Bill C-26

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

Telecommunications Act

[Larry Maguire, Conservative, Brandon—Souris, MB]

Mr. Speaker, earlier today, some of my colleagues, particularly the member for Scarborough—Guildwood, indicated the pillars involved in the bill. The member mentioned them as well in his presentation. There are so many different areas that need to be looking at the cybersecurity issues in Canada. As other colleagues indicated, some countries around the world are ahead of us in some of those areas.

I wonder if the member could expand a bit on that. I will give him an opportunity to look at the number of pillars that might be in place and the reasons he thinks it so important to deal with the cybersecurity issues that each one of those would have.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Mr. Speaker, we can look at some of the issues we are facing. The CRA has been subjected to relentless cyber-attacks over the last number of years. Even CERB fraud was committed by cyber-attackers. Somewhere between 1,200 and 1,800 individual accounts were exploited for fraud because the lack of cybersecurity was able to help them out. Eventually we got that under control, but it just shows how many attacks we have. Having a framework in place is good, and the government is trying to go in the right direction here, but there are things we need to do with this bill. Hopefully at committee we can help to establish some stronger pillars to make sure Canadians are protected.

[Dan Mazier, Conservative, Dauphin—Swan River—Neepawa, MB]

Mr. Speaker, I rise today to speak on Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. Cybersecurity is of the utmost importance to Canadians, and I am glad to see the topic debated in the House today.

Bill C-26 would amend the Telecommunications Act. I should note that any time the Telecommunications Act is changed, I am very interested. Not only am I the shadow minister for rural economic development and connectivity, but I also have a bill before Parliament, Bill C-288, that would amend the Telecommunications Act to provide Canadians better information when it comes to the service and quality they pay for.

The dependence on telecommunications throughout our society continues to grow. The uses of Internet and cellular services are foundational to both the social and economic success of Canada, so I appreciate seeing the government move forward with a bill to secure our telecommunications network through Bill C-26. However, I must ask this: What took so long?

It was over two years ago when this House of Commons passed a Conservative motion that called on the Liberal government to ban Huawei from our 5G network. Despite this motion passing in the House of Commons and the director of the Canadian Security Intelligence Service warning the government in 2018, it took years to ban Huawei from Canada's 5G network. Therefore, is Bill C-26 important? It absolutely is. Did it take too long to get here? It absolutely did.

I should note that I recently asked if the University of British Columbia continues to work with Huawei in any form. The response was, “Yes, we do”. The government has been warned about the risks to our national security over and over again, yet we fail to see concrete action.

Analyzing Bill C-26, I have a few questions and concerns.

In its current form, Bill C-26 allows the Minister of Industry to obtain and disclose information without any checks and balances. If passed, Bill C-26 would grant the minister the power to obtain information from the Canadian telecom companies. It could, “by order, direct a telecommunications service provider to do anything or refrain from doing anything...that is, in the Minister’s opinion, necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.”

There are no specific details on what information can be collected when it comes to personal consumer data, nor is there any clarity on who the minister could share this personal information with. Could the minister share it with other ministers or other departments? As of now, it does not say the minister could not do so.

A recent research report entitled “Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act” stated the following on this matter:

The legislation would authorize the Minister to compel providers to disclose confidential information and then enable the Minister to circulate it widely within the federal government; this information could potentially include either identifiable or de-identified personal information. Moreover, the Minister could share non-confidential information internationally even when doing so could result in regulatory processes or private right of actions against an individual or organization. Should the Minister or [any] other party to whom the Minister shares information unintentionally lose control of the information, there would be no liability attached to the government for the accident.

I think an accident by the current government happens quite a bit.

If Parliament is going to give the minister such powers, it is imperative that checks and balances exist. It is very important that, when we discuss the ability of a government to obtain personal information from Canadians, we ensure that Canadians are protected from the unauthorized use of such information.

I should also add to this conversation the impact Bill C-26 could have on smaller Internet service providers. Small Internet companies are foundational to improving competition within Canada's telecom industry, but they are sometimes left out of the conversation.

Bill C-26 would empower the minister to “prohibit a telecommunications service provider from using any specified product or service in, or in relation to, its telecommunications network or telecommunications facilities, or any part of those networks or facilities” or “direct a telecommunications service provider to remove any specified product from its telecommunications networks or telecommunications facilities, or any part of those networks or facilities”.

We do not know what types of telecom infrastructure and equipment will be deemed a risk to our national security in the coming decades, so imagine that a local Internet service company builds a network using a specific brand of equipment. At the time, no one raises security concerns with the equipment or the manufacturer. The local Internet company is just beginning its operations, investing heavily in equipment to build a network and to compete with larger telecom companies.

Imagine that, five years later, the government deems the equipment the company invested in to be a national security threat, forcing it to remove and dispose of such equipment. The small Internet company trying to compete, which acted in good faith, has just lost a significant amount of capital because of a government decision. There is a strong possibility that this local Internet provider can no longer afford to operate.

I am hopeful this conversation can be had at committee to ensure the government is not unfairly impacting small, local and independent Internet companies. As I said, I am glad the House is debating the issue of cybersecurity, as the discussion is long overdue, but it is imperative that the issues I raised be addressed at committee, it is imperative that the issues my colleagues have raised be addressed at committee and it is imperative that the issues experts have raised be addressed at committee. That is why I will be voting to send Bill C-26 to committee in hopes that these concerns can be addressed.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Mr. Speaker, I am glad to see there is general agreement in the House on the principle of this bill and on the fact that, obviously, work is needed.

I know the member has a lot of experience in the agricultural field and brings that experience to Parliament. I want to ask him about the part of this bill that would allow the Governor in Council to designate any service or system as a vital service or vital system. I would ask him for his thoughts.

Obviously, our transportation sector can be considered a vital service, especially our railway lines, but what does he think about our supply chains, especially involving our agricultural products, and how those might be targeted? As he knows very well, many of Canada's farmers, producers and processors are really starting to move into more digital ways of doing business, and much of their equipment is linked to computer systems.

I would like to ask whether he has any thoughts to share on how those could be classified as vital systems and services.

[Dan Mazier, Conservative, Dauphin—Swan River—Neepawa, MB]

Mr. Speaker, it is very important. The key takeaway is that this type of legislation is long overdue. That is why it is so important to get the amendments right and get this bill to committee as quickly as possible so we can all work on it. Let the experts review it and let the members get at it, but also let the industry get at it so we can come up with really good legislation to benefit all Canadians, especially farmers.

[The Deputy Speaker, Chris d'Entremont]

Is the House ready for the question?

[Some hon. members]

Question.

[The Deputy Speaker, Chris d'Entremont]

The question is on the motion.

If a member of a recognized party present in the House wishes that the motion be carried or carried on division or wishes to request a recorded division, I would invite them to rise and indicate it to the Chair.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, I request a recorded division.

[The Deputy Speaker, Chris d'Entremont]

Pursuant to order made on Thursday, June 23, 2022, the division stands deferred until Monday, March 27, at the expiry of the time provided for Oral Questions.

The hon. parliamentary secretary to the government House leader.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, if you seek it, I believe you will find unanimous consent to advance to Private Members' Business.

[The Deputy Speaker, Chris d'Entremont]

Is it agreed?

[Some hon. members]

Agreed.

The House resumed from March 23 consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[The Speaker, Anthony Rota]

It being 3:12 p.m., pursuant to order made on Thursday, June 23, 2022, the House will now proceed to the taking of deferred recorded division on the motion at second reading stage of Bill C-26.

Call in the members.