Bill C-26

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

Opposition Motion—Auto Theft

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, one of my Conservative colleagues was honest enough to tell me how he felt about this. These are tactics.

The Bloc Québécois is an opposition party. As everyone knows, the Bloc Québécois will never come to power in Ottawa. We are here to represent the interests of Quebeckers. Even though the current government is not our favourite and we do not always agree with it, we try to study and improve each bill as much as possible and make gains for Quebeckers.

My Conservative colleague told me that his party, as the official opposition, would oppose any bill introduced by the Liberal government to stop it from passing.

The Standing Committee on Public Safety and National Security is studying Bill C‑26 on cybersecurity, which is extremely important, and the Conservative Party is doing everything it can to delay it. The Conservatives always have an issue or a concern that is more urgent, or a motion to move. They are always filibustering, which is unfortunate. People elected us to do important work here in Ottawa, and we are being prevented from doing it because of these tactics. I want people who may be watching at home to realize this, but it is extremely difficult to get the message across.

In any case, we in the Bloc Québécois continue to do our job, and we are very proud of that.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I am delighted to have the opportunity to elaborate on this subject. As I was saying earlier, the Conservatives are finally paying attention. They now realize that this is an important topic and that it might be a good idea to add it to their arsenal of election slogans.

As my colleague from Saanich—Gulf Islands was saying a little earlier, it is true that investigative journalism brought this problem to our attention a few months ago. There are also organizations that come to Ottawa to tell us about certain issues and raise awareness about them.

Last April, I met with people from the Corporation des concessionnaires automobiles du Québec and the Canadian Automobile Dealers Association and they talked to me about this. It is wrong to say that they do not care about this phenomenon because they make money and they will be able to sell a car if a customer has theirs stolen, since they are reimbursed by the insurance company. It is not true that they do not care, because they are here in Ottawa to talk to us about it. They want the government to do something about this problem.

I first became interested in the subject a few months ago. I met with global car manufacturers, who also spoke to me about it. In October, following the feature story aired in J.E, a television program on TVA, and after the numerous news reports of the Journal de Montréal’s investigations bureau, I announced that I was going to move a motion at the public safety and national security committee. I talked to my colleagues about it, because we often see members of certain parties come totally out of left field with a motion on any given subject, thinking everyone is going to accept it as is. It is important to discuss these things with colleagues first and to make them aware of the issue. That is how I came to talk to my Conservative colleagues about the auto theft problem. They seemed to be very interested. When I moved the motion, all parties voted in favour of it. Everyone had a story to tell, everyone had a friend or colleague who had their vehicle stolen. A Conservative colleague even told me that he personally had his car stolen. There was definitely a consensus that this was something we should look into as soon as possible.

At the public safety and national security committee, we were looking at Bill C-20. That was significantly delayed by the Conservative Party for reasons we may or may not be aware of. The same thing is happening now with Bill C-26. The process has been delayed, and our committee agenda has us looking at the bill on auto theft after that. I do not really understand why the Conservatives are trying to delay this study as much as possible, when they are making it a priority today by talking about it. If it were that important to them, they would be working hard on the public safety and national security committee to finally get it done.

With today’s motion, they may be trying to get material for pre-election, or even election, slogans, because we get the impression that the Conservative Party may already be on the campaign trail. The Bloc Québécois did not get the memo. The Conservatives’ new slogan is in today’s motion, which states, “after eight years of soft on crime policies, this Prime Minister has created the auto theft crisis”. Who knew? The Prime Minister himself created the auto theft crisis. He sure has broad shoulders. I am not saying this to defend him. It is true that the Liberals have not done much in recent years to combat this problem. However, that the Prime Minister single-handedly created the crisis is something we cannot take very seriously.

I would even go so far as to say that the entire argument laid out in the Conservatives’ motion is completely disconnected from reality, despite the fact that the problem is all too real. If one looks at the problem with a minimum of seriousness, it is immediately clear that the COVID 19 pandemic in 2020 caused significant disruptions in the logistics chain around the world. One of the most hard-hit sectors was the industry producing the semiconductors needed for all microprocessors. The microprocessor shortage led to a worldwide reduction in auto manufacturing, which made demand go up. This increased the cost of used vehicles. Crime gangs jumped on the opportunity and quickly specialized in car theft and shipment to other markets. This was already happening on a smaller scale, but the pandemic and the impact it had on supply chains accelerated the phenomenon. Because of its geographical location, Montreal became an auto theft hub.

Why was that? Because Montreal is home to the largest port in eastern Canada that provides access to the rest of the world. Of course other ports are involved as well, such as those in Halifax and Vancouver. However, these ports have not been as affected as the port of Montreal. It is truly a gateway, a hub. As I was saying, the pandemic exacerbated the situation but, on top of that, new technological developments have made auto theft more appealing.

For example, consider the increasingly frequent use of smart keys, which make it easier to steal vehicles. Several news reports have shown how thieves go about it. All they have to do is use a relay to amplify the signal of a smart key inside a house by standing next to the front door. With an accomplice, the thief can then open the car door and start the engine.

They can also connect a computer to the onboard diagnostic port in the car, which enables them to use another key. All they have to do then is force open the door.

It is child’s play for people who know what they are doing.

In Montreal, as in the rest of the country, we have seen people using Denver boots or steering wheel locks to make it harder for thieves to steal their car. I say harder, because thieves have found other ways to remove these devices and leave with a car in no time at all.

This phenomenon is truly becoming a scourge, especially in Quebec and in Montreal. Auto theft has increased over the years. According to Équité Association, roughly 70,000 vehicles were stolen in Canada in 2022. That is huge. Between 2021 and 2022, the number of thefts increased by 50%, or half, in Quebec, by nearly half in Ontario, or 48%, by 34% in Atlantic Canada, and by 18% in Alberta. 2022 was a record year for auto theft. The numbers are not yet known for 2023, but by all indications auto theft has increased yet again.

The reported losses are in the billions of dollars for insurers, and we have seen premiums go up for ordinary people. Le Journal de Montréal reported that between 2012 and 2022, the average car insurance premium increased by 50% as well. This increase is in part tied to auto theft.

Given these facts, one of the questions we need to ask ourselves is why there is this growing interest in auto theft.

It must be said that auto theft is one of the easiest and least risky sources of revenue for gangs, which then use part of the proceeds to finance other criminal activities, such as gun trafficking and human trafficking. Those are the two reasons. It is easy and low-risk.

I explained earlier why it is easy. One reason it is so low-risk is that sentences are so light. In an article in La Presse, Jacques Lamontagne, director of investigations for Quebec and the Atlantic region at Équité Association and a retired Montreal police force criminal investigator, explained—

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I will start again. Unfortunately, I do not think anyone heard me. If the member would put his earpiece in, I think that would work even better.

I am pleased to see that the Conservatives have finally realized that there is an auto theft crisis in Canada. I for one have been talking about it since October. I moved a motion at the Standing Committee on Public Safety and National Security to study this issue. The Conservatives agreed to it. They thought it was a good idea, but all they have done since then is hold up the committee's work. That is what they did with Bill C-20 and Bill C-26.

Why are they doing that? The reason is that they do not think that the auto theft crisis is all that important after all.

Why do they want to talk about it today? Is it because it makes for a good campaign slogan? Is it because they want to crack down on crime? Why has this become a priority for the Conservative Party today?

[Kate Robertson]

The amassing of data in any database brings with it attendant security risks. The extent of them I cannot comment on.

I would indicate that your concerns are connected to amendments that we have raised in our brief regarding the handling of data. Right now, the information-sharing powers within the Canadian government that would be enabled by Bill C-26, if passed unamended, are extremely broad.

One limit that we recommended, for example, is that the use of the information being shared should be constrained to cybersecurity objectives, and not piggybacked objectives that are layered on after the fact. Retention limits should be strictly defined to address the very concern that you're raising.

In that way, while there is understandably a need for some examination of critical information to enable that mandate to be fulfilled, it should be very strictly defined within the legislation itself.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Mr. Chair.

Thank you to all the witnesses for being here today.

My line of questioning will be mostly for Ms. Robertson and Mr. Hatfield.

I'm very concerned by the testimony you've shared with me today, in light of the fact that the government itself certainly has been victim of hacking. I recall that Global Affairs was the victim of a recent hack.

I think this is one of the dilemmas of increasing centralization of information, as Bill C-26 purports to do in collecting information on the cybersecurity plans of the designated operators. Is there any guarantee that, when government collects all of this very confidential and powerful information, it is better equipped than some of the best companies in the world to protect that information from hackers?

[Matthew Hatfield, Executive Director, OpenMedia]

Hi there. I'm Matt Hatfield, and I'm the executive director of OpenMedia, a grassroots community of 230,000 people in Canada who work together for an open, accessible and surveillance-free Internet. I'm joining you from the unceded territory of the Sto:lo, Tsleil-Waututh, Squamish and Musqueam nations.

I’d like to ask us all a question: What does cybersecurity mean to you as an individual, as a family member and as a citizen? For me, and for many people across Canada, our cybersecurity is inseparable from our privacy, as so much of our everyday lives is conducted online—much more so since COVID—and none of us feel secure with the thought of being spied on in our everyday lives, whether by hackers, hostile states or our own government. For most Canadians, our cybersecurity is very much about that sense of personal security.

The draft of Bill C-26 you have in front of you threatens that security. It poses enormous risks to our personal privacy, without basic accountability and oversight to ensure that the people given these powers don't abuse them against us. You must fix this.

Exhibit A is proposed section 15.2 of the Telecommunications Act, which grants the government the power to order telcos “to do anything or refrain from doing anything”. There are no limits here, no tests for necessity, proportionality and reasonableness, and no requirement for consultation. The government could use these powers to order telcos to break the encryption we need to keep ourselves safe from hackers, fraudsters and thieves. They could even use these powers to disconnect ordinary people indefinitely from the Internet, maybe because our smart toaster or an old phone we gave our kids gets hijacked by a hostile botnet. Without a requirement that these orders be proportional or time-limited, these are real risks.

It gets worse. The government would be allowed to keep even the existence of these orders—never mind their content—top secret indefinitely, and even if these orders are challenged by judicial review, the minister could bring secret evidence before secret hearings, which flies in the face of basic judicial transparency.

There's no excuse for this. Our close allies in Australia and the U.K. have shown how cybersecurity can be strengthened without compromising fundamental rights. Why do Canadians deserve lesser protections?

All this comes when Parliament is working on strengthening our privacy laws through Bill C-27. I have to ask, does one hand of our government even know what the other is working on?

We recognize that there are very real problems, though, that Bill C-26 is trying to solve. When we read the government's stated objectives, we're on board. Should we protect the digital infrastructure? Sure. Should we remove risky equipment from hostile states? Of course. Should we force big banks and telcos to better protect their customers? Of course. However, we can fulfill these objectives without sacrificing our rights or balanced, effective governance. Let's talk about how.

First, the government's new powers must be constrained. Robust necessity, proportionality and reasonableness tests are an absolute must. An unbreakable encryption is the fundamental baseline that all of our personal privacy depends on, so there must be an absolute prohibition on the government using these powers to break encryption.

Second, privacy rights must be entrenched. Personal information must be clearly defined as confidential and forbidden from being shared with foreign states, which are not subject to Bill C-26's checks and balances.

Third, the government must not be allowed to conceal the use of its new powers under a permanent veil of secrecy.

Fourth, when the use of those powers is challenged in court, there must be no secret evidence. Special advocates should be appointed to ensure all evidence is duly tested.

Fifth, any information the Canadian Security Establishment obtains about Canadians under Bill C-26 should be used exclusively for the defensive cybersecurity part of their mandate. I hope you all remember that NSIRA, the body explicitly established by Parliament to oversee CSE, has complained for years about CSE not being accountable to them. Knowing how difficult it's proved to keep them accountable for their existing powers, please don't grant them broad new powers without tight and clear use and reporting mechanisms.

As other people have said, when cybersecurity works, it's a team sport. It requires buy-in from all of us. We all have to be on team Canada, and we all have to trust in the regulatory framework that governs it. There's zero chance of that happening with Bill C-26 as is. Adequate transparency, proportionality and independent verification are the necessary baseline that this bill has to earn for it to work.

We're going to be delivering a petition signed by nearly 10,000 Canadians to you shortly, folks who are calling for that baseline protection. We urge you to listen to these voters and adopt the amendments package that civil society has suggested to you to get this legislation where it needs to be.

Thanks. I look forward to your questions.

[Kate Robertson, Senior Research Associate, Munk School of Global Affairs and Public Policy, University of Toronto, Citizen Lab]

Good afternoon.

My name is Kate Robertson. I am a researcher at the Citizen Lab, which is based at the University of Toronto's Munk School.

My comments today draw on the Citizen Lab's research on cybersecurity and telecommunications policy, data security, and transparency and accountability mechanisms that are applicable to the relationship between governments and telecommunications providers. My brief, which was submitted to this committee, was written with Lina Li of McGill Law and provides a charter analysis of Bill C-26. Part three of our brief sets out our recommended amendments, building on a report on Bill C-26 written by my former colleague Dr. Christopher Parsons.

There are key recommended amendments that would act as constitutional safeguards in the legislation. This is not to state that they're exhaustively read here.

To protect the rule of law and free expression, orders issued under the legislation must be published in the Canada Gazette. Any exceptional circumstances that might justify confidentiality of those orders should be expressly and strictly defined in the legislation, and should be time-limited.

For privacy rights, the legislation needs explicit protections for personal information, notice requirements, and tighter controls surrounding the sharing and use of personal and confidential information. You'll find proposed terms for those amendments under recommendations 13, 14, 16, 19, 28 and 29 in our brief.

We also reiterate, as others have, that orders issued must be proportionate and reasonable. In particular, the legislation should make explicit that an order compelling the adoption of particular standards cannot be used to compromise the integrity of a telecommunications service, such as by compromising encryption standards. The terms for those amendments are in recommendations one and five of our brief.

It is notable that these amendments are compatible with the government's objective to play an assertive role in protecting Canada's networks. This is not a tug-of-war between competing public interests. This is important, because the courts do not tend to find it reasonable if constitutional rights are infringed upon in a way that is unnecessary. The desire for expediency through Parliament is understandable, but if these issues aren't fixed now by legislators, then the legislation may well be held up in court litigation for years, which ultimately requires additional legislative time to fix.

Amendments to limit secrecy and to require proportionality also reinforce the government's objective of protecting our networks. I agree that, as was said last week, cybersecurity is a team sport, and I agree with Mr. Warnell's comments on the same subject. Effective cybersecurity integrates expertise from across a range of sources, including regulators, industry, civil society, academic and security researchers, and data journalists.

Dr. Parsons' report on Bill C-26 last year, as well as this committee process itself, illustrates how industry and independent expertise can provide a path forward for improving the legislation without detracting from the bill's core mandate. Public transparency will be an effective way to garner expertise from these sources as the legislation is implemented over time.

The Citizen Lab's recent report, “Finding You”, which is appendix C to our brief, underscores how secrecy at the regulatory level has led to serious “geolocation-related threats associated with contemporary networks”. The report documents persistent vulnerabilities at the heart of the world's mobile communications networks. It notes, “The failure of effective regulation, accountability, and transparency has been a boon for network-based geolocation surveillance.” In other words, when network standards and regulations are shrouded in unnecessary secrecy, this enables network insecurity to fester.

Similarly, without proportionality and transparency, Bill C-26, unamended, could enable successive governments to actually undermine network security, and ultimately human security, through orders that would drill holes in encryption standards in telecommunications networks.

[Todd Warnell, Chief Information Security Officer, Bruce Power]

Thank you, Mr. Chair and members of the committee.

My name is Todd Warnell and I am the chief information security officer at Bruce Power.

Established in 2001, Bruce Power is Canada's only private sector nuclear generator, annually producing about one-third of Ontario's power, as well as life-saving medical isotopes used around the globe to fight cancer and sterilize medical equipment.

I'm grateful for the invitation to participate in your review of Bill C-26. Today, I will focus my comments on part 2 of the bill, namely, the critical cyber systems protection act.

I'm here before the committee to provide a perspective that proceeding with the implementation of Bill C-26 is of vital importance to the safety and security of all Canadians. Canada has prospered over the last four decades through a period of relatively stable and predictable global relations. However, that period of stability and predictability is changing amidst a backdrop of global geopolitical tensions and changing global dynamics. Ensuring the safe and reliable delivery of critical services that Canadians depend upon every day is not, and cannot be, a political issue.

Within Canada's nuclear industry, we have seen and demonstrated that through collaboration with governments, regulators, industry, academia, and individual Canadians, we can be successful in establishing and regulating cyber systems that are important to the safe and reliable operation of critical services.

The critical cyber systems protection act would introduce a broad framework from which all critical sectors, in collaboration with government and regulators, can develop and implement risk-informed and performance-based regulation to enhance the reliability and resilience of critical services. The committee should consider ways of ensuring that appropriate checks and balances are in place for any directives issued to address a risk or threat to Canada's critical cyber systems.

Harmonizing Canada's cybersecurity framework across critical sectors through Bill C-26 would also align our approach with our closest allies and avoid our being left behind as our allies move forward with enhancing their respective national cyber resilience programs and driving innovation that can enhance our collective capabilities in protecting ourselves and detecting and responding to a changing threat landscape.

In conjunction with Bill C-26, we urge lawmakers to review and consider the amendments to the CSIS Act, to enable Canada's intelligence community to exchange and co-operate on cyber-threat intelligence with Canada's public and private sector operators in both a proactive and preventative manner.

Thank you for the opportunity to address the committee today.

I look forward to your questions.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Ms. Bahr‑Gedalia, you spoke earlier about introducing a 72‑hour deadline to give companies time to report an incident to the government.

In the current version of Bill C‑26, it says that incidents must be reported as soon as they occur. You believe that the deadline you are proposing could give businesses a boost. I also think that 72 hours would be a good time frame, particularly to manage the additional paperwork that this bill will create.

As a chamber of commerce representative, you surely talk to companies and must know their opinion on this bill. What are you hearing from them?

What are the arguments behind the proposal to give them a little more time?

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you, Mr. Chair.

Once again, the Conservatives talk tough on crime. Mr. Brock can raise whatever supposed conversation he claims to have heard, because I guarantee it didn't exist, but I heard him talk about not even knowing what committee he was coming in to filibuster or what issues it was on.

It's been demonstrated very clearly that the Conservatives had time to ask questions and didn't bother.

I'll move to the witnesses on Bill C-26.

Mr. Shipley, you talked about the importance of this legislation. You raised examples of a natural gas pipeline that was hacked and what that does for critical infrastructure, including workers who might work in the energy industry. What happens if Canada is not prepared for a cyber-attack in our energy industry?

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

I'm actually really pleased that my colleague did that, because it just goes to show the immaturity the Conservatives are showing every day that we have been studying Bill C-26. They haven't asked a single question.

I overheard Mr. Brock, after his filibuster the other day, ask what we were studying and whether this was the first day we were on it.

They don't care about security or safety.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you, Mr. Chair.

Once again, it's fake outrage for the Conservatives while the cameras are rolling. Once we get through Bill C-26, auto theft is the very next study, which Madame Michaud brought forward, that we would be dealing with. I also find it incredibly ironic that—

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you.

I find it hard to understand why the Conservative Party wants to table a notice of motion on auto theft in the Standing Committee on Public Safety and National Security, when the committee has already voted in favour of a motion on auto theft that I tabled a few weeks ago. I don't understand that. In addition, we are supposed to study this subject in a few weeks, possibly after the study of Bill C‑26. So I'm wondering about the need to table a new notice of motion on the same subject.

Thank you.

[Daina Proctor]

Thank you for the question.

To bring both of your questions together, wherein you were asking about the risk of not acting, in IBM we operate with, partner with and strategically advise over 1,700 organizations. Admittedly, they're not all in the direct scope of this, but they would be impacted through the passing of Bill C-26. Many of those organizations struggle. Many of those organizations are focused on Canada. Many of them are focused on multinational. By not acting within Canada, we are, in effect, encouraging those organizations to pause on Canada.

We don't have the regulations. We don't have the definitions. We don't have the laws in place for them to understand the arena they're playing in within Canada. This bill languishing is causing that pause to get larger.

From a collective individual perspective, it also shifts into the mindset of our resources, our teams and our neighbours. Our graduates—our children coming up through education —challenge what Canada's position is on cyber risk and cybersecurity, not just for the critical infrastructure that we need to run and operate, but for the employment opportunities that we have and that our organizations have.

[Ulrike Bahr-Gedalia]

It is very critical. That's a definite “yes” that we should act in a timely manner.

I would also like to emphasize that we need to get it right and not rush through it in a way that.... I'm a little hesitant to name a time frame because the focus should be on all the challenges we pointed out and addressing these properly.

Comments were made as well on national cybersecurity strategies and plans in other countries and so forth. We don't have our national cybersecurity strategy yet launched. We greatly look forward to what the Canadian Chamber has fed into the submission, because for me and our members it would provide the broader, overarching picture of cybersecurity per se. Bill C-26 would be one part of that strategy. It's a holistic view and a comprehensive approach there.

Lastly, I wanted to make one comment in terms of time and I lost my train of thought there. You had another follow-up question to Mr. Shipley, I think. Could you please remind me what it was?