Thank you, Mr. Chair.
Thank you for giving me a reference point to begin my comments again, which start with:
I. Limiting powers to order modifications to organizations’ technical or business activities
29. To include appropriate safeguards surrounding compulsion powers under Bill C-26, Cybersecurity Will Not Thrive in Darkness makes the following recommendations:
a. Recommendation 1: Orders in Council and Ministerial Orders Must be Necessary, Proportionate, and Reasonable. Currently, the legislation allows the government to issue an order when necessary to secure the Canadian telecommunications system. However, necessity is an insufficient curb on the government’s power; Bill C-26 should impose more conditions regarding the specific circumstances under which the government can exercise its power.
b. Recommendation 2: Orders Should Include a Reference to Timelines. The draft legislation should be amended to include a requirement that telecommunications providers must implement cybersecurity demands or orders within a reasonable period of time in situations where compliance with a demand or order would require significant or material changes to the recipients’ business or technical operations.
c. Recommendation 3: Government Should Undertake Impact Assessments Prior to Issuing Orders. Government assessments of its orders should identify secondary- or tertiary impacts that would have the effect of worsening an organization’s cybersecurity practices or stance. These assessments should be presented to telecommunications providers along with any demands or orders or regulations that are based upon these assessments. Such assessments should be included in any and all proportionality analyses of government demands or orders.
d. Recommendation 4: Forbearance or Cost/Cost-Minus Clauses Should Be Inserted. The government may issue a direction that could severely alter how a telecommunications provider is able to offer a service to customers. The legislation should be amended such that telecommunications providers can seek forbearance of certain orders where implementing them would have a material impact on the providers’ economic viability. Alternatively, if an order or regulation would have a deleterious effect on a telecommunications provider’s economic viability and the government demands that the order be fulfilled regardless, the provider should be compensated on either a cost or cost-minus basis.
e. Recommendation 5: The Standards That Can Be Imposed Must Be Defined. Without a clear definition of what a “standard” in the draft legislation entails, it becomes difficult to assess what kinds of standards the government is seeking to implement and whether it is adopting them safely. The legislation should be amended such that it is clear what kinds of standards are within and outside of the scope of the legislation. The evidence and analysis in Finding You underscore that urgent action is needed to establish mandatory security and privacy standards for telecommunications providers to require security postures that address the vulnerabilities in signalling protocols that enable mobile geolocation surveillance threats.It should also be made explicit that an order or regulation compelling the adoption of particular standards cannot be used to deliberately or incidentally compromise the confidentiality, integrity, or availability of a telecommunications facility, telecommunications service, or transmission facility. The intent of this recommendation is to prevent the government from ordering or demanding that telecommunications service providers deploy or enable lawful access-related capabilities or powers in the service of “securing” infrastructure by way of adopting a standard.
II. Secrecy and Absence of Transparency or Accountability Provisions
30. As noted above, Bill C-26 has “extensive and overly onerous secrecy and confidentiality requirements.” Laws that impose meaningful limits on the freedom of expression must be balanced and reasonably justified. While some confidentiality will be appropriate to ensure that unresolved security vulnerabilities are effectively brought into control, certain powers in Bill C-26 go further than what is required to accomplish cybersecurity and national security objectives. Furthermore, certain powers proposed are unaccompanied by reasonably available measures to protect the public’s interest in access to information concerning an important area of government action. In light of identified deficits concerning excessive secrecy or the absence of accountability provisions, we reiterate the following recommendations from Cybersecurity Will Not Thrive in Darkness:
a. Recommendation 6: Orders Should Appear in The Canadian Gazette. In Bill C-26, orders are required to be published in the Canadian Gazette, but the Minister has the authority to “direct otherwise in the order.” As such, “the result is that the government might issue orders that never appear in the Canadian Gazette, and there is no requirement for the order to ever be published in a complete and non-redacted format.” The potential effect could unjustifiably restrict meaningful public debate on a matter of public importance and, as a consequence, the freedom of expression. The legislation should be amended such that orders must be published within 180 days of issuing them or within 90 days of an order being implemented, based on whichever condition is met first. The legislation should also expressly define circumstances that justify secrecy.
b. Recommendation 7: The Minister Should Be Compelled To Table Reports Pertaining to Orders and Regulations. To better safeguard the public interest, privacy, and the freedom of expression, the legislation should further be amended such that the Minister of Industry is required to annually table a listing of:
the number of orders and regulations that have been issued
the kinds of orders or regulations that have been issued
the number of telecommunications providers that have received the orders
the number of telecommunications providers that have partially complied with the orders
the number of telecommunications providers that have completely complied with the orders
a narrative discussion of the necessity, proportionality, reasonableness, and utility of the order-making power
c. Recommendation 8: Non-Disclosure Orders Should Be Time Limited. Bill C-26 also proposes gag provisions with respect to Orders in Council or Ministerial Orders, which are not limited either temporally (i.e., how long is secrecy necessary?) or substantively (i.e., what circumstances justify secrecy?). As noted at paragraph 15, non-disclosure orders affect not only the recipient of the gag order, but, also, the public's right to information that informs democratic debate. The legislation should be amended to include time constraints surrounding non-disclosure orders.
d. Recommendation 8A: The Circumstances Purporting to Justify Confidentiality in a Non-Disclosure Order Should Be Defined In The Legislation.
e. Recommendation 9: The CRTC Should Indicate When Orders Override Parts of CRTC Decisions. The legislation should be amended to, at a minimum, require that the CRTC post a public notice attached to any of its decisions where there is a contradiction between its decision and an Order in Council or Ministerial Order or regulation that has prevailed over part of a CRTC decision.
f. Recommendation 10: An Annual Report Should Include the Number of Times Government Orders or Regulations Prevail Over CRTC Decisions. The legislation should be amended to require the government to annually disclose the number of times it has issued orders or regulations that prevailed in the case of an inconsistency between a given order or regulation and a CRTC decision, as well as denote which CRTC decision(s) were affected.
g. Recommendation 11: All Regulations Under the Telecommunications Act Should Be Accessible to The Standing Joint Committee for the Scrutiny of Regulations. The legislation should be amended such that the Standing Joint Committee for the Scrutiny of Regulations is able to obtain, assess, and render a public verdict on any regulations that are promulgated under the proposed draft reforms to the Telecommunications Act, as well as on regulations pertaining to the Telecommunications Act and that are modified pursuant to s. 18 of the Statutory Instruments Act.
III. Deficient Judicial Review Process
31. Bill C-26 contemplates that telecommunication providers may initiate judicial review proceedings in respect of orders or regulations issued under the proposed legislation. In pages 22-24 of his report, Dr. Parson identified problems that would arise if Bill C-26 is passed without amending section 15.9. As drafted, section 15.9 would permit a series of mandatory limits on open court principles, which would prevent judges from exercising judicial discretion in balancing the need for secrecy or confidentiality with the public's interest in disclosure. As noted at paragraph 15 in this submission, the Charter protects open court principles that apply in the context of judicial review, including Charter protections for the freedom of expression.
32. Cybersecurity Will Not Thrive in Darkness recommends (Recommendation 12) that Bill C-26 should explicitly enable appointment of amicus curiae or a special advocate during judicial review. The legislation should be amended such that, at the Court's pleasure, amicus curiae or a special advocate can be appointed to contest and respond to information provided by the government in support of an Order in Council, Ministerial Order, or regulation under s. 15.8 in when evidence is sufficiently sensitive to bar a telecommunications provider's counsel from hearing it.
33. We also recommend:
a. Recommendation 12A: Section 15.9 Should Be Amended To Ensure The Judge Retains Authority To Balance The Public Interest In Disclosure Against The Interest In Confidentiality: In general, mandatory limits on open courts (which prevent the judge from balancing the public interests at stake), are generally viewed as excessive infringements on section 2(b) rights. For example, even in analogous provisions of the Canada Evidence Act (permitting secrecy in judicial proceedings for matters injurious to international relations, national defence or national security or endanger the safety of any person), the judge retains the authority to determine that “the public interest in disclosure outweighs in importance the public interest in non-disclosure”. The same safety valve should be incorporated into section 15.9 of Bill C-26, in order to ensure that any limits to openness minimally impair freedom of expression.
b. Recommendation 12B: Where Summaries Are Provided Of Evidence And Information Received By The Court, Pursuant To Section 15.9(1)(C), These Summaries Must Also Be Available To The “Applicant and the Public”. As noted at paragraph 15, the open court principle protects the public’s and the media’s interest in the openness of court proceedings. Practically speaking, the public’s right of access to judicial summaries of this nature is typically accomplished by marking such summaries as an exhibit to the proceedings. The public’s right of access to exhibits is a corollary of the open court principle.
c. Recommendation 12C: The Triggering Threshold Justifying Limits On The Openness Of The Proceedings Should Not Be Higher Than That Which Is Already Contained Under Analogous Provisions Of The Canada Evidence Act. In that regard, we recommend mirroring the language from the Canada Evidence Act through the following amendment:
Section 15.9(1)(a) “…if, in the judge’s opinion, the disclosure of the evidence or other information would [changed from “could”] be injurious to international relations, national defence or national security or endanger the safety of any person”.
IV. Extensive Information Sharing Within and Beyond Canadian Agencies
34. Bill C-26 proposes to create broad information sharing powers within and beyond Canadian government agencies, without accompanying those powers with necessary limits, oversight, or accountability mechanisms. As noted at paragraph 24, the absence of reasonable procedural safeguards to review government powers that infringe upon privacy interests can render legislation invalid under section 8 of the Charter. To impose more appropriate guardrails on the proposed powers to share information within and beyond Canadian agencies, Recommendations 13-20 of Cybersecurity Will Not Thrive in Darkness are the following:
a. Recommendations 13 and 14: Relief Should Be Available If Government Mishandles Confidential, Personal, or De-Identified Information. The legislation should be amended to enable individuals and telecommunications providers to seek relief should the government or a party to whom the government has disclosed confidential, personal, or de-identified information loses control of that information, where that loss of control has material consequences for the individual, or for a telecommunication provider's business or technical operations.
b. Recommendation 15: Government Should Notify Telecommunications Providers How It Will Use Collected Information, and Which Domestic Agencies Information Will Receive The Information.
c. Recommendation 16: Information Obtained from Telecommunications Providers Should Only be Used by Government Agencies for Cybersecurity and Information Assurance Activities. Information should not be used for the purposes of signal intelligence and foreign intelligence activities, cross-department assistance unrelated to cyber-security, or active or defensive cyber operations. These restrictions should apply to all agencies.
d. Recommendations 17 and 18: Data Retention Periods Should Be Attached to Telecommunications Providers’ Data and to Foreign Disclosures of Information. The legislation should be amended to highlight that confidential information will be retained only for as long as necessary to make, amend, or revoke an order under section 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a), or to verify the compliance or prevent non-compliance with such an order or regulation. Similarly, an amendment should also require that the government attach data retention and deletion clauses in agreements or memoranda of understanding that are entered into with foreign agencies. Retention periods should be communicated to the affected telecommunications providers.
e. Recommendation 19: Telecommunications Providers Should Be Explicitly Informed Which Foreign Parties Receive Their Information. Given that foreign parties can use information to launch investigations and bring non-penal charges against providers, the government should provide some notice when telecommunications providers’ information is being, or has been, shared for cybersecurity purposes.
f. Recommendation 20: Legislation Should Delimit the Conditions Wherein a Private Organization’s Information Can Be Disclosed. As drafted, section 15.7(1) appears to set an excessively low threshold for disclosing information, and could enable significant sharing of private, if not confidential, information, to address unspecified threats that are not set out in the legislation. Proposed textual amendments are found on page 30 of Cybersecurity Cannot Thrive in the Darkness (Appendix A to this brief).
V. Costs Associated with Security Compliance
35. As noted above, imposing substantial costs of compliance on telecommunications providers may have the potential to impact upon the accessibility of telecommunication services, the digital divide, and Charter-protected rights or interests. To address concerns surrounding the costs associated with security compliance, Cybersecurity Will Not Thrive in Darkness makes the following recommendations:
a. Recommendation 21: Compensation Should Be Included for Smaller Organizations. There should be a mechanism whereby smaller telecommunications providers (e.g., those with fewer than 250,000 or 500,000 subscribers or customers) that have historically been conscientious in their security arrangements can seek at least some temporary relief if they are required to undertake new, modify existing, or cease ongoing business or organizational practices as a result of a government demand or order or regulation. Such relief may be for only a portion of the costs incurred and, thus, constitute a “cost-minus” expense formula.
b. Recommendation 22: Proportionality and Equity Assessments Should Be Included in Orders or Regulations. The results of these assessments should be taken into consideration by the government prior to issuing an order or regulation, should be provided to telecommunications providers alongside associated orders or regulations, and should be included in any evidentiary packages that may be used should a telecommunications provider seek a judicial review of any given order or regulation.
c. Recommendation 23: Government Should Encourage Cybersecurity Training. The government should commit to enhancing scholarships, grants, or other incentives to encourage individuals in Canada to pursue professional cybersecurity training.
VI. Vague Drafting Language
36. The last set of recommendations pertain to ambiguities in Bill C-26. Notably, Bill C-26 does not specify the kinds of security threats that might be addressed by orders or regulations; fails to define key concepts like “interference”, “manipulation”, and “disruption”; provides the Minister with unnecessarily open-ended powers; and lacks clear guidelines as to how personally identifiable information that is obtained from telecommunications providers is to be treated. As a result, Cybersecurity Will Not Thrive in Darkness makes the following recommendations:
a. Recommendation 24: Clarity Should Exist Across Legislation. The government should clarify how the envisioned threats under the draft legislation (“including against the threat of interference, manipulation or disruption”) compare to the specific acts denoted in s. 27(2) of the CSE Act (“mischief, unauthorized use or disruption”), with the goal of explaining whether the reformed Telecommunications Act would expand, contract, or address the same classes of acts as considered in the CSE Act.
b. Recommendation 25: Explicit Definitions for “Interference,” “Manipulation,” and “Disruption” Should Be Included in the Legislation or Else Publicly Promulgated.
c. Recommendations 26 and 27: Ministerial Flexibility Should Be Delimited (i.e., remove open-ended language around powers such as “among other things”). In the event that a corresponding amendment is needed for Ministerial powers constrained to emergency circumstances, those powers should be subject to judicial review in Federal Court, including assessment for necessity, reasonableness, and proportionality. Decisions emergent from review should be published by the Federal Court.
d. Recommendation 28: The Legislation Should Make Clear That Personal Information and De-identified Information is Classified as Confidential Information. As noted above, the federal government's Charter statement appears to conclude that it is not the intent of Bill C-26 to authorize the collection and sharing of personal information. If that is the case, the legislation should expressly say so. Alternatively, personal and de-identified information should be treated as confidential.
e. Recommendation 28A: Individuals Should Be Explicitly Informed If Their Information Has Been Collected Or Shared. If the federal government does not expressly state that personal and de-identified information should not be included in collection and sharing powers, it should ensure that notice obligations are extended to individuals whose information is impacted by the collection and sharing powers under Bill C-26.
f. Recommendation 29: Prior Judicial Approval Should Be Required for the Government to Obtain Personal or De-identified Information from a Telecommunications Provider. The information is further to be used exclusively for the purposes of making, amending, or revoking an order under s. 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a), or of verifying compliance or preventing noncompliance with such an order or regulation.
g. Recommendation 30: The Government Cannot Disclose Personal or De-identified Information to Foreign Organizations.
Part 4. Concluding Remarks
37. We urge this Committee to take seriously the recommendations that were identified in Cybersecurity Will Not Thrive In Darkness. We note that most of these recommendations have been either reiterated or expanded upon by the Joint Submission to this committee submitted by civil society organizations and individuals. In detailing these recommendations for this Committee's study, we also urge the Committee to consider the additional Charter interests that are engaged by Bill C-26, including equality, non-discrimination, freedom of expression, and privacy, as described in Part 2 of this Brief. We echo Dr. Parsons' view that “cybersecurity efforts through Bill C-26 should seek to build trust between the government and non-government entities, including the general public,” and that independent bodies (including the Privacy Commissioner of Canada, National Security and Intelligence Committee of Parliamentarians, or National Security and Intelligence Review Agency) should be integrated into the government's assessments of the necessity, proportionality, and reasonableness of Orders in Council, Ministerial Orders, or regulations.
38. Citizen Lab's recent report, Finding You (enclosed as Appendix C), documents continuing vulnerabilities at the heart of the world's mobile communications networks. The report's findings underscore that cybersecurity has not thrived in darkness. Historical and continuing deficiencies in oversight, transparency, and accountability of network security have led to serious geolocation-related threats associated with contemporary networks. The report notes that the “failure of effective regulation, accountability, and transparency has been a boon for network-based geolocation surveillance.”
39. While Canada needs to move forward in combating threats to its telecommunications and critical infrastructure, it should not do so at the expense of democratic norms and safeguards, public transparency and accountability, or respect for the Charter and human rights. Rather, a human security and human rights approach to cybersecurity requires the recognition of the importance of accessible and inclusive cybersecurity, public accountability, and public transparency when regulating telecommunications and cybersecurity.
The rest of it is just a bit of a biography of the individuals who were involved in putting that together.
I think I've given you a fairly comprehensive.... It's a lot for the committee to think about when we want to go back to clause 124, which deals specifically with Bill C-26.
I certainly recognize that there are some who didn't want to have this conversation, but I think this provision, with Bill C-26 being such a key part of this clause.... We need to consider whether or not we should support a clause that contains linkage to a bill that clearly has so many glaring errors. So many critical civil society organizations have come forward and said this is something we need to amend. We need to make changes, because there are significant concerns about the impact on privacy, data sharing and government reporting when they collect information from individuals or other entities. I believe we should give strong consideration to voting against this particular clause. The information I provided should formulate part of that discussion, but I know other members have some concerns they want to share with the committee.
Therefore, Mr. Chair, I will turn the floor over to the next speaker. However, while I still have the floor, I would indicate that I would like you to put me at the end of the speaker list, as well. I'd like to hear what my colleagues have to say, and then have the opportunity to follow up. Could you add me to the list and perhaps give us all a reminder, as I turn the floor over, what that list looks like, to make sure I have a place at the end of it?
Thank you, Mr. Chair.