Bill C-26

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you, Mr. Chair.

My question is for all the witnesses. They should feel free to answer it.

Bill C‑26 strikes a type of balance between the items already enshrined in the bill and the regulations. I gather that many definitions will come from the regulations, penalties, all the people involved, and so on.

Cybernetics is a fast‑paced sector. While regulating a good portion of the sector can provide some flexibility, it can also hamper efforts to keep smaller companies up to date and informed of the latest developments.

I would like you to comment on the balance between the two.

[Francis Bradley]

Thank you very much.

With respect to the bill not significantly adding to the security, and in fact potentially diverting attention, it is not an issue with the bill itself. It's that the bar has already been raised higher than what's in Bill C-26 as a result of the mandatory standards our sector is already subject to through the North American Electric Reliability Corporation standards regime. That bar has already been set higher.

What has been put in Bill C-26 does not improve upon that. It detracts. It diverts attention to a separate and second parallel reporting structure, as opposed to using those resources to work on a response.

[Francis Bradley]

Thank you very much. Those are two very good questions.

On the first question, with respect to the consequences of delay—and this relates to your second question as well—we've been engaged in discussions about this gap, given that we're a sector that has had mandatory reliability and mandatory critical infrastructure protection standards for a decade and a half. We have been asking the question, “What about those other sectors upon which we rely?”, because the sectors are interdependent. Some sectors have robust programs and, as for others, we just don't know, frankly.

We've been in favour of seeing something broader across different critical infrastructures, those other infrastructures that we depend on. We have a very high level of confidence in the regime that we have, because it is mandatory and enforceable. We would like to see something in place, and this has been the conversation that we've been having with the government for a very long time about other sectors upon which we rely.

I think Bill C-26 does fill that gap. It overlaps—and I did talk about that in my comments—but, with respect to consultation, in terms of agencies and departments of the government, we have been talking about this for more than a decade. This is something that we've been consulted on extensively, certainly, but it is something that has been a gap for quite some time.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you very much, Mr. Chair.

Thanks to our witnesses. You've given us a lot of food for thought. I have a lot of questions. I hope that there are no further disruptions because, quite frankly, my Conservative colleagues haven't asked a single question on Bill C-26 to date, and I think that has to change. This is important legislation.

I have two questions for all three of you.

First, Ms. Quaid, you mentioned that further delays would cause loss of the faith of our partners. The government introduced this in June 2022. We're now in February 2024. We're seeing delays and disruption from the official opposition in trying to process this legislation. Beyond losing the faith of our partners, what are the other consequences? We've had previous witnesses say that, basically, Canada is increasingly becoming a target because we don't have legislation in place. What are the consequences of further delay? That is for all three of you.

My second question is based on your excellent brief, Mr. Bradley, talking about doing consultation during the regulatory process. To what extent has the industry been consulted by the government in the legislation to date? To what extent was there input so that we get this bill right?

I'll start with Mr. Bradley and then go to Mr. de Boer and Ms. Quaid.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you.

I would like to hear from anyone who wants to address the responsibility issue, even if it means a second round.

I'm concerned that, if we completely remove the responsibility of large companies, which could have a team to do the job properly, they may somehow avoid feeling the need to comply with Bill C‑26.

Is there a risk of completely removing the idea of responsibility?

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you.

Ms. Quaid, you recommended that the bill be expanded to include voluntary collaboration among companies. However, this would mean a greater need for workers to implement Bill C‑26.

Was this part of your thought process? Is the widespread labour shortage a potential issue? I put this question to the committee earlier, and to the Communications Security Establishment, or CSE. I was told that this could be an issue.

I want to know whether this is an issue for you too, and if so, whether you have any possible solutions.

[Francis Bradley]

Thank you.

That is absolutely an excellent question.

My remarks and our brief focus specifically on that interface between the bill and our NERC requirements, which are quite onerous. The member is absolutely correct. There are other requirements that come into play at the different levels of government, as well, and also internationally. It isn't solely a matter of Bill C-26 coming into conflict with NERC. There are other levels, as well.

Our particular area of concern, where we see the potential for a significantly increased burden, is that lack of alignment between the NERC requirements, which have been in existence for many years, and what is being proposed in Bill C-26.

[Chris Bittle, Liberal, St. Catharines, ON]

That's excellent. Thank you so much.

Thank you so much to the witnesses for being here.

It's truly disappointing to see, on issues of such importance, the Conservatives attempting to hijack this once again when they stand up and pretend to care about security.

Mr. de Boer, you mentioned mandatory reporting, not only here but with respect to the executive order in the United States. Bill C-26 requires mandatory reporting for affected sectors when there is a cybersecurity incident. Do you believe that this is important, and if so, why?

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Mr. Chair.

I want to thank all the witnesses for coming today, and for their testimony. We're taking notes, and we'll be taking everything you've said under advisement in our consideration of this bill.

Going forward, though, we do have another urgent issue that we're facing in this country, and it is the issue of auto theft. In the interests of allowing this committee to continue working on Bill C-26, but also to walk and chew gum at the same time and deal with the urgent issue of auto thefts in this country, I plan to be moving my motion that I put on notice at the last committee meeting to discuss. However, given that there have been some discussions with the other parties present, we have come forward with proposed amendments to this motion so that we can program this committee to work simultaneously on Bill C-26 while also working on the very important issue of auto theft.

We know that in 2022, the latest year that auto theft insurance statistics were made available, $1.2 billion in auto theft claims were made. We know that over 100,000 vehicles were stolen in Canada last year. This is a growing issue. It has increased, year over year, 50% in the provinces of Ontario and Quebec. It's a cross-Canada issue. Alberta is the third highest on the auto theft issue. This is a very important issue in my riding and I am very concerned.

We do need education to help people know what tools are available to them to help protect their vehicles from auto theft. However, at the same time, if the federal government does not take action to secure our ports and to put these repeat offenders behind bars, I fear that we are going to see an increase in the brazenness of these criminal acts, including violence committed against our citizens, if we don't take action to immediately put a chokehold on this unprecedented flow of Canadians' vehicles out of, particularly, the port of Montreal.

I understand, Mr. Chair, that my colleague, Larry Brock, is on the speaking list and will be next to speak. In the interests of ensuring that this committee can continue with its very important study of Bill C-26, but also continue and accelerate the study that was already agreed upon by this committee on October 23, on the motion put forward by our colleague in the Bloc Québécois, Ms. Michaud, I will cede the floor to my colleague, Mr. Brock, so that he can move the appropriate amendment.

Thank you, Mr. Chair.

[Francis Bradley, President and Chief Executive Officer, Electricity Canada]

Thank you, Mr. Chair.

I'm CEO of Electricity Canada, formerly known as the Canadian Electricity Association. Our members are companies that generate, transmit and distribute electricity in every province and territory in Canada.

My comments today will focus on part 2 of Bill C‑26, which enacts the Critical Cyber Systems Protection Act.

Before I proceed, I want to acknowledge the efforts of federal departments in drafting Bill C-26 and the time spent engaging stakeholders over the past two years. The problems that the bill is trying to solve are hard ones, with lots of moving pieces and far-reaching implications against the backdrop of a constantly evolving threat landscape.

While I commend the efforts, I must add my voice to the witnesses you've already heard from who emphasized the importance of getting this legislation right. While we acknowledge the urgency to pass this type of legislation, it is crucial to carefully consider amendments and resist the pressure to rush through the review the bill.

Mandatory security requirements can help strengthen our overall security posture, but the approach taken by Bill C-26 risks having the opposite effect, adding very little security to our sector and redundantly adding additional layers of regulatory requirements. Today, I will highlight three areas where the legislation falls short and requires improvement.

First, the bill must align with existing regulatory frameworks. The electricity sector is unique in that the assets targeted by Bill C-26 are already regulated by the North American Electric Reliability Corporation, or NERC. This poses a risk of regulatory conflicts, increases the burden on operators and introduces compliance confusion and ambiguity, ultimately impeding the goal of Bill C-26 to enhance the safety of our critical system.

A witness last week recommended that the bill should take a risk-based approach and impose fewer requirements on those with already strong cybersecurity programs. Under this approach, mature organizations could spend more resources on incident prevention instead of compliance activities, and regulators could better focus their time on high-risk operators. Given our sector's strong security posture and the existing NERC standards, we feel that a risk-based approach to Bill C-26 would be a step in the right direction.

Another area needing improvement in the bill is its reporting requirements. The reference to the immediate reporting of cyber-incidents should be revised. Reporting obligations should not divert critical infrastructure operators from their response and recovery efforts during and post incident. Reporting requirements should be well defined and consistent and have a reporting timeline that is flexible enough to allow the effective use of limited resources during incident response and recovery.

Still on the topic of reporting requirements, the goals of the legislation would be better served if it included legal protection for operators. Safe harbour provisions are an important part of promoting information sharing between industry and government, ensuring the successful implementation of the new reporting requirements and promoting voluntary information sharing.

The final aspect I wish to address is the unintended impact of the bill on the existing industry-government collaboration. Imposing mandatory requirements may create a chilling effect on the industry's relationship with government departments and agencies. Without appropriate safeguards, operators would likely receive legal advice to share just enough information to comply with the act and nothing more.

This is counterproductive to the goals of the legislation, but there are a couple of things you could do to mitigate those risks. First, put clear limits on how the government can use the information collected by way of this act. Several provisions in the bill would allow for information sharing among a range of persons and entities, and it does not explicitly limit how recipients use the collected information.

Second, the cyber centre should be carved out from the legislation and exempt from obligations to report information obtained by way of the act to other entities. Critical infrastructure operators currently enjoy a positive and collaborative relationship with the cyber centre. This is grounded in the confidence that the cyber centre does not disclose operators' information to regulators, enforcement agencies or other departments. Protecting the cyber centre from information-sharing obligations is crucial to maintaining this collaborative relationship.

Many other aspects of Bill C‑26 also deserve our attention, but my time's up for this morning.

However, I encourage you to take a look at our brief, which contains 14 recommendations on how to improve Bill C‑26.

Thank you.

[Jennifer Quaid, Executive Director, Canadian Cyber Threat Exchange]

Good morning, Mr. Chair.

Thank you, all.

I have the honour of being here today representing the Canadian Cyber Threat Exchange, which is an organization created by Canadian companies to provide a safe environment for members to share cyber-threat information and collaborate by sharing best practices and ideas. The goal is to build cyber-resilience and create a stronger economic environment for all. With 170 members, representing 15 sectors and more than 1.5 million employees, our members are actively sharing cyber-threat information to help build awareness and resilience in others and to prevent breaches, as well as the corresponding need to report.

Many of our members represent the critical infrastructure sectors impacted by this legislation, while others make up their supply chain. Many of them are small and medium businesses, like so much of the Canadian economy.

I applaud the government for focusing its attention on creating legislation that will help strengthen Canada's critical infrastructure sector. I believe that with a few small modifications, there is an opportunity with this legislation to do more to support resilience among Canadian businesses and to strengthen the Canadian economy beyond the confines of the six critical infrastructure sectors referenced.

Others have spoken eloquently about privacy issues and about the real risks of attributing liability to our CISOs. All are very good points, which we support.

I want to talk about three cost-effective suggestions that are easily implemented and will have a significant impact on cyber-resilience throughout Canada.

First, the legislation should be amended to include language that encourages all organizations to voluntarily share cyber-threat information and to collaborate with others to build resilience. This can be done with the addition of language in the preamble and two small related changes. I'd be happy to provide the committee with some of the proposed text later.

The second change is to make membership in a Canadian cyber-threat information-sharing association an allowable expense for government programs. For example, Canada's industrial and technological benefits policy does not permit membership in an organization as an allowable inclusion. This change would incentivize companies to participate in a sharing and collaborative organization to raise their cyber-awareness and resilience in an ongoing way. It would be a small change with a significant impact at no cost to the government.

Third, this legislation requires only specified organizations to share cyber-incident information with their regulators or with the government. We have an opportunity here to create a legal environment that enables all companies, including those specified, to share information beyond what they are required to by law. The CCTX has Canadian members and Canadian companies whose American extensions are currently sharing information in the U.S. that they can't share in Canada because they are not protected by legislation. They are concerned about civil liability if they voluntarily share information that could help others prevent an incident.

The objective of Bill C-26 is to prevent further cyber-incidents. Mandated reporting of incidents is not enough. It will not protect enough organizations quickly enough. By adding protection from civil liability, this legislation could fix that. You could enable companies to share beyond what is strictly necessary to become compliant and improve the cybersecurity and resilience of the economy as a whole in a cost-effective, meaningful way. Without this protection, critical information will continue to be shared with organizations outside of Canada.

In creating and supporting the CCTX, Canada's business community continuously demonstrates its willingness and desire to share cyber-threat information and to share its expertise and experience to support Canadian businesses. Help it do more. Enable it to do more. If enacted as part of this legislation, these three changes will ensure a more secure supply chain for critical infrastructure, which is the focus of this bill, and for all Canadian businesses, large and small.

Thank you.

[The Chair, Liberal, Heath MacDonald]

I call this meeting to order.

Welcome to meeting number 93 of the House of Commons Standing Committee on Public Safety and National Security. Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely using the Zoom application.

I would like to make a few comments for the benefit of witnesses and members.

Please wait until I recognize you by name before speaking.

To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from any microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings.

All comments should be addressed through the chair.

Pursuant to the order of reference of Monday, March 27, 2023, the committee resumes its study of Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

I would like to welcome our witnesses for the first panel.

From Blackberry, we have John de Boer, senior director, government affairs and public policy, Canada. From the Canadian Cyber Threat Exchange, we have Jennifer Quaid, executive director. From Electricity Canada, we have Francis Bradley, president and chief executive officer.

Up to five minutes will be given for opening remarks, after which we will proceed with rounds of questions.

Welcome to all of you.

I invite Mr. de Boer to make an opening statement, please.

[Chris Bittle, Liberal, St. Catharines, ON]

Thanks so much.

I reached out to a friend of mine who's in the know, and her response was it's false that there are only five officers who are engaged in this. So we don't have the facts. There's dispute about the facts. The importance of the public safety study, which the Conservatives are filibustering, and Bill C-26 focuses on cybersecurity, which I know....

I take Ms. Gallant at her word in terms of being worried about money going to terrorist entities or state actors that Canada is not allied with. That's actually happening on the cyber front. That's being filibustered to prevent us to get to a thorough study. It's great to take a headline and put it into a motion and say, “This is fact.” We could have witnesses here, but the Conservatives don't want that.

It was interesting to hear Mr. Strahl talk about the good old days of the 41st Parliament. I'm sure he remembers fondly the Conservative cuts to CBSA. I believe it was about a thousand CBSA jobs that were cut during their time in office. That's interesting. You can send to my personal email account the motions like this that I'm sure he voted on, which were NDP motions like this that were just to set up a concurrence debate. I'm sure that was permitted quite a bit.

There is work being done by the government and in Parliament. I know the Liberal government is working with the Conservative government in Ontario on a big announcement in terms of money for a response to this. I'm looking forward to the outcome of the auto theft summit, and I really want to get to the public safety study on auto theft. Let's hear from all of these witnesses.

Mr. Strahl is right. A concurrence motion is an appropriate tool—it's in the rules—but the way the Conservatives are using it is to just shut down debate and the important work that Canadians expect us to do.

The motion at public safety was unanimous in terms of having a thorough study on the subject. Let's get to that. I'm sure Mr. Strahl, after this meeting, is going to get on the phone with his colleagues on the public safety committee, insist that they end their filibuster tactics and get us to a point at which we can actually debate something important and come up with actual recommendations from actual experts rather than gripping a headline that may or may not be true and using it as the basis for a motion for a concurrence debate in the House of Commons, which I guess Mr. Strahl is now admitting is the tactic in play.

I can't support this motion since it's based on incorrect information, despite being a serious issue. Let's do it properly. Let's get to the study at public safety.

[Chris Bittle, Liberal, St. Catharines, ON]

Thank you so much.

There are a lot of statements being made that. They don't want to call experts. They're making these statements, and perhaps they're true, but if these statements are true, like combatting terrorism and this money's going to foreign governments to fund wars, I think Ms. Gallant will want to speak to her Conservative colleagues on the public safety committee, who are filibustering at every opportunity our attempts to get to that study. They're even filibustering bringing in additional motions similar to this, even though there's a study on the books already. It's just the Conservatives flailing their arms, trying to cripple Parliament. That's what we're seeing here.

Ms. Gallant accused me of filibustering. It must have been the world's worst filibuster—I think I spoke for five minutes. I think she has spoken for longer than I have. However, I really think she needs to speak to her colleagues on the public safety committee, because that's where this motion and a comprehensive study on it is currently sitting.

We need to get through Bill C-26, which is on cybersecurity. In that case, we've heard from experts that money from cyber-attacks is being used to fund foreign governments, to fund wars and conflicts, and to fund countries like North Korea. What are the Conservatives doing on that, a Conservative Party that cares about security or pretends to, anyway? They're filibustering it. They're filibustering witnesses who appear, whom Parliament's paying to fly in. They're making them sit there and watch filibuster debates, one after another.

I appreciate the crocodile tears from the Conservative Party that those of us on the other side of the table aren't taking this seriously. When the chips are down on the public safety committee, it's the Conservatives who don't care, who are not showing that they want to see action and hear from experts. Here we just have a motion, which is a one-liner that we can send to the House of Commons to cripple debate and continue their obstruction in the House of Commons. It's disappointing. Canadians deserve better.

Again, I ask the members here—and maybe it's not Ms. Gallant but the other Conservative members—to please speak to their members on the public safety committee. I really want to get to that study, and I don't want to do this piecemeal, like a one-line report. Let's hear from the RCMP, CBSA, port officials and experts on criminal justice. Let's actually find out. Maybe Ms. Gallant is right. Maybe this money is going to fund terrorism. If that's the case, why doesn't she want her colleagues to stop filibustering in the public safety committee to get to that thorough study that Mr. Strahl—and I believe him—says he wants? Even though his motion for a study is, I think, one meeting with two witnesses.... It's pretty weak tea from the Conservatives, who pretend to care about public safety. Clearly, the Liberals, the NDP and the Bloc care about this issue and want a significant study to look at the actual details so we can provide recommendations.

We need to be better on this, as a country, at all levels of government: municipal police forces, provincial police services, RCMP and CBSA. We need to be looking at this from a holistic perspective. It's easy and great for fundraising emails to say, “It's the federal government's fault.” There are some opportunities that we need to address, but if you're not going to do it in a serious way, it just shows how unserious the Conservative Party is on issues of security and on a lot of different issues. Pound the table. Get angry.

Housing is another example. During question period, there are 45 minutes when the Conservatives pretend to care about housing and security, but when it gets to actual tangible items, they're nowhere to be found.

Filibustering and obstructing, that's all this motion is. It's truly disappointing, once again, to watch the Conservatives go down this path. They used to be serious on issues of public safety, but not anymore.

[Chris Bittle, Liberal, St. Catharines, ON]

Thank you so much.

I sit on the public safety committee, and this is on the agenda for that committee.

Unfortunately, what we're seeing here is that the Conservatives will delay. They talk a good game in terms of an important issue of public safety, which this is. I don't think there's anyone here at this table who believes that this isn't fundamentally important. However, even though there's a study at public safety, we're seeing Conservatives filibuster day after day. We can't get to that study. Here, what do we have? We're taking a headline, and I'm sure it's true, but the Conservatives don't want to have a study. They don't want to look into evidence. They just want to make a statement to bring a concurrence motion in the House of Commons to delay debate, to further the crippling of the House. This is what this is being used for—not for anything productive, not to get to the bottom of things, not to make a reasonable suggestion. This is all this motion is to do.

Even at this committee they're furious about the Infrastructure Bank, and have to find a way to filibuster to get to a report, which is something they want to do. Even their filibusters are conflicting in terms of where they find themselves.

You can see right through this. Again, I appreciate that this is a very fundamental concern for our constituents across the country, but they're not calling for a study. They're just accepting at face value a line from a newspaper report, which again may be true, but they don't want to get to the bottom of it. They don't want to look into things. They just want to have a concurrence debate in the House of Commons to delay legislation that is fundamentally important to Canadians. Again, they don't want to get to the bottom of it.

Really, what they should do is ask their Conservative colleagues on public safety to stop filibustering Bill C-26, so that we can actually get to a study on public safety and speak to not just the CBSA, but to the RCMP, to police chiefs in the greater Toronto area, to port officials.

With respect, this is not the effort that I would expect for a party that says this is a crisis. This is making a statement and delaying debate in the House of Commons, which will produce no recommendations. It's sad actually, if the Conservatives actually believe this is a serious issue and their response is to filibuster in the committee that's seized of the matter, and to have a throwaway motion in this committee so they can delay debate in the House of Commons, not get any evidence, not listen to the experts, because they have all the answers—not the RCMP, not CBSA, not local police chiefs. They have all the answers on this, and it's disappointing to see.