Bill C-26

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

Telecommunications Act

[Gerald Soroka, Conservative, Yellowhead, AB]

Madam Speaker, I will be splitting my time with the member for Kootenay—Columbia.

I am pleased to rise in the House today to speak to Bill C-26, the critical cyber systems protection act, introduced in June 2022 and split into parts 1 and 2. The former aims to amend the Telecommunications Act to include:

the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.

The latter outlines the introduction of the critical cyber systems protection act, which would create a new regulatory regime requiring designated critical infrastructure providers to protect their cyber systems.

I would like to emphasize that the safety and security of our telecom industry, with particular reference to foreign adversaries such as the Beijing Communist Party, has been a broad theme in communications lately. This is especially concerning the controversial Bill C-11, the online streaming act, or, should I say, government censorship, and new revelations from the Canadian Security Intelligence Service, CSIS, flagging election interference from those involved with the Beijing Communist Party.

We Conservatives believe it is of paramount importance to defend the rights and interests of Canadians from coast to coast to coast. Thus, Canada's national security should be strongly well equipped to be prepared for cyberwarfare threats that could be presented by emerging digital technologies, intelligent adversaries or authoritarian artificial intelligence.

The NDP-Liberal government has had a long record of denying Canadians the truth. Instead of protecting their rights and freedoms, the government uses deflection tactics to divide Canadians, pitting them against one another to distract from the real issue: that the NDP-Liberal government has been too slow to address cyber-threats. For this critical lack of action, Canada has seen several serious incidents occur with no substantive legislative response for over seven years. After years of chronic mismanagement and utter failure, it is time for the government to step aside and let the Conservatives turn Canadians' hurt into hope.

We support the stringent and thorough examination of this legislation. We will always defend and secure the security of Canadians, especially with regard to cybersecurity in an increasingly digitized world. There is a pressing demand to ensure the security of Canada's critical cyber-infrastructure against cyber-threats. Let us not forget that these very systems lay the foundation of the country as a whole. It is these cyber systems that run our health care, banking and energy systems, all of which should be guarded against the cybercriminals, hackers and foreign adversaries who want to infiltrate them.

Akin to several other Liberal ideas, a number of aspects of this bill require further review, and it should thus be sent straight to committee where it can be further dissected and refined to ensure that all flaws are addressed. One can only imagine the disaster that a hospital system crash would add to the already horrible wait times in emergency rooms and shortages of medical professionals thanks to the NDP-Liberal government. The results would be disastrous. Furthermore, disruption of critical cyber-infrastructure in health care can bring severe consequences, such as enabling cybercriminals to access confidential patient health care information.

While we understand that it is imperative to provide the resources necessary to effectively defend against cyber-threats, it is still equally important to ensure that the government does not overreach on its specified mandate through Bill C-26. A research report written by Christopher Parsons called “Cybersecurity Will Not Thrive in Darkness” highlights some recommendations to improve Bill C-26. Among these recommendations is an emphasis on drafting legislation to correct accountability deficiencies, while highlighting amendments that would impose some restrictions on the range of powers that the government would be able to wield. These restrictions are critical, especially concerning the sweeping nature of Bill C-26, the critical cyber systems protection act, as outlined in parts 1 and 2, which I have explained in my opening statement.

The sweeping nature of this legislation is not new, particularly for the Liberal government. It even goes back to Bill C-11, the online streaming act, which essentially placed the Liberal government as the online content regulator controlling what Canadians see or listen to online. If members ask me, the government policing what Canadians view online is a cyber-threat in its own way, but I will not get into that right now.

There are other flaws in Bill C-26 that I would like to highlight, which brings us back to having Bill C-26 closely reviewed in committee.

In terms of civil liberties and privacy, some civil liberties groups have flagged serious concerns regarding the scope and lack of oversight around the powers that may be granted to the government under Bill C-26. In September last year, the Canadian Civil Liberties Association, along with other groups, released a joint letter of concern regarding Bill C-26, highlighting that the bill is “deeply problematic”, like several other questionable Liberal policies. They went on to further explain that Bill C-26 “risks undermining our privacy rights, and the principles of accountable governance and judicial due process”.

From an economic perspective, the bill lacks recognition of foreseeable impacted enterprises, such as small and medium-sized businesses, which will undoubtedly bring forth unintended consequences. According to the Business Council of Canada, some concerns include the lack of transparency seen through the one-way sharing of information. This brings about serious concerns. Operators are required to provide information to the NDP-Liberal government, yet those same operators are not entitled to receive any information back from the government or other cyber-operators. This whole information-sharing regime is lacking and, simply put, completely misses an opportunity to implement a transparent information-sharing system that would benefit all parties involved.

There is also concern regarding government overreach. Considering what powers would be granted to the government to order what a telecommunications provider has to do under Bill C-26, I would have expected to see sufficient evidence to support this overreach. However, that was not addressed at all, if not vaguely, in this bill. This, on top of blatant disregard for the recognition of privacy and other charter-protected rights, proves how the government only cares about granting itself more and more power, even in the face of blatant transparency and accountability concerns like election interference or the Bill C-11 censorship bill.

I only highlighted a few of the several highly valid concerns regarding this critically flawed bill. Obviously, it is important to defend national cybersecurity and defend against cybercriminals or foreign threats. However, there is a fine line between upholding the best interests of Canadians and just using another faulty bill as a power grab for the NDP-Liberal government, despite concerns regarding cyber systems, privacy and security infrastructure.

We Conservatives believe that it is of paramount importance to truly defend the rights and interests of Canadians from coast to coast to coast. One of the best ways this can be done is by securing Canada's cyber-infrastructure from attacks. While we welcome the idea of protecting the interests of Canadians in terms of cybersecurity, we want to flag that Bill C-26 has some highly concerning content that should be closely reviewed and discussed in committee to correct flaws and prevent potential overreach from the NDP-Liberal government. In the interest of protecting Canada's cyber-infrastructure, we must also guard against the sweeping government powers outlined in the critical cyber systems protection act.

The House resumed from December 1, 2022, consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

Business of the House

[Mark Holland, Liberal, Leader of the Government in the House of Commons]

Mr. Speaker, I appreciate my hon. colleague's very sincere effort, I am sure, to lay that on the record. I am sure he is in shock that there was not unanimous consent. However, my hon. colleague can rest assured that, when it comes to climate change, we will not allow inaction to be the rule of the day and that we will absolutely continue to take action to make sure climate change does not ravage this planet.

I do want to pick up on the second-last comment that the hon. opposition House leader made, which were comments with respect to Family Day. I hope that he, and indeed all members in the House, take time with their families and with their constituents, and that they return to this place in good health.

Tomorrow, we will resume debate on Bill C-34 to amend the Investment Canada Act at second reading.

Upon our return on Monday, March 6, we will call Bill C-27 on the digital charter, at second reading.

Tuesday shall be an allotted day.

On Wednesday, we will commence debate on Bill C-33 concerning the port system and railway safety.

Thursday will not only be the opportunity for my hon. colleague's favourite time of the week, another Thursday question, but we will also resume debate on Bill C-23 respecting historic places, at second reading.

On Friday, we will continue second reading debate of Bill C-26, the cybersecurity legislation.

[Anthony D. Rosborough, Researcher, Department of Law, European University Institute, As an Individual]

Thank you.

Good afternoon, Mr. Chairman and honourable members of the committee.

I'm a lawyer and doctoral researcher in law at the European University Institute. I'm also a practising member of the Nova Scotia Barristers' Society. In the past I've taught in the intellectual property area at the Schulich School of Law at Dalhousie University. My doctoral thesis investigates the design, function and implications of TPMs across the automotive, consumer electronics and agricultural equipment industries. I have published several peer-reviewed articles on the right to repair and TPMs, including a forthcoming publication in the Berkeley Technology Law Journal, which analyzes the right to repair in Canada and the bill under discussion today, along with Canada's international trade obligations. I've included open access links to these works in a brief I've submitted to the committee.

I firmly support the right to repair and the substance of this bill, but my focus this afternoon is not to reiterate the numerous social, economic or ecological benefits of repair. Rather, my aim today is threefold: first, to explain why repair restrictions enabled by TPMs are a misuse of copyright; second, to explain how the bill could be strengthened; and finally, to respond to the core arguments put forward by those who have opposed the bill.

To begin, looking at copyright misuse, access control TPMs in physical devices are best understood as an aberration in the history of copyright. TPMs were first recognized in the 1996 WIPO Copyright Treaty as measures that are used by authors in connection with the exercise of their rights and that restrict acts in respect of works that are not authorized or permitted by law.

TPMs were originally conceived as legal protection to safeguard copy control technologies to assist the digital content industry, but today's access control TPMs in physical devices often bear little, if any, relationship to copyright infringement. They bear only a superficial resemblance to copyright. They function principally to protect technologies, rather than works or the rights of authors, so when device manufacturers rely on anti-circumvention to prevent diagnosis, understanding or repair of computerized devices, this contorts copyright policy to perform the work of a patent or a trade secret. Put simply, this is a misuse of copyright.

As for how the bill could be strengthened, one approach would be to transpose it into a system of comprehensive regulation under section 41.21 of the act. That section allows for regulations that could exclude certain TPMs, or classes of them, from protection and to conduct review and consideration of specific implementations. This may also assist in providing a path forward for Bill C-294, which aims to create a new exception to anti-circumvention for the purposes of interoperability between embedded computer systems. A regulatory framework under section 41.21 could safeguard a whole host of socially beneficial activities. It could also address new and unforeseen uses of TPMs.

To respond to the opponents' claims, opponents have put forward three main themes in their remarks. The first is cybersecurity concerns. The second is health and safety risks, and the third is carve-outs for certain industries.

With respect to cybersecurity, we have scant evidence that repair activities can or will undermine cybersecurity. In any event, cybersecurity should not form part of TPM policy under the Copyright Act. This is not the role of copyright law. A more appropriate framework for cybersecurity considerations is under Bill C-26, currently under consideration, or the Telecommunications Act.

As for health and safety risks, these fears seem to misunderstand what the bill seeks to do. No longer making it unlawful to circumvent a TPM does not equip anyone with new powers or capabilities. The fact is that anyone who wishes to manipulate or modify a device for unlawful purposes can already do so. Any system can be hacked. If the repair of devices poses health and safety risks, the government should consider amending the Consumer Product Safety Act or other legislation. We should ask more of manufacturers and not rely on copyright law to ensure the health and safety of Canadians.

As for industry-specific carve-outs, opponents of the bill have often sought to exempt certain industries or limit the bill's application to consumer products. The reasons for this have not been convincingly argued.

The Copyright Act's purpose is to create a system of rights and incentives, including exceptions and limitations, which govern the use of works. It's not the role of copyright law to distinguish between different technologies or physical devices. In fact, Canadian copyright law has long rested on the principle of technological neutrality. This means that copyright policy should not discriminate against any technology or medium of expression, so to create a TPM distinction based on the type of product or device would amount to a clear violation of this principle.

To conclude, TPMs are increasingly used by manufacturers as a tool for protecting a series of interests that are unrelated to copyright. Repair is not infringement.

The purpose of copyright law is to incentivize the production of artistic and literary works. It encourages authors to bring ideas into the public realm.

Repair-inhibiting TPMs undermine these goals. They function as absolute barriers to the diffusion of knowledge. They are indefinite in duration and receive legal protection in the absence of any connection to copyright.

I ask this committee to move the bill forward and to include it as part of a comprehensive regulatory scheme that ensures that TPMs in devices are protected to the extent that they are connected to copyright.

Thank you.

[Dr. Wesley Wark]

I'm sorry that Aaron can't take that question. I'll try to answer for both of us to the best of my ability.

I think the suggestion that Mr. Shull made about tax incentives is certainly one way forward. Regulation, at least of what we might determine to be critical data infrastructure and communications, is another. Bill C-26 may have an interesting impact in that regard, depending on what Parliament does with it. It's certainly worthy of study.

I think the conclusion that we've come to, which CSE has also spoken to, is that, while there are pretty high levels of cybersecurity capabilities, awareness and implementation on the part of the major private sector actors in Canada, including the financial sector and other aspects of critical infrastructure, the real problem is with small and medium-sized enterprises. They have neither the resources nor, perhaps, even the understanding of the degree to which they are vulnerable to cyber-attacks

I think the small and medium enterprises are the area of focus, as well as figuring out ways to help them up their game in cybersecurity in ways that are affordable and understandable to them. That is the challenge.

[Dr. Wesley Wark]

I would say we have a long way to go in deciding what we want to do about critical infrastructure. Let's put it that way.

We're waiting for a critical infrastructure strategy, which has been under study by the federal government. You will have seen a reference to Bill C-26, which refers to critical infrastructure. We have a list of critical infrastructure that dates back to 2009. In other words, it hasn't been updated since that time, which is the last time we had a critical infrastructure strategy.

The starting point is going to have to be to decide what we mean by “critical infrastructure”. Once we've done that—that will be an important but not an easy step—then we can think about regulating the terms under which critical infrastructure functions and what we expect of them in terms of, particularly, cybersecurity strategies.

There's some of that under way, obviously informally. Some aspects of critical infrastructure have done a terrific job in terms of ensuring they have very high levels of cybersecurity. The major banks are probably a key example of that. Across the board, the system is very diverse.

[Sami Khoury, Head, Canadian Centre for Cyber Security, Communications Security Establishment]

Thank you, Mr. Chair and members of the committee, for the invitation to appear today.

My name is Sami Khoury. My pronouns are he and him. I am the head of the Communications Security Establishment's Canadian centre for cybersecurity, known as the cyber centre.

I am joined today by my colleague, Alia Tayyeb. She is the deputy chief of CSE's signals intelligence branch.

I'm glad to appear before the committee to discuss cybersecurity and cyber operations.

As this is the first meeting of your study, I'd like to begin by providing an update on the current cyber-threat landscape and what CSE is doing to protect Canada and Canadians. I will largely focus on the cybersecurity aspect of our mandate, whereas my colleague, Ms. Tayyeb, will focus on the foreign intelligence piece of CSE's mandate, our support to partners, and our active and defensive cyber-operation capabilities.

Now, more than ever, we understand that cybersecurity is the foundation of Canada's future: for our digital economy, our personal safety and privacy, and our national prosperity and competitiveness. In October, the cyber centre released its third national cyber-threat assessment. This report outlines the current cyber-threat environment.

One of the key points in the report is that cybercrime remains the largest cyber-threat to Canadians and that critical infrastructure is the main target of cybercriminals and state-sponsored threat actors.

Ransomware, specifically, was prominent in the past two years, and it remains a persistent threat to Canadian organizations. The state-sponsored cyber-programs of China, Russia, Iran and North Korea continue to pose the greatest strategic cyber-threat to Canada. In the face of these threats, and as Canada's technical and operational authority on cybersecurity, CSE defends Government of Canada networks and the cyber centre leads the government's response to cyber-incidents. However, cybersecurity is not solely a federal government responsibility or concern, as cyber-threats continue to target and impact Canadian individuals and organizations.

CSE works with partners in the industry, including those outside government, sharing information about threats and best practices in cybersecurity. The Canadian Centre for Cyber Security regularly publishes guidance and expert advice for Canadians.

Moving forward, to continue to adapt to the evolving threat environment, bolster defences and help better protect Canada and Canadians, we hope to see the continued progress of Bill C-26, an act respecting cybersecurity, in Parliament. This legislation would establish a regulatory framework to strengthen cybersecurity for services and systems that are vital to national security and public safety and give the government a new tool to respond to emerging cyber-threats.

We also look forward to continued work to support public safety in the renewal of Canada's national cybersecurity strategy. The renewed NCSS will articulate Canada's long-term strategy to protect our national security and economy, deter cyber-threat actors and promote norms-based behaviour in cyberspace.

For CSE, the renewal of the strategy provides an opportunity to review the situation and build on what the Canadian Centre for Cyber Security has achieved over the past five years. The creation of the centre was actually one of the main initiatives set out in the National Cyber Security Strategy, developed in 2018.

Finally, as we work to build relationships with Canadian industry and other levels of government, we are also focused on collaboration with our international partners, in the Five Eyes and beyond.

I will now hand it over to my colleague, Ms. Tayyeb, to speak to her area of responsibility.

[Marco Mendicino, Liberal, Minister of Public Safety]

Mr Chair, thank you for the opportunity to present to you and committee members today.

I would like to begin by commending the committee for studying the so-called police stations, which are a suspected vector of foreign activities steered by the People's Republic of China and operate in Canada as well as other democracies around the world.

The reports of the PRC attempting to enhance its clandestine footprint on Canadian soil reflect two incontrovertible trends. First is that the geopolitical landscape is increasingly complex, with hostile actors looking to disrupt the international rules-based order that has been in place since the end of the Second World War; and, second, like other democracies, Canada has increasingly become a target of foreign interference, which is a direct by-product of the agenda driven by hostile actors whose objective is to undermine our national interests.

Today, I will outline the concrete steps the federal government is taking to mitigate the threat of foreign interference. Before I do so, let me emphasize that Canada has a strong and resilient democracy that is bolstered by a community of national security and public safety agencies that work around the clock to protect our institutions. These agencies have important resources, technologies and tools at their disposal to ensure national security.

The federal government does not undertake this work alone. Rather, we work collaboratively with other levels of government, as well as key allies in the Five Eyes, G7 and NATO. Together, the whole of government is positioned to assess, mitigate, investigate, prosecute and report on threats to Canadian national security.

We need to be always vigilant, because those threats are constantly evolving and manifesting in different ways, including through state and non-state hostile activities, foreign interference, cyber-attacks and threats to the security of our democratic, economic, academic, environmental and public health institutions.

In the face of these threats, the federal government is vigilant, and we are acting. I'd like to highlight five priority areas of our work.

First, we have put into place robust measures to protect our democratic institutions, including our elections.

We introduced Bill C-76 to crack down on foreign funding from third parties to federal campaigns and candidates. We created the security and intelligence threats to elections task force, or SITE. We created the critical incident reporting protocol to communicate transparently and impartially with Canadians during elections in the event that there is a threat to the integrity of a federal election. We also introduced the digital citizen initiative to promote democracy and social inclusion by building resilience against online disinformation and building partnerships to support a healthy information ecosystem.

The SITE task force looked at the federal elections of 2019 and 2021 and independently concluded that in both cases the integrity of the election was not compromised.

Second, we implemented a national cybersecurity strategy and action plan, which resulted in the launch of the Canadian Centre for Cyber Security.

In budget 2022, we allocated more than $850 million to enhance the Communications Security Establishment's ability to conduct cyber operations and better protect the privacy of Canadians.

Moreover, last spring, I introduced Bill C‑26, our new legislation on cybersecurity, which prioritizes critical infrastructure protection as it relates to the financial, telecommunications, transportation and innovation sectors.

Third, we have introduced national security guidelines for research partnerships that are backed by a research security centre and a $12.6-million investment, in order to protect the integrity of our academic institutions. The purpose of these guidelines is to integrate national security considerations into the overall assessment of research partnerships. Among other things, the guidelines require clear information about who researchers intend to partner with, what researchers intend to research and what additional due diligence will be taken to mitigate if the subject of research involves a sensitive area. In addition to the guidelines, research partnerships are subject to rigorous admissibility screening and required to comply with existing authorities that regulate exports and imports.

Fourth, when it comes to protecting our economy, the government vets foreign investments under the Investment Canada Act and has the capacity to reject those deals when they are contrary to our national security. The government, as you know, is proposing to further augment the authorities under the ICA.

We also have a new national critical minerals strategy in place. It will help leverage Canada's national resources in a sustainable way, in partnership with indigenous peoples.

Fifth, and finally, we've also modernized our foreign policy with the Indo-Pacific strategy. This strategy calls for the strengthening of our intelligence capabilities in the region, in order to enhance our cyber-diplomacy and deepen our partnership with allies. It is supported by an investment of over $100 million for these particular areas. Within the Indo-Pacific strategy, vis-à-vis our relationship with China, Canada states its commitment to challenge, compete, co-operate and coexist. Put simply, we will never apologize for defending our national interest.

Taken together, these give the committee an overview of the government's approach to managing threats, including foreign interference.

In closing, I would like to say a few words about the activities of foreign governments in Canada. Under international law, all foreign government representatives have a duty to respect our laws and regulations. Any foreign state that threatens, harasses or intimidates Canadians and Canadian residents is in violation of these international agreements.

I assure you that the RCMP is working with the intelligence community and our law enforcement partners to address these so‑called police stations that appear to be operating in the greater Toronto area. Its goal is to ensure that the public feels safe in its own communities. It's about building trust and, where possible, enforcing the law or disrupting activities.

The only way to build trust, Mr. Chair, is by being transparent. That is why we have grown the arsenal of national security tools. However, we have simultaneously raised the bar of transparency through the creation of NSIRA, NSICOP and more frequent public reporting by our intelligence agencies. In a similar vein, we have expressed that we will explore ways to further enhance transparency with regard to our fight against foreign interference. All options are on the table. These could include requiring foreign agents to be properly registered.

However, we must bring all Canadians into this discussion as we reform our institutions so they are more diverse, inclusive and free from systemic discrimination, biases and racism.

The objective of these and other ongoing efforts is to recognize that the threat of foreign interference is not static and that we must continue to develop the tools available to Canada to deal with this evolving threat.

Colleagues, as I close, I will underline that our national security and intelligence agencies continue to investigate and monitor reports of Chinese overseas police stations in Canada. There will be no tolerance for this or any other form of intimidation, harassment or harmful targeting of Canadians or individuals within Canada.

Canada will continue to stand for its interests and values, both at home and abroad.

Thank you.

[Marco Mendicino, Liberal, Eglinton—Lawrence, ON]

In addition to Bill C-26—and you've given some highlights of it—we will work with industry and regulators to protect our critical infrastructure in a number of priority areas, including telecommunications. As you may recall, part 1 of Bill C-26 seeks to add, expressly, the objective of ensuring the security of our telecommunications sector. Beyond that, we have the protocols and policies that govern procurement, which we do in partnership with PSPC.

We also have the authorities granted to the service under the CSIS Act, which include the threat reduction measures this government introduced in 2019, but with the corresponding transparency and accountability, as granted by both NSIRA and NSICOP. There are reviews coming up for that legislation.

Mr. MacGregor, I hope that is something you and I will be able to work on, along with other parliamentarians.

We are making additional investments right across the national security and public safety apparatus so that Canadians can be assured we will be vigilant 24-7 in protecting our critical infrastructure and institutions, so we can keep them safe and preserve the Canadian interest, both here and abroad.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Thank you.

I'm sorry to cut you off, but I want to get one last policy-related question to the minister.

Minister, your government has introduced Bill C-26, which is a wide-reaching bill in terms of the powers it will give the executive branch. We know the United States has taken similar steps. Bill C-26 requires designated operators to establish and implement security programs and mitigate supply chain and third party risks. That's the legislative fix.

However, in absence of that bill—because, of course, it has not yet passed Parliament—where are the gaps we need to be focusing on? Is this your government's answer to closing those gaps?

Immigration and Refugee Protection Act

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Mr. Speaker, I would like to thank my hon. colleague from Edmonton Strathcona, who has done incredible work on this file.

Throughout the debate today, I have heard issues raised about the lack of clarity in this bill and the fact that there is not enough parliamentary oversight into the sanctions regime. I am just wondering if my hon. colleague could tell the House if that would inform her committee strategy. Does she see that there might be opportunities amongst the government and opposition sides to reach a compromise to make sure that the important aspect of parliamentary oversight is there?

I have noticed that, in public safety bills introduced earlier in this session, notably in Bill C-20 and in Bill C-26, there was a clear lack of parliamentary oversight specified. That will inform our strategy going forward. I am just wondering if the member could add some further comments on that.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Mr. Speaker, in several other public safety bills, notably Bill C-20 and Bill C-26, I have noticed, in the way the bills are written, there is a lack of avenue for parliamentary oversight.

One thing that has been missing with this sanctions regime is also a lack of parliamentary oversight. Would Conservatives join with New Democrats at committee to look for avenues in which this bill could be strengthened to buttress up parliamentary oversight so members of the House could make sure the government is doing its job when it should be doing its job?

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Thank you very much, Mr. Chair.

As I was saying, I'm the vice-chair of the public safety and national security committee, and it's a real pleasure to be with industry today. I appreciate and applaud my colleagues for bringing forward this very comprehensive motion to investigate a very critical issue, which I think many Canadians are paying attention to. The Prime Minister, of course, has weighed in on this as has the Minister of Public Safety.

I would like to hear more from Minister Champagne, given that he is the industry minister lead, of course, and I think it does impact a number of different areas of government, national security and, of course, industry. We can also look at the impact this will have on setting a precedent should we allow these types of contracts to continue.

Now, the government has said that it is pausing this contract, but I do have concerns given that the company that received the contract is ultimately owned in part by the company Hytera, as mentioned by my colleague, which is based in the People's Republic of China. We know that some of that technology in this contract is already being implemented in Ontario and Saskatchewan. I have not heard from Minister Champagne or the Prime Minister or the Minister of Public Safety whether this pause of the contract will mean that this government will be insisting on the removal of that technology that's already in place, again, for surveillance purposes, for RCMP. It's quite shocking when you consider that the parent company, which is in part owned by the People's Republic of China, is now sort of responsible for the surveillance technology of our RCMP.

I would have thought that would be one of the first things they would have committed to. If there were any threat to our national security, in setting a precedent in this surveillance industry that we have in Canada, whether it's for national security or within our telecoms utilized by, for example, the Department of National Defence, you would think they would set a clear standard that this is unacceptable and it would be removed immediately.

We did see, with the Liberal government, they took about five years to commit to removing the Huawei technology, and, because it took so long, it will cost hundreds of millions of additional dollars that will be passed down to the consumer. Huawei and the 5G technology we saw have so infiltrated our telecommunications systems that it will be very hard work to remove that.

I have those same concerns with what's happening here. As my colleague mentioned, earlier this year, I believe on February 22, the U.S. Department of Justice unsealed a federal indictment showing that there were 21 charges of conspiracy to commit theft of trade secrets against Hytera.

We see that in the United States they're being very aggressive and transparent with the threat from Hytera, which again is sort of the parent of the parent company that owns Sinclair. We see the Americans taking very strong action on this, yet we have not seen the Prime Minister or the Ministry of Industry or the Minister of Public Safety make a very clear statement that this surveillance technology that is being provided by this ultimately Chinese-owned company, so to speak, will be removed in Ontario and Saskatchewan.

I'd like to hear that and I'd like the Minister of Public Safety and the Ministry of Industry to come to this committee and make that commitment.

Further to that, Mr. Chair, I am concerned that there may be other contracts like this and that has not been made clear. This was found because of very solid journalism in this country. That's great, but are there more? You would think if there's one, there are likely others. We know that recently the Minister of Foreign Affairs put forward her Indo-Pacific strategy, and that falls under the Canada-China committee, which I also sit on.

There was certainly appreciation for the tougher stance that was communicated in that Indo-Pacific strategy, but what I would say is that the government on one side is saying that procurement is independent. They're blaming the independent system of procurement of this government. They're saying it's independent and they don't agree with it, but it is independent. They're sort of blaming others for what has happened under their watch, but what I would say is that every independent agency of government certainly has to follow the ethos, the values set forward by the Prime Minister and his cabinet.

I would argue that perhaps if the Indo-Pacific strategy for which the Conservatives have been calling for quite some time had been brought forward sooner, the procurement agency would have had a better idea of the threat analysis of China and companies that are partly Chinese-owned that provide surveillance technology and other technologies. Perhaps they would have had that lens to apply to this contract.

I don't believe that it is an appropriate assessment by the Prime Minister to sort of kick this over to the independent procurement agency and say it's all on them. If they had brought forward the Indo-Pacific strategy, which makes quite a bit more clear the threat analysis of China, perhaps the independent procurement agency would have had a more clear picture in order to enter any contracts with companies like this with eyes wide open.

I know there is some discussion around whether this falls under public safety, whether this falls under foreign affairs, whether this falls under the China committee or whether this falls under industry. Certainly, Minister Champagne is bringing forward bills like Bill C-27, which is in part related to the Minister of Public Safety's Bill C-26. Bill C-26 ultimately is a bill to deal with telecommunications in this country and other companies that are providing national security critical infrastructure types of services.

I would say that both committees and both ministers play a role. Given that Bill C-26 and Bill C-27 are closely related in some ways, and given what I know about the industry committee, I think it would make sense and would not be out of scope to have the ministers come forward to this committee.

I hope that members consider that, given that this may be an industry-wide problem, even beyond telecommunications and surveillance. This could be in data management. We can see health services and the privacy information therein. There are countless industries across Canada that may very well have contracts owned in part or in full that are connected to the People's Republic of China.

This is a national security concern. My point is that it also impacts a number of industries, and that's why we're seeing similar bills under Minister Mendicino and Minister Champagne.

I do feel that it is appropriate to set the standard for industry at the industry committee that these types of contracts will not be tolerated any longer. Certainly, we must bring to the attention of the Minister of Procurement and other ministers impacted by this, that, given the very clear message—or, I would say, clearer message—set forth in the Indo-Pacific strategy, there needs to be a whole-of-government approach to reviewing all contracts provided.

The last thing I will mention is that it is not just government contracts that are of concern. There are other private contracts that are of concern in multiple different industries, or there may be. If there's one that got through the procurement vetting process with the Government of Canada, it is very likely that there are a number of private entities that have contracts that would impact our national security and that really go across a number of industries.

I appreciate the very comprehensive 106(4) motion put forward. It certainly is exhaustive, and I think that's important because we want to make sure we don't have any cracks. It is very critical that we ensure that the veil is lifted on this so to speak. By passing this 106(4), the industry committee sends a very clear message to all industries that may have contracts with the People's Republic of China—which may impact data security, surveillance and the like—to take note. The industry committee taking a leadership role in that, I think, sends a very strong message across industries that are critical to our national security.

I hope that the committee considers that. I hope it considers taking that leadership position and certainly leads by example at this committee and sets a very clear tone, so that any industry impacted by national security concerns shall be made aware.

Those would be my remarks. Thank you, Mr. Chair.

Telecommunications Act

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague from Saint‑Hyacinthe—Bagot, who said he wished that we could talk a bit about what is being done proactively, and that is what I intend to do.

As members know, we cannot discover new worlds until we have the courage to not see the shore. Those who know me know that I would rather talk about the “why” than the “how”. I like to clearly define what we are talking about.

Let us start with the word “security”. Security is an absence of worry. It is peace of mind, a form of safety. It is rather easy to define.

Now, what is the definition of the prefix “cyber”? Cybersecurity is a word that is used in all kinds of ways. We want to combat cybercrime with cybersecurity. We want to prevent cyberstalking. Sometimes it can be confusing. What is the meaning of the prefix “cyber” that is used everywhere?

The origin of the word will help us to understand it. It was coined after the Second World War by an American researcher named Norbert Wiener. This brilliant mathematician was hired by the Massachusetts Institute of Technology, or MIT, to work on a research project on new types of weapons. More specifically, he was asked to develop missiles that could take down V‑1s and V‑2s, the unmanned German aircraft filled with explosives that were causing so much damage in England.

To that end, Professor Wiener had to model the behaviour of a pilot who knew he was being chased in order to better understand the decision-making mechanisms of humans in general. We will use the term human so as not to offend anyone. In 1948, Norbert Wiener named this field of research “cybernetics”, a new area of science that studies the mastery of machines. He was inspired by the Greek term kubernao, which means to pilot and from which the terms “government” and “governance” are also derived. It means “to steer”.

In 1949, Wiener's book was deemed one of the most important works of the 20th century. The New York Times praised it and predicted that cybernetics would be a leading branch of science in the future, which has come to pass. This book still contributes practical knowledge to today's world because one of the main concepts underlying this new theory is that of regulation. That is what we are discussing today.

With the Internet, everything becomes cyber, but the societal challenge is huge because in cyberspace we no longer know what is the cause and what is the effect. We are no longer certain who governs and who is governed. We no longer strive to determine if the chicken came before the egg or if the egg came before the chicken. In cyberspace, we cannot make sense of the chickens and the eggs.

When we talk about the Internet, we are talking about space and time. Space and time are concepts that, throughout history, have allowed us to place and understand ourselves. In philosophy it is said that nothing exists without space and time because everything is always somewhere in space and in a given moment, it is situated in time.

However, the Internet is everywhere and nowhere. In fact, when we talk about the web we picture an entanglement of threads without a centre. Humans, with their neurolinguistics, have a hard time placing themselves when there is no centre. We are always looking for the end. The Internet does not have one. In space, there is no centre and time is eternal. The Internet is always, never, and in perpetuity. It is therefore very hard to understand and associate with the cyber point of view.

Bill C‑26 is divided in two parts. In the first part, it says that it seeks to reinforce the security of the Canadian telecommunications system. Then there are indications of how it will change this and how it will change that. In the second, it says it will create the new critical cyber systems protection act to do this or that. I am summarizing the bill.

I noticed when I read Bill C‑26 that there is a lot of “how” and not a lot of “why”. What is the “why” behind Bill C‑26? In my opinion, there is just one reason why and that is to ensure that citizens can trust in the mechanism that protects them in the area of cybernetics and cyberspace.

Trust is complicated because it is not something that is easily granted. I will use the example given by my colleague from Saint‑Hyacinthe—Bagot. I know him and he is conspicuous in his absence, even though I am not allowed to say that. I do not have eyes in the back of my head.

It is pretty easy to build up trust between two individuals. However, trusting an entity, a company or a government is harder. Trust means having peace of mind, without needing supporting evidence. It is difficult to achieve in the public sphere. It is essential, however, and I think that is what Bill C-26 seeks to accomplish.

Trust begins with education and insight. Since this has been explored in speeches throughout the day, I will not dwell on it, but the geopolitical world is changing these days, and the balance of power is shifting. In addition, it is hard to know where the centre is, as I explained a little earlier.

The Canadian government's foreign policy is vague at best. It took years for the government to acknowledge that there was a problem with Huawei. It was the only Five Eyes nation that did not see the inevitable, that did not see the evidence right under its nose.

I am talking about education, but the bill does not contain any provisions for education in cybersecurity. I am talking about education in terms of privacy and facial recognition. Education would help people avoid the temptation to commit the act that we are trying to prohibit here.

We also know that we are stronger together. It is interesting to see who has already thought about these issues. One of our colleagues said that other institutions have thought about this. Yes, there is a concept known as cyber diplomacy, which involves co-operation and dialogue between nations. Moreover, to answer a question that has not been asked, which is the nature of philosophy, the Council of Europe could offer some very interesting answers and solutions in this matter.

This brings me to another question. Despite the many measures, there are quite a few things I do not see in this bill. I do not see measures that would prevent our devices from being taken over by malware, for example, or by a foreign power. Device takeover is something we recently studied at the Standing Committee on Access to Information, Privacy and Ethics. It is not the stuff of science fiction; it is actually happening now.

Also, I do not see how this bill prevents intellectual property infringement. I could name 200 other things I do not see in this bill, but I will mention just one more. I do not see how we are going to regulate what is known as the dark web. However, the bill names six organizations that will have the power to act as regulators.

However, I would like to ask the following question: Do these organizations have the necessary knowledge to do that? It is not always clear. In previous bills on other subjects, we were told, for example, about the CRTC, which was responsible for implementing some provisions. We saw that the CRTC was an outdated organization. The organizations in question now are not much better.

Cybersecurity is not something that is easy to regulate. That is why it is a good idea to look up and try to see a little further. I agree that the bill is well-intentioned, but intention without courage is meaningless.

A poet that I recently met in Montmartre told me that there is no love, only shows of love. It is the same thing here, except that we are talking about shows of courage, and so I hope that the government will show courage with Bill C‑26 and turn its intentions into action.

Let us send Bill C‑26 to committee as soon as possible.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, Bill C‑26 does contain some good solutions and some interesting elements.

The only thing is, we will have to look at the details and see what is next. Are we giving the minister too much power? At the same time, we may have to think twice about giving more power to the minister at the expense of Parliament when we are not sure whether the minister will fulfill his commitments. There have been promises followed by waffling in the past. There are definitely things that need to be looked at, yes, but at least this bill is motivated by good intentions. For that alone, it deserves to be supported at this stage.