Bill C-26

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

[The Chair, Liberal, Heath MacDonald]

I call this meeting to order.

Welcome to meeting number 94 of the House of Commons Standing Committee on Public Safety and National Security.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely using the Zoom application.

I would like to make a few comments for the benefit of witnesses and members.

Please wait until I recognize you by name before speaking. To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from any microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings.

Pursuant to the order of reference of Monday, March 27, 2023, the committee resumes its study of Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

Today we have two panels of witnesses. I would now like to welcome our witnesses for the first panel.

In person, from the Office of the Privacy Commissioner of Canada, we have Mr. Philippe Dufresne, Privacy Commissioner of Canada. By video conference, from the Office of the Superintendent of Financial Institutions, we have Mr. Tolga Yalkin, assistant superintendent, regulatory response sector. From The Citizen Lab, we have Ms. Kate Robertson, senior research associate at the Munk School of Global Affairs and Public Policy, University of Toronto.

Welcome to all.

Up to five minutes will be given for opening remarks, after which we will proceed with rounds of questions.

I now invite Mr. Dufresne to make an opening statement.

Go ahead, please.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you very much.

At the Foreign Interference Commission, a number of experts said that Canada was probably one of the least transparent countries when it comes to national security. We know that the Communications Security Establishment, or CSE, reports to National Defence.

The Standing Committee on National Defence has already made recommendations to the effect that the CSE should be a little more transparent and that it should provide people with more information when there are cyber attacks, for example.

The Standing Committee on Public Safety and National Security is currently studying Bill C‑26, and there are expectations of the private sector. Don't you think that National Defence should set an example and be a little more transparent and proactive when it comes to whistleblowing when there are attacks or computer computer-related issues, instead of that information being somewhat concealed, in a way?

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

I do understand that you're a quasi-judicial body, and that limits what you can respond to here, but we're here to study Bill C-26 to make it better so that when it is delivered out into the world, it does its job. Is there anything you can offer us that will help us do that?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I would encourage you to consider the question to see whether there is an impact.

We also know that Bill C-11 and Bill C-18 gave sweeping new powers to the CRTC. We've heard from witnesses that Bill C-26 as written also grants too much power, mainly ministerial power. How do you recommend amending the act to give Canadians the confidence that there will be proper oversight without overreach and that transparency and accountability will be balanced?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you very much, Chair.

I'll focus my questions on the CRTC. Last year, the Auditor General reported that the CRTC was not doing enough to track the affordability of Internet and cellular services, particularly in rural and remote areas. Has the CRTC undertaken any sort of analysis of the impacts of Bill C-26 as written on the prices that Canadians pay for Internet and cellular services?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Mr. Chair, I'll ask a question on behalf of Mrs. Normandin. I would appreciate some flexibility with my speaking time. If you don't mind, I'll ask her question first and then move on to my own questions.

Ms. Wright, my question concerns the recommendation that the committee received from Citizen Lab, which suggested that we provide relief for smaller telecommunications providers.

Should Bill C‑26's regulatory framework be implemented in a manner that takes into account its impact on smaller telecommunications providers? Should the implementation of this regulatory framework be flexible enough to ensure that smaller companies can easily comply with the components of the bill?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Okay.

I guess I'll ask you one last question before my time is up.

Is there anything that is not in Bill C-26, Ms. Wright, that you would like to see that could provide greater support for the work you're doing?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Would you be able to comment on how Bill C-26 will intersect with the Privacy Act? Is there anything in the bill that affects the applicability of the act?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

One of the main focuses in this committee is on improving the bill and looking for things that are not included in it but that we could include to strengthen it.

Is there anything our trading partner and ally, the United States, is doing that we are not doing and that is not included in Bill C-26 but that you believe should be included?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

I'll follow up on that.

Given the interconnectedness of the energy sector in Canada and that of our largest trading partner and ally, the United States, how important is it, in Bill C-26, for Canada to strengthen our cybersecurity protection?

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you.

I think that somewhere in there there was a little bit of good news for us. As I said, with that number of 5.2 million at the beginning, hearing yours at considerably less than that obviously will help us sleep a little better at night.

How will Bill C-26 change the way you do business overall? Will it help your members and help you? What's the main implication, if and when this is passed, for how it's going to change?

[Leila Wright, Executive Director, Telecommunications, Canadian Radio-television and Telecommunications Commission]

Good morning, and thank you for inviting us to speak with you this morning.

Before I begin my remarks, I would like to acknowledge that we are gathered on the traditional unceded territory of the Anishinabe people.

My name is Leila Wright, and I am the executive director of telecommunications at the CRTC. I am joined today by my colleagues Steven Harroun, chief compliance and enforcement officer, and Anthony McIntyre, general counsel.

The CRTC is an independent and quasi‑judicial tribunal that operates at arm's length from the government. We hold public hearings on telecommunications and broadcasting matters. We make decisions based on the public record.

In the telecommunications industry, our work focuses on increasing competition for Internet and cellphone services. We do this by promoting greater choice and affordability for Canadians, encouraging investment in reliable and high-quality networks, and improving access to telecommunications services in indigenous, rural and remote communities. We also have a team that helps protect Canadians from unwanted emails, texts and online scams.

The CRTC plays a small part in the federal government's effort to protect the security of Canada's telecommunications system.

Other organizations that contribute to this effort include the Communications Security Establishment, the Canadian Security Intelligence Service, Innovation, Science and Economic Development Canada, the Canadian security telecommunications advisory committee and many others.

The CRTC does not have a role to play within the proposed critical cyber systems protection act. Additionally, many of the proposed amendments to the Telecommunications Act establish new authorities exclusively for the Governor in Council and the Minister of Industry, and do not modify the CRTC's regulatory mandate under the act.

However, a few changes would be relevant to the CRTC's work. I'll focus on three changes in particular.

First, the proposed amendment to section 7 of the Telecommunications Act would add a new policy objective focused on promoting the security of the Canadian telecommunications systems. As with other policy objectives set out in the act, this addition would allow the CRTC to expressly consider how its decisions could further this new objective.

Second, the addition of proposed section 15.6 would facilitate information sharing between a broad group of security-focused government departments and agencies and the CRTC. This would be for the purpose of ensuring compliance with orders and regulations made by the Governor in Council and the minister.

Third, section 47 would require the CRTC to take into account any orders or regulations made by the Governor in Council and the minister in its decision‑making.

Should Parliament adopt Bill C-26, the CRTC will be ready to implement the amendments made to the Telecommunications Act that affect our work.

Thank you again for inviting us to speak today. We look forward to your questions.

[Chris Loewen, Executive Vice-President, Regulatory, Canada Energy Regulator]

Good morning.

My name is Chris Loewen. I am the executive vice-president, regulatory, at the Canada Energy Regulator. I'm joined today by Mr. Chris Finley, director of emergency management and security.

Thank you for inviting the Canada Energy Regulator to appear before the committee today to discuss Bill C-26.

We join you today from Calgary. I would like to take this opportunity to acknowledge the traditional territories of the people of the Treaty 7 region of southern Alberta.

I'll start by outlining the mandate of the Canada Energy Regulator, or CER.

The CER regulates infrastructure to ensure the safe and efficient delivery of energy to Canadians and the world. It regulates pipelines, power lines, energy resource development and energy trade on behalf of Canadians in a way that protects the public and the environment while supporting efficient markets.

Safety is at the core of our work. We regulate to prevent harm in all forms, and we understand that this includes the cybersecurity threats that Bill C-26 is seeking to address. The CER takes the matter of cybersecurity threats to Canada's energy supply seriously.

The CER oversees roughly 71,000 kilometres of the oil and gas pipelines in Canada. We regulate pipelines that cross provincial boundaries or the Canada-U.S. border. CER-regulated pipeline companies are required to have proactive measures in place to protect this critical infrastructure from cybersecurity threats.

Regulated companies must have a security management program that anticipates, prevents, manages and mitigates conditions that could adversely affect people, property or the environment. In addition to the physical threats to infrastructure, companies must consider cybersecurity threats in their security management program and implement appropriate mitigation based on the results of a security risk assessment process. These requirements are laid out in the Canadian Standards Association's Z246.1 standard, which is included in the CER Act's onshore pipeline regulations by reference.

Cybersecurity measures must reflect the criticality of cyber-assets, as well as the results of regular assessments of threats, vulnerabilities and overall security risk.

The regulation of electricity generation, transmission and distribution rests primarily within the jurisdiction of provinces and territories. However, the CER regulates approximately 1,500 kilometres of international power lines. The Canadian public rightfully expects us to hold the pipeline and international powerline companies we regulate accountable for the safe operation of CER-regulated energy infrastructure.

The CER is well positioned to administer the obligations of Bill C-26, in particular those that apply to companies we regulate, and, given these obligations, align with those already found in the Canadian Energy Regulator Act.

For example, the bill provides the CER with the ability to issue orders and to take necessary enforcement actions to bring a company back into compliance, so that critical cyber systems are protected.

The CER already uses similar tools. For example, it issues notices of non‑compliance, inspection officer orders and administrative monetary penalties, as needed, to bring companies back into compliance and ensure that they operate safely.

The CER also verifies that companies are meeting requirements through inspections, audits, compliance meetings and emergency response exercises.

The CER uses an integrated government approach. It works with federal, territorial, provincial and international agencies, as well as regulated industry, to ensure that proactive measures are taken to protect federally regulated energy infrastructure from cyber-related risks or attacks.

Thank you very much for the opportunity to speak with you today about this important issue. We look forward to your questions.

[Jennifer Quaid]

There was certainly an opportunity for consultation several years ago. We participated in that with our members, as well, because we reached out to them. It became a trickle-down process, but it would be nice to see something like Bill C-26 running in concert with a national cyber-strategy.

The consultation was several years ago and is now two years behind. I see that coming down the pipeline.

What was the third question?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

I'd like to congratulate Mr. Motz on asking the first question for the Conservatives on Bill C-26, a month into the study.

I'd like to go back to you, Ms. Quaid, on the issue of consultation.

There's also the question of whether or not we're increasingly a target because of the lack of action and delay around important legislation.

My third question comes back to your recommendation around expenses for joining, if I have this correctly, the Canadian Cyber Threat Exchange. To what extent would that be a cost? You said there is no cost, but I'm sure there would be. Have you evaluated what that would be and what the advantages are from that?

Those are three questions for two minutes.