed at committee. Hearings could be held, and we could find out what is reasonable for each industry and what is not. From a privacy standpoint, we could also ask what the government means when it designates someone under this act. Does it mean a person or a company? What are their rights and responsibilities? Unfortunately, this is all on the government side; it decides, saying, “Trust us.”

My colleagues and I will be seeing this bill go to committee. However, I have to protest in this place that this is not the way to make our systems better and provide more trust in our institutions. “Trust us” is not an argument, and the government should know better by now.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Madam Speaker, I listened with great interest to the member. I heard him speak at length about why the bill is so horrible. He then concluded his speech by saying that he would vote in favour of sending it to committee. If it is so horrible, why would he bother to vote in favour of it? Why not just vote against it?

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Madam Speaker, Conservatives have been calling for the government to deal with the very real threat of foreign interference for years. This is not only a threat on the government side but also something that takes on other forms, such as cyber-espionage.

Not everything in this bill is terrible, but it could have been structured better. As the previous member from Winnipeg said, Conservatives on the committee will work to make the legislation better and ask qualifying questions. Moreover, we will pull support if the current government continues to stonewall and ask us to trust it without offering better arguments or better amendments.

[Martin Champoux, Bloc, Drummond, QC]

Madam Speaker, I commend my Conservative colleague for his speech.

We have heard concerns about the fact that legislating in this manner and governing essential cybersecurity infrastructure could have an impact on the freedom of expression of Quebeckers and Canadians.

I would like to ask my colleague whether he believes it is possible to implement such legislation so that we can regulate and govern essential cybersecurity infrastructure as needed while protecting freedom of expression. I would like to hear his thoughts on that.

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Madam Speaker, I do not have a precise answer to the member's question, but I do know that this is not it. The government has basically thrown everything to a one-sided argument. Industry has raised concerns with the government that there is no two-way communication. Industry can report to government, but there is no way to have any kind of forward guidance from the government in this legislation. Those one-way streets lead nowhere.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, I appreciate the speech my colleague made. I think the track record here is one of the biggest points I took from his speech. Specifically, he referenced how the government delayed enforcing its decision on Huawei for years. This is not a new concern after eight years of the Liberals delaying and refusing to act or provide leadership while many of our global counterparts have done so.

Specifically, he emphasized the example of Huawei very well. Could he expand a little on how damaging the delay was to Canada's international reputation on cybersecurity?

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Madam Speaker, governments are made of people, and people make mistakes. After talking to many of our allies and seeing what our other Five Eyes partners in the United States, Great Britain, New Zealand and Australia have done, the government probably heard the feedback that it was a black eye that it took so long for Huawei to be banned from Canada's 5G infrastructure. This is now perhaps an overreaction to try to make up for that.

Let me say this. In this place, in this country, we want laws that are just, fair, and most of all, practicable. Unfortunately, this is a one-size-fits-all, big, bossy government that asks us to trust it because it knows the shots and will take them as it sees them. It has not done well in the past, and I believe that this overshoot is to respond to that lack of credibility with respect to Huawei. However, two wrongs do not make a right.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Order.

It is my duty pursuant to Standing Order 38 to inform the House that the questions to be raised tonight at the time of adjournment are as follows: the hon. member for Victoria, Taxation; the hon. member for Stormont—Dundas—South Glengarry, Immigration, Refugees and Citizenship; the hon. member for Lanark—Frontenac—Kingston, Cannabis.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, today I will be talking about the bill we have been discussing for the past few hours, Bill C‑26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts.

From the outset, I would like to mention that in 2019, when I arrived in the House of Commons, the topic on everyone's lips was the data breach at Desjardins. To put things into context, at the time I was a member of the Standing Committee on Access to Information, Privacy and Ethics. I was determined to find out how we might protect privacy and decorrelate the social insurance number that we were using far too readily as a means of identification. My colleagues see where I am going with this.

It took a scandal for the government to do something about this. Now I am no longer a member of the Standing Committee on Access to Information, Privacy and Ethics, I am vice-chair of the Standing Committee on Procedure and House Affairs. Again, it took a scandal being uncovered by the media for the government to truly listen to us.

This is a case of being lax when it comes to the security of the electoral process and national security. I am addressing all those who are listening to us; I hear their concerns. For the past six months, the Standing Committee on Procedure and House Affairs has been looking into Chinese interference in our electoral process. It is likely that there will be an announcement in the near future that will once again demonstrate that we really need to sound the alarm to get things moving. Of course, the Bloc Québécois will always be vigilant. The Bloc Québécois will be there every time it is important to get to the bottom of various allegations or scandals. We will force the government to take action for our constituents, because they deserve it.

In light of all that, it goes without saying that Bill C‑26 is a step in the right direction. The bill introduced by the Minister of Public Safety aims to strengthen the security of Canada's telecommunications system. That said, I want to be honest. I have serious concerns. Over the past few years, my confidence in the government on security issues has been eroded. The government must not stick its head in the sand. Quebeckers need assurances. They need to be assured that this paternalistic and so-called well-intentioned government is doing its job, particularly in its areas of jurisdiction. That is all we ask and all we expect.

We know that China, Iran and Russia can be considered hostile powers that do not wish us well. When someone does not wish us well, we have to protect ourselves. The government absolutely has to come up with systems to guard against what we have seen since the latest scandals. We demand an explanation, and answers are to be expected, yet the government says everything will be fine and we should move on to other things. Unfortunately, our constituents feel betrayed and lack confidence in this government because it is not taking things seriously, as all the numbers indicate.

Regarding what is going on with Beijing specifically, I wonder if there is something we do not know. Why are we taking action so late in the game? Why are we always reacting? I am fed up with all this dissatisfaction. Every time I go back to my riding, my constituents want to talk to me about this, and I get why they are feeling discouraged.

As members know, I will be going to the United Kingdom. We are going to be taking a look at the procedures in different Commonwealth countries so we can implement other countries' best practices with respect to national defence and protection against interference in our elections.

I know that when having discussions with my colleagues, I am going to have to tell them that the process is ongoing even though the British and the Australians understand the situation and have taken action. The Americans, too, understand and are taking action. I am wondering if our closest allies, our Five Eyes partners, still have confidence in us.

For quite some time, the Bloc Québécois maintained that the government needed to tighten control over broadcasting. That is unequivocal. It was part of the discussion on the Huawei and 5G infrastructure file. We continued to call out the government for its indecision, which went on too long. This proves once again that we were right. However, international pressure from our closest allies was needed to make the government take action.

Everything is always so urgent. Urgency seems to be an imperative that really drives this government. We would like to see the government change its ways and become more proactive rather than reactive. With Bill C-26, I think we finally have a starting point. Obviously, there is a lot of work to be done to go further in terms of accountability, in terms of the legitimacy of disclosure on all sides, so we can prevent situations like the one we are in.

I agree that it is a noble goal. Of course I agree with everything about the security of our critical systems. Do we have everything we need right now to deal with both internal and external threats? The answer is no. That is what we have been told and what we continue hearing, at both the Standing Committee on Procedure and House Affairs and the Standing Committee on Access to Information, Privacy and Ethics. We must act. This bill must be quickly sent to committee to be fine-tuned and given some teeth. It is urgent.

I am making a wish and sending it out to the members of the government. I am asking them to always keep in mind our collective security. I trust that they will. We have faith, but we need to be proactive, smart. We also need to talk to our constituents, to speak to people's intelligence. They have suggestions. The G20 countries have good practices that we need to adopt as quickly as possible. We need to set aside partisanship in the interest of our democracy. We need to ensure that the legislation resulting from Bill C-26 really makes people feel safe and lets them know that there is a public, non-partisan institution there to watch out for threats.

The bill names six public organizations that will be given the power to order investigations to make sure things are being done right. I am talking about the Superintendent of Financial Institutions, the Minister of Industry, the Bank of Canada, the Canadian Nuclear Safety Commission, the Canadian Energy Regulator and the Minister of Transport. These are critical sectors of our society and our economy. We must not take threats lightly. Is this enough? We will need experts to tell us whether this is truly legitimate, both for whistle-blowers and for the dissemination of information, because people need to know.

Since I only have about 30 seconds left, I would like to say to those who were just here that the government took action with regard to TikTok because, once again, there was an urgent need to do so. I hope that any future interventions will be undertaken proactively.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I appreciate the comments the member has made. However, when we go to these conferences, one thing that is important to recognize is that even with the legislation, compared to other countries, this is an ongoing issue and cybersecurity is dealt with in a wide variety of ways. What we are talking about today is a very important tool. We have been talking about it and have the legislation before us. We now have an opportunity. In listening to members on all sides of the House, we see that there is a will to support the legislation going to committee. My concern is that if we do not allow that opportunity, there is a finite amount of time. We would like to see the legislation go to committee so that opposition members could propose ideas, suggestions and possible amendments.

Could the member provide her thoughts in regard to the importance of trying to get the legislation to the next stage, given that everyone seems to be supporting the legislation?

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, that is a very interesting question. Here is what I would say in response. If my colleague and I were to switch places, I would say that one of the truly urgent and useful things we could do would be to fine-tune and improve the bill to show that the government really cares about cybersecurity and wants to make sure it protects Canadians from all cyber-attacks and any potential interference while strengthening transparency.

If I were in government, which will never happen, I would make sure I handed over everything if someone asked me for information. I would not hide anything to avoid a potential scandal a year from now. I would take it that far with this bill. That would be the first step in a constructive process.

[Bonita Zarrillo, NDP, Port Moody—Coquitlam, BC]

Madam Speaker, there were definitely some words in the member's speech that I have to agree with as a member of the NDP, which are really around the Liberals' not taking due care in preparing these pieces of legislation that are coming to the House of Commons. They are not taking due care. They are bringing in these bills that need so much work, and it just appears that perhaps they are not committed to doing their best here. I wonder if they are not qualified, if they are outsourcing to people who are not qualified or what is going on here. I would like to hear if the member really thinks that this is salvageable in committee.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, in my opinion, a government that knows where it is headed and has the competence to get there does not stumble around and try to clear its conscience or improve its own image. On the contrary, a leader who is in a really good position does not wait for the opposition's proposals to figure out what to do. My colleague asked a good question. I will let people come to their own conclusions in that regard.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I will ask a question I asked earlier of another member. In this member's opinion, what does she view as the greatest threat to Canada's cybersecurity? Is it state actors? Is it cybercrime and cyber-technology? Specifically, what does the member think is the greatest threat that we face as a nation around cybersecurity?

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, that is exactly one of the questions we need to ask the experts. We must listen to them and accept their recommendations. We must take action based on the analyses of scientists, particularly those who may have had to reconsider some mechanisms.

Obviously, it is important to be ready to act. The answer might be very different depending on the situation. We are hearing a lot about foreign interference in elections these days. We would like this bill to help put an end to that.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I will take maybe a different tack today to contribute to this debate on cybersecurity. I am going to tell a story about Tom and how he has been impacted by technological changes over the last couple of decades. Before I tell Tom's story, I have to share Emily's story with technology and why this legislation and changes to cybersecurity in Canada are so important and so needed.

Before I get into that, I think it is important to first lay out in simple terms what this bill is about from my current understanding. There are really two parts to the bill.

The first part is about amending the Telecommunications Act to address and fix the security needed for our Canadian telecommunications system. The bill would do this by addressing it through two means. First, it would “direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.” As well, it would establish some monetary penalties tied to those changes.

The second part of the bill is all tied to the critical cyber systems protection act. It would provide the framework for the protection of our critical cyber systems, which are vital to national security and public safety. It would do that through five different aspects. First, it would authorize the government to designate those services that are vital to Canadians, those critical sorts of services, what they are and what systems are tied to them. Second, it would authorize the government to establish who is responsible for maintaining those systems. Third, it has how these cybersecurity incidents would be reported and how Canadians and institutions comply with those changes. Fourth, it lays out how information would be shared and, arguably, needs to be protected. Finally, it gives the “so what” of the enforcement and the consequences for non-compliance with the legislation.

In reality, this bill is quite lengthy and very technical, so I am going to focus most of my speech around two important aspects of the bill. The first aspect is the threats to cybersecurity. The second is information sharing and the need to protect Canadians' privacy rights while highlighting the important need for transparency. How would the government ensure the accountability of any institution affected by this bill, particularly the government itself, with the additional powers this legislation would grant it?

Let us get back to Emily. She is a senior citizen and a retired teacher. She uses a mix of online banking and billing, although she still prefers to handle the majority of her financial transactions right at the bank. She has a fledging social media presence mainly to stay in contact with her grandchildren and friends. She even has a TikTok account at her grandchildren's urging. We will see if she is going to change her mind and delete that sooner than later.

Being online and connected is essential to all Canadians now, more than ever, as a lot of Canadians rely on the Internet for their daily lives. It is about more than just conducting business and paying bills. As I have mentioned, we have seen an increased dependency on the Internet, especially for government services. In the last few years, under the Liberal government, it continues to shift more and more government services online, while unfortunately decreasing service delivery for those without access to the Internet at the same time. I will not go into detail on all the shortfalls I see with the current approach, considering that a large portion of rural Canada still do not have access to high-speed or dependable Internet.

What threats does Emily face? She complains about getting emails and phone calls from people alleging to be affiliated with her bank or service providers. She wonders about the advertising that shows up on her social media feeds that align with something she only mentioned in an email to a friend. How is all of this happening?

To quote the director of CSIS from December 4, 2018, over four years ago, during a speech that he gave to Bay Street, which I have extracted from Stephanie Carvin's Stand on Guard, Mr. Vigneault stated that the greatest threat to our prosperity and national interest is “foreign influence and espionage.” While terrorism remains the number one threat to public safety, “other national security threats—such as foreign interference, cyber threats, and espionage—pose greater strategic challenges”.

In her book, Professor Carvin clearly lays out the risks associated with cyber-attacks, whether malware, ransomware, a targeting of critical infrastructure, denials of services or others. She talks about cyberterrorism, cyber-espionage and cybercrime, so how do we deal with this?

We deal with this not only through this legislation, but also, mainly for some of the challenges we have, as my colleague from Selkirk—Interlake—Eastman talked about in much greater detail earlier today in his speech, our Canadian Armed Forces, the Communications Security Establishment and even our federal police services, which have ways to deal with this. My colleague hinted that sometimes the best defence is a good offence.

Offensive cyber-operations are really not the bailiwick of this legislation, although I would offer that there is some overlap, as we look at a lot of these threats Canadians and Canadian institutions are facing are financed through cyber-attacks and more here at home. We need to tackle this and get the balance right.

The bottom line is Emily and Canadians like her being affected by all of these cyber risks. Professor Carvin pointed out that at least 10 million Canadians had their data compromised in 2017 alone. Unfortunately, this number is likely under-reported, and neither the government nor the private sector fully understand the scale of the problem. To sum up, the threats are huge.

Bill C-26 must balance privacy rights while ensuring national security. Increased use of encrypted apps, data being stored in the cloud on servers outside of Canada, IP protection and more factor into the challenges of getting this legislation right. In order to deal with these threats, the legislation would need to enable our security establishments with robust, flexible powers. However, these robust powers must come with clear guidance on how far and when to inform the public. This is essential in rebuilding our trust in our democratic institutions.

The Business Council of Canada has already publicly expressed concerns over the current draft of this legislation. It rightly identified that large companies, and also small- and medium-sized enterprises, are concerned that the sheer amount of red tape tied to this bill is extremely high.

We need to get the balance right. It is vital, and it is going to require significant expert testimony at committee. Although I would argue the legislation is desperately needed, and I would argue even late in coming, it needs to be done right and cannot be rushed through debate or review at the committee stage.

I have some final comments. This legislation is needed to protect Canadians. However, this legislation needs to be reviewed regularly and needs to include safeguards. I know if he gets the chance, the member for Winnipeg North might ask about what amendment we are recommending. There is no annual reporting mechanism in this bill, so the government should have to table an annual report to Parliament outlining the progress on this legislation, and include an updated cyber threat assessment to Canadians and what it has been hearing back from the companies impacted by this legislation.

Sean McFate, in this book The New Rules of War: Victory in the Age of Durable Disorder, wrote, “ Secrets and democracy are not compatible.... Democracy thrives in the light of information and transparency.”

Finally, I will conclude with Tom's story and how he has been impacted by technology. The bottom line is that he has not been. He does not have a cell phone. He does not use the Internet. He only pays in cash and does not have a credit card. The only way he is currently being impacted is when he shows up to try to get some federal services from the government. He cannot do it because he does not have any of that, and he cannot get anybody to show up in an office to work.

[Jennifer O'Connell, Liberal, Parliamentary Secretary to the Minister of Intergovernmental Affairs]

Madam Speaker, I listened intently to the member opposite's speech. He spoke about transparency. He talked about advertising and constituents who wondered how certain ads were targeted to them. He spoke about annual reporting.

In that vein, I am curious if the member opposite would like to report to the House anything that the Conservative Party has done to condemn their leader for the misogynistic, anti-women hate hashtags that were used to target individuals who promote hate towards women and violence. That is a form of domestic terrorism CSIS has highlighted as well.

Would the member opposite like to talk about clarifying in the House how Conservatives are going to address the cyber-attacks against women in this country?

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I suggest that the member ask the member for Carleton, the Leader of the Opposition, to answer that question because I cannot speak for him other than to state that he has put out a very clear, definitive statement condemning the hashtags that were put on some videos, which he knew nothing about. I will leave my comments at that.

The last time I checked, we are debating Bill C-26, legislation that is needed to protect Canadians. It needs to be improved and debated to get it right so we can deal with threats of political interference from foreign states, such as the Communist Chinese government. That is of utmost importance to Canadians.

[Maxime Blanchette-Joncas, Bloc, Rimouski-Neigette—Témiscouata—Les Basques, QC]

Madam Speaker, I listened carefully to my colleague's speech.

The Bloc Québécois has often supported the need for the government to tighten cybersecurity controls. I am curious about the Conservative Party and I have a question for my colleague. There has been a lot of doubt and uncertainty concerning cyber-attacks and companies like Huawei. We know and people know that a former candidate for the Conservative leadership worked with Huawei.

I would like my colleague to explain to me what credibility the Conservative Party has today, as we talk about cybersecurity and Chinese interference, because one of its own members, who was a leadership candidate, worked with a company like Huawei. The giants in this world, the Five Eyes in particular, have stopped doing business with this company. Today, we are once again asking how that party can lecture everyone else about cybersecurity.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I think the public record of the House and this party in the chamber has been clear-cut on the issue of Huawei. We have called for it to be disavowed, taken off devices and not be allowed to be a provider here. That was passed a year and a half ago.

Whether someone had private employment prior to them declaring or running in a leadership race is a great question for the individual. Because somebody's past history involved them working for different institutions and companies, yes, we can judge those individuals, but let us talk about the public record here. I would argue that there has been no party in the history of Canada that has stood up more for the defence and sovereignty of this nation than the Conservative Party of Canada.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, a common theme I have heard, highlighted well from members from the Conservative side, is how past records are one of the best indicators for future success or failure. Certainly, when it comes to the issues surrounding Huawei and cybersecurity, we see Canada, especially its reputation on the world stage, being greatly diminished by the actions and, in many cases, inactions of the Liberal government and the Prime Minister over the course of five years.

Could he expand on how those past actions have diminished Canada's reputation among allies and partners?

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I referenced a couple important books and a couple references by some of our esteemed national security experts across this country. If people read through that and read some books that are out there, they would see this is a threat that has been building for the better part of a decade or more.

The government has known about this since the day it formed government, yet we have seen no action. As mentioned by the CSIS director from 2018, here we are almost five years later, and we are just now seeing this important legislation being delivered.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Madam Speaker, it is an honour to rise again in the House to speak to Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. My Conservative colleagues and I, as has been indicated, support this legislation being sent to committee for further study, as it needs a lot of further work and amendments.

For those watching this debate, who have not had time to review the legislation, the bill has two main parts, as has been explained throughout the day. The first part would amend the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.

The second part of the bill would enact the critical cyber systems protection act, which is a new act, that attempts to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are designed to operate as part of a work, undertaking or business that is within the legislative authority of Parliament. Services and systems that would initially be designed and designated as vital are telecommunications systems, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems, banking systems, and clearing and settlement systems. Any additions to this list of vital systems can be made and added to by the Governor in Council.

The critical cyber systems protection act would have several components to it. It would authorize the Governor in Council to designate any service or system as a vital service or vital system; it would authorize the Governor in Council to establish classes of operators in respect of a vital service or vital system; it would require designated operators to, among other things, establish and implement cybersecurity programs, mitigate supply-chain and third-party risks, report cybersecurity incidents and comply with cybersecurity directions; it would provide for the exchange of information between relevant parties; and would authorize the enforcement of the obligations under the act and impose consequences for non-compliance. Those would be significant consequences, I might add.

On its face, it seems that the Liberals have finally awoken after eight years of doing absolutely nothing on this file, yet somehow they hastily scrambled to cobble together a proposition for sweeping changes to a regulatory framework, which this legislation would enact.

The Civil Liberties Association said, “The problems with the Bill lie in the fact that the new and discretionary powers introduced by C-26 are largely unconstrained by safeguards to ensure those powers are used, when necessary, in ways that are proportionate, with due consideration for privacy and other rights. The lack of provisions around accountability and transparency make it all more troubling still.” We understand that a modernization in this field may be required to do so without the caveats of being necessary, proportionate and reasonable to take it one step too far for Canadians to accept.

For support of this argument, the Liberals only need to look at the research report from Citizen Lab, written by Christopher Parsons. The report is called “Cybersecurity Will Not Thrive in Darkness, A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act”. That report provides 30 recommendations that clearly lay out common sense changes and how this legislation could be improved to include transparency or at least apply limitations on the government's authoritarian use of power. For the benefit of the careless drafters and my Liberal colleagues across the way who would happily vote on any flawed legislation their leader tells them to without bothering with independent thought or even reading its criticisms, I will take some time and share the flaws.

Citizen Lab also seems to address what appears to be a recurring theme with the government: a lack of transparency and limitations on the government's authoritarian use of power. It too addresses that, “The minister may, by order, direct a telecommunications service provider to do anything or refrain from doing anything...that is, in the Minister’s opinion, necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.”

That, too, seems a little broad. Amendments need to be applied that include a limitation on the minister's powers, ensuring that actions are necessary, proportionate and reasonable. This government has proven that it cannot be trusted with powers without strict limitations. It is simply unable to self-regulate.

The Canadian Civil Liberties Association and Christopher Parsons agree again on the lack of privacy and broad provisions around information sharing.

The CCLA writes:

Also concerning are the very broad provisions around expanding information sharing with a long list of potential recipients including Ministers of Foreign Affairs and National Defence, the Canadian Security Intelligence Service (CSIS), and also, once an agreement is signed, with provincial governments, foreign governments, or international state organisations, again, at the Minister’s discretion. The Communications Security Establishment (CSE), Canada’s signals intelligence agency is also a key recipient of information.

The Citizen Lab review echos how the government ought to have included provisions that respect information privacy. To any Canadian listening, this does not sound like too much to ask. Specifically, the Citizen Lab report recommends that “information obtained from telecommunications providers should only be used for cybersecurity and information assurance activities".

It also recommends that “government should explain how it will use information and reveal the domestic agencies to which information is disclosed”. The report says “information obtained for telecommunications providers should only be used for cybersecurity information assurance activities”. It should only be used for “data retention periods”, and that it “should be attached to telecommunications provider's data”. Citizen Lab states that “data retention periods should be attached to foreign disclosures of information”. It also indicates that “telecommunications providers should be informed which foreign parties receive their information”, and “legislation should delimit the conditions wherein a private organization's information can be disclosed”.

Why does the government need to be told that its legislation has these fundamental flaws by outside organizations? Many are asking: Do these Liberals have no shame when it comes to the privacy of Canadians?

The CCLA further points out that, although there is an appeal process through judicial review, when the subject of an order finds it to be unreasonable or ungrounded, it suggests that, under Bill C-26, the government overlooks the basic, fair process that even a national security threat would receive. The Citizen Lab, on the other hand, discusses that the government fails to compensate for government intrusion into small business. Mr. Parsons proposes that the legislation should be amended such that telecommunications providers can seek moderation of “certain orders where implementing them would have a material impact on the provider's economic viability”.

In conclusion, while it is notable that the Liberal government has finally awakened to this topic, the legislation has again missed some pretty traditional marks of Liberal legislation. It leaves citizens at risk of major government overreach. It takes the privacy and information of Canadians for granted. It relies on a system of review that falls short of due process, and it leaves businesses susceptible to bearing the costs of an overbearing government. Lastly, this is typical lazy Liberal legislation.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Mr. Speaker, let us look at the bungling that has gone on in recent years. Ottawa arrested Meng Wanzhou, not for a common law crime, but for failing to comply with an American embargo. It kowtowed to the Americans on an embargo that Canada does not even share.

There is also Ottawa's refusal to follow the leadership and initiative of the U.S., which acted very quickly with regard to Huawei. Does that not demonstrate a glaring lack of vision?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, I think many Canadians are wondering why the government took so long to act on Huawei. Our Five Eyes allies have certainly put pressure on Canada and acted previously to ensure that their 5G systems were not compromised, which had been found to be the case with the Huawei technology. That is why, in my statement, I made some comments that this government is finally waking up, after all this time, to deal with some of these issues we are facing as a country.

[Bonita Zarrillo, NDP, Port Moody—Coquitlam, BC]

Mr. Speaker, I will say it again: It does not feel like the Liberals are taking due care in presenting legislation. In listening to the debate today, I am really concerned, not only as a Canadian but also as a parliamentarian, that there is not enough knowledge in the House to be even having this discussion. I would like to know from the member whether there have been adequate technical briefings from the Liberal government in regard to this legislation, because it seems like this is a lot more serious than what this debate is holding to today.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, we all know that cybersecurity issues are a fast-moving target and how they change almost monthly. One thing that I can be confident in is our national security agencies that deal with some of these issues on cybersecurity. They are working diligently on our behalf. I would agree that there would be very few of us in the House who would have the technical capacity to understand much of what we ask our defence agencies, our national security agencies and our cybersecurity agencies to do for us on behalf of our country.

I would encourage the government, as was indicated by my colleague, to enlighten the House and to provide briefings by those technical experts in government and from our public servants. We would all benefit, not only from the study of this bill but also from the ability to answer our constituents who have cybersecurity questions. We could answer them more intelligently.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Mr. Speaker, I appreciated the speech by my colleague from just south of my constituency. Certainly, this is an incredibly complex and important series of issues. They are not just related to this particular bill but a whole host of larger security and cybersecurity issues. I wonder if the member could provide further comments, specifically on the lack of leadership that Canada has shown on the world stage over the last eight years that this Prime Minister has been in charge, and has it impacted Canada's reputation globally?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, it is disconcerting, as Canadians, when we look at the history of the Liberals since they have been in for seven years and five months. Inflation brings it to eight years.

One of the things that is important is we have lost face, if one wants to use that term, with our global partners and our Five Eyes agencies that have now gone and done things without us. That is because we have not been at the table. We have been slow to react to the very legitimate concerns about the cybersecurity and the national security of this country and of our allies.

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Mr. Speaker, as the member for Portneuf—Jacques-Cartier, I am pleased to rise today to speak to Bill C-26. I want to say hello to all of the families who are taking advantage of March break to do fun activities in the beautiful riding of Portneuf—Jacques-Cartier.

As I was saying, Bill C‑26 seeks to add the promotion of the security of the Canadian telecommunications system. It also seeks to provide a framework for the protection of the cyber systems that are vital to national security or public safety and create frameworks for the exchange of information.

It goes without saying that these issues are very important to the official opposition, of which I am very proud to be a member. It is no secret that my Conservative Party of Canada colleagues and I are, and always have been, great defenders of public safety. It is part of our DNA.

Industry and experts have asked the government many times to create cybersecurity standards, but it is important to act intelligently.

There is a lot of instability in our modern world, and threats can come from anywhere. Cyber-threats are nothing new. This is not a recent thing. It is clear that this weapon is used as much by foreign governments, which have their own motives, as by individuals or groups seeking to do harm or make money, for God knows what motives. It happens everywhere, on both small and very large scales.

Here are a few examples that illustrate this reality: data stolen from institutions or companies and held for ransom; the leak of personal information that affected millions of Desjardins members or customers in Quebec; and possible election interference from Beijing.

No, we are not going to question the outcome of previous elections here. We do not believe that interference changed the overall outcome of those elections. However, electoral integrity is the foundation of our democracy, and it must be ensured and maintained. As a Canadian, I have the privilege of going abroad, and people recognize that we are concerned about protecting our democracy. We need to put measures in place to continue that.

The fact remains that, over the past eight years, the government has been slow to crack down on cyber-threats. This is yet another example of a foot-dragging government finally coming up with a bill, but it turns out that bill has flaws that call for more thorough study in committee.

I know for a fact that this issue is really important to Canadians. We will do the work to make sure this bill is the one Canadians need and deserve. Yes, people want to be safe. Actually, since I was elected in 2015, my constituents have regularly told me they are increasingly concerned about this issue, especially over the past year.

What it comes down to is that confidence in the government and its ability to provide what people need and to keep its promises is essential. It is hard to have confidence in a government that keeps messing up pretty much everything.

I could go on and on about Bill C-13 as an example of a government that makes promises but does not deliver. The government recognizes the decline of French across the country, even in Quebec, but it is trying to impose a bill that does little to address that decline. I know that that is not the subject today, but everyone knows how much I care about official languages, and I had to pass on the message.

I would like to conclude by sharing a very real situation that occurred in my riding. One of my constituents wrote to me about a serious handling error made by Passport Canada.

I would like to inform the House that this is the first time this situation has been discussed publicly. He sent me a letter, and I would like to read it.

Dear Sir/Madam:

I am taking the time to write you a brief note to let you know about what I would describe as a “serious” security flaw within Passport Canada pertaining to the confidential information of Canadian citizens.

It is very important in terms of a timeline.

In early January, 2023, I applied for passports for my three children at Passport Canada.

On February 1, 2023, I received three envelopes containing our passport applications, which were rejected because we forgot to tick a box.

Inside the envelope I also received the rejected application of a woman from British Columbia. I therefore had in my possession her full identification, her passport and her credit card information. I returned those very sensitive documents by express post with a tracking number to Passport Canada.

I filed a complaint out of principle thinking that, although it was just a mistake, it was still worth reporting through Passport Canada's website, so I followed the official procedure. I got a call back. Passport Canada apologized. Nothing more. They refused to compensate me for the cost of returning the documents belonging to the woman from British Columbia. I was told, however, that our applications would be prioritized.

On February 15, 2023, I received four envelopes. I was quite pleased, as I thought we'd finally received our children's passports, but we have three children, not four. As it turns out, our children's passports weren't inside those envelopes. Instead, there were the passport applications (including full identification, passport, original birth certificates, complete credit card data, etc.) of four people from across Canada. These are four different people who have no connection to one another.

What is not stated in the letter is that these people were from Sherbrooke, Ontario, Manitoba and Alberta. That is incredible.

A few days later, we finally received our three children's passports.

As it is obvious, I don't feel I need to explain in my letter the seriousness of receiving the full identification of these people and information that could be used to carry out fraudulent financial transactions by total strangers.

We can't fathom that such mistakes would be made by a recognized federal organization such as Passport Canada, which manages the personal and financial information of so many Canadians. We can't believe that these are two isolated incidents.

This is a very simple task that requires putting the right documents in the right envelope. That's it.

I no longer trust Passport Canada's administration at all. That is why I am entrusting you with the identity documents, which don't belong to us.

I no longer trust Passport Canada's “internal” complaint process, as it will certainly try to cover up this failure, and will only offer an apology.

I am most pleased to read the following excerpt from the letter:

We trust our MP.

I'm always available to answer any questions.

Yes, cybersecurity matters, but the government also needs to take responsibility for the existing systems. It cannot even handle paper documents, but now it wants to allow a minister to step in and be able to manipulate and control information. I am concerned.

I have shown that we have a problem in Canada. We recognize that. We have a problem when it comes to cybersecurity, but we have a problem on other levels too. I would like to see this government take responsibility.

Like my constituent who gave me the documents mentioned, I had to ask myself, what do I do with these documents now? Do I return them to Passport Canada, or do I give them to the minister responsible here? That is a very important question.

Let us get back to the subject at hand, Bill C-26. I am very interested in having measures in place to protect us. It is important that we have confidence in our systems. As a member of the Conservative Party of Canada, I have a lot of confidence in the Conservative members who sit on the committee, as well as members of the Bloc Québécois, the NDP and even the Liberal Party. Things are normally supposed to be neutral in committee.

I must say that I believe in the future. Having said that, we need to put measures in place to have concrete results. Let us work in committee.

[Maxime Blanchette-Joncas, Bloc, Rimouski-Neigette—Témiscouata—Les Basques, QC]

Mr. Speaker, I listened closely to the speech by my colleague from Portneuf—Jacques-Cartier. The first thing he mentioned is that the Conservative Party of Canada was a great defender of cybersecurity. I want to remind him of the following.

First, the member for Portneuf—Jacques-Cartier supported Jean Charest as a candidate in the Conservative leadership race. Jean Charest worked with the company that was complicit in China's interference. So much for credibility and being a great defender.

Second, a quick Google search shows that the CPC App that the Conservative Party of Canada used during the 2019 election is a version of the uCampaign app, which is used in the United States and requires access to contacts and geolocation, things that relate to privacy. Cybersecurity researchers were actually advising against using that app.

When it comes to credibility and being great defenders, are the people in the Conservative Party of Canada really people we can trust?

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Mr. Speaker, I just want to point out that people in the Conservative Party of Canada lined up for a chance to become the leader of a national party, whereas the Bloc Québécois has to pick from a grab bag that does not have much in it and has trouble finding a real leader. I think the Bloc members need to ask themselves some questions when it comes to the availability of leaders.

Now, to answer my colleague, there was nothing illegal being done on our side. However, if I turn and look over at the government side, there is a long list of illegal activities that occurred there. I would encourage my colleague to direct his questions to the right party, because we, on this side, obeyed the law.

[Ken McDonald, Liberal, Avalon, NL]

Mr. Speaker, I could not help but notice an answer that the member just gave to the member from the Bloc on leadership and picking a leader to be the next prime minister. I wonder if he could explain how that has worked out for him since 2015.

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Mr. Speaker, I salute my colleague from Avalon. It is true I do not have a good batting average. In three leadership races, I have never backed the right horse. However, I am very happy being a member of the Conservative Party of Canada, and it is where I belong. That is part of democracy.

We are straying from the topic. I invite my colleague to ask me a more specific question about Bill C-26, if he has one.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Mr. Speaker, since the member told us that there has always been a long list of Conservative leadership hopefuls, I would just like to quote his own words.

He said, “I will resign, or join another party in the House of Commons, or sit as an independent, or help form another party.”

This was in reference to the winner of the recent Conservative Party leadership race. The options did not include remaining a Conservative, which is what he ended up doing.

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Mr. Speaker, one thing my colleague from Saint‑Hyacinthe—Bagot did not mention is that, when there is a change in leadership, it makes perfect sense to reflect on one's political future.

I invite the Bloc Québécois members to reflect on that when they choose a new leader, as they too have done regularly in the past.

The thing is that, when we think about it, there are options. One very important option is the status quo. We may have to check the record to see what my colleague said. I have a very clear recollection of what I said: status quo, reflection, departure, new party.

I am very happy. I feel very comfortable in the Conservative Party of Canada, and it is the only party I can work with to defend Canadians' interests.

[Randy Hoback, Conservative, Prince Albert, SK]

Mr. Speaker, that was a great speech from my colleague. I think we would like to see him go on and on, because he has done such a great job.

It has been interesting to be here in the House today, as we listen to the different members from parties talk about the legislation and how important it is. I think there is recognition from all parties within this House that the bill will go to committee and that the committee will have some serious work in front of it, to take a bill that is kind of so-so and put some teeth into it, and make it into something that will work for all Canadians.

I am going to focus mainly on the critical infrastructure part of the legislation. It is so important that we get this right and make sure we have our critical infrastructure protected going forward and make sure we have the tools to keep it protected.

There is a war going on in Europe right now, in Ukraine. We saw that when Putin attacked Ukraine, one of the first things he did was attack certain facilities through cyber-attacks. Ukraine did not have proper protections in place and did not have the tools in place. All of a sudden Putin was able to turn the power off and do things to destabilize local governments. This allowed him to take advantage of the scenario, to move in, take advantage of the territories and conquer those territories. That is just one example of many around the world where cyber-attacks have been used ahead of brutal land attacks. We can see this being used in other ways to influence Canadian politics, or politics around the world, just by how they go about conducting that type of cyber-attack.

It would be really interesting, but it would not be interesting, as I do not ever want to see it, where all of a sudden the natural gas pipelines shut down in the middle of 40-below weather in Saskatchewan. That would be a huge hit to people in Saskatchewan. That would be a hit to our economy. It would be very serious to our seniors and people living without any other means of heating. All of a sudden we could have a cyber-attack, and the gas line would be off, and furnaces would not be working for 12 hours, 18 hours or 24 hours. Our houses would freeze up and our water pipes would break. These are the types of things that could happen with a cyber-attack.

What if our power grid were under attack? What would that mean to Ontario and Toronto, for getting people to and from work? What would it mean to our electric cars, if all of a sudden we did not have any ability to charge them or get them from A to B? What would that mean for people in hospitals, where the hospitals would need a generator to run the emergency services? If someone was getting surgery or was in an accident, they might not get the medical treatment that is required.

These are reasons we need to make sure we are doing everything we can to protect ourselves from cyber-attacks. These are some very simple reasons.

The committee is going to have some very interesting things to do to deal with the legislation. I think that is a good thing. I think we have identified here today some of the flaws in the piece of legislation: some of the oversight flaws, some of the flaws in regard to the sharing of information and why they are important to be addressed as we go forward.

We can look at, for example, the sharing of information. I was at the University of New Brunswick in 2017, and they said one of the issues they had with cybersecurity attacks was that somebody might be attacked, but might not share the information on what the attack was and how it happened for fear of liability. For example, in such a situation, if a hospital was attacked, it may not necessarily want to share that information with anybody else for fear of liability, if all of a sudden the records of patients had been confiscated by somebody part of the attack.

In the legislation before us, if we get it right, they should be able to share that information. They should be able to share it with a variety of different critical infrastructure facilities to make sure they put the appropriate patches into their software so that same person who attacked that hospital cannot attack another hospital, attack the electrical grid or use malware, or whatever means they used to attack that hospital, and so it does not happen anywhere else.

That would be a good thing. We have to make sure the legislation can reflect that and allow that information to flow between different parties, so we can keep protecting ourselves in a fluid situation. I think that is something we will see in the legislation, if it is done properly.

We know oversight is very important. Canadians have to trust that the oversight bodies and the people who are putting in these regulations and monitoring these regulations have accountability and that they are accountable back to Parliament. It cannot be just to the minister. We have seen situations in the past with the current government where accountability goes to the minister, and Parliament never really finds out what actually went on and what goes on, and Canadians are in the dark.

We can look at SNC-Lavalin. There is a classic example where we did not see all the details of what was going on in a situation. We can look at what was announced today, how the government is going to leave the investigation into Chinese election interference to NSICOP. That is something the Chinese would do. They would create a committee and say they were going to investigate themselves in their own committee and then make sure it is never public. That sounds rather Chinese to me, but that is happening here in Canada, and Canadians do not accept that. That is why it is very important that there be public oversight and that there be the ability to make sure these bodies and the government are acting in a fair and responsible way.

Some of the civil liberties groups have said that there are some serious concerns with this legislation. They should be brought in front of the committee and listened to, and then the committee should try to figure out how to address those concerns, to make a better piece of legislation.

We have seen the Liberal government react and react and react, in so many situations. To me, this looks like another example where it is reacting. It is basically just doing lip service and then it will throw it to the committee to do the work. This should have been done a long time ago. For eight years, we have been vulnerable. What could have happened in those eight years could have been life-changing for a lot of Canadians, because of the lack of forethought or good policy out of the Liberal government.

If we think about it, it is a talking point that the Liberals have done here. They have put some stuff together and thrown it into the House to say they are working on cybersecurity, but it is half done. The committee is now going to have to do the rest of the job, to actually finish it and hopefully get a good piece of legislation.

That is in question, because we do have a Liberal-NDP government here. They tend to side with each other all the time. Will they side together here, or will they actually take a step back and say, yes, we have to do what is right for Canadians and address the issues that have been raised by different associations and different groups? Are they going to look at what they can do to make this a better piece of legislation, or are they going to stick to their partisan angles and dig in their heels? If they do that, the people who really lose out are Canadians. They are the people who will be impacted by a cyber-attack, because we did not put the proper safeguards in place.

We should not think that this will not have an impact on our economy. A good example we have just seen is the cyber-attack on Indigo last week. Its computer systems are down as we speak. It is telling customers they cannot buy books online. They actually have to go to a storefront to buy their books because of a cyber-attack, a ransomware attack.

We have seen, over and over again, different schools and universities facing these types of attacks. They need to know that the government is there and is going to be there to help them. They need to know that the people who are doing these attacks will be identified and somehow dealt with, if possible. We understand that a lot of these attacks happen from Russia or North Korea, outside of our territory, but when they happen from within Canada, we want to make sure that the people who are doing these types of things are properly dealt with. We want to make sure that this does not happen again. We want to make sure we learn from the experience so it cannot happen again.

There are lots of things in this legislation that can be really good if it is dealt with properly, but it has to go to committee. I think Conservatives have been very clear. We want to see this go to committee. I just hope the committee members are able to actually do the work that is required to take a piece of legislation that is mediocre at best and make it into something that will work for all Canadians.

[Fraser Tolmie, Conservative, Moose Jaw—Lake Centre—Lanigan, SK]

Mr. Speaker, it is always an honour to rise in this House on behalf of the people of my riding of Moose Jaw—Lake Centre—Lanigan.

The safety and security of our nation is of paramount importance, and I understand the need to enhance the safety and security of Canadians, both here at home and abroad. This would include many of our international corporations, which are large contributors to our economic base, and of course our own government institutions and interests. Having the opportunity to speak to cybersecurity in Canada gives us an opportunity to enhance or increase our country's ability to protect us from cyber-threats.

A significant concern for all Canadians is security. This concern has increased in recent times, as we see the rise in organized crime and gang-related offences, which have gone up 92%. The question I ask myself when I see this increase is this: Will the Liberal government be led by evidence and act on the evidence that has been reported?

Cybersecurity is extremely important for our nation to protect itself from inside and outside threats. I welcome Bill C-26, but I do have some concerns pertaining to the success of the bill, and one concern is about accountability. This is a question that we in opposition bring up every day in this House and regularly.

Bill C-26 is essentially divided into two different parts. The first part is to amend the Telecommunications Act to promote the security of the Canadian telecommunications system, adding security as a policy objective; to bring the telecommunications sector in line with other infrastructure sectors; and to secure Canada's telecommunications system and prohibit the use of products and services provided by specific telecommunications service providers. This amendment would enforce the ban on Huawei Technologies and ZTE from Canada's 5G infrastructure and would remove or terminate 4G equipment by the year 2027. What stands out to me, which has been a concern, is the time that it took the government to react to enforce the ban on Huawei.

The second portion of this bill is to enact the critical cyber systems protection act, or CCSPA, designed to protect critical cyber systems and “systems that are vital to national security or public safety and that are delivered or operated...within the legislative authority of Parliament.” As a report by Norton Rose Fulbright notes, the purpose of the CCSPA is, first, to “[e]nsure the identification and effective management of any cybersecurity risks, including risks associated with supply chains and using third-party products and services”; second, to “[p]rotect critical cyber systems from being compromised”; third, to “[e]nsure the proper detection of cybersecurity incidents”; and finally, to “[m]inimize the impacts of any cybersecurity incidents on critical cyber systems.”

The impacts of this bill would be far-reaching, and here are the things that need to be considered when this bill is in place. The government would have the power to receive, review, assess and even intervene in cyber-compliance and operational situations within critical industries in Canada; to make mandatory cybersecurity programs for critical industries; and to enforce regulations through regulatory and legal enforcement, with potential financial penalties. With this in place, the Governor in Council and the Minister of Industry would be afforded additional powers.

As the report notes:

If any cybersecurity risks associated with the operator’s supply chain or its use of third-party products and services are identified, the operator must take reasonable steps to mitigate those risks. While the Act doesn’t give any indication of what kind of steps will be required from operators, such steps may be prescribed by the regulations [at committee].

It goes on:

The Act also addresses cybersecurity incidents, which are defined as incidents, including acts, omissions or circumstances, that interfere or could interfere with the continuity or security of vital services and systems, or the confidentiality, integrity or availability of the critical cyber systems touching upon these vital services and systems. No indication is given as to what would constitute interference under the Act. In the event of a cybersecurity incident, a designated operator must immediately report the incident to the CSE and the appropriate regulator. At present, the Act does not prescribe any timeline or give other indication as to how “immediately” should be interpreted.

Some deficiencies in Bill C-26, as it is presently drafted, can be listed as follows:

The breadth of what the government might order a telecommunications provider to do is not sufficiently bounded.

The secrecy and confidentiality provisions imposed on telecommunications providers threaten to establish a class of secret law and regulations.

There is a potential for excessive information sharing within the federal government and with international partners.

The costs associated with compliance with reforms may endanger the viability of smaller providers.

The vague drafting language means that the full contours of the legislation cannot be assessed.

There exists no recognition of privacy or other charter-protected rights as a counterbalance to the proposed security requirements, nor are appropriate accountability or transparency requirements imposed on the government.

Should these recommendations or ones derived from them not be taken up, the government could be creating legislation that would require the public and telecommunications providers to simply trust that it knows what it is doing and that its actions are in the best interests of everyone.

Is it reaching the right decision to say that no need exists for broader public discussion concerning the kinds of protections that should be in place to protect the cybersecurity of Canada's telecommunications and networks? The government could amend its legislation to ensure its activities conform with Canada's democratic values and norms, as well as transparency and accountability.

If the government is truly focused on security for Canadians, should we not start by reviewing the gang and organized crime evidence showing that our present policies have failed? Should we not look at safety and security in our bail reform to protect innocent Canadians who become victims?

If Bill C-26 is a step in protecting Canada from cybersecurity threats, what is the review process to ensure compliance? What is the review process to ensure effectiveness and goals are met when we look at Bill C-75 regarding bail reform? The NDP-Liberal government is not interested in reviewing bail reform even though the evidence clearly shows that Bill C-75 failed.

Cybersecurity is important to our country's security, as are the victims of crime after their safety and security are violated. I am deeply concerned that the government is struggling with evidence-based information to review Bill C-26, as Bill C-75 and Bill C-5 are not supported by evidence. In fact, offenders and criminals are a higher priority than their victims are. My concern is if Bill C-26 requires amendment or review.

Bill C-26 proposes compliance measures intended to protect cybersecurity in sectors that are deemed vital to Canadian security. Therefore, although late out of the gate, Bill C-26 is a start.

In conclusion, I would like to see some clear accountability to ensure the objectives of this bill are met and that a proper review process is conducted that holds individuals, corporations, and most importantly, our government accountable.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Mr. Speaker, I really appreciate the debate and the questions my colleague posed.

I think most Canadians back home watching this are wondering what the technical nuances are of everything we are discussing with respect to this legislation. We have even had some members of Parliament stand up here and say that they do not feel properly equipped to have this conversation.

I think one thing that everybody back home can relate to is seeing something on the news stating that the credit card information of a million people has been stolen or the data of some businesses that might have their personal information is now being held hostage in a ransomware attack. That is why this is a very important debate. I will be speaking about this a bit later.

I think the bill is missing the component of protecting the personal information of Canadians. Can my colleague tell us his thoughts on the bill in this regard? My speech will focus on the advances in technology and network infrastructure, as well as the rapid pace of technological development. With this bill, would we actually be able to keep up with the threats we are facing?

[Fraser Tolmie, Conservative, Moose Jaw—Lake Centre—Lanigan, SK]

Mr. Speaker, Canadians are very trusting people. We like to give. However, when we buy into something, such as an app, we are giving over some vital information that is ours. We have seen cases where people had that information abused, and there has been no full disclosure. This is one of the concerns I have with the bill.

There are concerns that we have already witnessed in this country in terms of different businesses; a colleague mentioned Indigo being attacked. My hope is that, during committee, we ensure that we are protected. We have a responsibility to Canadians to protect them.

[Andréanne Larouche, Bloc, Shefford, QC]

Mr. Speaker, I am hearing some contradictions from my Conservative colleagues today. My colleagues in the Bloc have perhaps done a better job than me of explaining the importance of banning Huawei and the fact that Canada has been slow to do so. My Conservative colleague also mentioned it, but one of the Conservative leadership candidates actually worked for Huawei, so one wonders which way the Conservatives are leaning.

I met with an interdisciplinary cybersecurity research group and learned some fascinating things. Canada's bureaucracy is really slow when it comes to cybersecurity. The research chair at the Université de Sherbrooke criticized the fact that the cybersecurity issue was allowed to drag on under the pretext that it was not yet an election issue. Now it is finally becoming one. That is exactly what we are seeing right now with China's interference.

The Conservatives were not very quick either, because we are behind many other countries. The first RCMP report on cybercrime was not released until 2014, and the report was criticized at the time for containing no numbers, no statistics. The comments were general and predictable, and there were no forecasts. Things have not happened fast enough.

Here we are in 2023, and we really have a lot of ground to make up compared to many other countries, especially European countries. I think it is time to turn this over to the committee, make up for lost time, and pick up the pace on this bill.

[Fraser Tolmie, Conservative, Moose Jaw—Lake Centre—Lanigan, SK]

Mr. Speaker, I agree with the member that when the bill is in committee, this issue has to be really focused on. Obviously, we want it to move swiftly but not at the expense of overlooking some of the potential pitfalls that will impact Canadians. I think we have to trust the committee to actually make good amendments on this.

[Bonita Zarrillo, NDP, Port Moody—Coquitlam, BC]

Mr. Speaker, I would ask the member about the secrecy and lack of transparency. Does the member believe that the committee can solve this, or is this bill just too shallow for it to go forward?

[Fraser Tolmie, Conservative, Moose Jaw—Lake Centre—Lanigan, SK]

Mr. Speaker, we always give loaded questions.

I would have to say that, obviously, when one is a member of Parliament, one's honour is on the line all the time. I would hope that our ability to restore honour in our profession always depends on our own moral compass. Sometimes we see that fail, and it is disappointing. However, I really hope this committee can get its act together and get this sorted out.

[Clifford Small, Conservative, Coast of Bays—Central—Notre Dame, NL]

Mr. Speaker, there is a pressing need to secure Canada's critical infrastructure against cyber-threats.

Computer systems, which run our health care, energy and financial systems, are targets for criminals and foreign adversaries to attack. Disruption of medical services at a hospital or electricity through a grid would have severe consequences, possibly including injury or death.

This is exactly what happened on October 30, 2021, in my province of Newfoundland and Labrador. My hon. colleague across the way agrees with what I am saying because he, his family members or his friends, I am sure, had some of their personal information breached in that attack.

Personal information belonging to thousands of patients and employees was obtained through a cyber-attack on Eastern Health. In fact, over 200,000 files were taken from a network drive in Eastern Health's IT environment. Over 58,000 patients and almost 300 staff and former staff had their personal data breached.

The information taken included health records, medicare plan numbers, dates of birth, names and addresses. In fact, some even had their social insurance numbers taken. The immediate result was that a complete shutdown of the health care system took place throughout the entire province.

Patients who had waited through the pandemic found that critical care for such things as cancer and heart disease were put on hold. Many had to wait weeks or even months to have their appointments rescheduled. Some of these folks had poor outcomes. In fact, people's lives were shortened in some cases as a result of the cyber-induced shutdown of the health care system in Newfoundland and Labrador.

This is very serious stuff. This was not the first time such a cyber-attack happened in Canadian health care. In October of 2019, three hospitals in Ontario were victimized in a similar fashion.

On another note, a pipeline company in the United States fell victim to hackers in 2021. This led to diesel and jet fuel shortages, disrupting most of the economy of the eastern seaboard of our neighbour to the south.

These are just a few examples of catastrophic outcomes resulting from cyber-attacks in recent years. Canadians need protection from these types of attacks. This legislation is intended to align with the actions of our allies in the Five Eyes. This bill would give clear legislative authority to the government to prohibit high-risk entities, such as Huawei, from assuming critical roles in our cyber-infrastructure.

This legislation is filled with good intentions. Currently, a cybersecurity incident is defined as:

an incident, including an act, omission or circumstance, that interferes or may interfere with

(a) the continuity or security of a vital service or vital system; or

(b) the confidentiality, integrity or availability of the critical cyber system.

There is no indication given as to what would constitute interference under the bill. Does this mean that the cyber-attack on Newfoundland and Labrador health care would not be classified as interference?

In addition, there is no timeline specified in this bill for the reporting of cybersecurity incidents to the CSE and the appropriate regulator. The bill says that reporting must be immediate. “Immediate” is not interpreted in this bill. Is it one hour, one day or one week? This is something we need to know.

In terms of civil liberties and privacy, technical experts, academics and civil liberties groups have serious concerns about the size, scope and lack of oversight of the powers that the government would gain under the bill.

In late September 2022, the Canadian Civil Liberties Association, the International Civil Liberties Monitoring Group and the Privacy and Access Council of Canada, as well as several other groups and academics, released their joint letter of concern regarding Bill C-26.

While stating the collective's agreement with the goal of improving cybersecurity, the joint letter goes on to state that the bill is “deeply problematic and needs fixing”, because “it risks undermining our privacy rights, and the principles of accountable governance and judicial due process”.

The joint letter outlines several areas of concern, including increased surveillance. The bill would allow the federal government “to secretly order telecom providers to ‘do anything, or refrain from doing anything’” necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.

While this portion of the bill goes on to list several examples of what “doing anything” might entail, including, for example, prohibiting telecom providers from using specific products or services from certain vendors or requiring certain providers to develop security plans, the collective expresses the concern that the power to order a telecom to do anything “opens the door to imposing surveillance obligations on private companies, and to other risks such as weakened encryption standards”.

Bill C-26 would allow the government to “bar a person or company from being able to receive specific services, and bar any company from offering these services to others, by secret government order”, which raises the risk of “companies or individuals being cut off from essential services without explanation”.

The bill would provide for a collection of data from designated operators, which could potentially allow the government “to obtain identifiable and de-identified personal information and subsequently distribute it to domestic, and perhaps foreign, organizations.”

There is a lack of “guardrails to constrain abuse”. The bill would allow the government to act without first being required to perform “proportionality, privacy, or equity assessments” to hedge against abuse. This is concerning to the collective, given the severity of the penalties available under the statute.

There is the potential for abuse by the Communications Security Establishment, the federal agency responsible for cybersecurity but, more prominently, signal intelligence. The CCSPA would grant the CSE access to large volumes of sensitive data. However, it would not constrain its use of such data to its cybersecurity mandate.

The civil liberties of Canadians are already under attack. Bill C-26 does not accurately enough define how our civil liberties would be protected. Given the need for protection from cyber-attacks, a bill like this is quite necessary, no doubt.

In its current form, with so many unknowns for Canadians, I will not be able to support it. However, I do support sending it to committee for some input from Canadians and for some fine tuning, to turn it into an instrument to protect us all from cyber-attacks.

[Ken McDonald, Liberal, Avalon, NL]

Mr. Speaker, it seems that the Conservative Party keeps pointing out the flaws or weaknesses in this bill as it is put forward. However, I wonder, if it goes to committee and gets amended, does the member think it would prevent the so-called robocall scam that happened a few years back, when the Conservative Party was found guilty of using it during an election?

[Clifford Small, Conservative, Coast of Bays—Central—Notre Dame, NL]

Mr. Speaker, I am sure that sending this bill to committee will make some improvements. It is unfortunate that my bill, Bill C-251, did not get the opportunity to get to committee and get improved. My hon. colleague is quite aware of the ill consequences of not allowing legislation to get to committee and to be improved, to seal the deal and have positive outcomes for all Canadians.

[Mel Arnold, Conservative, North Okanagan—Shuswap, BC]

Mr. Speaker, it is a pleasure to take this debate from coast to coast. I live on the west coast, and I thank the member for Coast of Bays—Central—Notre Dame for presenting from the east coast.

Recently, we had a cyber-attack on Okanagan College in my riding of North Okanagan—Shuswap. It is always an honour to rise as the representative from that area.

Does my colleague for Coast of Bays—Central—Notre Dame think that this bill will address the concerns that were obviously brought to light there, when the college was basically shut down for weeks after the Christmas break? Students could not access their files. Basically, the entire college system was shut down.

If this bill is needed, I wonder if the member has a comment as to why it has taken the government seven and a half years to address this, when our party brought to its attention the potential issues with Huawei and its activities in Canada. Maybe the member would like to comment on that.

[Clifford Small, Conservative, Coast of Bays—Central—Notre Dame, NL]

Mr. Speaker, it is great to take a question from my colleague, who has constituents who have had hard times due to cyber-attacks. I hope this bill can stop that from happening. I also hope that my hon. colleague can bring some of these people who were affected by a cyber-attack to committee and let them have their input as the bill is being debated and amended.

I am sure this bill is going to need quite a lot of amendments if it is anything like most of the legislation that has come from the government.

[Marc Dalton, Conservative, Pitt Meadows—Maple Ridge, BC]

Mr. Speaker, I get the impression on this side of the House that the Liberals only come forward with measures to do anything when their feet are put to the fire. We had an example of that today, with the Prime Minister announcing the appointment of a rapporteur, which is a good French word. How many Canadians even know what the word means? He is throwing these measures out to make it look like he is doing something. It is not happening. It is simply not happening. It is to make it look like they are doing something. Canadians see through this.

I wonder if the member could talk about one of the half-measures that the Liberals are doing with this bill.

[Clifford Small, Conservative, Coast of Bays—Central—Notre Dame, NL]

Mr. Speaker, I cannot really concentrate. My hon. colleague came up with that word that I cannot even make sense of. That reminds me of the Prime Minister's dad with his famous “fuddle duddle”. What does “fuddle duddle” mean? I do not know what “rapporteur” is. I am hoping that this bill addresses some of my hon. colleague's concerns.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Mr. Speaker, I appreciate the fact that we have the ability to have this debate in the House of Commons today. It has been lively, and I have enjoyed it, but I am going to remind Canadians, who might be watching at home, and my colleagues who are here, just how rapidly technology has advanced in the course of our lifetimes.

One of the last jobs that I did prior to becoming a member of Parliament here in the chamber was as a tenured faculty member at Red Deer College in Red Deer, Alberta, where I was a member of the computer systems technology department. I taught computing systems to students there for a number of years. It was a great job with brilliant minds of the young people who had come to that college.

I learned all about computing when I was an adult. I did not have the privilege of growing up inside a computer. Those of us in the room who are old enough to know, back in the mid-1990s, an old IBM 386DX used to cost hundreds, if not thousands of dollars, for computing power that right now would not even match an outdated, obsolete iPhone.

I would remind the people watching what the significance of this debate is and why the legislation we are discussing, and hopefully sending to committee, is so important.

If we go back to the 1960s, the development of ARPANET is where the foundations of the Internet started. The transmission rate of data at ARPANET, which was a military defence network, and as I said, the founder of the Internet, was 56 kilobytes per second. Now, in 2022, we are at 5U, which is 100 megabits per second. This is an absolutely astounding rate of growth in the ability to move information from point A to point B.

The growth since 1983 is based on Nielsen's Law on bandwidth. Basically, every year we increase the capacity to send information over a network by 50%, which is an exponential number that keeps going up. It is not 50% of where we started from. It is 50% from now. If we could do compound interest in the financial system that would give us a 50% compound interest return, we would be doing quite well. However, this is how fast the network processing, or the bandwidth, is growing in the world.

If we take a look at Moore's law, when it comes to the ability of microchip processing, transistors on a microchip double every two years, which is what they said back in the mid-1960s. In 1970, there were just over 1,000 transistors on a microchip. Now, there are 50 billion transistors on a single microchip. That is an insane amount of computational power, and coupled with the bandwidth that I just talked about, leaves us in a situation where parliamentarians and politicians need to be cognizant of the scale of the capacity of what we are talking about.

Let us go back to the early 1990s and a computer at that point in time. We measure computational power in things like FLOPS, or floating point operations per second, and MIPS, or million instructions per second. A computer back in the early 1990s could do under 1,000 calculations per second. Today, we are well over a billion computations per second, and that is floating point operations, which are more complicated than even just the millions of instructions per second. We can just take a look at that efficiency.

When we talk about going back to original computers, we talk about the Harvard Mark II, which I think weighed 23 tonnes. Now, with today's technology, the demand of energy per unit of processing or unit of computing power has actually been cut in half every 18 months, which means that every 18 months, the amount of energy and power that it took to do the same job is now half of what it was. This is allowing for massive growth. We see things springing up all the time. We have Bitcoin mining operations using massive amounts of electricity. Can members imagine if we tried to use that much electricity using older computers? It would have been absolutely astounding.

On storage, I am not talking about memory in the computer, and I already talked about the microchip storage. However, when I was teaching at Red Deer College, we got these hard drives that came in so that we could play around with a hard drive. Now, I am mostly a software guy. I was a programmer and database administrator, but I had to learn a little bit about the hardware.

We had a 420-gigabyte hard drive. It might have been a megabyte, but I think it was a gigabyte, but oh my goodness. I remember we had 20-gigabyte hard drives. Who can remember when they were excited about having a 20-gigabyte hard drive?

In the 1950s, if we go back to early computing, the cost to store one terabyte of data, using that technology and working backwards on the cost of a unit of storage and the evolution of computing, it would have cost over $100 trillion. Today, for less than $100, people can go to a computer store and buy a hard drive or a disk for their computer that contains well over a terabyte of data.

Why is this history lesson so important? It is because we are moving into an age of artificial intelligence. Some of my colleagues have expanded upon the importance of artificial intelligence in their speeches earlier. I listened with great anticipation to what they said.

What does the requirement for computational power and bandwidth require for artificial intelligence? Today's computers, looking at artificial intelligence, are actually using something called petaFLOPS, that is 10 to the 15th, a quadrillion floating point operations per second. That computational power exists in our networks that are out there that are now hooked up with 5G networks that can operate at 100 megabits per second.

The amount of technology and the availability of technology and the ability of that technology in today's standards are absolutely amazing. In fact, because of these advances in technology, we now have some pretty amazing facts. A television today, a software game, any of our intelligence toys, anything that requires computing is 35% lower in cost relative to income than it was just 20 years ago. Meanwhile, college tuition, education and so on have gone up over 150% in the same time frame. That tells us the vast amount of research and technology that has been put in place on the development of this technology.

That is why it is so important. Artificial intelligence is a conversation that we should be having in this House, and cybersecurity is certainly a part of that. Everybody knows, we are watching the news, and we see some great potential uses. That is the thing; everything that is designed to make our lives better, more efficient and more productive could also be used for evil.

I am not accusing anybody of using it for evil. That is not the point I am making. However, everything we want to use for good, somebody else could use with malicious intent.

I will just give a couple of examples. We have had the conversation today about the amount of personal information that has been lost, hacked and held hostage through various cyber-attacks. We know that the People's Liberation Army in China has tens of thousands of people working, just in their cyber-attack divisions alone. Just to keep in mind, for the people who are watching at home, Canada's entire military hovers between 60,000 and 70,000 people. The People's Liberation Army, just in their cyber-intelligence division alone, would have more people than the entire Canadian Armed Forces across all three of our divisions.

These are the folks, coupled with our security establishment, who need to have the tools to defend us, our networks, our infrastructure and all the critical things that we do. We are talking about hospitals, electricity grids and all these things. Imagine something as simple as a driverless or autonomous vehicle. An autonomous vehicle can now drive itself, and the reason it can do it is because we have that 5G technology, and we have the cameras and the ability for that car to make intelligent, informed decisions at the calculation rate, because of the advances in computers that I just talked about. Imagine what somebody with malicious intent could do with an autonomous car, if they wanted to.

That is why we have to get the cybersecurity question right in this debate. If we leave our systems vulnerable, if we leave ourselves open to the possibility, and we are never going to be perfect, and for everything we do, somebody with malicious intent could find a workaround for it, so we have to keep it up to speed.

With all the facts I just talked about, the doubling of technology and computing power and the halving of electricity requirements, we need to be very clear. This is the one piece of advice that I will offer to my friends across the way in the government, because this is too important not to be working together on this. The technology is growing and developing at such a rapid pace that I really do hope that we and the government have the ability to put in some clauses to review this, because it is just so important that we get this right and constantly review our cyber defences and cybersecurity in this country.

The House resumed from March 6 consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[Chandra Arya, Liberal, Nepean, ON]

Mr. Speaker, I rise today to speak to Bill C-26, an act about cybersecurity. In the 21st century, cybersecurity is national security, and it is our responsibility to protect Canadians from growing cyber-threats. We have to take the necessary steps to protect Canadians and our telecommunications infrastructure. Canadians must have confidence in the integrity, authenticity and security of the products and services they use every day.

This bill reflects the values of Canadians and is in line with our closest allies, including our Five Eyes partners. That is why we are investing in cybersecurity, ensuring respect for the privacy of Canadians and supporting responsible innovation. We will continue to protect Canadians from cyber-threats in an increasingly digital world. As said in our international cybersecurity overview, a free, open and secure cyberspace is critical to Canada’s economy, social activity, democracy and national security.

Canada faces cybersecurity risks from both state and non-state actors. Protecting Canada’s and Canadians’ cyber-infrastructure from malicious actors is a serious challenge and a never-ending task. Canada works with allies and partners to improve cybersecurity at home and to counter threats from abroad. This includes identifying cyber-threats or vulnerabilities and developing capabilities to respond to a range of cyber-incidents.

A few years back, we put forward the national cybersecurity strategy, a vision for security and prosperity in the digital age. As mentioned there, virtually everything Canadians do is touched by technology in some way. We are heavily interconnected and networked, a fact that not only enhances our quality of life but also creates vulnerabilities. From commercial supply chains to the critical infrastructure that underpins our economy and our society, the risks in the cyberworld have multiplied, accelerated and grown increasingly malicious.

Major corporations, industries and our international allies and partners are engaged in the global cyber-challenge, but many others are not and that represents a significant risk. The strategy's core goals were reflected in budget 2018, where $500 million was invested in cybersecurity. Part of the funding was for the new Canadian Centre for Cyber Security, which is Canada’s technical authority on cybersecurity. It is part of the Communications Security Establishment, and it is the single, unified source of expert advice, guidance, services and support on cybersecurity for Canadians and Canadian organizations.

It regularly publishes the “National Cyber Threat Assessment”, and I would like to quote from their latest one for 2023-24. It states:

Canadians use the Internet for financial transactions, to connect with friends and family, attend medical appointments and work. As Canadians spend more time and do more on the Internet, the opportunities grow for cyber threat activity to impact their daily lives. There’s been a rise in the amount of personal, business and financial data available online, making it a target for cyber threat actors. This trend towards connecting important systems to the Internet increases the threat of service disruption from cyber threat activity. Meanwhile, nation states and cybercriminals are continuing to develop their cyber capabilities. State-sponsored and financially motivated cyber threat activity is increasingly likely to affect Canadians.

In the latest assessment, they chose to focus on five cyber-threat narratives that they judge are the most dynamic and impactful.

First, ransomware is a persistent threat to Canadian organizations. Cybercrime continues to be the cyber-threat activity most likely to affect Canadians and Canadian organizations. Due to its impact on an organization’s ability to function, ransomware is almost certainly the most disruptive form of cybercrime facing Canadians. Cybercriminals deploying ransomware have evolved in a growing and sophisticated cybercrime ecosystem and will continue to adapt to maximize profits.

Second, critical infrastructure is increasingly at risk from cyber-threat activity. Cybercriminals exploit critical infrastructure because downtime can be harmful to industrial processes and the customers they serve. State-sponsored actors target critical infrastructure to collect information through espionage, to pre-position themselves in case of future hostilities and as a form of power projection and intimidation.

Third, state-sponsored cyber-threat activity is impacting Canadians. State-sponsored cyber-threat activity against Canada is a constant, ongoing threat that is often a subset of larger, global campaigns undertaken by these states. State actors can target diaspora populations and activists in Canada, Canadian organizations and their intellectual property for espionage, and even Canadian individuals and organizations for financial gain.

Fourth, cyber-threat actors are attempting to influence Canadians, degrading trust in online spaces. Cyber-threat actors' use of misinformation, disinformation and malinformation, collectively referred to as MDM, has evolved over the past two years. Machine learning-enabled technologies are making fake content easier to manufacture and harder to detect. Further, nation-states are increasingly willing and able to use MDM to advance their geopolitical interests.

Fifth, disruptive technologies bring new opportunities and new threats. Digital assets, such as cryptocurrencies and decentralized finance, are both targets and tools for cyber-threat actors to enable malicious cyber-threat activity. Machine learning has become commonplace in consumer services and data analysis, but cyber-threat actors can deceive and exploit this technology. Quantum computing has the potential to threaten our current systems of maintaining trust and confidentiality online. Encrypted information stolen by threat actors today can be held and decrypted when quantum computers become available.

Simply put, cyber-threats pose a growing risk to all Canadians and institutions. We are confronting this threat head-on. Our government regularly engages with domestic and international cybersecurity partners to protect Canada’s critical infrastructure and the systems that underpin essential services. We are working closely with critical infrastructure stakeholders and partners to ensure that they are better prepared to face cyber-based threats.

Our cybersecurity framework continues to detect, deter and disrupt state and non-state actors attempting to take advantage of the Canadian cyber-landscape. Our government is, and will always be, ready to respond to any malicious cyber-acts that threaten Canadian interests.

To conclude, the purpose of this act is to help protect critical cyber systems in order to support the continuity and security of vital services and vital systems by ensuring that, first, any cybersecurity risks with respect to critical cyber systems are identified and managed; second, critical cyber systems are protected from being compromised; third, any cybersecurity incidents affecting, or having the potential to affect, critical cyber systems are detected; and finally, the impacts of cybersecurity incidents affecting critical cyber systems are minimized.

[Denis Trudel, Bloc, Longueuil—Saint-Hubert, QC]

Mr. Speaker, speaking of cybersecurity, I would like to hear what my colleague thinks of the allegations made in the Journal de Montréal two or three weeks ago about a woman of Chinese descent who was elected as a Brossard city councillor. We know that she was the director of two Chinese community centres, one in Montreal and one in Brossard, that are suspected of having become Chinese police stations.

It is suspected that this woman got elected to Brossard's city council because people from the Chinese government sent WeChat messages to members of Brossard's Chinese community, telling them to vote for her. This woman is believed to be a Chinese operative. There is a link to the Chinese government, which is using digital platforms to influence our municipal and even provincial and federal elections.

I would like to know what my colleague thinks about that. Does this not prove that it is more urgent than ever to launch an independent public inquiry into Chinese interference in this country?

[Chandra Arya, Liberal, Nepean, ON]

Mr. Speaker, the hon. colleague mentioned the growing importance of protecting Canadians and Canada from state-sponsored activities with respect to cybersecurity. State actors are very active in exploiting advanced technologies to create disruption and to erode trust in our systems and institutions, so that is one of the major objectives of our government in proposing this bill.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Mr. Speaker, the government seems to be granting itself some pretty broad powers in the bill, especially to the Minister of Public Safety and the Minister of Industry. Maybe my colleague can explain, and assure Canadians, how these powers would not be unjustly applied to ordinary Canadians who have done absolutely nothing wrong.

[Chandra Arya, Liberal, Nepean, ON]

Mr. Speaker, with our system of checks and balances, like here in the House, the government is held to account by the opposition benches, which is one of the ways the government's powers and the ministers' powers are monitored and controlled.

There is a broader aspect to this. This legislation deals with evolving technologies, which are very difficult to even define in the legislation. The legislation cannot be changed or amended frequently, which is why the legislation provides more opportunities for the government or the ministers of the day to pass on regulations so that they can immediately identify those and take remedial measures.

[Earl Dreeshen, Conservative, Red Deer—Mountain View, AB]

Mr. Speaker, it has been reported that small and medium-sized businesses could face immense financial pressure from increased red tape and reporting measures. The Business Council of Canada, in an open letter, indicated that businesses were concerned with the added red tape and the impact it would have on small and medium-sized businesses.

We realize, at least on this side of the House, that small and medium-sized businesses are the backbone of the economy. Is this the time to be adding more financial pressures to these businesses? Can the member think of alternative ways of being able to satisfy that?

[Chandra Arya, Liberal, Nepean, ON]

Mr. Speaker, I agree with the member that small businesses are the backbone of Canada and the Canadian economy, with the majority of Canadians working in small and medium-sized businesses.

Related to this bill is the fact that this issue affects small-sized businesses disproportionately more, because they do not have enough resources to protect themselves from cyber-threats. In fact, as I mentioned in my speech, the new Canadian Centre for Cyber Security, which is part of the Communications Security Establishment, is there to provide expert advice, guidance, and service and support on cyber-threats and cybersecurity to Canadian organizations.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, it is a pleasure to rise and join the debate this morning in the House of Commons. I will be sharing my time with the member for Fort McMurray—Cold Lake.

Bill C-26 is a bill that addresses an important and growing topic. Cybersecurity is very important, very timely. I am glad that, in calling this bill today, the government sees this as a priority. I struggle with trying to figure out the priorities of the government from time to time. There were other bills it had declared as absolute must-pass bills before Christmas that it is not calling. However, it is good to be talking about this instead of Bill C-21, Bill C-11 or some of the other bills that the Liberals have lots of problems with on their own benches.

Cybersecurity is something that affects all Canadians. It is, no doubt, an exceptionally important issue that the government needs to address. Cybersecurity, as the previous speaker said, is national security. It is critical to the safety and security of all of our infrastructure. It underpins every aspect of our lives. We have seen how infrastructure can be vulnerable to cyber-attacks. Throughout the world, we have seen how energy infrastructure is vulnerable, like cyber-attacks that affect the ability to operate pipelines. We have seen how cyber-attacks can jeopardize the functioning of an electrical grid.

At the local level, we have experienced how weather events that bring down power infrastructure can devastate a community and can actually endanger people's health and safety. One can only imagine what a nationwide or pervasive cyber-attack that managed to cripple a national electrical grid would do to people's ability to live their lives in safety and comfort.

Cyberwarfare is emerging as a critical component of every country's national defence system, both offensively and defensively. The battlefield success of any military force has always depended on communication. We know now just how dependent military forces are on the security of their cyber-communication. We see this unfolding in Ukraine, resulting from the horrific, criminal invasion of that country by Putin. We see the vital role that communication plays with respect to the ability of a country to defend itself from a foreign adversary, in terms of cybersecurity.

I might point out that there is a study on this going on at the national defence committee. We have heard expert testimony about how important cybersecurity is to the Canadian Armed Forces. We look forward to getting that report eventually put together and tabled, with recommendations to the government here in the House of Commons in Canada.

We know that critical sectors of the Canadian economy and our public services are highly vulnerable to cyber-attack. Organized crime and foreign governments do target information contained within health care systems and within our financial system. The potential for a ransom attack, large and small, is a threat to Canadians. Imagine a hostile regime or a criminal enterprise hacking a public health care system and holding an entire province or an entire country hostage with the threat to destroy or leak or hopelessly corrupt the health data of millions of citizens. Sadly, criminal organizations and hostile governments seek to do this and are busy creating the technology to enable them to do exactly this.

The Standing Committee on Access to Information, Privacy and Ethics conducted three different studies while I was chair of that committee that were tied to cybersecurity in various ways. We talked about and learned about the important ways in which cybersecurity and privacy protection intersect and sometimes conflict. We saw how this government contracted with the company Clearview AI, a company whose business is to scrape billions of images from the Internet, identify these images and sell the identified images back to governments and, in the case of Canada, to the RCMP.

We heard chilling testimony at that committee about the capabilities of sophisticated investigative tools, spyware, used by hostile regimes and by organized crime but also by our own government, which used sophisticated investigative tools to access Canadians' cellphones without their knowledge or consent. In Canada, this was limited. It was surprising to learn that this happened, but it happened under judicial warrant and in limited situations by the RCMP. However, the RCMP did not notify or consult the Privacy Commissioner, which is required under Treasury Board rules. This conflict between protecting Canadians by enforcing our laws and protecting Canadians' privacy is difficult for governments, and when government institutions like the RCMP disregard Treasury Board edicts or ignore the Privacy Commissioner or the Privacy Act, especially when they set aside or ignore a ruling from the Privacy Commissioner, it is quite concerning.

This bill is important. It is worthy of support, unlike the government's somewhat related bill, Bill C-27, the so-called digital charter. However, this bill, make no mistake, has significant new powers for the government. It amends the Telecommunications Act to give extraordinary powers to the minister over industry. It is part of a pattern we are seeing with this government, where it introduces bills that grant significant powers to the minister and to the bureaucrats who will ultimately create regulations.

Parliament is really not going to see this fleshed out unless there is significant work done at committee to improve transparency around this bill and to add more clarity around what this bill would actually do and how these powers will be granted. There have been many concerns raised in the business community about how this bill may chase investment, jobs and capital from Canada. The prospect of extraordinary fines, without this bill being fleshed out very well, creates enormous liability for companies, which may choose not to invest in Canada, not fully understanding the ramifications of this bill.

There is always the capture. We have seen this time and time again with the government. It seems to write up a bill for maybe three or four big companies or industries, only a small number of players in Canada, and yet the bill will capture other enterprises, small businesses that do not have armies of lobbyists to engage the government and get regulations that will give them loopholes, or lawyers to litigate a conflict that may arise as a result of it. I am always concerned about the small businesses and the way they may be captured, either deliberately or not, by a bill like this.

I will conclude by saying that I support the objective. I agree with the concern that the bill tries to address. I am very concerned about a number of areas that are ambiguous within the bill. I hope that it is studied vigorously at committee and that strong recommendations are brought back from committee and incorporated into whatever the bill might finally look like when it comes back for third reading.

[Ken Hardie, Liberal, Fleetwood—Port Kells, BC]

Mr. Speaker, I would like to invite my hon. colleague to take a higher-level view of an important issue because we are dealing here with cybersecurity and the need for protections, but we are also looking at a realm of artificial intelligence and things like that. These are things that can happen. People can 3D-print a gun that cannot be picked up by airport security. There is a lot of technology out there that could be purposefully harmful to individuals or to our whole society. In that regard, given some of the other conversations we have had about gatekeepers, would the member care to put a frame around the kind of gatekeeping that he and his party see as essential and necessary for the purpose of protecting Canadians?

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, the primary function of government is to protect its citizens from external harm and to ensure that Canadians are able to live freely and safely in their communities.

I do have concerns about the gatekeeping aspect of this bill. I am concerned that if this bill does not get the balance of the regulation and the ability of commerce to continue, we will lose businesses and we will lose services and access to economic activity within Canada if we chase investment out through poorly thought-out regulations.

Yes, there is of course a delicate balance to be had. If we come down too hard on the side of regulation and gatekeeping, it will result in job loss and lack of investment, and the absence of investment would then compound businesses' abilities to actually deliver on cybersecurity.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Mr. Speaker, over the past few years, businesses and even political parties have been gathering data, whether through quizzes or games, not only on the person playing the game but also on all the contacts that person has on their phone.

I would like to know if my colleague finds this tactic to be ethical, given that these people were receiving unsolicited advertising. Does my colleague think the bill will put an end to this practice?

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, that may be a better question for the government to answer, but I do not believe this is the intent of this bill. This bill is about cybersecurity. The government has another bill before the House, Bill C-27, which is a bit closer to privacy changes. The government has not proposed changes to the Privacy Act or the Elections Act, so I do not think this bill is relevant to the question that the member raised. The member is getting away from cybersecurity and into the much broader rubric of the privacy of Canadians. She raises some points, but I do not actually connect them to this bill.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Mr. Speaker, I want to ask some questions of the hon. member that are more related. I know it is a bit away from this bill, but he mentioned in his speech the work we are doing in our defence committee on cyber-defence and cybersecurity. I have two questions.

There have been calls for the International Criminal Court to declare cyberwarfare an actual war crime. What does the member think about that?

There is also the fact that we heard that Canada and its security institutions actually overclassify information by about 90%, and that if we could declassify a lot of that information, this would significantly help those security organizations deal with the specific threats we are seeing. I want to hear the member's opinion on that.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, with respect to the first question, I will set it aside and await more testimony and discussion at the defence committee about that.

With respect to the second point, about the overclassification of information, that is a good one and I am glad the member raised it. It actually speaks to the overall culture of secrecy that exists in the Government of Canada. This is a real problem that has been ongoing for years. The current government ran on a platform in 2015 to let the sunshine in and we have absolutely unprecedented secrecy within the government. The member raises a good point around the overclassification of documents.

[Laila Goodridge, Conservative, Fort McMurray—Cold Lake, AB]

Mr. Speaker, it is wonderful to have an opportunity to speak to Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

I think this is such an important topic, and it is something we need to be very aware of, especially in this increasingly digital era. We are seeing more and more attacks on cybersecurity happening here in Canada and around the world. I support the overall concept of the bill, and I want to see it go to committee so that we can have further study, as well as some amendments to alleviate some of the concerns that I, some of my colleagues and different stakeholders have brought forward. However, I have some questions I want to pose and put forward in the hope that the minister will have a plan to address some of them.

One big question I have is that the bill is pretty vague when it comes to the definition of “critical infrastructure”. Coming from northern Alberta, critical infrastructure can look very different from what it would look like in a larger centre in an area further south. One of the things I immediately thought of was whether a pipeline would count as critical infrastructure. Frankly, in northern Alberta, at the very minimum, pipelines not only export our oil but also bring up gasoline and natural gas, which are the ways we heat our homes. Most homes, at least in the Fort McMurray area, are heated with natural gas. In the wintertime, specifically and especially, if somehow a natural gas pipeline were to be the target of a cybersecurity threat, that could actually have devastating consequences and cause thousands of people to freeze.

I think this is the kind of question we have as to what exactly critical infrastructure is.

One of the other big pieces is that critical infrastructure seems to be defined in terms of what small and medium-sized businesses and not necessarily different government actors have. Different layers of government have different pieces of infrastructure that could also be attacked by cybersecurity threats. I think of provincial governments. Some of the big pieces for cybersecurity threats would probably be in hospitals, but it could go far beyond just a hospital, depending on the community. In the case of a specific emergency, like a fire, flood or some other natural disaster, the definition of critical infrastructure might be very different.

While I understand the idea of keeping it broad, a hacker or bad actor could specifically target an area in the case of an emergency or natural disaster because they know we are already in a weaker state. I think it is important to have some pieces in place so there can actually be plans to ensure that is not going to happen. That is something the legislation needs to define, and I would urge us to define it and specifically include pipelines as part of critical infrastructure. This is especially the case because we have gone into this space where so much is digitized.

There is digitization in just about every aspect of our world, so it becomes a question of actually having to define some of these pieces. We cannot just leave this all up to regulation. I think some baselines need to be set out in this piece of legislation in order to make sure we are actually talking about the same things. In this way, we can plan for future pieces of infrastructure we do not currently know are important and part of this plan.

While the legislation would give absolutely broad and sweeping powers to government, it does not seem to have any safeguards in place. I think the lack of safeguards is very concerning. I think back to the floods that were experienced in southern Alberta in 2012. Through the process of those floods, for a number of reasons that were not necessarily well defined, the RCMP decided to go into High River and seize guns. The RCMP made a decision not to seize guns in Calgary or other communities, but in High River, it decided to go in and seize guns.

This is a piece where we need to be very careful and make sure we have some safeguards in place. Then, in the case where there is government overreach in trying to prevent a security threat, there is recourse available that is defined in the legislation. It should not be left to regulation, where it could be changed at the whim of a minister. This is so important.

Another big, important piece that is scary to me is the fact that the government has all this work in place to make sure that small and medium-sized businesses, and other businesses, have security plans, which they must send to the government. However, what work is the government doing specifically to ensure that it is prevented from being part of a security threat? How many times has the federal government been hacked? In recent memory, it has been hacked a number of different times in different ways. This may be our email system or the House of Commons intranet. Some of these pieces are very much at risk. Is it a smart idea, from a security standpoint, to have everything housed in one place? What kinds of safeguards would we have such that information is not accessible should that aspect of the government be hacked? In turn, we want to make sure hackers do not find out all of our security plans so they can get around them or mess with things they identify as unprotected. That is one of the interesting pieces.

The bill also stipulates that businesses are to share with government but not that the government has to share with businesses. While I understand part of why the government would do that, I think having a two-way dialogue when it comes to this information is going to be important. We should be trying to work towards best practices whenever possible. An organization in one part of the country might be doing something that is innovative and substantially safer for all Canadians that prevents security threats compared with another part. Such information should be shared, not just held by government, so we can build on best practices in case there is an emergency at some point.

The other big question I have with respect to this bill is: What has the government done to work with municipalities, provinces and first nations governments to ensure that this is going to respond to their cybersecurity threats and cybersecurity needs? This is a piece where I do not want to let perfect be the enemy of good. Quite frankly, we are not going to know what the next big threat is; however, we need to make sure we are protected and must try to apply as many best practices as possible so that we do not open ourselves up to unintended risks.

This is about making sure we are taking care of all the little links in the chain. We can have a very robust system and an amazing plan in place, but if we have one weak link, it counts for nothing. That is why we need to send the bill to committee now. We need to have some very robust conversations with security experts from around this country and the world to make sure we do not have any weak links in the chain. All it will take is one weak link for this entire pyramid to collapse. It will crumble apart. This is something that, as Canadians, we all need to be prepared for and ready to address, as well as having meaningful and robust conversations around it.

With that, I am thankful for this opportunity.

[Tako Van Popta, Conservative, Langley—Aldergrove, BC]

Mr. Speaker, I am reading from the summary of Bill C-26, which would amend the Telecommunications Act to “authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure” our telecommunications security.

Although it is a laudable goal, those are very broad powers to give to a minister. Does my colleague feel it is necessary to give such broad and unfettered authority to one person?

[Laila Goodridge, Conservative, Fort McMurray—Cold Lake, AB]

Mr. Speaker, my colleague actually brings up another big point that I did not get to in my speech. The amount of control that it provides to a few people is very concerning.

Some serious conversations are needed about what we are doing to ensure that it is not just one or two people making these decisions, especially as we explore whether we really want the government to be the sole keeper of all this information and give it that broad power. It could actually open us up to specific risks if a threat agent knows that the best way of going after us is to go after that one particular minister. That could create more of a risk, not less.

That is something we should explore and look at amending, not so we are removing that power, but so we are expanding or changing it to create those safeguards. This would make it very clear that a bad actor cannot just go after one minister or ministry and shut down an entire system.

[Martin Champoux, Bloc, Drummond, QC]

Mr. Speaker, as we know, technology is evolving at a frightening and unpredictable pace. It is exponential, according to all the experts.

I wonder if my colleague could comment on quantum computing, which is an extremely impressive technology that is evolving at an unbelievable pace.

I am wondering whether the contents of Bill C‑26 and the agility we write into legislation are sufficient to respond to any concerns we may have about evolving technologies, which often mean that governments become outdated.

I would like my colleague to comment on that.

[Laila Goodridge, Conservative, Fort McMurray—Cold Lake, AB]

Mr. Speaker, my colleague has pinpointed some very serious problems. The reality is that technology progresses at such a rapid pace that it is really difficult to have legislation in place to address the next steps.

It is crucial to have the best experts analyzing the flexibility of our legislation to ensure the protection and security of future technologies that will be implemented. This means not just for now, but for the future as well.

[Lisa Marie Barron, NDP, Nanaimo—Ladysmith, BC]

Mr. Speaker, we know that threats to cybersecurity are increasing and are very concerning. We are far behind other countries in our capacity to respond to them. We have heard from civil liberty groups that the surveillance provisions in this bill could be quite problematic.

Bearing in mind that we need to strengthen our cybersecurity, does the member have thoughts on the concerns or unknown ramifications that might result from this bill?

[Laila Goodridge, Conservative, Fort McMurray—Cold Lake, AB]

Mr. Speaker, my colleague actually highlights a very important issue here. While having security is critical for our cybersecurity system, we must also make sure that we are balancing this with civil liberties and not allowing personalized data to be shared in an unfettered way. We need safeguards in place so we are able to respond. In certain circumstances, we might have to have a bit of flexibility.

We also need to have safeguards in place, as well as ramifications, for when governments or businesses go beyond that space. We owe it to Canadians and to the world. We need to be safe, but we also need to protect one another. I do not think any member would like to have their personal telephone number shared with everyone across the country.

Without adequate safeguards, that information could possibly be shared, and these are the kinds of pieces that could create a lot of harm to each and every one of us. We have to have serious conversations about them.

The House resumed consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[John McKay, Liberal, Scarborough—Guildwood, ON]

Mr. Speaker, in some respects, Bill C-26 is quite complicated, but it is also quite simple. It aspires to have the risks of cybersecurity systems identified, managed and addressed so we are at much less risk because of our cyber system.

In the last while, I have had the good fortune to be the chair of the public safety committee in the previous Parliament, and I am now the chair of the defence committee. As such, I have listened to literally hours of testimony from people who are quite well informed on this subject matter. My advice to colleagues here is this: It behooves us all to be quite humble and approach this subject with some humility because it is extremely complex.

The first area of complexity is with respect to the definitions.

For instance, cybersecurity is defined as “the protection of digital information, as well as the integrity of the infrastructure housing and transmitting digital information”. Cyber-threat is defined as “an activity intended to compromise the security of an information system”.

Cyber-defence, according to NATO, is defensive actions in the cyber domain. Cyberwarfare generally means damaging or disrupting another nation-state's computers. Cyber-attacks “exploit vulnerabilities in computer systems and networks of computer data”.

Therefore, with respect to the definitions, we can appreciate the complexity of inserting yet another bill and minister into this process.

Let me offer some suggested questions for the members who would be asked to sit on the committee to look at this bill if it passes out of the House. I do recommend that the bill pass out of the House and, if it does, that the committee charged with its review take the appropriate amount of time to inform itself on the complexities of this particular space.

The first question I would ask is this: Who is doing the coordination? There are a number of silos involved here. We have heard testimony after testimony about various entities operating in various silos.

For instance, the Department of Defence has its silo, which is to defend the military infrastructure. It also has some capability to launch cyber-attacks, but it is a silo.

Then there is the public safety silo, which is a very big silo, because it relies on the CSE, CSIS and the RCMP, and has the largest responsibility for the protection of civilian infrastructure.

While the CSE does not have the ability to launch cyber-attacks domestically, it has the ability to launch a cyber-attack in international cyberspace. It is a curious contradiction, and I would encourage members to ask potential witnesses to explain that contradiction, because the more this space expands, the more the distinctions between foreign attacks and domestic attacks become blurred.

The bill would charge the Minister of Innovation, Science and Industry with some responsibility with respect to cybersecurity.

I would ask my colleagues to ask questions about how these three entities, public safety, defence and now the Minister of Innovation, Science and Industry, are going to coordinate so that the silos are operating in a coordinated fashion and sharing information with each other so that Canada presents the best possible posture for the defence of our networks. Again, I offer that as a suggestion of a question to be asked. We cannot afford the luxury of one silo knowing something that the other silo does not know, and this is becoming a very significant issue.

CSIS, for instance, deals in information and intelligence. The RCMP deals in evidence. Most of the information that is coming through all of the cyber-infrastructure would never reach the level of evidence, whether the civil or criminal standard of evidence. This is largely information, largely intelligence, and sometimes it is extremely murky. Again, I am offering that as a question for members to ask of those who come before the committee as proponents of the bill.

The other area I would suggest is to question is how this particular bill would deal with the attributions of an attack. To add to all of the complications I have already put on the floor of the House, there is also a myriad of attackers. There are pure state attackers, hybrid state criminal attackers and flat-out criminals.

For the state attackers, one can basically name the big four: China, Russia, North Korea and Iran. However, there are themes and variations within that. Russia, for instance, frequently uses its rather extensive criminal network to act on behalf of the state. It basically funds itself by with proceeds of its criminal activities, and the Russians do not care. If one is going to cripple a hospital network or a pipeline or any infrastructure on can name, then they do not care whether it happens by pure criminal activity or hybrid activity or state activity. It is all an exercise in disruption and making things difficult for Canadians in particular. We see daily examples of this in Ukraine, where the Russians have used cyber-attacks to really make the lives of Ukrainians vulnerable and also miserable.

The next question I would ask, and if this is not enough, I have plenty more, is on the alphabet soup of various actors. We have NSICOP, CSE, CSIS and the RCMP. I do not know what the acronym for this bill will be, but I am sure that somebody will think of it. How does this particular initiative, which, as I say, is a worthy initiative to be supported here, fit into the overall architecture?

Finally, CAF and the defence department are now doing a review of our defence posture, our defence policy. Cyber is an ever-increasing part of our security environment and, again, I would be asking the question of how Bill C-26 and all of its various actors fit into that defence review.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I am looking for the member's commentary on something I will read to him. It reads:

There are several legislative changes that could be implemented to enhance cybersecurity in Canada. Some of these changes include:

1. Strengthening Privacy Laws...

2. Mandatory Reporting of Cybersecurity Incidents...

3. Improving Cybersecurity Standards...

4. Increasing Cybersecurity Funding...

6. Strengthening Cybercrime Laws...

Overall, these legislative changes could help strengthen cybersecurity in Canada and better protect individuals and organizations from cyber threats.

I am reading this and I could have read more, but this was all generated by ChatGPT. I could have also given some negatives around certain legislation. My point is that I think this emphasizes the importance of the bill and getting it right because we have artificial intelligence getting to the point where it can literally write speeches for us for the House if we want it to. I would like the member's comments on that.

[John McKay, Liberal, Scarborough—Guildwood, ON]

Madam Speaker, that was an excellent question. I wish I had written it myself, but apparently someone, or something, else already had.

Prior to question period, I was sitting with my colleague from Scarborough—Rouge Park. He wrote a speech for me, through ChatGPT, on my modern slavery bill. We just sat there, and after he had fed in a few words, an entire speech was spit out. Yet again, we have another challenge for us as legislators.

I sometimes think that we are so far behind that we do not even know how far behind we are. Cheney said that we do not even know what we do not know. Bill C-26 is an opportunity to bring ourselves into the game.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, I want to thank my hon. colleague for his speech and his series of responses. I also want to thank him for being the chair of the defence committee.

I know this is a little outside the topic of the bill, but I had asked a another colleague from the same committee two questions that have come forward during our study of cybersecurity. The first was on his thoughts and ponderings on international calls for the International Criminal Court to consider cyber warfare an act of war. The additional thought was that 90% of what the Canadian government sees as classified information could actually be declassified, and the ability to help our organizations sort through a lot of these cyber-attacks and information, when in fact we could eliminate and limit the amount we classify.

[John McKay, Liberal, Scarborough—Guildwood, ON]

Madam Speaker, that is two impossible questions in a row, and I congratulate the member for them.

The first was whether cyberwarfare should be declared an act of war. To my mind, an attack is an attack. If someone is running cars off the road, or interfering with pipelines or hospitals, they are putting people's lives at risk and sometimes even killing them. That does strike me as an act of war.

The second issue, and the member was probably there when I raised that question with one of our witnesses, was our levels of classification for information. The question I put to one of the witnesses was as follows: I have been in on some of the security briefings, and I am sitting there wondering whether I read it two weeks ago in The Globe and Mail. We seem to have a very high threshold of classifications, and maybe this could be an opportunity to reduce that threshold.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, this is an area where I appreciate the member's expertise in identifying where the actors are that attack our cybersecurity.

Does the member think, from what he knows, that there is any level of response from the Canadian government that would not always be playing catch-up with cybercriminals who are ahead of us?

[John McKay, Liberal, Scarborough—Guildwood, ON]

Madam Speaker, the brief answer is no. I think we will always be playing catch-up. In this case, things are moving so quickly.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, these are the words spoken yesterday by President Xi of China to Vladimir Putin as they departed company in Moscow: “Change that hasn’t happened in 100 years is coming and we are driving this change together.” Their meeting, which took place under the shadow of Russia's onslaught in Ukraine, was one that the experts stated was a meeting to build Russia's and China's alignment against the U.S. and the west, “and a world order more suited to their more autocratic agendas”.

Before us is a very serious bill at a very serious time, and it also would work in coordination with a lot of other serious bills we have on the floor right now. Bill C-34 is on the Investment Act, which looks closely at what investments are security minded and good for Canada. Bill C-27 would enact the consumer privacy act and look at the protection of Canadians' privacy. We have stated all along that privacy for Canadians needs to be a fundamental human right. The bill on interoperability and the right to repair look at different ways in which we are dealing with our IP and technology in Canada.

Today at the science and research committee, we continued the study of IP commercialization, ensuring we can develop technology and hold technology in Canada. We lose a significant amount of our IP to the Americans, to other nations and to foreign entities.

We talk about the world order and what is happening in the world. Albert Einstein famously said that he was not sure what weapons would be used in World War III, but that the weapons of World War IV would be sticks and stones. The weapons being used right now are joysticks and software. We should make no mistake that, at this moment, we are already at war. We are not only talking about Ukraine. The member previous spoke about some of the attacks that are happening from a centre of cyber-attacks in Ukraine.

Cyber-attacks are happening across the world, and they are happening right now in Canada. There has been a lot of different alarming statistics on cyber-attacks and malware attacks in Canada. We know the Canada Revenue Agency was attacked in August 2020, impacting nearly 13,000 Canadians, who were victims of that. There was also a hospital in Newfoundland in October 2020 where cybersecurity hackers stole personal information from health care employees and patients in all four health regions. That affected 2,500 people.

Black & McDonald, a major defence and security company and contractor, was hit with ransomware just two weeks ago. That is our security being hit by the very thing it is trying to protect us from. Global Affairs Canada was attacked in January 2022 right around the time Russia engaged in the illegal invasion of Ukraine. It was reported that it may have been Russian or Russian state-sponsored actions responsible for the cyber-attack on Global Affairs.

Most famously, there was a ransomware attack on critical infrastructure in the United States back in May 2021 where pipeline infrastructure was attacked. President Biden, who will be here tomorrow, issued at that time a state of emergency, and 17 states also issued states of emergency. It was very serious, which shows the capabilities of some of those cyber-threat actors. With ransomware, there are companies that attack companies and then demand a ransom or money before they return those computers or the networks back to the owners. It is now worth $20 billion. That is how much money ransomware is costing businesses. Back in 2016, it was only $5 billion.

The technology is rapidly advancing, and it is a war. It is a war that is affecting Canadians at this very moment, and it is something we have to be very serious and realistic about looking at what cybersecurity is, what it means and what we have to do as Canadians and as a Canadian government to combat attacks.

We know that the bill is something we support. We, of course, support the bill. Cybersecurity is very important, and as the member noted earlier, we have to make it right. We do not have time for a flawed bill or to race something through. Because of the advancements and because of the need to be very serious and realistic about cybersecurity, let us make sure we get the bill to committee and make sure then that we look at certain amendments that would get it right.

The question at this very moment is whether the government is taking this seriously enough. Despite a ban on Huawei announced by the government in May 2022, this week it was ascertained by the member for Dauphin—Swan River—Neepawa, as we were talking about IP commercialization in the science and research committee, that UBC is still working with Huawei after May 2022.

The minister assured us that Huawei was banned, that Huawei was done. Of course, there were reports months ago of a crackdown on IP being stolen and shared from Canadian universities. It has already been projected that 2023 will be the worst year for ransomware, for cybersecurity and, of course, for IP leaving Canada.

We have to take this seriously, and I know that members across the way have talked about it. Of course, this bill does that, but we need to be serious. We need to talk about cybersecurity, which means being realistic and bold in how we counter, and how we aid the west in winning, the war over cybersecurity.

There are amendments to the bill that we would like to see. Number one is to ensure that we protect and safeguard our national security and infrastructure. I know a member talked earlier about the different silos that exist. Probably the most important function is to ensure that silos in the government dealing with cybersecurity are talking to one another. The Americans deal with their cybersecurity concerns through the National Security Agency, the Department of Homeland Security, the Federal Bureau of Investigation and the Department of Defense. They all work alongside each other to enhance the cybersecurity establishment that was developed in 2018.

Similarly, Canada has the Communications Security Establishment, part of which is the Canadian Centre for Cyber Security, but as a member noted previously, is it talking to NSICOP and CSE? Are we making sure we are talking to the different departments? We know that the government is pretty large and unwieldy. We have to make sure that these departments are working together.

We also have to make sure we are looking after our businesses, as 40% of Canadian SMEs do not have any cybersecurity protection. It is going to be very costly for those businesses to implement that. As a business owner, I know the single biggest cost when it comes to cybersecurity is actually insurance. Insurance premiums just for cybersecurity attacks are going up and up. Every year they have increased by 20% to 30%. Of course, that is aligned with the $20 billion we are seeing from malware and ransomware across the world and the increase in cyber-attacks.

We have to make sure that we help our businesses, so perhaps we need to look at tax credits. One thing we can do is ensure that we share best practices and that businesses get support from the federal government to enhance their cybersecurity.

Another concern we have is how much power the minister will get, as the minister is supposed to get all the power. We have seen this with other bills. We have seen this in bills on the right to repair and interoperability. We have seen it in Bill C-27. Perhaps it is better to look at an ombudsman. We have talked about the Governor in Council and orders in council, but we want to hear from the security experts at committee to ascertain who exactly should be making these decisions instead of bringing them back to one minister. This bill right now could fit under the INDU committee and the industry minister, but it is going to the public safety committee, so already we have two different departments managing this bill. Why does one minister have to handle it? Why can it not be a broader process to ensure that we are seeing some congruence?

Privacy is something we talked about quite a bit. We will be debating Bill C-27 in the House tomorrow, and I certainly feel that privacy needs to be a fundamental human right. Part of this bill has different groups and organizations concerned about how we are protecting Canadians' right to privacy. When they lose their privacy, who is responsible for that? There will be a lot of different witnesses coming to committee. When we look at cybersecurity, we have to ensure we are protecting Canadians' fundamental right to privacy and ensure we are doing all we can so that if their privacy is breached, Canadians can find some relief.

We have talked about Bill C-27 and a tribunal, and maybe giving more powers to the Privacy Commissioner, who should have more power to look at whether we should go after criminals or organizations for breaches. We also have to look at the law and at what we are doing to go after criminals who are engaging in cyberwarfare and who continue to be a threat to Canadians.

Russia and China are very concerning right now, and there are a lot of different reasons for that. Russia is growing increasingly reliant on China as both an import market and an exporter of electronics. Both leaders are building a closer energy partnership on oil, gas, coal, electricity and nuclear energy. They are going to build the Power of Siberia 2 pipeline through the territory of Mongolia. This is important because Taiwan is coming up—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I am sorry, but the hon. member's time is up. I am sure he will be able to add more during questions and comments.

Questions and comments, the hon. member for Scarborough—Guildwood

[John McKay, Liberal, Scarborough—Guildwood, ON]

Madam Speaker, I pretty well agree with everything the member said. However, what I am concerned about is that partisanship is a debilitating exercise around here and this is serious business.

Does the member have any thoughts as to how to innoculate this bill, in particular, from the partisanship that may inevitably follow it? Then we can deal with this as serious legislators and serve all of our public.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, as I have heard, members from across this side of the House are in agreement with the bill and think that cybersecurity is needed. I think the difference is that on our side, we just want to make sure that we slow down a bit, get the bill right and are realistic and bold about what the Canadian government needs to do to ensure we tackle cybersecurity.

I think we can come together at committee. I have heard from many Conservative speakers, and we all agree that we should bring the bill to committee. However, let us bring in the best witnesses to ensure we get it right so that in the end we are leading the world, not catching up.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Madam Speaker, like all members of the House, I believe, experts are concerned about Chinese equipment in our critical infrastructure, especially telecommunications infrastructure.

Should the Liberal government not be very concerned about the presence of Liberal MPs in its own ranks who are a threat to national security in their own way?

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, absolutely. We are seriously concerned in an ever-evolving world about national security, cybersecurity, infrastructure and investment security, protecting Canadian interests in IP and making sure we have fair, open and honest inquiries. If there are breaches and interference in our democracy, they should be tackled openly and honestly. We are certainly asking for that every day, and when it comes to the bill before us, it is no different.

We are at war with joysticks and software that threaten our infrastructure and the very livelihoods of Canadians and Canadian businesses. Let us get this right. Let us work together openly and honestly and make sure that we pass a good bill that protects Canadians.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, I am glad the member mentioned the same concerns that we in the NDP have about the overly broad powers being proposed for the minister. Could he share with us whether he thinks some options, which the NDP might propose, to fix some of those concerns could possibly include parliamentary oversight, some kind of review mechanism and an independent review body as a fix to the overly broad powers being proposed for the minister.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, yes, there has to be a lot of different options, and not just in this bill. There are a lot of bills that suggest to give broad powers to one minister, which makes no sense. I do not know how the minister has time to deal with that.

Certainly we are open to a lot of suggestions and some suggestions sound good, like an ombudsman. There have been suggestions of tribunals to make sure we have broad bodies that can oversee this so we do not just give power to one minister. One hundred per cent we support that.

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Madam Speaker, the member talked a bit about silos and the inability for governments to sometimes work in them. I know he has a great background in innovation and business. Maybe he could expand a bit more on the importance of collaboration with respect to cybersecurity and in business in general.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, collaboration from government agencies is key, but those who are really going to solve this, which is the same in the U.S., are Canadian businesses, inventors and entrepreneurs who can develop software and technology for cybersecurity that can be world-leading, help Canada, help Canadians and help the world in combatting this awful thing.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

Order.

It is my duty pursuant to Standing Order 38 to inform the House that the questions to be raised tonight at the time of adjournment are as follows: the hon. member for South Okanagan—West Kootenay, Climate Change; the hon. member for Victoria, Climate Change; the hon. member for Spadina—Fort York, Democratic Institutions.

The House resumed consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[Peter Fonseca, Liberal, Mississauga East—Cooksville, ON]

Madam Speaker, let me start off with the point you were just talking about, because in the 21st century, cybersecurity is national security. It behooves us all as parliamentarians to work as hard as we can to protect our businesses, consumers and institutions from cyber-threats. That is why I am so grateful and delighted to be here today in the House to speak to the second reading debate of Bill C-26, which concerns the important topic of cybersecurity.

Cybersecurity is a matter of great concern to my constituents of all ages. I firmly believe both the public and private sectors need to be able to protect themselves against malicious cyber-activity, including cyber-attacks. As parliamentarians, it is our duty to establish a framework for secure critical infrastructure that we can all rely on.

The past few decades have seen remarkable advancements in computer and Internet technology. Online connectivity has become an integral part of the lives of Canadians and people around the world. The COVID-19 pandemic has shown us how we rely on so much on the Internet for everything we do, from education to conducting business and staying in touch with loved ones. With more and more people depending on the Internet, including young children and seniors, our most vulnerable, it is crucial to ensure that we have a secure and reliable cyber-connectivity.

Our government is committed to improving cybersecurity to safeguard our country's future in cyberspace. However, as technology and cyber systems continue to evolve, our infrastructure is becoming more interconnected and interdependent. This brings new security vulnerabilities.

For instance, personal interactions like banking and credit card transactions are now mainly conducted online, making cybersecurity even more important. According to the Cybersecurity and Infrastructure Security Agency, ransomware attacks were among the most significant cybersecurity threats in recent years.

Cybercriminals continue to use sophisticated tactics to gain access to critical systems, steal sensitive data and extort money from victims. In addition to ransomware attacks, other common cybersecurity threats include phishing attacks, malware, insider threats and distributed denial of service attacks. I know members have all received emails or phone calls with these types of threats. We do not know where they are coming from, but they are trying to crack our system and do criminal activity.

As more organizations adopt cloud computing, like we do here, Internet of Things devices and artificial intelligence, these technologies are also becoming significant targets for these cybercriminals.

Cybersecurity threats can have severe consequences for individuals, businesses, all levels of government. These include financial losses, which we have heard are in the billions, reputational damage, legal liabilities and even physical harm. We have read and heard the stories of those who have taken their lives because of these harmful attacks. It is crucial to take proactive steps to prevent and mitigate cybersecurity risks.

Bill C-26 is a landmark legislation that would amend the Telecommunications Act and other consequential acts to enhance cybersecurity. The bill proposes to add more security as an express policy objective of the telecommunications sector, bringing it in line with other critical infrastructure sectors.

The key objectives of the bill are twofold. First, in part 1, the bill proposes to amend the Telecommunications Act to add security expressly as a policy objective. This amendment aims to align the telecommunications sector with other critical infrastructure sectors.

The changes we are bringing about through this legislation would authorize the Governor in Council and the Minister of Innovation, Science and Industry, after consultation with stakeholders, to establish and implement the policy statement “Securing Canada's Telecommunications System”, which the minister announced in May of 2022. The primary objective is to prevent the use of products and services by high-risk suppliers and their affiliates. This would enable the Canadian government, when necessary, to restrict telecommunications service providers' utilization of products or services from high-risk suppliers.

With such restrictions, consumers would not be exposed to potential security risks. This approach would allow the government to take security measures similar to those of other federal regulators in their respective critical infrastructure sectors.

The second part of Bill C-26 pertains to the introduction of the critical cyber systems protection act, or CCSPA, which mandates designated operators in federally regulated sectors such as finance, telecommunications, energy and transportation to undertake specific measures to safeguard their critical cyber systems. It would include the ability to take action on other vulnerabilities, such as human error or storms causing a risk of outages to these critical services. In addition, the act would facilitate organizations' capacity to prevent and bounce back from various forms of malevolent cyber-activities like electronic espionage and ransomware. Notably, cyber-incidents that surpass a certain threshold will necessitate mandatory reporting.

Both parts 1 and 2 of Bill C-26 are required to ensure the cybersecurity of Canada's federally regulated critical infrastructure, and in turn, protect Canadians and Canadian businesses. The need to intensify our efforts is apparent because of the advent of new technologies we are hearing about like 5G.

The COVID-19 pandemic has highlighted our growing dependence on technology. In addition, in my riding of Mississauga East—Cooksville, there is a growing concern about Russia's unwarranted and unjustified invasion of Ukraine, which has resulted in international tensions and a range of potential threats. Such threats include supply chain disruptions and cyber-attacks from state and non-state actors.

We are not starting from scratch in our fight against this threat, though. Our government is always vigilant when it comes to any type of threat, including cyber-threats. Our government has made several investments in cybersecurity in recent years to improve the country's cyber-resilience and protect Canadians' data and privacy. For example, in 2018, we created the national cybersecurity strategy. This was based on the consultations that we initiated with Canadians in 2016. Our government adopted this strategy to establish a framework aimed at protecting citizens and businesses from cyber-threats while leveraging the economic benefits of digital technology.

Cyber-incidents involve a certain threshold at which reporting would be required. This legislation would give the government a new tool to compel action, if necessary, in response to cybersecurity threats or vulnerabilities.

Canada is working alongside other democratic nations around the globe, both in the context of our Five Eyes relationship and in the G7 alliance. These multilateral forums are intensely focused on devising strategies to counter a range of cyber-threats, such as ransomware attacks; the dissemination of false information, which we have seen too often; and attempts by malicious actors to engage in cyber-espionage.

To facilitate this collaboration, we are emphasizing the importance of sharing information and intelligence, thereby breaking down those silos. This would enable us to more effectively combat efforts made to destabilize our economies and undermine Canadian interests. While we are currently engaged in a debate regarding Bill C-26, we are also taking proactive measures to address the current gaps in our domestic cybersecurity landscape, while simultaneously partnering with like-minded nations to confront these challenges in a comprehensive manner.

We have listened to Canadians, our security experts and our allies, and we are following the right path. We will ensure that our networks and our economy are kept secure. A safe and secure cyberspace is important for Canadian competitiveness, economic stability and long-term prosperity.

Bill C-26 aims to enhance designated organizations' preparedness, prevention, response and recovery abilities—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I am sorry. The hon. member's time is up.

Questions and comments, the hon. member for Northumberland—Peterborough South.

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Madam Speaker, I very much enjoy working on the finance committee with the member and enjoyed his thoughtful remarks.

I hope my question hits the other Liberals' concerns about partisanship, as this is substantive criticism and not partisanship. We have heard concerns from both the NDP and from the Conservative Party that the bill would provide a broad swath of powers to the minister. Is the government open to delineating some of those powers so it gives additional assurances to us and to the other opposition parties?

[Peter Fonseca, Liberal, Mississauga East—Cooksville, ON]

Madam Speaker, I very much enjoy working with the hon. member on our finance committee. The member always looks for pragmatic solutions.

For our cybersecurity to work, we have to work right across party lines. We have to work across all levels of government, with all our institutions, the private sector and the public sector. That is the only way that we are going to implement a system that really has an effect and is able to combat these cybercriminals we find and what we are being bombarded with. They are always trying to stay one step ahead, and the only way for us to combat that is to work together.

[Gabriel Ste-Marie, Bloc, Joliette, QC]

Madam Speaker, I too would like to thank the chair of the Standing Committee on Finance, with whom I have the great pleasure of working. I thank him for his speech.

It is important to have a better way of dealing with all cybersecurity issues. Like the Conservative member who raised the issue, we have concerns that this bill gives the government a great deal of power to do this through regulations.

I would like the assurance of the hon. committee chair that proceeding by way of regulations is not a way to circumvent Parliament.

[Peter Fonseca, Liberal, Mississauga East—Cooksville, ON]

Madam Speaker, it is also great to work with this member on the finance committee. The way that we work on the finance committee is how this bill is being structured and how it would work. The bill talks about ensuring that we work across party lines. This is a non-partisan thing. As parliamentarians, we are all here to protect Canadians in the best way that we possibly can. We know, in our distinctive ridings, that we get many calls, emails and letters from concerned citizens who are being hit by these attacks.

I can say to the member that we will do this in a non-partisan way. We will reach out to stakeholders, again, across all lines. We have too many silos. We heard the member for Scarborough—Guildwood say that we have to break down the silos. I feel that the legislation would be able to do this, and it would strengthen our cybersecurity systems.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, I would like to encourage all members to look at the seventh report from the Standing Committee on Public Safety and National Security on Canada's security stance vis-à-vis Russia. A lot of that report covers why a bill like Bill C-26 is necessary.

We can see agreement on the principle of the bill, but like my two colleagues from the Conservative Party and the Bloc, I am going to express some frustration that the Liberals did not anticipate that we in the opposition would have concerns with this first draft of the bill in terms of accountability, oversight and transparency. I wish the Liberals could have anticipated that before releasing this draft of the bill because now it looks like the committee has its work cut out for it to improve those measures. Could my hon. colleague express some comments on that particular part of this?

[Peter Fonseca, Liberal, Mississauga East—Cooksville, ON]

Madam Speaker, that is what committee work is there for. The committee has the opportunity to dig deep into the bill and look at ways to enhance and better the legislation. That is a very important aspect.

In the end, I believe that this bill is about bringing Canadians and our institutions together. It is about making sure that we break through those silos, as we have just heard, and being able to set up the type of cybersecurity system that we are all looking for. In no way do I see this to be a partisan piece of legislation. It is something that we wholeheartedly feel strongly about in the House and that we can make a significant difference on.

[Larry Maguire, Conservative, Brandon—Souris, MB]

Madam Speaker, as I rise to speak today, all of us in this place are acutely aware of the deeply concerning realities of foreign interference in Canada’s affairs.

The Government of Canada cannot afford to ignore this troubling trend. While there are many angles from which we must consider how best to protect our national interests, as we examine the content of Bill C-26 we are focused primarily on matters related to cybersecurity. There is no question that Canada’s critical infrastructure must be protected from cyber-threats.

In our modern world, computer systems are integral to the provision of health care, powering our homes and businesses, upholding our financial systems and so much more. While these incredible tools of our time may not be visible to the naked eye, they are tremendously powerful and we cannot afford for these systems to be compromised. The consequences from a criminal's or a foreign adversary’s disruption of medical services in our hospitals or of our electrical grid would be incredibly dangerous and potentially deadly.

In its 2021 “Special Report on the Government of Canada’s Framework and Activities to Defend its Systems and Networks from Cyber Attack”, the National Security and Intelligence Committee of Parliamentarians concisely listed what is at stake when cyber-threats arise: things like the personal information of Canadians; proprietary information, intellectual property and research of Canadian businesses and researchers; government policies and policy-making; security and intelligence information and operations; and the integrity of government systems, to name a few.

I was grateful to hear the Minister of Public Safety, when introducing this bill, say that cybersecurity is national security. It is a simple statement, but it is true. If we truly recognize cybersecurity as an essential element of our national security, we are more likely to give it the attention it deserves.

Bill C-26 is not perfect, as has been stated here, and we must ensure we protect the privacy of Canadians, nor will it be a cure-all for every cybersecurity weakness. However, I am fully behind updating our cybersecurity legislation. I hope the Liberal government is open to improving the bill at committee stage, and I will offer my support to get it to committee.

The objective of this bill is solid: to equip government to quickly respond to cyber-threats. As any expert in the field would tell us, rapid response is critical when a serious attack is under way. However, there are key issues that remain with the bill as it is presented to us today. Make no mistake, this legislation would give the government the ability to insert itself into the operations of companies, and therefore their customers.

As Christopher Parsons of the University of Toronto wrote in a critical analysis of the bill, “There is no recognition of privacy or other Charter-protected rights as a counter-balance to proposed security requirements, nor are appropriate accountability or transparency requirements imposed on the government.” As with any new power that a government gives itself, there must be extensive checks and balances. There must be transparency. Most of all, there must be oversight. What this legislation does not do is provide those much-needed guardrails. We need the safety oversight.

Giving a minister the power to order a private company “to do anything, or refrain from doing anything”, particularly when it comes to the private information of its customers, is deeply problematic. While I understand that how the minister can wield this new power might be spelled out in future regulations, I believe it must be clearly outlined in the legislation, rather than leaving it up to cabinet to decide at a future date.

We must also have a fulsome airing of what information the government could collect from companies and their customers. Almost every aspect of our lives is interwoven with digital information. From banking to how we do business and how we communicate, numerous companies have that information on each of us.

Therefore, the question that remains is this. If we grant the government access to information from companies, even for the most altruistic reasons or for national security reasons, who is overseeing those government agencies? I can assure members that the government will not be giving new powers to members of Parliament or parliamentary committees to undertake that role. We can look no further than the stonewalling Parliament is receiving on foreign interference in our democracy now. It is absolutely imperative that oversight and guardrails be built into this legislation, and I implore my colleagues on the parliamentary committee that would be tasked with this legislation to do just that.

The fact is that the government has trouble protecting its own sensitive information from cyber-threats. Many examples of cyber-attacks against the government have already been cited during this debate. There was the attack against the Canada Revenue Agency in August 2020, which resulted in 13,000 victimized Canadians. Global Affairs was attacked in January 2022. Canada Post has filed several breach reports after cyber-incidents, according to records from the Privacy Commissioner. If the government is unable to protect itself from cyber-threats, how can it be expected to protect the sensitive cybersecurity plans of private companies? The Liberal government would do well to lead by example before it can truly ask private companies to beef up their own cybersecurity practices. The weaknesses of the government’s own cybersecurity have been flagged over and over again.

In September 2020, the National Security and Intelligence Committee of Parliamentarians announced its review of the government’s framework and activities to defend its systems and networks from cyber-attack. The review resulted in a number of findings, which deserve mention.

First, the committee found that cyber-threats to government systems and networks “are a significant risk to national security and the continuity of government operations.” It also noted that nation-states “are the most sophisticated threat actors”, although the threats do not come from nation-states alone. Second, the committee found that while the government has implemented a framework to defend itself from cyber-attacks, “[t]he strength of this framework is weakened by the inconsistent application of security-related responsibilities and the inconsistent use of cyber defence services.” In plain language, the report found that not all federal organizations receive cyber-defence protection. The committee review identified that, while Shared Services Canada provides some cyber-defence services to 160 of 169 federal organizations, only 43 of those organizations actually receive the full complement of its services.

Given these findings, the committee recommended that the government “continue to strengthen its framework for defending government networks from cyber attack” and apply and extend cyber-defence policies and practices equally across government. At the time, the Liberal government agreed with the recommendations that were put forward. While this was an important step toward acknowledging the issue, taking action is another thing entirely.

Just days ago, a Globe and Mail headline read, “Ottawa makes little progress shoring up Crown corporations' cybersecurity”. The report noted that this is despite 18 months passing since the National Security and Intelligence Committee of Parliamentarians raised concerns about the possibility that Crown corporations, which are still not subject to the government’s cyber-defence policies, could inadvertently serve as gateways into the federal government’s well-protected systems.

The public safety minister did not mention the NSICOP report and recommendations when introducing this bill, but I hope that the work of this committee, made up of parliamentarians from across party lines, can be helpful in enhancing the government’s own cybersecurity defences. As NSICOP has underscored, “The data of organizations not protected by the government cyber defence framework is at significant risk. Moreover, unprotected organizations potentially act as a weak link in the government's defences by maintaining electronic connectivity to organizations within the cyber defence framework, creating risks for the government as a whole.”

In closing, the government is aware of these risks, but it has been slow to rectify the issue. While Bill C-26 covers another angle of this discussion, it does not address the problem of the government's own house. As I said already, cybersecurity laws need to be updated here in Canada. Bill C-26—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I am sorry, but the hon. member's time is up.

Questions and comments, the hon. parliamentary secretary to the government House leader.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is interesting listening to the Conservatives speak to the legislation, because this morning they did not want to debate the legislation, and I think it is because they support it. It would be nice to see the Conservative Party actually allow the legislation to pass, come to a conclusion in debate and put it to a committee that would be able to deal with many of the issues they are talking about.

Does the member believe that there is any onus of responsibility whatsoever for the Conservative Party, once they recognize and support legislation, to at least give consideration to its passing to committee in a timely fashion so that we can see legislation being discussed at committee? Ultimately, if the Conservative Party wanted to, they could drag every piece of legislation out until 2025.

[Larry Maguire, Conservative, Brandon—Souris, MB]

Madam Speaker, I appreciate the interjection and question from my colleague for Winnipeg North. He and I are used to debating each other from our days in the Manitoba legislature, but not too much, because we were both in opposition in those days. However, we did teach him how to speak. When we had the opportunity to filibuster, we were always short a person to speak in the Manitoba legislature, but we could go to my colleague for Winnipeg North and ask him if he wanted a chance to speak. He was the only Liberal in the house at the time, and so he never refused us. I think he learned his lesson on how to carry on well. However, I will not try to do that.

The big thing here is that Canadians need to know that the minister still has extreme powers in the bill, which is why we are making sure that we put it on the record that there need to be some amendments coming forward at committee. The government is listening to that, and I would hope that it would be willing to look at some of those amendments when the time comes, and the bill will get to committee.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, in this modern age, in 2023, we are finally about to pass a cybersecurity bill. We do not oppose the spirit of this bill, but some criticisms have been raised since the bill was introduced.

University of Toronto professor Christopher Parsons has made 29 recommendations to strengthen the transparency and accountability of the measures proposed in this bill. In his view, the bill is so flawed that it would allow authoritarian governments around the world to cite it to justify their own repressive laws.

I have met with groups that support these recommendations and have concerns. They think this bill might give the minister too much power. There may also be some privacy issues for citizens.

I would like to know if my colleague shares those concerns, if he has heard about them and if he is willing to work on this bill in committee with us.

[Larry Maguire, Conservative, Brandon—Souris, MB]

Madam Speaker, I thank my colleague for her excellent question in regard to trying to move the bill forward.

I have indicated that I do want to see the bill go to committee, and I will support it to go to committee. I did refer to a couple of remarks that Christopher Parsons, from the University of Toronto, had made, in a very critical analysis of the bill when it was brought forward. His report states, “No recognition of privacy or other Charter-protected rights exists as a counterbalance to proposed security requirements”. He was very clear on the improvements that could be made to the bill. That is why we want to see it go to the committee, so that we can actually put some of those amendments forward, unless the government brings them forward.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Madam Speaker, the intervention just before the last one was unusual, where the member for Winnipeg North said that any time a Conservative debates a bill, we are somehow obstructing it from getting to committee. However, right before the minister's speech, a Liberal member spoke. Therefore, when Liberals speak, they are debating, but when Conservatives speak, they are obstructing.

The debate on the bill may well collapse soon, but it is important to debate it. I would like the member, with the time he has left, to talk again about the serious concerns that people have with the bill and what we can look forward to at committee.

[Larry Maguire, Conservative, Brandon—Souris, MB]

Madam Speaker, it is my expectation that we will send this bill to committee not to give it a quick rubber stamp, but instead to carefully examine it, amend it where it is needed and improve it in order to ensure that Canada's cyber-defences are the best they can be. That was the last paragraph of my speech that I did not get to present.

That would indicate to the Liberals a clearer analysis of what needs to be done.

[Jenica Atwin, Liberal, Fredericton, NB]

Madam Speaker, I am pleased to join the debate on second reading of Bill C-26, an act respecting cybersecurity.

Several of my colleagues have already spoken at length about the importance of the bill and the details therein, but it bears repeating that Bill C-26 is critical to our country's national security, our public safety and our economy.

Not only would Bill C-26 introduce the new critical cyber systems protection act or—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I am going to bring the House to order a little bit. There are conversations. I would ask the members to maybe step out to have those conversations, to allow the hon. member for Fredericton to have the respect that she deserves during her speech.

The hon. member for Fredericton.

[Jenica Atwin, Liberal, Fredericton, NB]

Madam Speaker, not only would Bill C-26 introduce the new critical cyber systems protection act, or CCSPA, to legally compel designated operators to protect their cyber systems, but it would also amend the Telecommunications Act to enshrine security as a policy objective and bring the sector in line with other critical infrastructure sectors.

Being online and connected is essential to all Canadians. Now more than ever, Canadians rely on the Internet for their daily lives, but it is about more than just conducting business and paying bills. It is also about staying in touch and connected with loved ones from coast to coast to coast and, indeed, around the world. That is also why the Government of Canada is connecting 98% of Canadians to high-speed Internet by 2026 and 100% of Canadians by 2030.

Our critical infrastructure is becoming increasingly interconnected, interdependent and integrated with cyber systems, particularly with the emergence of new technologies such as 5G, which will operate at significantly higher speeds and will provide greater versatility, capability and complexity than previous generations. These technologies certainly create significant economic benefits and opportunities, but they also bring with them new security vulnerabilities that some may be tempted to prey on.

At this time, I want to bring the perspective of my constituents in the riding of Fredericton to this important debate today. Fredericton is home to the Canadian Institute for Cybersecurity at the University of New Brunswick, with a focus on disruptive technology and groundbreaking research. The institute provides hands-on support for community and industry partners as they face emerging threats, with company-specific, cross-disciplinary research.

Led by Dr. Ali Ghorbani, Canada's research chair in cybersecurity, the institute generates datasets to help thwart malicious cyber-attacks and works in tandem with the National Research Council of Canada in an innovative hub model that will lead to discoveries and advancements in cybersecurity, including publications, patents and the commercialization of technology, as well as provide training opportunities for graduate students and post-doctoral fellows.

Innovative cybersecurity research is conducted with a focus on Internet security, artificial intelligence, human-computer interaction and natural-language processing. I was honoured to welcome many ministers to my riding and to connect them with researchers and leaders in the industry to showcase how my community distinguishes itself in this sector. Fredericton is at the forefront of this new age and the challenges it presents, and I could not be more proud.

Even if there is enormous potential for Canadian digital innovation and expertise in cybersecurity, and I am witnessing it every day at home, we also need to face the fact that cyber-threats are growing in sophistication and magnitude. In 2021, close to 200,000 businesses across the country were affected by cybersecurity incidents, and this number continues to grow. Each of those businesses is not merely a business. It is comprises hard-working owners and employees, with families to feed and bills to pay. It is all the more maddening that many of these businesses must spend precious amounts of time and money preventing or fighting back against these incidents, many of which involve stealing money or demanding ransoms.

Canadian businesses have spent billions of dollars over the last years to detect and prevent cybersecurity incidents and, consequently, they have been experiencing downtime and a loss in revenue. Cybercrime is costly, and those who are bearing the brunt of it are Canadian businesses.

We also know that at all levels of government, we have not been immune from these kinds of attacks, even, horribly, hospitals. Earlier this year, the Toronto SickKids hospital was targeted by a ransomware attack affecting its operations. Closer to home, in Atlantic Canada, a ransomware group was behind the 2021 cyber-attack that paralyzed the Newfoundland and Labrador health care system.

Beyond the monetary implications, attacks like these have the real-life potential of impacting the health and safety of the ones we love, and we must do everything in our power as legislators to put in place effective safeguards. The effects on Canadians demonstrate beyond a doubt why we need to strengthen Canada's cybersecurity systems. As lawmakers, the least we can do is ensure that Canada and its institutions and businesses can continue to thrive in the digital economy and that our banks and telecommunications providers can continue to provide Canadians with reliable services.

Bill C-26 would modernize existing legislation to add security to the nine other policy objectives in the act, bringing telecommunications in line with other critical sectors. The bill would also add new authorities to the Telecommunications Act, which would enable the government to take action to promote the security of the Canadian telecommunications system.

As mentioned, in recent years, Canada's cybersecurity status has been tested by a variety of threat campaigns targeting critical infrastructure, businesses and individuals. The increase in digitization has led to the weaponization of digital tools and processes. This results in the disruption of critical systems and causes a lack of confidence in physical, psychological and economic well-being.

I am proud of all the work that has been done to secure Canada's critical telecommunications infrastructure, but I do not want us to lose sight of the work still to be done. The advent of the COVID-19 pandemic was a catalyst for bolstering national and international cyber-defence practices, requiring improved policies, guidance and cyber-intel.

Furthermore, given what is happening in Ukraine with the Russian invasion, we know that there are still military threats in the 21st century. However, we are also dealing with the emergence of new technologies that pose non-military threats.

With rising geopolitical tensions, government-driven hostile cyber-operations are more prevalent now than ever, posing an increased threat level to Canada's national security, economic prosperity and public safety.

In the 21st century, cybersecurity is national security, and it is our government's responsibility to protect Canadians from growing cyber-threats. That is exactly why we have developed Bill C-26.

It contains a multitude of important measures to protect Canadians and Canadian businesses. It is a carefully designed, multipronged approach. Part 2 of this act would enact the critical cyber systems protection act to provide a framework for the protection of the critical cyber systems that are vital to national security and public safety.

It also authorizes the Governor in Council to designate any service or system as a vital service or vital system, and requires designated operators to establish and implement cybersecurity programs, mitigate supply chain and third party risks, report cybersecurity incidents and comply with cybersecurity directions.

Introducing the new critical cyber systems protection act would strengthen baseline cybersecurity and provide a framework for the government to respond to emerging cyber-threats.

It is essential that we keep pace with the rapidly evolving cyber-environment by ensuring we have a robust, legislative framework in place.

In short, Bill C-26 is essential to helping keep Canadians and their data safe. In a world as connected as ours, we cannot take that for granted. Once again, cybersecurity is national security.

I am looking forward to this bill being sent to committee, and I encourage all members to join me in supporting Bill C-26 in subsequent readings.

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Madam Speaker, it is great to see my fellow 2019 member in the House.

My question is with respect to a theme from all the opposition parties. We generally support the idea of cybersecurity legislation and it is actually well overdue. The challenge is that many of the powers are not sufficiently delineated, and it gives the government quite a bit of power. Without being partisan and talking about particular failures, I think giving any government that much power without delineating it would pose concerns for any opposition party.

Is the government open to making amendments?

[Jenica Atwin, Liberal, Fredericton, NB]

Madam Speaker, my hon. colleague and I are part of the class of 2019.

That is why a bill works its way through the House. Hopefully this is something that could be discussed at the committee phase, once it has passed through.

It also speaks to the important role of the official opposition in questioning these kinds of powers and holding the government to account. Certainly, I think we are open to these discussions continuing. Any way we can strengthen the bill is a win for Canadians.

[Gabriel Ste-Marie, Bloc, Joliette, QC]

Madam Speaker, I have a bit of a technical question for my hon. colleague. We are wondering how such legislation would apply, for example, to Hydro-Québec, the public utility in Quebec that generates electricity, since the legislation designates interprovincial power lines as a vital service and a vital system.

Does my hon. colleague have any idea what this could mean for Hydro-Québec, a public utility?

[Jenica Atwin, Liberal, Fredericton, NB]

Madam Speaker, I do not have a technical response for the very technical question that the member asked. We have to consider the importance of protecting our electrical grids. New Brunswick relies heavily on our partners in Quebec, so it would certainly have implications for my constituents.

These are questions that we need to ask and hopefully consider during the committee stage, and hear testimony from witnesses that would be able to address those concerns.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, I am pleased to hear from my Liberal colleague that the Liberals are open to much-needed amendments to this bill to increase the oversight, transparency and accountability on the executive branch.

I just want to read a quote from Jérémie Harris, who is the co-founder of Gladstone AI. He said, “ChatGPT is a harbinger of an era in which AI will be the single most important source of public safety risk facing Canada. As AI advances at a breakneck pace, the destructive footprint of malicious actors who use it will increase just as fast.”

Does my hon. colleague have any comments on how fast this technology is advancing, and how important it is that we equip all of our agencies to keep those vital systems safe?

[Jenica Atwin, Liberal, Fredericton, NB]

Madam Speaker, I have a lot of concerns about how fast technologies are developing, particularly around artificial intelligence and facial recognition technology. All these moving pieces have incredible implications, especially for vulnerable people in our communities. It deserves a hard look by all members of the House, particularly in the committee that would be studying this legislation, but I think beyond that as well.

We are in a new, unpredictable time. I mentioned, in my speech, a lot about geopolitical factors and a lot of threats that are coming in. We do not know what we do not know at this point, and I think that causes a lot of fear. This is a conversation that is long overdue, and I thank the member for allowing me the opportunity to enter into that space. I really hope we have more fulsome discussions around those aspects in particular.

[John McKay, Liberal, Scarborough—Guildwood, ON]

Madam Speaker, I would be interested in the hon. member's thoughts on how we protect rights without going down the rights rabbit hole that leads to paralysis with respect to a space that is going so fast that very few of us can actually comprehend how fast it is moving.

[Jenica Atwin, Liberal, Fredericton, NB]

Madam Speaker, it speaks to the concept that we need to modernize a lot of our legislation. We need to modernize a lot of our approaches and processes. As I said about not knowing what we do not know, things are happening so fast at this point that we need to protect those who are most vulnerable. We need to protect the generations to come.

There are a lot of unknowns right now, and legislation like this allows us to bring in those experts, have those conversations and ensure we are getting ahead of these things and being proactive.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Madam Speaker, it is an honour to speak today in the House on Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

With every passing year, Canadians are increasingly moving their lives online. They communicate with loved ones through email, messaging, photo sharing, video calls and more. They can order their entire grocery orders, rent cars for the weekend and book appointments with a click in an app.

As more and more Canadians choose to put more of their lives online, it falls to us, as members of Parliament, to ensure our cybersecurity laws are as protective of their personal and private information as possible.

The next generation of Canadians are increasingly building their professional and personal lives online. At the same time, they face mounting threats from foreign actors, ranging from scammers to state actors. These actors have shown they would use any tactic, from identity theft to cyber-attacks, to exploit Canadians and attack our institutions.

That is why the legislation we have before us today is essential, and why getting it right the first time is even more important. In particular, it must protect our online information while not crushing our small business start-ups under mountains of red tape.

On this side of the House, my Conservative colleagues and I believe that, as currently constructed, Bill C-26 fails to account for the welfare of small business start-ups by adding more red tape and placing burdensome costs on our homegrown technology sector. As constructed, this bill would directly affect start-ups by adding further bureaucracy that would drive up their starting costs. It would overburden with regulation the small telecommunications providers, the companies that provide our families and businesses with access to a global market online.

Wrapping them in red tape could risk our access to competing on the world stage. The Liberal government has already made it hard enough for start-ups, and the Liberal record on small business has been one committed to mazes of bureaucracy, punitive fines and penalties, and rising inflation. A Liberal economy of high tax and wasteful spending has already made it hard enough for start-ups.

Through the overarching premise of this cybersecurity bill, we know that it is needed. We absolutely need to update our cybersecurity laws, while at the same time we cannot allow Bill C-26 to add unnecessary burdens to business, especially small businesses.

I am particularly concerned about how this bill's regulations would also apply to businesses “irrespective of their cyber security maturity”, implying that providers who already have advanced electronic protection measures would still have to comply with the new regulations of the bill. This means that businesses could not continue using their current, possibly more robust, cybersecurity systems. Instead, they would have to disregard their current cybersecurity measures and replace them with the newly proposed government model.

Even Canadian businesses that have already worked hard to protect their customer security at accepted global standards would still incur more cost despite their robust electronic security measures. They would need to invest in government-regulated security measures, incurring costs such as inspection, extra time, installation and further training. They may have to completely overturn their superior standards for the government's preference.

The thing is, we do not know what the regulations would be or how they would affect businesses, because the actual regulations have not been developed. That is how the government does a lot of its bills. There are great titles, with few details. We are expected to just trust the Liberals to figure it all out later, behind closed doors, with no opportunity to study them at committee with expert witnesses.

Imagine if this regulatory framework were applied to any other business. Suppose we were regulating changes in the banking security industry. We would require that every Canadian bank and credit union tear its building down to the ground, brick by brick, and then rebuild itself from scratch. That really does not make sense.

Now is the time when we should be encouraging competition and bringing in more telecommunications companies. We know Canada has some of the highest telecommunications costs in the world. As more and more Canadians move their lives online, whether for banking, social media or work, adding more tape in this bill, as mentioned, would make this transition far more difficult. Costs never remain in the businesses' ledgers forever; they are inevitably always passed on to the consumer.

As a government, we should encourage the next generation of Canadian entrepreneurs who are innovating.

I will mention, as a sidebar, that I was formerly on the industry committee and we did a quantum computing study, which was, frankly, terrifying. It was about how Canada could be exposed to bad actors, which could affect every part of our online lives. As these technological advances develop, we have to be aware of risks and be able to stay ahead of technology.

These enterprises, businesses and telecommunications providers do not need more red tape; they need a stable market without uncompetitive government interference. We know very well how easy it can be for the government to build regulations that only the largest providers of an industry can shoulder. Without attention to scale, a single fault of noncompliance could instantly wipe out a smaller company. The legislation would allow ministers and bureaucrats to levy fines as high as $15 million without special consideration, such as the size of a company's user base.

Nonspecific details like that are music to the ears of our largest telecommunications providers. Monopolization of our telecommunications sector is something Canadians are already concerned about. We must always proceed cautiously, so as not to turn away innovation and new businesses entering the market, which creates healthy competition. For example, these fines could also be enacted under the vague term of “protecting a critical cyber system”. This vague terminology can leave a lot of leeway for government ministers to injure Canadian businesses with rampant fines.

There is already a shortage of online and electronic security professionals in Canada. According to the Business Council of Canada, an estimated 25,000 personnel are needed in the cybersecurity industry. Instead of dissuading these crucial professionals from joining this industry and helping keep Canada safe from domestic and foreign cyber-threats, let us provide a better framework and encourage them to build new businesses in this essential industry. Let us not scare them off with red tape and penalties.

As members can see, the legislation proposed for Bill C-26 has some significant concerns that require amendments at committee. Regulations being made with a lack of transparency behind closed doors, after the bill passes, is a concern. Conservatives will be looking to make amendments to the bill at committee as we hear from experts.

As I mentioned earlier, my Conservative colleagues and I encourage and support new, updated and secure cybersecurity measures being put in place, especially as more and more Canadians move their lives online. However, by placing more and more red tape on small and start-up businesses and providers that have already been in the industry for years, the bill would effectively dissuade businesses from entering this market and providing more services for Canadians. Large and mature businesses can handle the related costs of Bill C-26, but the associated expenses could crush small businesses.

I have worked, for much of my career, around various regulated industries and have seen, all too often, red tape and regulations making it too hard for small businesses to even start or to stay afloat without being acquired by larger firms, as small companies just cannot keep up with the regulatory compliance.

Cybersecurity threats affect all our communities. In January, an international ransomware group claimed responsibility for an Okanagan College cyber-attack in my region. Let us keep Canada safe by building clear online security measures that would encourage start-up professionals and businesses to help build up our cybersecurity infrastructure to a world-class standard. We will not accomplish this goal if we continue to add burdensome fines, penalties and red tape.

[Jenica Atwin, Liberal, Fredericton, NB]

Madam Speaker, I certainly hear my hon. colleague's support for small businesses and the concerns she is raising, but I come at this from a different standpoint where I feel there are protections here for small businesses. The bill is designed to protect them from unnecessary losses when they happen to be attacked or be subjected to ransomware.

Is there a balance here, where this is also about supporting them by preventing those losses?

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Madam Speaker, I think a part of the piece of legislation is that we really do not have the details, and that is part of the concern, so I am hoping that, if it goes forward to committee, some of that could be worked out, because that is part of the concern right now.

We have the topic and we know what the overarching desire is and what the fines may be, but we do not actually know what all of the regulations would be, and that does raise a lot of concerns, especially for small businesses that do not really know at this point what the bill would mean for them. Hopefully that will come out at committee and there will be more information added, potentially as amendments to the bill.

[Tako Van Popta, Conservative, Langley—Aldergrove, BC]

Madam Speaker, I appreciate my colleague's comments, particularly about not wanting to add more bureaucracy and more red tape to small and medium-sized enterprises, especially small start-ups. I am looking at a study from the public safety committee about Canada's security posture in relation to Russia. I will just read one of the committee's recommendations. Recommendation number 4 states:

That the Government of Canada instruct the Communications Security Establishment to broaden the tools used to educate small- and medium-sized enterprises about the need to adopt cyber security standards.

Therefore, it is about making education tools available versus adding more red tape. I would like my colleague's comments on that.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Madam Speaker, I appreciate the great question from my colleague. That is a great recommendation, and I will just give a very specific example. One of the roles that I have had in my career was the privilege of being on the board of one of the largest credit unions in Canada for 10 years. We underwent extensive training and cybersecurity was one of the topics that we had to do.

I was able to take some of that training and bring it into my small business that I had at the time. I remember thinking that I wished a lot of other small business owners could be going through the extensive training that I just went through. That is a great approach and something that we should definitely work on.

[Luc Thériault, Bloc, Montcalm, QC]

Madam Speaker, clause 13 of Bill C-26 essentially allows the government to take new measures to protect critical cyber systems by order in council. That gives it a lot of flexibility. There is more flexibility there than in the legislative process.

Does my colleague think that the bill should be amended in committee so that we can be certain the government will be accountable to Parliament?

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Madam Speaker, that is certainly something committee members could ask the expert witnesses when they are there at committee. Maybe they could delve into that more to see what those issues are and what the opportunities might potentially be for amendments. That is one of the things that could be looked at in the committee. Certainly the committee members there could ask those questions for the witnesses.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, this bill would create tools for governments to support Canadian business and organizations in securing their networks and protecting personal and private information. I wonder if the member could share her thoughts on how this bill could better ensure that businesses are better protected.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Madam Speaker, that is one of the parts of the bill that philosophically sounds like a great thing that the bill could work on, but again, we do not have any details. It is a great objective, but we do not really have any strategies or any other information, so that is something that definitely could be asked at the committee as well.

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Madam Speaker, while sitting through this debate, I observed that it has been one of the highest in quality since I have been in the House. It has been a substantive discussion of a very important issue. I am proud today, as I always am, to be a member of Parliament and to be sitting in the House of Commons.

Today, we are speaking to Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. More broadly, it is a cybersecurity issue.

From the debate and other academic discussions, we can all agree that this is an area of substantial importance where legislation is required. In fact, it is one of my frustrations, which I think is shared by many Canadians, that this government is not agile enough in responding to a world that is quickly changing. We need to be more agile as a legislature, as the government, to reflect the changes that are going on.

We have had a little bit of talk about important changes, such as artificial intelligence, and the exponential speed in which it is changing is unbelievable. Any type of quick Google search will tell us, from many academics, about the great part artificial intelligence can serve in doing much of the hard work that human beings are now doing. However, those observers also say that its ability to do malicious work is equal, which is obviously very challenging. We see these threats, and as we go forward and see more and more powerful artificial intelligence and computing power, the potential for those threats is growing.

We have certainly seen our share, for lack of a better term, of run-of-the-mill cybersecurity threats just in the last couple of years. I was serving as the shadow minister for national revenue when there were substantial CRA breaches of confidential information. One such breach did not actually transmit any information, but it forced the CRA to shut down its entire system, which shut out over 800,000 people from their My Account or log-in system right around tax filing season, which was obviously a tremendous concern for Canadians who were attempting to file their taxes.

The unfortunate reality, as it stands today, is that we are vulnerable to cybersecurity attacks. My colleague for Kildonan—St. Paul spoke recently about a conversation she had with cybersecurity experts from the minister's department just last year. They warned her about the incredible implications of an attack on our critical infrastructure, such as our electrical infrastructure or pipeline technology.

Of course, it is no surprise to many, but maybe to some of my colleagues from British Columba, that we are in a cold country. We can imagine what the impact could be. Our heating infrastructure, our electrical grid and our ability to get natural gas out to some of the coldest places in the world could literally be a matter of life and death. Members can imagine, for example, a cyber attack on one of our nuclear facilities and what that could potentially mean. All this is to highlight in the House today the significance and importance of cybersecurity legislation.

Another example, which I believe has been discussed and debated but I think deserves highlighting again, was in Newfoundland in October 2020 when cybersecurity hackers stole personal information from health care workers and patients in all four regions, as well as social insurance numbers of over 2,500 patients. This is deeply personal information, and as our information increasingly goes on that magical cloud both in the public and private sector, it is increasingly important that we put the appropriate measures to cybersecurity.

As I said, the spirit of the legislation before us is absolutely right. The intent, I believe, is also right. The timing is a little slow, but we need to get it in place.

The member for Winnipeg North did comment on the need for expediency, and I agree with him in one sense. We need cybersecurity legislation, new cybersecurity legislation, in place yesterday. Unfortunately, they brought this legislation in, and it is not complete. There are a series of regulations that we do not know.

This is our job, and I am honestly not trying to be partisan. Instead, this is a substantive criticism that it would have expedited this legislation if they had brought forward the legislation completely baked to show us the regulations and what they want to do.

Of course, I would feel this way about any government as a Canadian citizen. If we are going to grant them wide swaths of power, and maybe even necessarily, we just want to know what exactly those powers are. Do not do as Nancy Pelosi famously said, as the Speaker of the House of Representatives, to pass the bill and then read the bill.

Let us read it first and understand it because, quite frankly, I think the conversation in the House has been at a very high calibre and the more information one can feed us, the more information we can digest to do our job for Canadian citizens by improving the legislation, especially in matters of, as the member from the Liberal Party rightfully said, not just cybersecurity but also national security. We really, in all candour and all honesty, want to do our due diligence here.

As I said, part one of the act:

amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything

This is obviously a very broad power, and that is what we need to look at and work on at committee. Like I said, this legislation, if fully baked, would have meant less work at committee. It would have meant, perhaps, carrying forward with the debate quicker, but as we are left with many questions, those questions deserve to be answered here in the people's House.

The legislation continues:

Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,

(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;

(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;

(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;

(d) provides for the exchange of information between relevant parties; and

(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.

I hope that I have highlighted the fact that this is an important piece of information and that there are gaps within the information, so my substantive ask would be for the government to publish some of those regulations, so that we can review them, perhaps even before committee, and come to it in a spirit of collaboration and discussion. This is a matter of national security.

Perhaps, as I am getting a little bit less young these days, I get a little bit more skeptical. I would love to see some accountability mechanisms where the minister reports back to Parliament or otherwise because the question with the government is always who will watch the watcher.

We have seen that all governments are not infallible and each can commit its own share of foibles, errors and mistakes, unintentional or intentional, so I would love to see some greater accountability come committee.

[Jenica Atwin, Liberal, Fredericton, NB]

Mr. Speaker, I would agree that this is a very high-level discussion we have been having this afternoon. I think that it has been well placed.

He mentioned the possible impacts of, say, a nuclear facility being attacked. It got me thinking about the military capabilities of Canada. My riding of Fredericton is home to CFB Gagetown, very proudly so. We are also home to the Canadian Institute for Cybersecurity, as I mentioned previously in my speech.

I am wondering if he could comment more generally on this expanding role and the necessity to have cybersecurity education and professionals in our Canadian military.

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Mr. Speaker, the short answer is that I agree. The longer answer is that I agree with the comment the member made earlier with respect to modernization. We need to modernize our view on security. The world changed dramatically a year and a half ago, and it continues to change. We need to be adept and agile, and quite frankly, willing to put the resources where they are needed for the future.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Mr. Speaker, my colleague knows that TikTok has been banned from all government devices.

My question is simple. Does my colleague believe that Beijing is using this platform to engage in political interference?

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Mr. Speaker, I agree with the government's recommendation or policy to remove TikTok from all government devices. I believe the CEO of TikTok is testifying in front of U.S. Congress today, so we will see what comes from that. I would agree with him that we need to be on guard against foreign interference in all forms.

[Niki Ashton, NDP, Churchill—Keewatinook Aski, MB]

Mr. Speaker, I acknowledge that today we are having a serious debate about cybersecurity and amendments to the Telecommunications Act.

What strikes me is that as we discuss this issue in Parliament, there is an immense disconnect. Many communities here in our own country have barely any access to the Internet and the wired world that so many of us take for granted.

I am thinking particularly of first nations in my constituency, 11 of which announced a regional state of emergency today. The threat they face is not from the outside; it is from within. It is the threat of drugs, as well as the threat of federal neglect through the housing crisis and the public safety crisis. It is truly an unbelievable set of crises that they are facing in one of the wealthiest countries in the world. As their member of Parliament, I certainly share the concern that Canada is not taking the reality of first nations seriously in this country. There is a disconnect they are facing.

The big question is: What will it take for the Government of Canada to act and deal with the real threats that first nations, particularly the most marginalized here in our country, are facing right now?

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Mr. Speaker, I thank the member for bringing forward this important area of discussion with respect to this debate. It always merits taking time on the floor of the House of Commons to discuss these issues.

Unfortunately, my time is very brief. I believe that any child, born on or off reserve, deserves an equal opportunity to be successful in this country. It is my commitment to do that. I have the great privilege of having two first nations within the constituency of Northumberland—Peterborough South, and I am very proud to represent them here in the House of Commons.

[Gerald Soroka, Conservative, Yellowhead, AB]

Mr. Speaker, my biggest concern with the legislation, as the member brought up, is about the overreaching powers the government is giving itself. We do not know much about what it will be doing with that power or how it can implement that.

Can the member give his opinion on how overreaching these powers are?

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Mr. Speaker, there are a series of provisions talking about frameworks and giving the government powers to put itself within the private sectors to direct them without providing specific delineation of how that would happen. Like I said, it is difficult to get this type of legislation through in expedient ways without the government fully explaining what it wants to accomplish in this legislation.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Mr. Speaker, it is always an honour and a privilege to rise in this place, and it is nice to join the debate on the topic at hand.

When we talk about cybersecurity, there are so many different factors that go into it. I recognize that the bill before us largely has to do with telecommunications companies, bigger companies, and perhaps with government institutions as a whole. However, as we are having this conversation, we need to recognize and address the fact that the risk presented through cybersecurity extends much beyond that. With the current generation of kids being raised, kids are heavily involved in using cellphones, video game systems and computer consoles, for example, and are curious by nature. They are more at risk of clicking on a link that they do not know or realize is harmful. We know that is quite often how a lot of bad actors exploit weaknesses in computer systems in businesses or in homes. It is important to have that context out there early as we start the debate on this bill.

I want to get into a few specific parts of the bill at the start. First, it proposes to amend the Telecommunications Act to make sure the security of our Canadian telecommunications system is an official objective of our public policy, which is not a bad idea in and of itself. Second, it would create a new critical cyber systems protection act. The stated goal is to have a framework in place that would allow for better protection of critical cyber-services and cyber systems, which impact national security and public safety.

Some of the proposals include the designation of services or systems deemed to be “vital” for the purposes of this new act, along with designating classes of operators for these services or systems. The designated operators in question could be required to perform certain duties or activities, including the implementation of security programs, the mitigation of risks, reporting security incidents and complying with cybersecurity directions. Most significantly, Bill C-26 would authorize the enforcement of these measures through financial penalties or even imprisonment.

Anybody hearing these few examples listed in the preamble probably thinks this sounds like common sense, and I would generally agree with them. However, there is a problem, especially with the last one, which has to do with directions, because it is quite vague. These points should raise some obvious questions. How are we defining each of them? What are the limits and the accountability for using these new powers? It is fair to have these general concerns when we consider any government, but Canadians have reason to be especially wary with the one currently in power based on the Liberal record itself.

Unfortunately, the most recent and disturbing revelations related to foreign interference in two federal elections, which allegedly included working with an elected official, are not the only things we need to talk about. Here is another example. For a number of years, the Conservatives were demanding that the Liberals ban Huawei from our cellular networks. Despite all the warnings and security concerns, they delayed the decision and left us out of step with our closest partners in the Five Eyes. We had been calling it out for years before they finally decided to make the right decision thanks to pressure from Canadians, experts, our allies and the official opposition.

It was not very long ago, almost a year, when the announcement to ban Huawei came along. As much as it was the right decision, it should have been made much sooner. To say that is not a complaint about some missed opportunity in the past. The delay caused real problems with upfront costs for our telcos, and it created extra uncertainty for consumers.

Prior to becoming a member of Parliament, I worked for a telecommunications company in Saskatchewan. When we look at how big and vast our country is, we start thinking about how much equipment is required for one single telecommunications provider in one province, like SaskTel, the company I worked for. We can think about how much equipment it would have ordered or pre-ordered and potentially would have had to replace based on the government taking so long to make up its mind on whether or not to ban Huawei. If we look at some of the bigger companies out there, it is the same thing. There are the upfront costs they would have had to incur, and then the new costs if they had to replace all their equipment on top of that. This was simply because the government dragged its feet on such a big decision.

We have learned a lot of other things about foreign interference since then that need to be properly addressed and independently investigated. We need a public inquiry, at the very least, into some of these issues. However, once again, the Liberals are refusing to do the right thing for as long as they possibly can. It is clearer than ever before that we need to get a lot more serious about our cybersecurity, because what we are really talking about is our national security as a whole. These two things are closely intertwined, and having this conversation is long overdue.

We are happy to see the issue get more of the attention it deserves. Canadians have a lot of questions and concerns about it that should not be ignored. That is why it is a priority for Conservatives on our side of the House, and we are not going to let it go.

While we work to carefully review Bill C-26 in this place, we want to make sure that it will be effective and accomplish what it is supposed to do. It needs to protect Canadians living in a digital world. At the same time, it should not create any new openings for government to interfere with people's lives or abuse power.

After all, we are waiting for Bill C-11 to return to the House with all the problems it has, including the risk of online censorship. The problem is that whether it is about Huawei or the latest scandal about foreign interference, the Liberal government has failed to act, and it has undermined trust in our institutions. Therefore, it is hard to take it seriously when a bill like this one comes forward. The government's failure in this area is even more frustrating because we should all agree that there is a real need to strengthen cybersecurity. That is what experts and stakeholders have been telling us over many years. Canadians have had to wait for far too long for the government to bring something forward.

Make no mistake: This bill is flawed, and it will require more work to make sure that we get it right. However, the fact that we are talking about the issue right now is a small and necessary step in the right direction.

There are a few points I would like to mention.

Part 1 of this bill will allow the federal government to compel service providers to remove all products provided by a specified person from its networks or facilities. First of all, that puts a lot of companies at risk of having adversarial agreements signed in the future. If I were a company trying to sign an agreement, I would be doing everything I could to make sure that someone is not going to put a clause in there that if the government forces its removal, there is going to be an extra fine levied on the company. The problem with this bill is that it exposes companies to having these bad contracts negotiated, signed and forced on them by bad actors.

Under the new critical cyber systems protection act, the minister would be able to direct and impose any number of things on a service provider without giving them compensation for complying with the orders. Earlier, I was talking about the upfront costs paid by telcos trying to advance their networks to provide the products and services that their clients and customers want and need, especially as the world moves forward in a more digital fashion. The government is going to force them to do something without any compensation or without the ability to have help dealing with these changes. I think this is something that needs to be reconsidered in this bill.

That leaves service providers in a position where they have to pay for complying with potentially arbitrary orders or face legal penalties, such as the ones I mentioned earlier: fines or even imprisonment.

Again, we do have a desperate need to improve our cybersecurity regime, but these problems show that the bill is poorly written. By seeking to implement personal liability for breaches of the act, it will incentivize skilled Canadian cybersecurity professionals to leave Canada to find jobs elsewhere. This phenomenon, commonly known as the brain drain, is emerging as a severe issue for our economy, in some part thanks to the policies of the government.

Thousands of skilled, highly employable Canadians move to the United States thanks to the larger market, higher salaries and lower taxes, while very few Americans move to Canada to do the same. This issue is bigger than just the cybersecurity sector. Thanks to this government, we are losing nurses, doctors and tech workers to the United States. All the while, professionals who immigrate to Canada are being denied the paperwork they need to work in the field they are trained for because of the ridiculous red tape that plagues our immigration. Given that we are already short 25,000 cybersecurity professionals in Canada, is it wise to keep incentivizing them to go to the States?

Another massive problem with this bill is that it opens the door for some extreme violations of individual privacy. It also expands the state's power to use a secret government order to bar individuals or companies from accessing essential services. While we must improve our framework against cybersecurity attacks, drastically expanding what cabinet can do outside the public eye is always a bad idea. Accountability to the people and Parliament has always been an essential part of how we are supposed to do things in Canada. It is, however, not surprising that the current government would advocate for more unaccountable power. After all, government members have been anything but transparent. They have hidden information from Canadians to protect their partisan interests.

Canadians deserve to know what the government is doing. We must always uphold the principle that everyone is innocent until proven guilty. Giving cabinet the right to secretly cut Canadians off from essential services could threaten to erode this fundamental right.

[John McKay, Liberal, Scarborough—Guildwood, ON]

Mr. Speaker, the hon. member seems to be concerned about the enforcement powers in this legislation. However, without those enforcement powers, it would be kind of a useless piece of legislation.

If I am sending an email to him to go over there, somehow or another, his entity may be the weak link. If, in fact, he is concerned about his piece of the infrastructure, the problem is: How would he propose changing that without some sort of significant power on the government's part to make sure that his piece of the cyber-infrastructure is not the weak link in the entire system?

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Mr. Speaker, we need the government to talk to businesses, to be transparent in the process, to work with industry and to make sure there is a good process of approval so that equipment or the companies people are buying from are not already compromised. Let us work with them to make sure they know there are good actors out there that provide good equipment. There are many companies out there besides Huawei that provide good equipment. The government could work with those companies, rather than threatening them with fines and imprisonment, to make sure we have the proper equipment in our networks and make sure Canadians have not only the best services, but also the highest level of security they can possibly get.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Mr. Speaker, I sit on the national defence committee, and we are discussing a lot about cybersecurity, which relates to the debate today. Obviously, the armed forces are having quite a recruitment retention issue, but across the board we are seeing this with the labour shortage. One of the questions we were talking about regarding cybersecurity as it relates to national defence was around security clearances and what the government needs to do to attract people to the cybersecurity industry, potentially trying to ensure that people from outside Canada are attracted to this industry. Maybe the member of Parliament could address that a bit. I know it is a little outside our scope, but it certainly gets into how we start to address a lot of the problems we have been discussing all day.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Mr. Speaker, I thank the member for her question because it is an important one, whether in this debate or any other debate, that gets into credential recognition. Many other countries around the world are further along than us in prioritizing the digital environment.

There are lots of Asian countries and Pacific countries that are further along in their advancement of that, so if workers want to come to Canada, we should be working with them to make sure their credentials match up with the standards we have here in Canada, while removing red tape so we can get those people into jobs right away. Rather than having them come here and work in other jobs for a number of years without working in their professions, they should be able to come here and do the things they are able to do. We should have the credentialing system in place now so they can get the jobs they are here to do right off the bat.

[Larry Maguire, Conservative, Brandon—Souris, MB]

Mr. Speaker, earlier today, some of my colleagues, particularly the member for Scarborough—Guildwood, indicated the pillars involved in the bill. The member mentioned them as well in his presentation. There are so many different areas that need to be looking at the cybersecurity issues in Canada. As other colleagues indicated, some countries around the world are ahead of us in some of those areas.

I wonder if the member could expand a bit on that. I will give him an opportunity to look at the number of pillars that might be in place and the reasons he thinks it so important to deal with the cybersecurity issues that each one of those would have.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Mr. Speaker, we can look at some of the issues we are facing. The CRA has been subjected to relentless cyber-attacks over the last number of years. Even CERB fraud was committed by cyber-attackers. Somewhere between 1,200 and 1,800 individual accounts were exploited for fraud because the lack of cybersecurity was able to help them out. Eventually we got that under control, but it just shows how many attacks we have. Having a framework in place is good, and the government is trying to go in the right direction here, but there are things we need to do with this bill. Hopefully at committee we can help to establish some stronger pillars to make sure Canadians are protected.

[Dan Mazier, Conservative, Dauphin—Swan River—Neepawa, MB]

Mr. Speaker, I rise today to speak on Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. Cybersecurity is of the utmost importance to Canadians, and I am glad to see the topic debated in the House today.

Bill C-26 would amend the Telecommunications Act. I should note that any time the Telecommunications Act is changed, I am very interested. Not only am I the shadow minister for rural economic development and connectivity, but I also have a bill before Parliament, Bill C-288, that would amend the Telecommunications Act to provide Canadians better information when it comes to the service and quality they pay for.

The dependence on telecommunications throughout our society continues to grow. The uses of Internet and cellular services are foundational to both the social and economic success of Canada, so I appreciate seeing the government move forward with a bill to secure our telecommunications network through Bill C-26. However, I must ask this: What took so long?

It was over two years ago when this House of Commons passed a Conservative motion that called on the Liberal government to ban Huawei from our 5G network. Despite this motion passing in the House of Commons and the director of the Canadian Security Intelligence Service warning the government in 2018, it took years to ban Huawei from Canada's 5G network. Therefore, is Bill C-26 important? It absolutely is. Did it take too long to get here? It absolutely did.

I should note that I recently asked if the University of British Columbia continues to work with Huawei in any form. The response was, “Yes, we do”. The government has been warned about the risks to our national security over and over again, yet we fail to see concrete action.

Analyzing Bill C-26, I have a few questions and concerns.

In its current form, Bill C-26 allows the Minister of Industry to obtain and disclose information without any checks and balances. If passed, Bill C-26 would grant the minister the power to obtain information from the Canadian telecom companies. It could, “by order, direct a telecommunications service provider to do anything or refrain from doing anything...that is, in the Minister’s opinion, necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.”

There are no specific details on what information can be collected when it comes to personal consumer data, nor is there any clarity on who the minister could share this personal information with. Could the minister share it with other ministers or other departments? As of now, it does not say the minister could not do so.

A recent research report entitled “Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act” stated the following on this matter:

The legislation would authorize the Minister to compel providers to disclose confidential information and then enable the Minister to circulate it widely within the federal government; this information could potentially include either identifiable or de-identified personal information. Moreover, the Minister could share non-confidential information internationally even when doing so could result in regulatory processes or private right of actions against an individual or organization. Should the Minister or [any] other party to whom the Minister shares information unintentionally lose control of the information, there would be no liability attached to the government for the accident.

I think an accident by the current government happens quite a bit.

If Parliament is going to give the minister such powers, it is imperative that checks and balances exist. It is very important that, when we discuss the ability of a government to obtain personal information from Canadians, we ensure that Canadians are protected from the unauthorized use of such information.

I should also add to this conversation the impact Bill C-26 could have on smaller Internet service providers. Small Internet companies are foundational to improving competition within Canada's telecom industry, but they are sometimes left out of the conversation.

Bill C-26 would empower the minister to “prohibit a telecommunications service provider from using any specified product or service in, or in relation to, its telecommunications network or telecommunications facilities, or any part of those networks or facilities” or “direct a telecommunications service provider to remove any specified product from its telecommunications networks or telecommunications facilities, or any part of those networks or facilities”.

We do not know what types of telecom infrastructure and equipment will be deemed a risk to our national security in the coming decades, so imagine that a local Internet service company builds a network using a specific brand of equipment. At the time, no one raises security concerns with the equipment or the manufacturer. The local Internet company is just beginning its operations, investing heavily in equipment to build a network and to compete with larger telecom companies.

Imagine that, five years later, the government deems the equipment the company invested in to be a national security threat, forcing it to remove and dispose of such equipment. The small Internet company trying to compete, which acted in good faith, has just lost a significant amount of capital because of a government decision. There is a strong possibility that this local Internet provider can no longer afford to operate.

I am hopeful this conversation can be had at committee to ensure the government is not unfairly impacting small, local and independent Internet companies. As I said, I am glad the House is debating the issue of cybersecurity, as the discussion is long overdue, but it is imperative that the issues I raised be addressed at committee, it is imperative that the issues my colleagues have raised be addressed at committee and it is imperative that the issues experts have raised be addressed at committee. That is why I will be voting to send Bill C-26 to committee in hopes that these concerns can be addressed.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Mr. Speaker, I am glad to see there is general agreement in the House on the principle of this bill and on the fact that, obviously, work is needed.

I know the member has a lot of experience in the agricultural field and brings that experience to Parliament. I want to ask him about the part of this bill that would allow the Governor in Council to designate any service or system as a vital service or vital system. I would ask him for his thoughts.

Obviously, our transportation sector can be considered a vital service, especially our railway lines, but what does he think about our supply chains, especially involving our agricultural products, and how those might be targeted? As he knows very well, many of Canada's farmers, producers and processors are really starting to move into more digital ways of doing business, and much of their equipment is linked to computer systems.

I would like to ask whether he has any thoughts to share on how those could be classified as vital systems and services.

[Dan Mazier, Conservative, Dauphin—Swan River—Neepawa, MB]

Mr. Speaker, it is very important. The key takeaway is that this type of legislation is long overdue. That is why it is so important to get the amendments right and get this bill to committee as quickly as possible so we can all work on it. Let the experts review it and let the members get at it, but also let the industry get at it so we can come up with really good legislation to benefit all Canadians, especially farmers.

[The Deputy Speaker, Conservative, Chris d'Entremont]

Is the House ready for the question?

[Some hon. members]

Question.

[The Deputy Speaker, Conservative, Chris d'Entremont]

The question is on the motion.

If a member of a recognized party present in the House wishes that the motion be carried or carried on division or wishes to request a recorded division, I would invite them to rise and indicate it to the Chair.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, I request a recorded division.

[The Deputy Speaker, Conservative, Chris d'Entremont]

Pursuant to order made on Thursday, June 23, 2022, the division stands deferred until Monday, March 27, at the expiry of the time provided for Oral Questions.

The hon. parliamentary secretary to the government House leader.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, if you seek it, I believe you will find unanimous consent to advance to Private Members' Business.

[The Deputy Speaker, Conservative, Chris d'Entremont]

Is it agreed?

[Some hon. members]

Agreed.