Bill C-26

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

[The Chair, Liberal, Heath MacDonald]

I call this meeting to order.

Welcome to meeting number 95 of the House of Commons Standing Committee on Public Safety and National Security.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely using the Zoom application.

I would like to make a few comments for the benefit of witnesses and members.

Please wait until I recognize you by name before speaking.

To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from any microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings.

As a reminder, all comments should be addressed through the chair.

Pursuant to the order of reference of Monday, March 27, 2023, the committee resumes its study of Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts.

Appearing before us today are the Honourable Dominic LeBlanc, MP and Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs; and the Honourable François-Philippe Champagne, MP and Minister of Innovation, Science and Industry. Welcome.

Witnesses from the Department of Public Safety and Emergency Preparedness include Patrick Boucher, senior assistant deputy minister, national cyber security branch; Colin MacSween, director general, national cyber security directorate; and Kelly-Anne Gibson, acting director, national cyber security directorate.

Witnesses from the Department of Industry are Éric Dagenais, senior assistant deputy minister, spectrum and telecommunications sector; and Mark Schaan, senior assistant deputy minister, strategy and innovation policy sector.

Please note that the ministers will be with us for one hour and 30 minutes. The officials will stay for the rest of the meeting in order to answer questions from members.

Colleagues, we need about 10 to 15 minutes before the end of the meeting to deal with committee business items, such as budgets and the committee schedule.

Welcome to all.

I now invite Minister LeBlanc and Minister Champagne to make an opening statement of up to 10 minutes each.

Thank you.

Minister LeBlanc, will you start?

[The Chair, Liberal, Heath MacDonald]

Thank you, Ms. Michaud.

We're right on schedule.

I appreciate the witnesses today.

Before asking for adjournment, I want to make people aware that our last meeting for Bill C-26 is Thursday. We're contemplating having the amendments in and ready for clause-by-clause when we come back, so that will be by Wednesday noon next week. I know there is some discretion, so we'll likely have further discussions on that on Thursday. That is the outline.

We're adjourned.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

,

Thank you, Mr. Chair.

I have a fairly simple question. It's the same question that I've asked various stakeholders at other meetings.

Bill C‑26 sets out quite heavy financial penalties for organizations that fail to comply with decisions or demands imposed by the government. We don't know what these demands might be, because the power granted is quite broad.

I asked the stakeholders whether these penalties were excessive. Some said that, instead of imposing penalties, incentives should be introduced to encourage organizations to comply with the government's demands. Others said that the penalties should be maintained, but that incentives for organizations should still be implemented.

Mr. Smith or Mr. Ghiz, what do you think of the penalties targeting companies such as the ones represented by your association?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you for that.

What you're saying is that there are some major difficulties with Bill C-26 that need to be responded to, that the bill itself needs to be considerably improved, and that there are a number of amendments that need to be considered for the bill to do what it purports to do but also to ensure that the protection of information and the transparency are there. Is that not true?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you.

I'd like to move on to Professor Clement.

You signed on, along with a number of important organizations—the Canadian Civil Liberties Association, la Ligue des droits et libertés, the National Council of Canadian Muslims, OpenMedia, the Privacy & Access Council of Canada—pushing for a series of amendments, 16 recommendations that would help to, in the words of the briefing, “restrain ministerial powers”, “protect confidential personal & business information”, “maximize transparency”, “allow special advocates to protect the public interest”, and “enhance accountability for the Communications Security Establishment”. These are very valuable recommendations that you've brought forward to us, that the coalition has brought forward to us.

What are the most important ones, the ones that we need to be absolutely cognizant of in putting forward amendments to Bill C-26?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Okay. Thank you very much.

Ms. Mason, I have the same question for you. To what extent was the Canadian Bankers Association actually consulted on the drafting of Bill C-26?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Okay.

To what extent were you consulted around the drafting of Bill C-26?

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

,

Yes, it did, Mr. Smith. Thank you.

I would like to put the same question to the representatives of the Canadian Bankers Association.

According to the Office of the Superintendent of Financial Institutions, banks are increasingly the target of cyber attacks. We've seen some examples in recent months. I imagine that this may lead customers to worry about the protection of their personal information. As in the case of telecommunications companies, I imagine that banks already have certain mechanisms in place and that, as Mr. Smith was saying, they're already meeting the requirements of Bill C‑26.

What does this mean for banks? Is it a relief or a burden?

In your opinion, what should be better regulated?

[Eric Smith]

It's a very good question.

One of the things is that our members have very robust cybersecurity processes already, and, as Mr. Ghiz mentioned in his remarks, they already collaborate deeply with government. Many of the things that could come about as a result of Bill C-26 are things that the industry is already doing. There is CSTAC, the Canadian security communications advisory committee, which puts out best practices and guidance, etc., for all the telecommunication service providers. Bill C-26 could allow the minister to actually order specific practices, for example input.

In terms of the regulatory burden, I don't know of any industry that welcomes additional regulations, as it does add some burden. Again, our members already have robust practices, so I think the additional burden is mostly around things like the reporting requirement. That's where the legislation could require some improvements. It says that we must “immediately report” an incident. Well, “immediately” is right away, and you wouldn't have enough information to even know if you'd had an incident. Some of those things can be improved.

I hope that has answered your question.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

,

Thank you, Mr. Chair.

I want to thank the witnesses for joining us.

I would like to put my first question to the representatives of the Canadian Telecommunications Association. I'll then put a similar question to the representatives of the Canadian Bankers Association.

Almost everyone agrees that Bill C‑26 is a step in the right direction, and that it's relatively good news that the government wants to tackle the cybersecurity issue. However, there are fairly widespread concerns about the protection of personal information and privacy, in addition to the government's sweeping regulatory and order‑making powers in particular.

You represent carriers and companies that invest in telecommunications networks, such as Vidéotron, Rogers or Bell. I imagine that these large companies are already investing in ways to protect themselves against any cyber-attacks. They have the workforce to do so.

You may also represent slightly smaller companies with fewer customers. This could mean an additional workload for them. Some of them may have already endured cyber-attacks.

At this time, how do the companies that you represent protect themselves against cyber-attacks? What will Bill C‑26 change?

If the bill isn't amended, for example, to better regulate the government's powers, will somewhat smaller companies—such as small and medium‑sized businesses—consider it a burden or a relief?

I know that it's a fairly broad issue.

[Prof. Andrew Clement]

In addition to proportionality, which has been mentioned several times, much greater transparency about the operations of the security agencies and the measures that are being taken is required. At this point, we do not have that kind of transparency.

There have been many recommendations, particularly those within the reports I mentioned earlier, that address greater transparency so Canadians can know what's going on. Those would achieve a much better balance. At this point, Bill C-26 is not balanced in terms of those abilities.

[Professor Andrew Clement, Professor Emeritus, Faculty of Information, University of Toronto, As an Individual]

Thank you, Mr. Chair and committee members.

I am Andrew Clement, a computer scientist and professor emeritus in the faculty of information at the University of Toronto. I co-founded the interdisciplinary Identity, Privacy and Security Institute there.

For the past decade, I have focused on the privacy, security and surveillance aspects of Internet communications. Currently, I co-lead a project with the Canadian Internet Registration Authority on Internet measurement aimed at advancing Canadian cybersecurity, resiliency and sovereignty. The project is funded through Public Safety Canada's cybersecurity co-operation program. Beyond an annual $1,500 honorarium, I receive no funds from either CIRA or Public Safety. While I endorse CIRA's submission to your committee, I am speaking here in a personal capacity.

I strongly endorse the recommendations in the submission by the Citizen Lab and the joint submission by several civil society organizations. Both of these submissions draw heavily on the fine report by Dr. Chris Parsons, “Cybersecurity Will Not Thrive in Darkness”.

There is no debate over whether Canada needs a stronger regime for securing our critical cyber infrastructure. Bill C-26 contributes to establishing a worthy cybersecurity regime. However, it needs substantial amendment to ensure that the sweeping and secretive powers it grants the government do not override other equally vital values, such as privacy, freedom of expression, judicial transparency and government accountability.

For better and worse, the government's leading agency for ensuring cybersecurity is the Communications Security Establishment. It faces a vital and remarkably difficult task. Fortunately, it appears to be staffed by dedicated experts. However, unsurprisingly, given its origins in wartime signals intelligence, CSE operates with an extraordinary degree of secrecy and boundless appetite for data collection. This is quite justified in some areas of its mandate, but as its capabilities have grown to include extensive surveillance of domestic communications, CSE needs to be much more open and publicly accountable.

In 2013, Snowden documents—notably, about CSE's “CASCADE: Joint Cyber Sensor Architecture”—indicated that the agency was embedding extensive interception capabilities within the Internet infrastructure able to capture a very large portion of Canadians' Internet communication.

While CSE is legally prohibited from directing its activities at Canadians, its capabilities of full take of content and metadata, mass surveillance, and the “incidental” bulk collection of personal and even intimate information on every Canadian Internet user pose a significant challenge to privacy rights and democratic governance more generally.

Renowned cybersecurity expert and director of the Citizen Lab, Ron Deibert, noted the following in 2015: “These are awesome [surveillance] powers that should only be granted to the government with enormous trepidation and only with a correspondingly massive investment in equally powerful systems of oversight, review and public accountability”.

Basic questions here are whether the government should make Canadians aware of this mass surveillance, provide them with robust assurances that this bulk collection is necessary, proportionate, and safe, and offer them an opportunity to decide collectively whether such practices are acceptable or not.

As mentioned by previous witnesses, a key concern with Bill C-26 is its failure to restrict the CSE's use of the information it collects under its extensive new Bill C-26 powers. As Kate Robertson made clear earlier, based on NSIRA reporting, if it is not explicitly prohibited from doing so, the CSE will consider itself authorized to use this information across any of its mandates. This accountability deficit must be fixed before granting CSE new powers under Bill C-26.

Privacy is a fundamental human right. It is essential that Bill C-26 be amended to explicitly define personal and de-identified information as confidential and to ensure that the government obtains a court order before requiring its disclosure. The government must not be allowed to use its sweeping new powers to undermine privacy, such as by weakening encryption or communications security. Data retention periods must be attached to the information it collects.

Before closing, I'd like to briefly raise an issue that is missing from Bill C-26, one that your committee has previously considered important—namely, how the government should handle cybersecurity vulnerabilities. Where Bill C-26 requires telecommunications service providers to conduct assessments to identify any vulnerability in their services—

[Angelina Mason, General Counsel and Senior Vice-President, Legal and Risk, Canadian Bankers Association]

Thank you.

Good evening.

I would like to thank the committee for inviting us here today to provide our views on part 2 of Bill C-26, an act to enact the critical cyber systems protection act.

My name is Angelina Mason, and I am general counsel and SVP of legal and risk at the Canadian Bankers Association. I am joined by my colleague, Charles Docherty, assistant general counsel and vice-president, legal and risk.

The CBA is the voice of more than 60 domestic and foreign banks that help drive Canada's economic growth and prosperity. The CBA advocates for public policies that contribute to a sound, thriving banking system to ensure Canadians can succeed in their financial goals.

Banks in Canada are leaders in cybersecurity and have invested heavily to protect the financial system and the personal information of their customers from cyber-threats. We are also a highly regulated industry and comply with robust requirements from the Office of the Superintendent of Financial Institutions in respect of cybersecurity risk, supply chain and third party risk management, and incident reporting.

The security of Canada's critical infrastructure sectors is essential to protect the safety, security and economic well-being of Canadians. The banking industry counts on other critical infrastructure sectors, such as telecommunications and energy, to deliver financial services for Canadians. We have encouraged the government to leverage and promote common industry cybersecurity standards that would apply to those within the critical infrastructure sectors, and we support the government's efforts to achieve this under the act. We recognize that critical infrastructure, such as energy, crosses jurisdictional boundaries. We have also recommended that the federal government work with provinces and territories to define a cybersecurity framework across all critical infrastructure sectors.

Having consistent, well-defined cybersecurity standards will provide for greater oversight and assurance that these systems are effective and protected. Protecting against state-sponsored and other threat actors requires a coordinated approach between the government and the private sector. The government can play a pivotal role in bringing together critical infrastructure partners and other stakeholders and building upon existing efforts to respond to cyber-threats.

While recognizing the importance of the act, we need to get this right. Some of the proposed provisions need to be better tailored to address operational and other risk concerns, including being able to leverage existing robust requirements of specific sectors, like banks, to mitigate duplicative or inconsistent requirements, providing greater safeguards for the protection of confidential information, and improving the threshold and timing for cybersecurity incident reporting.

In addition, there should be appropriate guardrails for the invocation of the government's very broad powers under the act. Consistent with other legislation, the act should also include safe harbour provisions that provide designated operators immunity from civil and criminal proceedings for good-faith compliance with the act's reporting requirements and cybersecurity directives.

Looking beyond mandatory incident reporting, the act should also support broader voluntary sharing of incidents, cyber-threat information and expertise about cyber-protection with the Communications Security Establishment and among classes of designated operators, while also including safe harbour provisions to enable this sharing without creating additional risk. Effective sharing of this type of information is a critical component to cyber-resiliency and should be fostered through the act.

Finally, we believe it is necessary to allow the CSE and CSIS to share relevant intelligence and information with designated operators of critical cybersecurity infrastructure in Canada to help them effectively prevent and mitigate cybersecurity incidents.

We will be following up to provide the committee with additional written details on these recommendations. We want to work collaboratively with the government and with other sectors to ensure that Canada remains a safe, strong and secure country.

We look forward to your questions.

[Robert Ghiz, President and Chief Executive Officer, Canadian Telecommunications Association]

Thank you, Mr. Chair.

Good evening. As said, my name is Robert Ghiz. I'm the president and CEO of the Canadian Telecommunications Association. I'm joined today by our senior vice-president, Eric Smith.

The Canadian Telecommunications Association is dedicated to building a better future for Canadians through connectivity. Our association includes carriers, manufacturers and other companies that invest in Canada's world‑class telecommunication networks.

We appreciate the opportunity to speak to you today about our association's views on Bill C‑26.

The security of Canada's telecommunications system is of the utmost importance. Our members recognize that their services are critical to the social and economic well-being of Canadians, as well as to their security and safety. Accordingly, our members invest significant resources to safeguard their systems and infrastructure from cyber-attacks and other threats.

Members also actively participate in the Canadian security telecommunications advisory committee, or CSTAC, which facilitates the exchange of information between the private and public sectors, as well as strategic collaboration on current and evolving issues that may affect telecommunications systems, including cybersecurity threats. In addition to providing connectivity services, many of our telecommunications service providers also deliver cybersecurity solutions to businesses across the country, helping them protect their operations against cyber-attacks.

In other words, our industry takes security seriously and is committed to the security of the Canadian telecommunications system. As such, we share the Government of Canada's objective of protecting critical infrastructure from cyber-attacks and other threats.

However, Bill C-26 in its current form raises some concerns. We have outlined our concerns and proposed amendments to the legislation in a written submission to the standing committee. I will mention a few of them, all of which pertain to part 1 of Bill C-26 and the proposed amendments to the Telecommunications Act.

First, the bill gives the minister very broad order-making powers that lack appropriate checks and balances. Given the extremely broad scope and potential impact of these powers, the proposed legislation should be amended to impose conditions on exercising them. Specifically, orders should not only be necessary in the opinion of the minister but also reasonably necessary—in other words, proportionate to the potential harm of the security risk and reasonable in the circumstances. The legislation should also require that orders be made only after the minister has consulted with prescribed experts to ensure they are proportionate to the risk posed, have a limited impact on service availability and are economically and operationally feasible for affected service providers.

Second, while orders made under the bill are subject to judicial review, the legislation provides that a judge can base his or her decision on evidence the applicant is not allowed to see and therefore cannot challenge. This process makes no effort to provide for alternative means of testing the government's evidence, including the appointment of a special advocate with the appropriate level of security clearance.

Third, Bill C-26 does not include a due diligence defence for alleged violations of orders made pursuant to the proposed new sections of the Telecommunications Act, even though a defence of due diligence is available for other violations of the act, as well as for violations of orders by others under the rest of Bill C-26. The absence of a due diligence defence is even more striking given that the legislation seeks to introduce significant monetary penalties. Telecommunications providers should have the right, as afforded to others under Bill C-26, to avail themselves of a due diligence defence in appropriate circumstances by demonstrating they took all reasonable care in the circumstances to avoid the alleged violation.

Lastly, part 1 of Bill C-26 should be amended to make clear that compensation may, at the discretion of the government, be awarded for any financial expenditures, losses and costs resulting from complying with an order.

Thank you for giving us the opportunity to share our views on this key issue. We look forward to answering your questions.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

We're basically seeing an incident of that magnitude every two weeks or less at this point. Are you concerned about that number growing? As some witnesses have indicated, if we don't put in place protections, for example with Bill C-26, Canadian financial institutions may increasingly be targets.