Bill C-26

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

Industry and Technology

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, the member raises a very important issue about the Internet, and threats on the Internet, in a number of ways. He spent a great deal of his time focused on Bill C-27, and understandably so since that is what the motion is about. The government has taken a very holistic approach in dealing with all aspects of the Internet in the form of legislation and regulations.

Quite often in legislation, we see a framework that is absolutely essential to support healthy and strong regulations that, ultimately, protect the interests of Canadians. It has been somewhat frustrating, as the member was frustrated when talking about what is taking place in committees; on the floor of the House of Commons, it has also been frustrating. The member referred to Bill C-27 being held up in committee, but he tried to put the blame on the government.

One of the biggest differences between the government today and the government while Stephen Harper was prime minister is that we are very open to ideas, constructive criticism, and looking at ways we can improve legislation. That means we have been open to amendments and changes. There have been a number of recommendations, but there was also an extensive filibuster on Bill C-27. It was not just government members but opposition members, much like we see filibusters taking place now on other aspects of the safety of Canadians.

For seven or eight weeks now, there has been a Conservative filibuster on the floor of the House of Commons, and there are other pieces of legislation dealing with the Internet that the Conservatives continue to filibuster. I am referring to Bill C-63, which deals with things such as intimate images being spread on the Internet without consent and child exploitation. We are talking about serious issues facing Canadians, including Bill C-63, that we cannot even get to committee because the Conservative Party has made the decision to filibuster on the floor of the House of Commons.

When the member opposite talks about Bill C-27, I can assure the member that the government is very keen on the legislation. We do not see how Canadians would benefit by splitting the legislation because both aspects are really important to Canadians. We should look at where it can be improved and we are open to that. We have clearly demonstrated that, but we need a higher sense of co-operation, whether dealing with Bill C-63 in the chamber or Bill C-27 at committee. Bill C-26 deals with cybersecurity. As I said, the government is very aware of what is happening on the Internet and our responsibility as legislators to advance legislation that helps establish a framework that will protect the interests of Canadians.

Earlier, I referred to a trip I took to the Philippines in the last five days. One of the companies we visited was a Canadian company, Open Text, that employs 1,500-plus people. We sat in a room that had this huge monitor of the world, and Open Text talked about how threats to infrastructure and to individuals occur every second. We are talking about a trillion type of number when it comes to computer threats occurring on a monthly basis. Open Text can tell where they are coming from and where they are going. It was a very interesting presentation.

No government has invested more in issues around AI than this government has, recognizing the potential good but also the extreme harm out there. We can think about different types of data banks. There are government data banks, such as Canada Revenue at the national level and health care records at the provincial level. There are the Tim Hortons, the private companies, and the data they acquire in their applications. The amount of information about Canadian individuals on the Internet is incredible. Technology has changed the lives of each and every one of us, whether we know it or not.

We can take a look at the number of cameras on our public streets, in malls and so on. We can think of the number of interactions we have on a daily or weekly basis, whether that is banking, which contains very sensitive information, or medical reports—

Message from the Senate

[The Assistant Deputy Speaker, Carol Hughes]

I have the honour to inform the House that a message has been received from the Senate informing this House that the Senate has passed the following bill with an amendment to which the concurrence of the House is desired: C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts.

Copies of the amendment are available on the table.

[Wendy Hadwen]

Thank you for your question.

With regard to CAFCYBERCOM and everything to do with cyber operations, in its annual report, the Communications Security Establishment mentions that we have already made progress in implementing several operations, but without giving further details. Rest assured that, since Bill C‑26 was passed and provided us with the requisite powers, we have been exercising them.

You suggested that the newly announced CAFCYBERCOM was just a gathering of people taken from elsewhere, but I assure you that it's a very important gathering, because it puts us on a more equal footing with our allies.

I'll let my colleague tell you more about it. I can assure you that, from a Communications Security Establishment perspective, we are a very well-recognized ally of our Five Eyes partners for our capabilities in this area.

[Wendy Hadwen]

Bill C-26, an act respecting cybersecurity, addresses exactly the 5G opportunity.

In other avenues of advanced technology, such as artificial intelligence or the advent of quantum computing, there is a significant amount of research under way within research agencies. CSE recently published, with the National Research Council, a call for proposals concerning artificial intelligence security.

[Wendy Hadwen]

Mr. Chair, Bill C-26, an act respecting cybersecurity, is currently in the Senate awaiting second-reading. This will create mandatory reporting obligations for critical infrastructure, but only for those that are federally regulated—that's four sectors.

Access to Information, Privacy and Ethics

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, I appreciate the question and especially that it is coming from a Conservative member.

He is asking us what thoughts we have in regard to legislation. I made reference in my comments to Bill C-63, the online harms act. I made reference to Bill C-26, which deals with cybersecurity. I made reference to Bill C-27, which deals with updating a framework so that we have regulations that address many aspects of the report.

The biggest barrier is not a lack of ideas or legislation. The biggest barrier is, in fact, the Conservative Party of Canada, which continues to prevent legislation from ultimately becoming law. On the one hand, the Conservatives talk about the importance of privacy for Canadians and the importance of cyber-related issues, but when it comes time to advance legislation, they are found wanting. If my colleague believes that we should have legislation, I would encourage him to allow legislation to get through.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is a pleasure to rise and speak on an issue that I know is very important to all Canadians. I wanted to make note of a couple of things before I really get under way. When we think of the Internet, I think that we need to put it into the perspective of how things have changed over time in a very significant way. I would suggest that applies more to the industry of technological changes related to the Internet and computers: it is virtually second to none, and it is something we all need to be much aware of. It is an issue our constituents are very concerned with. I think, at the end of the day, we need to recognize just how much things have changed and the importance of governments to show that not only do they understand the issue, but they also have taken tangible actions in order to address the many different concerns out there.

I will start off by saying there are a number of pieces of legislation that are all related to that technological change. If we canvass Canadians, we will find that there is a wide spectrum of ways they use the internet. There are many benefits to it, and there are many drawbacks.

The legislative agenda that we have put forward and advanced over the last number of years deals with both sides: How important it is to have a framework that enables us to protect, for example, the marketplace; and how important it is that we have laws that protect the victims of the abuse that takes place over the Internet.

I would like to cite three pieces of legislation and where they are at today. It is not necessarily because of the government's will to constantly push opposition members in trying to get through the legislation, but I believe that these are the types of legislation that a vast majority of Canadians would ultimately support. I can make reference to the issue of protection, for example. I think there have been four concurrence reports from the Conservative Party, this is either the second or third from the Bloc and I know the New Democrats have done a concurrence report. This is all during government business. Then we have had the issue of the matters of privilege. No Conservative is standing up saying, “Why are we doing these concurrence reports when we should be dealing with the privilege?” This is because the privilege is actually being used as a tool to prevent the discussion of legislation.

Why is that important to highlight right now? It is because one of the pieces of legislation we have been trying to push out of second reading is Bill C-63, the online harms act. That is a piece of legislation that ultimately protects individuals and our communities from inappropriate behaviour taking place on the Internet and creating victims. These are the types of things to which I question, what role does government have? This particular report raises a number of concerns on the impacts of AI and facial recognition. Imagine all the images on the Internet today that Canadians do not want on the Internet.

I am thinking of a breakup where one spouse is, without the consent of the ex, putting inappropriate pictures on the Internet. Bill C-63 is legislation that addresses an issue of that nature, yet it continues to be frustrated in terms of getting through the House of Commons on second reading. However, I know that a majority of members of Parliament who are sitting in the House of Commons actually support Bill C-63.

We have Bill C-26, which deals with the important issue of cybersecurity. When we think of cybersecurity, we can imagine the data banks out there collecting information and how critical that information is. We are defending and supporting Canadians, where we can, through issues related to privacy and the potential leak of data bank information.

There was a time when a data bank was paper-driven, and the shredders might have had good business at the time. I remember going into an embassy where I saw containers full of correspondence. Containers are disappearing as more and more things are becoming digital, and that applies in many different forms. In literally seconds, millions of data points can actually be lost and ultimately acquired by someone who might have malicious intent. However, we are still waiting for Bill C-26 to ultimately get that royal assent, not to mention Bill C-27.

Bill C-27 has a great deal to do with what we are talking about today. I think members need to fully understand, when we look at how important this issue is, that the last time we actually had a modernization of the acts that are in question, and I am referring to Bill C-27, was back in 2000, over 20 years ago, when iPhones did not exist. Can members imagine a time where iPhones did not exist? I can, and it really was not all that long ago.

When I was first elected, when I turned on the computer, the first thing I heard was a dial tone, a ding-dong, and then I was logged onto the Internet type of thing, and it took quite a while to get that connection. People used five-and-a-half-inch floppy disks. However, from 1995 to 2001, we really started to see an explosion of Internet advancement and technology, and it continues today.

Let us think about where the government has put its investments. It is not only toward protecting Canadians, but toward ensuring that communities have access to the Internet because of how critical it is to all of us.

We can look at one of the largest expenditures in my own province of Manitoba, which expanded broadband Internet into rural communities. It is being financed through the Canada Infrastructure Bank. Ironically, it is the same Canada Infrastructure Bank that the Conservatives say is doing nothing and has no projects. The leader of the Conservative Party has said he is going to get rid of the Infrastructure Bank. However, in Manitoba, we have seen the Internet expand through the Canada Infrastructure Bank.

The Internet is an absolutely essential service today. Back in the late eighties and going into the nineties, some might have said it was an option. Today, it is not an option. The year 2000 was the last time the act was updated. For almost a decade, Stephen Harper chose to do absolutely nothing to protect individuals' identifications from being consumed through the Internet.

This government, for a number of years, has been looking at how we can modernize the protection of Canadians through the Internet and how we can maximize the benefits of the Internet, while minimizing harms to society. Those are the types of initiatives the Government of Canada has been taking to show, in a very real and tangible way, whether with legislative or budgetary measures, that it understands the technology. We are going to continue not only to be there but also to invest in it. It is one of the reasons that Canada virtually leads the rest of the world in many areas, especially on AI and facial recognition. It is because we understand, looking forward, the role that they are going to play.

That is why it is so important to bring forward legislation and, ultimately, look across the way. In a minority situation, we need a sense of co-operation coming from all opposition parties. It does not take a majority of members to prevent things from happening in the House. All it takes is one political party. Any political entity in the House that has 13 or 14 members can cause a great deal of frustration, even though a majority inside the House might want to see actions taken. In the last federal election, a minority government was elected, but that does not take responsibility away from all political parties to take the actions necessary to support what is in the best interests of Canadians.

That is why I am standing up to speak to the report, which had a lot of work. I was not at the committee, but I can assure everyone that a great deal of effort would have been put into coming up with the report.

Having read some of the comments provided by the minister's office in response to the report, obviously the government has taken the report very seriously. If members want to get an appreciation for the content of the report, I would encourage them to take a look at it. They should also look at the response the government has provided to the report. I suspect that if they were to take a look at the response, they would find that once again, much as in the many comments I have put on the record thus far, we have a government that understands the issue and the report and has taken action, not only today but previously, to deal with the concerns being raised.

All we need to do is take a look at Bill C-27. In his response, even the minister made reference to Bill C-27. If members are genuinely concerned about the report, they should be sympathetic to at least allowing Bill C-27 to get out of committee. Why would that not happen? I can assure members, contrary to what the member across the way said, that as a government, we are constantly listening to Canadians. That is why we will find within our measures, whether they are legislative or budget measures, the thoughts and ideas of the people of Canada being reflected.

The Speaker's constituents, my constituents and all of our constituents are genuinely concerned about what is happening on the Internet today. To amplify that fact and the need for change, I quickly made reference to the year 2000, when we last had legislation. We had a big gap when absolutely nothing was done. I call that the Stephen Harper era. Then we had a government replace that era and it immediately started to work with Canadians to get a better understanding of the types of legislation and regulations that are necessary.

The best example that I can come up with, because of the explosion of iPhones out there today, is the issue of Facebook and how many people participate in Facebook. How many people own an iPad or iPhone or are on Facebook, Instagram or the many other social media, which did not exist in 2000? None of them existed. If that is the case, as I stated, I think a good question to pose is why there is resistance to supporting what Canadians want to see. Why would anyone oppose the framework legislation that we are bringing forward that would protect the interests of Canadians?

As I said, it is not like the Internet is an option nowadays. Today, it is an essential service. People will go to the Internet for a wide spectrum of reasons, whether it is streaming a favourite show from the past or something more recent, or looking at issues related to health conditions. I am always amazed at how the general knowledge of the population continues to grow on health-related issues.

That area has great potential, and it will incorporate AI and facial recognition. Non-profit and private organizations and even governments will use the Internet as a tool to deliver health care services and provide health care advice. Many people are taking that up and looking into it. That is one of the reasons that people will be living longer lives in the future. It is endless. That is—

(Bill C-26: On the Order: Government Orders)

April 19, 2024—Consideration at report stage of Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, as reported by the Standing Committee on Public Safety and National Security with amendments—Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs.

(Bill concurred in at report stage, read the third time and passed)

(Bill C-40: On the Order: Government Orders)

June 17, 2024—Third reading of Bill C-40, An Act to amend the Criminal Code, to make consequential amendments to other Acts and to repeal a regulation (miscarriage of justice reviews)—Minister of Justice.

(Bill read the third time and passed)

(Bill S-6: On the Order: Government Orders)

May 3, 2023—Resuming consideration of the motion of Ms. Fortier (President of the Treasury Board), seconded by Ms. Khera (Minister of Seniors),—That Bill S-6, An Act respecting regulatory modernization, be now read a second time and referred to the Standing Committee on Industry and Technology.

(Bill read the second time and referred to a committee)

(Bill S‑9: On the Order: Government Orders:)

December 15, 2023 — Resuming consideration of the motion of Ms. Joly (Minister of Foreign Affairs), seconded by Mr. Beech (Minister of Citizens' Services), — That Bill S‑9, An Act to amend the Chemical Weapons Convention Implementation Act be now read a second time and referred to the Standing Committee on Foreign Affairs and International Development.

(Bill read the second time, considered in committee of the whole, reported, concurred in, read the third time and passed)

(Bill S-16. On the Order: Government Orders)

June 6 2024—Second reading and reference to the Standing Committee on Indigenous and Northern Affairs of Bill S-16, An Act respecting the recognition of the Haida Nation and the Council of the Haida Nation—Minister of Crown-Indigenous Relations.

(Bill read the second time and referred to a committee)

Business of the House

[Steven MacKinnon, Liberal, Leader of the Government in the House of Commons]

Mr. Speaker, for a moment there, I thought, for once, we were going to get away without a preamble, but we had a lot of amble there, a lot of post-amble.

I can assure my hon. friend that the law that is coming this fall would protect every single Canadian who draws their income from a paycheque, and 0.13% of Canadians would pay a modest amount of additional tax on capital gains over a quarter of a million dollars garnered in a single year.

Tax fairness not only will be written into the law, but also will continue to be the thing we talk about in the House.

Tomorrow, we will complete the report stage study of Bill C-40, Miscarriage of Justice Review Commission Act, which is also known as David and Joyce Milgaard's law.

I would like to request that the ordinary hour of daily adjournment of the next sitting be 12 midnight, pursuant to order made Wednesday, February 28.

Our priorities next week will be to complete report stage and third reading of Bill C-69, the budget implementation act, and second reading of Bill C-65, the electoral participation act. We will also give priority to other important bills, namely third reading of the aforementioned Bill C-40 and report stage and third reading of Bill C-26, the critical cyber systems protection act.

Finally, there have been discussions amongst the parties and, if you seek it, I think you will find unanimous consent for the following motion:

That the motion standing on the Order Paper in the name of the Leader of the Government in the House of Commons related to the appointment of Christine Ivory as Parliamentary Librarian, pursuant to Standing Order 111.1(2), be deemed adopted.

[Caroline Xavier]

We actually do continue to follow up with the entities. We continue to call them or work with them, and I don't want to leave anybody with the impression that there aren't relationships that exist. On the contrary, we have very great relationships with critical infrastructure, especially the energy sector, the telcos and the banks, where we meet with them regularly to talk about threats and to learn from each other about the threats they're facing. There are great relationships and governance bodies that exist to be able to work through understanding.

Having said that, though, we will continue to support and offer our support, but we can't force them. This is where, as I said in my opening remarks, Bill C-26 is really important in the four critical infrastructure sectors that have been identified as part of that bill, because they're really important to Canadians in the critical infrastructure space.

[Caroline Xavier]

Okay. I apologize for the interruption.

When requested, we provide cyber-defence services and maintain an open line of communication to mitigate potential threats.

To detect malicious cyber-activity on government networks, systems and cloud infrastructure, the cyber centre uses autonomous sensors, including network-based sensors, cloud-based sensors and host-based sensors. These defences protect systems of importance from an average of 6.6 billion attempted malicious actions per day.

CSC continues to monitor Government of Canada networks and systems of importance for cyber-threats. We are working in close coordination with government partners, including relevant security agencies.

We deliver foreign intelligence-informed cyber-defence.

Finally, I would like to call members’ attention to the solutions available to them. Indeed, the Canadian Centre for Cyber Security offers parliamentarians a support service, in addition to holding regular information sessions for political parties on cyber-threats, as well as providing a dedicated point of contact at the centre for accessing cybersecurity support.

Since 2017, the CSE has established four unclassified reports on cyber-threats to Canada's democratic processes, and our “National Cyber Threat Assessment 2023-2024” highlights how online foreign influence activities have become a new normal, with adversaries seeking to influence elections and impact international discourse related to current events.

Since 2014, interdepartmentally, the CSE's cyber centre has worked closely with Elections Canada to ensure that our election systems and infrastructure remain secure. The CSE also continues to work as part of the security and intelligence threats to elections task force, SITE. Cyber-incidents such as ransomware, DDoS and supply chain compromises are becoming more frequent across all industry sectors, and these incidents are negatively impacting our prosperity, privacy and security. That's why Bill C-26 is so important. It would give the government new tools and authorities to better bolster defences, improve security across critical federally regulated industry sectors, and protect Canadians and Canada's critical infrastructure from cyber-threats.

Four sectors are subject to the mandatory cyber-incident reporting in Bill C-26: finance, energy, telecommunications and transportation. These were all prioritized due to their importance to both Canadians and other sectors. They are critical enablers. Bill C-26 will improve our ability to protect ourselves from both the threats we observe today and the threats we will face tomorrow.

The federal government intends to launch its updated national cybersecurity strategy, which will communicate Canada's long-term approach to addressing evolving threats in cyberspace. Central to the new strategy will be a shift in focus towards a whole-of-society approach to Canada's national cyber resilience, where public and private entities and all levels of government work in close partnership to defend against cyber-threats, including threats to our institutions. The government also recently announced the defence policy update, “Our North, Strong and Free”, which proposes a significant new investment in the CSE through budget 2024.

Finally, an important aspect of Canada's whole-of-society approach to our collective security includes practising good cyber hygiene, including safe social media practices, especially in those public roles. The cyber centre has released guidance on ways to protect yourself online. It also has cybersecurity resources for elections authorities, political campaigns and Canadian voters. I really encourage you to take a look at our website, getcybersafe.gc.ca. I would also encourage organizations that have been impacted by cyber-threats to contact the cyber centre, so that it can help share threat-related information with partners to help keep Canada and Canadians safe online.

Further, to make cyber-incident reporting easier for Canadians, the CSE is also working with its federal partners to establish a single-window solution for reporting cyber-incidents, with the ultimate goal being to ensure that Canadians can always find the help they need. This was a key recommendation this week from the Auditor General.

To conclude, the CSE and the cyber centre remain active in their collaboration with all partners, including the House of Commons, to improve Canada's cyber-resilience and protect our democratic institutions. We will continue to monitor any developing cyber-threats and share threat information with our partners and stakeholders, as always.

Once again, thank you for your invitation to appear before you today. We are pleased to be able to contribute to this important discussion and give you an overview of the way the Communications Security Establishment and the Canadian Centre for Cyber Security both work every day to protect Canadians and their democratic institutions.

Thank you for your attention.

[Heath MacDonald, Liberal, Malpeque, PE]

This committee just did a review of Bill C-26. During that testimony, we heard that there were about 5.2 million cyber-attacks in four months in 2023, from September to December. I think that's correct. Of those, 62% targeted critical infrastructure.

In our testimony during our last meeting, Michel Juneau stated that “86% of our national infrastructure is either owned or operated by the private sector”. It's going to become a very serious issue, or it already is a very serious issue. We may not even be aware of what's transpiring underneath. What's the best way to go about delivering that message and ensuring that there are safeguards in place within this bill?

You talked a bit about 40 items that you guys did a report on. Can you talk a bit about them, and give us a couple of examples and their relevance?

[Trevor Neiman]

Thank you for the question.

The Business Council represents approximately 170 of Canada's largest, most successful businesses, so I can't speak to the specifics of the challenges facing small and medium-sized businesses, but what I can say is that small and medium-sized businesses are very much a part of the supply chains of large businesses. Large businesses are quite concerned about the security posture of small businesses, because they can often be an indirect route to attack large businesses.

There needs to be much more done in this space in terms of government support, and Bill C-26 is one way to help in that regard. The private sector itself is also willing to step up and do more. For instance, our members are very much committed to working with their supply chains to build up their baseline resiliency, including through education, capacity building and relationship brokering, including working jointly with Canada's security and intelligence community, with agencies like CSIS, the CSE and the RCMP.

[Aaron Shull, Managing Director and General Counsel, Centre for International Governance Innovation]

Thank you very much, Mr. Chair and distinguished committee members, for the opportunity to speak today on this important bill. It's a pleasure to be here.

Indeed, maybe I'll start by saying something that you probably don't all hear very often: Thank you very much. It was a real pleasure to see this bill proceed with the pace and with all of the work you're doing.

We're independent and non-partisan, so when I say this, I genuinely mean it. I know how hard you're working. We're sitting here in the evening, and everyone's working away to get this done, so thank you very much.

It's in that spirit that I plan to make three arguments.

Number one is that activities covered by the proposed foreign influence transparency and accountability act should extend to municipalities, and we need definitional clarity around who is a public office holder.

Number two, the registry and the commissioner should be in place before the next federal election.

Number three, the act should nest within a broader national security strategy.

Now, let me tell you what I mean by those things.

First, we need to extend this to municipalities, and we need definitional clarity. Now, in Canada, the preamble of a bill is an important tool for looking at its statutory interpretation. I don't want to put everyone to sleep by talking about the tools of that interpretation, but let me just say that the preamble provides an introductory statement that sets out the guiding principles, the values and the objectives of the legislation.

The preamble for the Foreign Influence and Transparency Accountability Act says:

Whereas efforts by foreign states or powers and their proxies to influence, in a non-transparent manner, political and governmental processes at all levels of government in Canada have systemic effects throughout the country and endanger democracy, sovereignty and core Canadian values;

I pause there to dwell on “all levels of government”, and just the impact of that.

Now we have to look at how it applies. The application of the act applies to:

(a) federal political or governmental processes;

(b) provincial or territorial political or governmental processes;

And, essentially, it applies to the governmental processes of indigenous groups and governments.

Now you have to look at the definitions. You go through them, and there's a definition of “public office holder”, but it's different in the Security of Information Act.

We're not covering municipalities here, and we have two different definitions in the same bill about what a public office holder is, so we're probably going to want to take a hard look at that.

If you contrast that with the Security of Information Act, what the bill says is that:

Every person commits an indictable offence who, at the direction of...or in association with, a foreign entity...engages in surreptitious or deceptive conduct...with the intent [to influence a political or governmental process, educational governance etc., etc., with a democratic right in Canada.]

It goes on to define a public office holder differently, and so now you have two pieces of legislation wrapped up in the same bill, effectively trying to do the same thing with different definitions of what a public office holder is.

I wonder why you wouldn't have concomitant obligations for registration. It's two sides of the same coin.

In my view, the SOIA provides the legal teeth to prosecute and punish covert foreign operations, while the FITAA—I don't know if that's what we're calling it, but I'll call it the FITAA—complements this by creating a preventive transparency regime aimed at exposing and deterring such activities through mandatory disclosure and public oversight.

It's a dual approach—deterrence and, hopefully, long-term preventative transparency.

Secondly, we must have the registry in place before the next federal election. You have to again go back to the purposes of the act, like we did at the beginning—“in Canada have systemic effects throughout the country and endanger democracy, sovereignty and core Canadian values”. It's not “might” have systemic effects; the bill says “have systemic effects”. It is a statement of fact.

If you were to meet that purpose, how can you not have it in place before the next federal election? It would be a little bit like bringing a birthday cake for a Saturday afternoon party on the following Tuesday. You will have missed it.

I watched the officials testifying. If it's too hard to do it all at once, just go with the federal government, the federal election. Roll it to provinces and municipalities separately and after. However, you have to get the birthday cake to the party.

Thirdly, it should nest within a broader national security architecture. The defence policy update said we're going to do a national security strategy every four years. The defence policy is going to be updated every four years. We have Bill C-26 that went through this committee, which I was happy to testify about. We have the CSE Act that's due for an update, a review, in 2022. The CSIS Act is now on a five-year review cycle. Bill C-34, on the Investment Canada Act....

This is all coming together. I think the point here is to look at all of the pieces of legislation and all of the various strategies—critical minerals, intellectual property, innovation, research, economic security. Look at them systematically, because adversarial states are looking at them systematically, believe me, and it requires a strategic approach.

As I said at the beginning of this, I've had the privilege of speaking with some of you before. I know how hard this committee works, and I know that you can do it, but I would just encourage you to think strategically and not just do the whack-a-mole thing on one piece of law.

Thank you very much, Mr. Chair.

[The Chair, Liberal, Heath MacDonald]

Thank you, Ms. Michaud.

I have a chair's ruling that I'm going to read.

The purpose of Bill C-26 is to help protect critical cyber systems in order to support the continuity and security of vital services and vital systems. The amendment would allow any law of the province relating to cybersecurity that provides for more stringent rules than those prescribed by regulations to prevail in that province. As House of Commons Procedure and Practice, third edition, states on page 770, “An amendment to a bill that was referred to committee after second reading is out of order if it is beyond the scope and principle of the bill.”

In the opinion of the chair and for the above-mentioned reason, giving precedence to a provincial law constitutes a new concept which goes beyond the scope of the bill as adopted by the House at second reading. Therefore, I declare the amendment inadmissible.

Thank you, Ms. Michaud.

We're at CPC-50.1, reference 12922438.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

This is a similar amendment, although the wording is slightly different. That tells me where my fellow members stand, but I will move it anyways.

The amendment would add the following provision:

(2) Any law of a province relating to cybersecurity that provides for more stringent rules than those prescribed by regulations made under subsection (1) is to prevail in that province.

Quebec, for instance, has a ministry of cybersecurity and digital technology. It's reasonable to think that Quebec's rules are pretty relevant, if not more stringent, as may be the case in other provinces. If so, the amendment would ensure that the rules of the province in question overrode the federal rules set out in Bill C-26.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you very much, Mr. Chair.

This is regarding the issue of Bill C-26 and to ask whether it needs operators to immediately report a cybersecurity incident.

The reality is that we heard testimony from the Canadian Chamber of Commerce and other witnesses about a 72-hour reporting period, with “immediate” being defined as 72 hours.

It's important to note that in the U.S., the Cyber Incident Reporting for Critical Infrastructure Act also talks about a 72-hour reporting time frame.

Our witnesses said very clearly that “immediately” made it potentially difficult for them to resolve the issue and to respond to the cyber-attack, because they would be concerned about the impacts of not reporting in that immediate time frame. A 72-hour window would provide the ability to combat the cybersecurity incident and do the reporting in a very timely way.

I'd like to move what we heard from witnesses and move NDP-10 to essentially provide an amendment such that the designated operator must report the cybersecurity incident within 72 hours from the time the operator reasonably believes the incident occurred.

[The Chair, Liberal, Heath MacDonald]

I call the meeting to order.

Welcome to meeting 101 of the House of Commons Standing Committee on Public Safety and National Security.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely by using the Zoom application.

I would like to make a few comments for the benefit of the witnesses and members.

Please wait until I recognize you by name before speaking. To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from any microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings. I will remind you that all comments should be addressed through the chair.

I will also quickly remind you of an informal meeting with the Norwegian delegation at 5:30 today, for those interested.

Pursuant to the order of reference of Monday, March 27, 2023, the committee is resuming its study of Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. Today the committee resumes its clause-by-clause consideration, beginning with clause 12.

I will now welcome the officials who are with us. They are available to answer questions regarding the bill, but will not deliver any opening statements.

From the Department of Industry, we have Andre Arbour, director general, strategy and innovation policy sector; from the Department of Public Safety and Emergency Preparedness, we welcome Colin MacSween, director general, national cybersecurity directorate, and William Hartley, acting manager; and from the Communications Security Establishment, we have Stephen Bolton, director general, strategic policy, and Richard Larose, senior technical adviser.

Thank you for joining us today. With that, we will begin—

Yes, Mr. Shipley, please go ahead.

[Andre Arbour]

The Telecommunications Act, as drafted currently, has a due diligence defence that applies broadly across the course of the act. Clause 10 of Bill C-26 would insert an exception that would essentially have it so that orders under Bill C-26 would not be subject to due diligence.

Rather than add amendments to insert due diligence back in, simply removing the exception in clause 10 would ensure that the due diligence defence that already exists in the telecom act would apply writ large. Just from a drafting standpoint, it avoids an exception and then a reinsertion of new language.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

This is another key decision point, and it's what we've repeatedly heard is the best route forward to improve Bill C-26. We heard from members of the coalition, and I'll remind you that the organizations involved include the Privacy and Access Council of Canada, OpenMedia, the National Council of Canadian Muslims, the Ligue des droits et libertés, the International Civil Liberties Monitoring Group and the Canadian Civil Liberties Association. All of them have said that an important component for ensuring that the public interest is protected is a provision for special advocates.

What this would do is add, after line 13 on page 8, the following:

(a.1) the judge must appoint a person from a list established by the Minister to act as a special advocate in the proceeding after hearing representations from the applicant and the Minister and after giving particular consideration and weight to the preferences of the applicant;

It would also add, after line 28 on page 8, the following:

(c.1) on the request of the Minister, the judge may exempt the Minister from the obligation to provide the special advocate with a copy of information if the judge is satisfied that the information does not enable the applicant to be reasonably informed of the case made by the Minister;

I won't read all of the amendment. I know that my colleagues around the table have had a chance to thoroughly review NDP-9, but the reality is that special advocates are top secret, security-cleared private practice lawyers, independent of government. We've already seen special advocates protecting the interests, for example, of permanent residents or foreign nationals subject to a security clearance certificate or other proceedings under the Immigration and Refugee Protection Act.

Currently, there is a list of special advocates who are cleared to defend individuals in matters like this, with the Immigration and Refugee Protection Act. There are apparently 10 special advocates available.

This is clear testimony we heard from numerous witnesses among the coalition members I mentioned. They are some of Canada's most reputable groups, and there is no doubt that having in place a special advocate would improve the legislation, so I want to move NDP-9.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I'll just follow up on that.

I know there are often exceptions for national security and whatnot. How can Canadians trust that, when an exception is laid out in Bill C-26...? This is larger than the conversation about this current proposed section. The minister is given discretion quite often to ensure they can use information if it's related to national security, etc. How can Canadians trust that the right balance is struck? This is a bigger conversation, but I think it will help speed up some of the forthcoming amendments.

Could you outline the processes in place to ensure that privacy is in fact protected and that, when an exemption is laid out in legislation, it's not opening it up for abuse?

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thanks very much, Chair.

My other committee is the access to information, privacy and ethics committee. While it notably prosecutes Liberal scandals, it also does a lot with privacy.

I would ask the officials if they could weigh in. I appreciate Ms. O'Connell's statement about it not being necessary, but I would ask if the officials could weigh in on the specific application of the privacy-related sphere in this and whether the amendments would make a notable difference compared to what is currently listed in the act versus what is in Bill C-26, as well as its applications of the myriad privacy rules that overlap here.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

The Conservatives did agree to go through Bill C-26 without filibustering. I hope Mr. Kurek now has a copy of that memo because we really need to get through this bill.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Thank you, Chair.

G-3.2 is similar to G-1.2. We are concerned about being too prescriptive and limiting the ability to consult with required people as to threats. Obviously, when we look at administrative law, there's a zone of expertise that we allow the agencies to have.

I move to amend Bill C-26, in clause 2, by replacing line 28 on page 2 with the following, which is referring, I assume, to the Minister of Emergency Preparedness:

Emergency Preparedness and with the persons the Minister considers appropriate,

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Thank you, Chair.

This is coordinating with G-1.1, which the committee agreed to. We're saying that Bill C-26, in clause 2, should be amended by replacing lines 25 and 26 on page 2 with the following:

tem against any threat, including that of interference, manipulation, disruption or degradation, the Minister may, by order and af-

Thank you.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

I apologize to my Conservative colleagues in advance for CPC-4 not being able to be moved if we adopt NDP-3.

We had a persistent theme in testimony before the committee that we need to ensure transparency around Bill C-26. What NDP-3 would accomplish is ensuring that orders are published “in the Canada Gazette within 90 days after the day on which it is made”. This has been suggested by coalition members who appeared before the committee, and it would ensure more transparency in the bill.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

I move the amendment, Mr. Chair.

As we know, Bill C‑26 enables the government to issue confidential orders applicable to telecommunications service providers. While confidentiality can certainly be justified in certain situations, it shouldn't be the default rule. A number of civil liberties organizations have told us as much.

These organizations recommend a mandatory Federal Court order as a check and balance against government overreach. This could be an effective way to ensure that the government isn't hiding disproportionately intrusive actions. It adds some checks and balances to the legislation.

I'll read amendment BQ‑2, which proposes an amendment by replacement:

(2) On application by the Minister, the Federal Court may, by order, prohibit any person from disclosing some or all of the order's contents if it is satisfied that there are reasonable grounds to believe that such disclosure could be injurious to international relations, national defence or national security or endanger the safety of any person.

I'm wondering about part of line 3 of the amendment. The wording is “disclosing some or all of the order's contents.” That sounds funny to me. Again, I think that the legislative clerks are the experts on how to write this. If it sounds good in the legislative language, so much the better. I just wanted to make sure.

I have a question for the officials before we move on with the discussion.

I want to make sure that adopting this amendment wouldn't add lengthy delays to the process. Would it?

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Thank you, Chair.

This is related to NDP-1 but has alternative language in G-1.2. We're moving that Bill C-26, in clause 2, be amended by replacing line 17 on page 1 with the following:

cil may, by order and after consultation with the persons the Governor in Council considers appropriate,

That's the amending language. Again, this is alternative language to NDP-1.

(Amendment agreed to)

[The Chair, Liberal, Heath MacDonald]

I actually thought you were talking about interpretation for a different language. It's okay. They speak English very well.

All right. Now we have our study on Bill C-26.

Pursuant to the order of reference of Monday, March 27, 2023, the committee resumes its study of Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts. Today, the committee commences clause-by-clause consideration.

I will now welcome the officials who are with us. They are available for questions regarding the bill but will not deliver any opening statements. From the Department of Industry, we have Andre Arbour, director general, strategy and innovation policy sector, and Wen Kwan, senior director, spectrum and telecommunications sector. From the Department of Public Safety and Emergency Preparedness, we have Colin MacSween, director general, national cyber security directorate, and Kelly-Anne Gibson, acting director, national cyber security directorate.

Thank you for joining us today.

We're going to move right into clause-by-clause.

The chair calls clause 1. Shall clause 1 carry?

Mr. Lloyd.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

I was saying that I signed the request made under Standing Order 106(4) allowing us to hold today's emergency meeting for the sole purpose of dealing with the specific issue of Luka Magnotta's prison transfer. The purpose wasn't to re-examine Paul Bernardo's case. We've already met a number of times on that. I more or less agree with what Mr. Julian said. This study shouldn't be a continuation of the one we've already done, in my view.

In this case, I think it's really about setting the record straight and reassuring the public. In the past few days, a lot has been said about this transfer, which took place in 2022, by the way. It didn't just happen. Luka Magnotta was transferred from a maximum-security facility to a medium-security facility a few years ago now.

As I see it, the motion is more about the process, which—may I remind the committee—is apolitical. The Correctional Service of Canada has a protocol in place for the transfer and security classification of inmates. As per the statement that came out earlier in the week, Canada's corrections system is fundamentally based on rehabilitating offenders, even if they remain incarcerated for the rest of their lives. That is the legislative mandate of the Correctional Service, which says that it regularly balances factors such as risks to public safety; safe, secure and humane treatment; and victims' rights.

The Correctional Service of Canada's policy dictates that a security classification review be completed at least every two years for inmates classified at maximum or medium-security level and that they be placed at an institution with the corresponding level of security.

Understandably, then, a whole protocol is already in place, and that's what the Correctional Service officials told us when they appeared before the committee with respect to Paul Bernardo's case. I think it's important to have the officials back so they can explain it to us again.

We also need to hear from the warden of the La Macaza Institution, so she can explain how it operates. Is it true that inmates there live more comfortably than most Canadians? Is it true that they can take part in tennis, skating and other such activities? What conditions do inmates there live in? I think we need to hear that directly from someone at the La Macaza Institution.

I don't want to make this into a big to-do. I don't see the need to hold six meetings and hear from multiple witnesses on this specific issue.

There is, however, something that bothers me about Luka Magnotta's transfer. In the past, he had asked more than once to be transferred, but his requests had always been denied. Apparently, his last request was granted because he said he was transgender. He was assessed by a team of psychologists at McGill University, and they were skeptical of his claims, but that seems to be the reason why he was granted a transfer to a medium-security facility. If we should be questioning anything about Luka Magnotta's transfer, that may be it.

As parliamentarians, we can't start meddling in the transfer of every inmate in Canada. We cannot do that, and it's not our job.

This is probably a good opportunity to have Correctional Service of Canada officials explain to us again the protocol and legislation they have to follow when assessing and transferring offenders.

For those reasons, I have a number of changes I'd like to propose to the motion. I will read the motion and flag the parts I would amend.

The beginning would stay the same, in other words, “That, in light of the transfer of sadistic killer Luka Magnotta out of a maximum security prison to a medium-security prison”. I would then remove everything up to “the committee”.

I would delete the word “immediately” before “undertake”. I would replace “study in priority order, of no less than six meetings” with “study of one meeting”. Then I would delete “, and that these meetings begin this week,” but I would keep the part that says, “on how the decision to make this transfer was made, the prisoner transfer process for prisoners in maximum-security facilities, and the committee report its findings to the House”.

The part that says that the committee “call the following witnesses to appear” would stay, as would bullet (a), “the Commissioner of Correctional Service Canada, Anne Kelly”. It's important for the committee to hear what she has to say. Bullets (b), (c), (d), (e) and (f) would come out, but I would keep bullet (g)—“the Warden of La Macaza Institution”—and bullet (h)—“representatives from the Union of Canadian Correctional Officers”. Bullet (i) would come out, as would the parts added further to Ms. O'Connell's amendment. Lastly, I would add a representative from the McGill medical team that examined Luka Magnotta's case to the list of witnesses to be called.

I hope my fellow members will agree with me that this isn't the time to play politics. That seems to be what some parties are trying to do, and it's wrong.

I think the way to better understand the process and reassure the public is to figure out whether Luka Magnotta's psychological or psychiatric evaluation was flawed and why he was transferred. We could certainly question his medical team about it, and we could get answers about the transfer process from the Correctional Service of Canada officials, but that's all. We cannot start challenging every prison transfer of every federal inmate. Otherwise, it will never end. As I already said, that is not our job as parliamentarians. We are talking about an apolitical process. Turning it into a political issue is wrong.

As I said, I think we should get rid of the part about the committee holding six meetings on the matter. One meeting is enough, in my view. Furthermore, this study shouldn't take priority over our other work. We are in the midst of examining Bill C-26, and we should finish that study before we meet on this issue. The same goes for our car theft study. It should take precedence over this one.

I repeat, Luka Magnotta was transferred in 2022. If Mr. Caputo hadn't visited the La Macaza Institution, we wouldn't be here today. I, myself, visited the Port-Cartier penitentiary two years ago, but I didn't make a big fuss about the individuals I saw there.

Again, the process has to remain apolitical.

I hope that my fellow members will agree with me that we need to narrow the scope of the motion to address the core issue—Luka Magnotta's transfer.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you very much, Mr. Chair.

Of course, my thoughts are with the victims today as well.

I support the discussion we're having. I appreciate that we've added additional witnesses. I think that is very important. Certainly, thinking of the victims today and the fact that we started this study last fall, my concern is that we have yet to report.... If the objective of our committee is to put in place recommendations that we oblige the government to follow to ensure that the concerns raised about victims and victims families, about the notification process around transfers and about how transfers are effectuated.... There are also the broad concerns that have been raised in the testimony we've heard so far in this study about correctional officers being consulted. They are the ones who know best the offenders who are in the institutions. We've heard from correctional officers that they haven't been consulted.

For all those reasons, it is important to continue this study. I would like the motion to reflect that we are continuing a study that we began last November and that what we're really doing is adding an additional six meetings for a total of no less than 11 meetings on this issue. As my Conservative colleagues have indicated, they see no distinction between the study we started last fall and the proposal to extend or continue that study we're hearing today.

I believe that we as a committee have made the decision to move ahead on clause-by-clause on Bill C-26. Cybersecurity is an issue that is of fundamental importance. I believe we can potentially wrap up the clause-by-clause study of this bill, which has been stuck out in no man's land now for two years. The reality is that we need to complete our work on that. I'm assuming that's the intent as well. We could potentially start the study this week. We would sit on clause-by-clause for cybersecurity, complete our work on that bill, which has been delayed for far too long and is far too critical for Canada's infrastructure, and then come back to this study. I have no objections to that. I believe the additional names Ms. O'Connell offered are valuable.

I have a further concern that's not reflected in the motion. I believe we need to clarify in the motion the fact that we're continuing this study. My further concern is the number of escapes we saw in previous years. I'm talking about the previous government, the Harper government. The number of escapes from federal institutions was at its highest level. In fact, the three worst years for prison escapes in recent memory were under the Harper government.

At the same time, we saw proposals to cut—to slash—funding to correctional services by $290 million. That was proposed by the Conservatives in December. That's a total of $290 million out of the overall Correctional Service Canada budget. I think that is a matter of some concern too. We've seen a higher level of escapes. If we're talking about public safety, it's important to keep in context that slashing the budget, as proposed and voted on in December, is not something that helps to reassure Canadians or to ensure public safety. That's an element that I think needs to be considered as part of continuing our study.

Overall, with those adjustments or changes, I think the most important element is that we proceed to hearing from witnesses, take a break around cybersecurity so we can complete the work that has been delayed for far too long and then come back and complete the study. Most importantly, I hope that we issue a report in the House of Commons that ensures victims are taken into consideration before transfers are put into place and ensures correctional officers are consulted in a meaningful way before transfers take place.

We can't defend at all the horrible, horrific, sadistic acts of Paul Bernardo and Luka Magnotta. The important thing is that the public have confidence in the correctional service and our prison system and see that they are working on their behalf. It is crucial that we get to a report and to recommendations, table them in the House, have a debate in the House of Commons and ensure that the government is being pressured to put into place the recommendations we are making.

In general, I support the motion. I think there is some tweaking required to ensure that people are aware that this is a continuation of a study we started last November. However, above all, I believe that we need to complete this study, make the recommendations and ensure that they are respected and put into place so that the concerns raised over the last few months are finally met with the response of the public safety committee.

Thank you.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thanks, Chair.

I'm glad we have this motion. From our perspective, we have no issue with looking further into transfers of prisoners and classifications and working with this committee to put forward reasonable, worthwhile recommendations on how we can advance victims' rights in this country and improve the system. However, I think what we learned from the last few days of the study we did on this...because it's important to note that this isn't new. This isn't something the Conservatives are bringing forward today. We, as a committee, have already held several meetings on this and heard testimony, and this would be a continuation of that.

I hope that today is not just Conservatives performing for clips and that this committee is actually serious about working together to put forward serious, legitimate policy recommendations on how we can move things forward. That's exactly what we want to do and what we did as a committee when we all came prepared to ask questions of CSC and the witnesses we had before on this very issue. Again, there's no issue. We've participated and asked tough questions, as I think all Canadians want us to.

I think it's important that we look into this. It was stated by the earlier speaker that this was somehow related to Liberal legislation or a change, and that's simply not true. In fact, some of the years with the highest number of prisoner classification changes from maximum to medium were under Harper Conservative governments. In 2012-13, there were 291 reclassifications from maximum to medium. In 2013-14, there were 319 from maximum to medium.

If there's a question of how this is happening and what policies are in place for the Correctional Service of Canada, I think that's a fulsome conversation we need to have, but putting it out there that this was somehow a change in legislation or policy is, frankly, just not accurate. It's important that Canadians understand that there are certain politicians trying to use the most heinous and horrendous crimes in this country as a fearmongering tactic to suggest that current policies are somehow different from when Conservatives have held office. I think it's important that we get this data on the table so that Canadians can see exactly how decisions are made.

If this committee wants to make recommendations to the government to make changes or to review policy, I think that's absolutely appropriate, but if there's a suggestion.... If we're starting off with a base of misinformation that there was a policy change, I've just outlined that the highest number of maximum to medium reclassifications in the Canadian justice system happened in 2013-14 under the Conservatives' so-called tough-on-crime language.

It's important that we get the facts. That's why we're very happy to continue to hold meetings on this, to make legitimate fulsome policy recommendations based on what we hear and to ensure Canadians' voices are at the table. However, as I said, I think it's incredibly important that we start from a place of truth and honesty. I hope the continuation of this meeting does that, because I think we have a number of policy insights and things that every member of this committee would want to share.

I'll just raise a couple of points about the motion as drafted. I want to hear from colleagues, so please add me to the list again, because I'd like to hear other opinions.

As for doing the study immediately and in six meetings, my issue is not with studying this but with whether or not we need six meetings. We're open to the idea, but based on the witnesses listed in this motion, that wouldn't equate to six meetings. I think the Conservatives are maybe being a little disingenuous in terms of what this motion says and what they hope to accomplish, but we can debate the numbers in terms of what's needed and whether it's immediate.

Based on this, the Conservatives are abandoning the auto theft study. They also don't want to complete Bill C-26, which, as we heard from witnesses, would actually have direct impacts on Canadians' safety, for example, during a weather event when phone lines could go down and there wouldn't be protections in place to ensure that telecommunication companies or banks would have robust procedures to avoid cyber-attacks. I guess Conservatives don't care about those impacts.

This committee can determine the timing, but we had determined the sequence of meetings. Auto theft would being abandoned. Cybersecurity would being abandoned. The other studies we were looking at would be as well, given timing. I assume the minister's visit on the mandate, which was scheduled for next week, would also be abandoned if this motion passed as is.

I have concerns with some of that given the other committee priorities we've talked about, but, as I said, I'm prepared to listen to other opinions about priority and sequencing. We're not opposed to this study.

Mr. Chair, I'm going to move one amendment for now, and that is to add the following witnesses: Howard Sapers, the former correctional investigator for Canada; the John Howard Society of Canada; the Canadian Association of Elizabeth Fry Societies; Aboriginal Legal Services; the Black Legal Action Centre and the Canadian Civil Liberties Association. I'll give those names to the clerk.

I may have other amendments later, Mr. Chair, given my concerns about sequencing and the number of meetings. We're more than happy to move forward with this study, but I want to take into account other people's comments before making any additional amendments. I think it's important that we add some additional witnesses.

Thank you, Mr. Chair.

[The Chair, Liberal, Heath MacDonald]

Thank you.

Okay. So leave that with the chair, please.

For Bill C-26, on Monday the clerk distributed the draft budget in the amount of $14,500.

Are there any questions or comments?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you, Chair.

Just so we're clear, amendments are due on February 26. For February 26 and 29, the recommendation is to have the auto theft study. That is what the majority of the opposition side has come up with. Then on Monday, March 18 we would begin clause-by-clause of Bill C-26 with the idea that on that particular day, Monday the 18th if possible, we would extend those hours for a reasonable time depending on resources. I think that would be very reasonable, to begin Bill C-26 on that date.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

I think there's kind of an understanding, at least among the majority of the committee, that we want to do two auto theft days next week and then we would start using extended hours in March on Bill C-26. That's my understanding.

I just don't want to get surprised when the notice comes out, Mr. Chair, and we have a huge extended February meeting coming out of nowhere when it's not very clear that the committee has agreed to that.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Chair, I'm sorry, but just to sort of recap, it's a riding week next week. The first week back both meetings would be on auto theft, and then when we returned after that we would do extended sittings for Bill C-26. Is that what I'm hearing, Mr. Julian?

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you.

I would like us to recap our discussion on dates.

I don't think that it's a bad idea to extend meeting hours. That said, sitting until midnight seems a bit like a closure procedure.

I agree that we could do more over four or five hours, such as Monday evening from 4:30 p.m. to 8:30 p.m. or 9:30 p.m. I don't see any issue with that.

Mr. Chair, please confirm that we can set the date for submitting amendments for February 26, and that the February 26 meeting will focus on car theft.

At the meeting on Thursday, February 29, we would begin the study of Bill C‑26. By then, the clerk would have already sent us the amendments proposed by the other parties, because we need to take time to study these amendments.

Since it will be on Thursday morning, we can't really extend the meeting. That brings us two weeks later, to Monday, March 18. I imagine that this meeting would be extended a bit. On Thursday, we would meet with Mr. LeBlanc.

We would continue the study of Bill C‑26 on April 8.

Is that right, Mr. Chair?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

What I find rather interesting is that this has been on the books since June 2022, so we're 20 months into this, and now we want to rush through a process that we have heard many witnesses.... We also have significant recommendations to make in clause-by-clause to go through and fix this, and it's the responsibility of this committee to do that.

I don't know why there is the rush of an extra day or week or two to go through this. I don't support the extra length of meetings. We have other responsibilities as well, so I definitely don't support the need to sit extra.

I think we should get at the study on auto. When we're done with our recommendations and have them submitted, then we can go back and work on the clause-by-clause of Bill C-26. That, for sure, is going to take a lot longer than a couple of meetings of extended time.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

I agree with my colleagues.

We could start our study on car theft in a week and a half. By next Tuesday, we could submit the list of witnesses for Ms. Michaud's proposed study on car theft. We could set the deadline for submitting amendments for the following week.

I would like to suggest something for the following week. In the next seven weeks, there are just two sitting weeks. If we conduct our study on car theft next week, I suggest that the committee hold longer meetings to discuss the proposed amendments to Bill C‑26.

Honestly, I find it difficult to discuss amendments for two hours and then to continue our discussion three days later. The amendments are often connected. I think that it would be more useful to hold a meeting from 3.30 p.m. to midnight, for example. If we did that, we could finish studying the bill that week. I'm talking about the second sitting week in March.

I propose that we hold longer meetings, extend the deadline for submitting amendments and start our study on car theft the week after next.

[The Chair, Liberal, Heath MacDonald]

Thank you.

Before we go any further, we have some administrative housekeeping that the clerk would like to get some answers on.

We talked about this at our last meeting. If the committee wishes to start clause-by-clause consideration of Bill C-26, on Monday, February 26, I recommend to establish the deadline for submitting amendments as Wednesday, February 21, at noon.

I know there was some conversation surrounding this, so I'll ask if that's still good.

Mr. Shipley.

[Mark Schaan]

I'm happy to.

Thank you for the question.

I think it's important to note that the telecommunications security objective, as the minister outlined, actually allows for a broad reach of application, in the sense that security is fundamental to a number of contexts. While we often think about that as related to cyber, in this particular zone I think we need to think about security in things like whether you can securely access the telecommunications system in the event of natural disasters, which are increasingly common.

The industry minister has order-making powers under Bill C-26, for instance, to allow for a telecommunication service provider to develop a security plan in relation to its services, networks or facilities and—

[Mark Schaan, Senior Assistant Deputy Minister, Strategy and Innovation Policy Sector, Department of Industry]

Mr. Chair, I want to thank the member for the question.

With regard to the collection of personal information, as noted in Bill C-26, the minister has order-making powers that will allow him to be able to issue orders to protect the security of the telecommunications system.

There are two things that I think are really important to note. The actions and orders related to the minister's order-making power have to be connected to that security objective and ring-fenced in that regard. Similarly, there's a proportionality test that applies as a function of administrative law to the orders that the minister is making.

Two things that I think are really important to note as well are, one, that the Privacy Act continues to apply, both to the Minister of Industry and to the minister's officials through the department; and, two, that the Personal Information and Protection of Electronic Documents Act, PIPEDA, continues to apply to the telecommunications providers for whom order-making would be done.

There are privacy protections in place on both entities, both on the government side and on the private sector side, and there are limitations to the order-making capacities of the minister.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

The Auditor General's report on the ArriveCAN application speaks specifically about this bad practice for handling confidential information.

This is something we need to learn from.

On Bill C-26 we've had testimony from The Citizen Lab at the University of Toronto. One of the recommendations was that relief should be available if the government mishandles confidential, personal or de-identified information, and that the legislation should be amended to enable individuals and telecommunications providers to seek relief if the government has mishandled that information.

I'll direct this question to Minister LeBlanc.

Do you believe that it's appropriate that we incorporate into that legislation lessons learned from ArriveCAN?

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

The issues that often came up during the consultations held here in the committee obviously concerned transparency and privacy.

Some colleagues have already addressed these issues. According to the Office of the Privacy Commissioner of Canada, it might be a good idea for the government to consult the office before making any decisions on Bill C‑26. Perhaps this would reassure Quebeckers and Canadians.

Obviously, Bill C‑26 currently doesn't set out a time frame from when the government accesses personal information held by companies, for example, to when it deletes this information under the bill. We also know that there are many data leaks, and that the government isn't necessarily immune to these leaks either.

How can we strike a balance between the right to privacy and the highly confidential power grabs and orders?

Where does the balance lie in all this? How can you reassure Quebeckers, Canadians and SMEs?

[Dominic LeBlanc, Liberal, Beauséjour, NB]

That's very much at the heart of the exercise that I think all of us are trying to achieve in Bill C-26.

Our federation gives our partners in provinces and territories jurisdiction over things as important as health care systems and highway infrastructure. We're all thinking of examples where these particular critical infrastructure sectors can be subject to these cyber-attacks. I've spoken to mayors of cities. Saint John, New Brunswick, it was reported—a small Canadian city—was subject to a pretty concerning cyber-attack.

The only way we're able to do that work is in partnership with provinces and territories and, of course, they are responsible in the case of municipalities as well. We would be wide open to signing agreements with provinces and territories. We think Bill C-26, if it's adopted and receives royal assent, can be a model for some other provincial legislation that should be companion pieces to this federal legislation.

As colleagues would want, we're always looking to respect provincial jurisdiction.

This is certainly a priority for us. However, we won't shy away from being a partner and a leader or from sharing information, as long as it's safe to do so. We'll be signing agreements with the provinces specifically to enable us to share information.

That said, we acknowledge that urgent situations arise in areas of provincial jurisdiction. That's why I gave the example of Newfoundland and Labrador. At the time, the premier of Newfoundland and Labrador told us that the province was completely overwhelmed in terms of resources. He asked the Government of Canada to step in. Of course, we did everything possible at the time to help them resolve the situation.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you.

My follow-up question is to Minister Champagne.

ISED has given GC Strategies 25 contracts. Were any of these contracts related to cybersecurity or to provisions in Bill C-26?

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Mr. Chair.

Minister LeBlanc, Bill C-26 deals with cybersecurity. We know that the government's in-house IT capabilities are limited, and they are often dependent on contractors and consultants. We learned yesterday that GC Strategies has received $258 million from your government in contracts.

Has this two-person IT company working out of their houses received any contracts from your department related to cybersecurity and measures in this bill?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you for that.

Other testimony we heard from Electricity Canada—and Madame Michaud noted that just a few minutes ago—was the fact that there are different regulations around NERC, the North American co-operative of energy, and what would be required in terms of Bill C-26. The recommendations from Electricity Canada were to ensure there wasn't a doubling up of regulations or requirements.

To what extent did the government consult with industry groups, such as NERC, over the course of the production of the bill? Is the government open to having more harmony between regulations that are already put in place by the industry groups and the provisions of Bill C-26?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you very much, Mr. Chair.

The coalition of national groups, including the Canadian Civil Liberties Association, la Ligue des droits et libertés, and the Privacy and Access Council of Canada, have been critical of the bill, but have also proposed some concrete solutions.

One of those, given the fact it is clear in their understanding that Bill C-26 would restrict the applicant's access to evidence, is to create a special advocate to enable evidence to be tested in a court of law without being disclosed to outside parties. This recommendation, of course, borrows from the Immigration and Refugee Protection Act.

I have two questions for you, Mr. LeBlanc, on their suggestion around a special advocate. First, why didn't the government consider creating that special advocate in the legislation initially? Second, does the government now support the idea of improving this legislation, which has some major weaknesses, by the creation of a special advocacy?

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Ministers, I'll be honest with you. I think you already know this. When studying a bill, the Bloc Québécois likes to make sure that the jurisdictions of the provinces and Quebec are respected.

There's a concern about Bill C‑26. Electricity Canada officials told the committee about this concern. Bill C‑26 includes interprovincial and international power line networks in its list of critical systems. We can read between the lines that an organization such as Hydro‑Québec could be affected by this bill. Correct me if I'm wrong.

The Electricity Canada officials said that they would like to see the bill amended to avoid duplication, overlap or redundancy with the jurisdictions of the provincial agencies already involved.

For example, Hydro‑Québec, the pride of Quebeckers, could receive a financial penalty of up to $15 million for failing, for any reason, to comply with certain ministerial orders.

Is that right?

What does Bill C‑26 mean for Hydro‑Québec, for example?

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you, Chair.

Thank you, ministers, for being here.

We heard a lot about privacy and privacy concerns, and we heard that from witnesses, certainly. I think my colleague across the way misquoted the Privacy Commissioner, but there was a conscious effort in this legislation to provide foundational legislation here, in Bill C-26, and then a conscious effort to deal with some of the specifics through regulations. What the Privacy Commissioner spoke about was wanting to be involved in the development of those regulations to specifically address concerns of privacy, details around SMEs and indigenous communities that may need specific help and foundational work to actually implement the goals of this objective. Can you speak to how regulations and the work with the Privacy Commissioner would be engaged to deal with privacy concerns?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you very much.

Mr. LeBlanc, one of your other portfolios is foreign interference in our election process. We've been talking about the Communications Security Establishment. They flagged late last year that Russia's, China's— and I think we can add to that allegations of India's—cyber-threat activity includes “attempts to conduct...attacks against election authority websites, accessing voter personal information or information relating to the election, and vulnerability scanning on online election systems.”

We've seen foreign interference have a dramatic impact in the United States in the election of Donald Trump and in the United Kingdom in the Brexit referendum. In what way would Bill C-26 reinforce our election system, our democracy, to protect against those cyber-attacks that have had such a marked influence in other democracies?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, but that actually wasn't my question. I certainly understand how Bill C-26 attempts to correct that problem. What I'm asking is what the figures are now? Do you have figures you can share with us, even if they've been reported on a voluntary basis, that indicate the extent and scope of cyber-attacks in Canada?

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Thank you, Ministers, for being with us this morning.

First, I want to talk to you about an article published in La Presse entitled “Quand Ottawa veut jouer au gérant d’estrade”. The article appeared in 2022, shortly after you tabled Bill C‑26. The bill was tabled some time ago—over eighteen months. One wonders if cyber security is indeed a priority for the Canadian government.

The article was written by Ms. Célia Pinto Moreira, a public policy analyst at the Montreal Economic Institute.

She begins her article as follows: “Imagine a referee at a Habs game approaching a player to explain how to shoot the puck into the net. He’d likely lose his job: it’s neither among his duties nor his field of expertise.”

She goes on to say that this is what Ottawa is doing with Bill C‑26. She says, “Instead of minding its own business, the federal government wants to interfere in the implementation of companies’ digital security plans.”

She adds, “In digital security, things move at breakneck speed. When a company discovers a flaw in its system, it knows full well that it has every incentive to fix it quickly; otherwise it exposes itself to significant legal, reputational and financial risks […]”

She goes on to say that the federal government is slow or inefficient, citing the passport saga.

We remember that saga. It’s been a while. Other examples include Phoenix, Canada Life, the border. I think the government has been slow and inefficient in those situations.

All in all, it seems likely that Canadian companies are currently well prepared. They already have to deal with cyber security incidents. It’s said that in 2021, Canadian companies invested over $10 billion to prepare for this type of breach. So they’re already doing the work.

In practical terms, what will Bill C‑26 change for Canadian companies?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you very much, Minister.

Mr. Leblanc, the same question is for you.

I'm glad that you mentioned our Five Eyes partners. With the interconnectedness of our economy growing day by day, how important is it for Canada to do our part to advance our cybersecurity protection efforts, specifically with relation to Bill C-26?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you very much, Mr. Chair.

I’d like to thank the witnesses for being here today.

Mr. Champagne, drawing on your experience, having worked with our economic partners around the world, including the U.S. and Europe, can you walk the Committee through the importance of passing C‑26 to protect not just our own businesses, but the businesses we work with every day under free trade?

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you.

We heard almost unanimously that this is an important bill, but this is also a poorly drafted bill. Business groups, civil liberties groups and cybersecurity firms are all united in the fact that Bill C-26 gives the government too much power with almost zero oversight. There's no requirement for regular reporting, no independent review and no requirements for production of written reports. In fact, most of the powers in this bill would be exercised in secret.

Do you think that the sweeping powers that you're attempting to give yourself have enough oversight mechanisms attached to them?

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you, Chair.

Thank you to the ministers and the officials for being here this morning.

We are definitely talking about a very serious issue here with cybersecurity and Bill C-26.

Minister LeBlanc, Public Safety Canada recognizes 10 critical infrastructure sectors, one of which is government. A recent NSICOP report noted that several departments and Crown corporations are not subject to Treasury Board policies related to cyber-defence or they apply those cyber-defence policies to their departments inconsistently. This leaves them vulnerable to cyber-attacks. In fact, just recently it was revealed that Global Affairs Canada was suffering from a massive data security breach.

Minister LeBlanc, why is your own government not adhering to the same cybersecurity standards as the designated operators listed in this bill whose confidential business and personal information you're planning to collect and store?

[François-Philippe Champagne, Liberal, Minister of Innovation]

Thank you, Mr. Chair.

It is a great privilege to appear before you today. It’s been over eight years since I had the privilege of becoming a Member of Parliament and testifying before committees. This morning is particularly important, especially as I have the privilege of testifying with Minister LeBlanc. For the people watching us, Canadians from across the country, it demonstrates the significance of the issue.

We should first ask ourselves why we are here this morning. Minister LeBlanc outlined the reasons. People should be reassured to see Minister LeBlanc, and his department, working in concert with the Department of Industry on an issue that affects not only all Canadians, but Canadian businesses across the country.

The issue of cyber security affects our small and medium-sized enterprises, or SMEs, families, all institutions across the country and even internationally. I can tell you that in the various international forums I’ve attended, the issue of cybersecurity is of paramount importance, especially when you add in everything to do with quantum technologies and artificial intelligence. That’s why I’m proud to testify today with Minister LeBlanc, a great friend who also sees the importance of our two teams working hand in hand to accomplish this today.

As I was saying, I’m pleased to be able to discuss a legislative text of paramount importance with you, dear colleagues. People across the country expect us to respond quickly to a situation that is evolving just as quickly.

One of the most important things we can do as legislators is to protect our critical infrastructure across the country.

As Minister of Innovation, Science and Industry, I take a particular interest in securing Canada's telecommunications system. Telecommunications networks are vital to the safety, prosperity and well-being of Canadians. When you've seen disasters striking around the nation, citizens expect their telecom networks to work. That's why adding, as we would be doing in this law, the concept of security as an objective under the Telecommunications Act is so crucial. It's not only about cybersecurity, but it's about protecting Canadians in the times they need it most. That's why we are committed to protecting the telecommunications system that underpins much of our critical infrastructure in the country.

Take the emergence of new technologies, such as 5G, as one clear reason we need to redouble that focus. As you know, 5G is going to have a network that is far more decentralized. You're talking about the Internet of things, you're talking about connecting almost everything. The object will become intelligent and connected. If you think about the impact of cybersecurity you'll understand the size of the problem, and not only the emergency powers we need but also the duty to act we all have as parliamentarians.

The threats targeting these technologies and systems are increasing in number. I’m talking, among other things, about threats to our supply chains and cyber security threats from state and non-state actors, of course.

With these threats in mind, the government undertook a thorough review of 5G technology. In fact, I’d like to thank all the Ministry of Industry officials and the Ministry of Public Safety and Emergency Preparedness officials who are here today. They carried out extensive consultations with stakeholders across the country.

We carefully examined the issue from a technical and economic standpoint, as my colleague Minister LeBlanc said, as well as from a national security standpoint.

It is clear that while this technology will bring significant benefits, it will also introduce new security concerns that malicious actors could exploit, as 5G networks are more interconnected than ever. Therefore, threats will have a more significant impact on the safety and security of Canadians, including our critical infrastructures, than in previous network generations.

It is in light of this security examination that the Government of Canada found serious concerns about suppliers such as Huawei and ZTE. You will recall that in May 2022 we announced the intention to prohibit Canadian telecommunications service providers from using Huawei and ZTE products and services in their 5G and 4G networks.

Our statement specified that the proposed measures would be subject to consultation.

However, the risks associated with telecommunications go far beyond cybersecurity, as I was saying. We took action in May 2022, when we made this announcement.

Canadians watching will remember the famous Rogers outage in the summer of 2022, which probably impacted 12 million Canadians for a number of hours. With the after-effects of Hurricane Lee in Atlantic Canada in September 2023, my colleague, Minister LeBlanc, was really involved in restoring the services that people need.

I want colleagues to understand that this is not just about national security, but the role of the industry minister is to ensure resiliency. If you think about hurricanes, if you think about the network outage we had, in the case of Rogers we were successful in getting a voluntary undertaking in the memorandum we signed with them in September, but I think Canadians will be reassured that the minister would have legislative power to compel companies to do what's right.

We know that these risks are not something the market can solve on its own, that's why we need rules for industry, rules that protect Canadians, our networks, our businesses and our data.

Bill C‑26, which we are discussing today, is designed to address those risks and evolving threats. It will enable the government to act quickly, if necessary, to ensure network security.

In my opinion, the powers granted to the Minister of Industry would enable him to act quickly. In an emergency, temporary measures must be adopted, but it must be done quickly to prevent bigger problems across the entire network.

The second part of Bill C‑26 will also strengthen the protection of our critical cyber systems. I believe Minister LeBlanc was heavily involved in that portion.

Our telecommunication network is probably the backbone of infrastructure. I know people at home may think of infrastructure as bridges that we need to protect, they may think about nuclear power stations, but the telecom network, which is basically enabling everything else, is one of the key networks that we need to protect.

Mr. Chair, we want to make sure we get it right. As Minister LeBlanc said, that's why we listened carefully to the debates in the House of Commons and comments from stakeholders and colleagues, who are here because, when it comes to national security, that's not a partisan issue. That's why we are committed to making sure that we do that in the best possible way.

I am happy to see that there seems to be broad support for the bill and the objective of securing our telecom network.

We want to work constructively to get the best possible bill, but I must add that action is urgently needed. People who would like to inflict harm on Canada are obviously seeking potential loopholes in the system. So it’s urgent to provide the government with the powers it needs to do things right. That’s important.

I therefore eagerly await the passage of Bill C‑26 to better protect our critical infrastructures.

Mr. Chair, my colleague Minister LeBlanc and I will be pleased to answer our colleagues' questions.

Thank you.

[Dominic LeBlanc, Liberal, Minister of Public Safety]

I will with pleasure, Mr. Chair—with a lot of pleasure.

Thank you, Mr. Chair.

Thank you, colleagues, for inviting me to speak about Bill C‑26, which pertains to cyber security.

I am pleased to be here with my colleague François Philippe Champagne and the other officials kindly named by the Chair.

Our critical infrastructure is becoming increasingly interconnected, interdependent and integrated with cyber systems. Canada's critical infrastructure plays a vital role in the delivery of essential services and the necessities of daily life. In order to safeguard our economic and national security, we need to take a more complete picture of the cybersecurity threats facing Canadians. We believe that Bill C-26 would be an important step in accomplishing that task.

This proposed legislation will protect Canadians and bolster cybersecurity across the federally regulated financial, telecommunications, energy and transportation sectors. These sectors are all critical contributors to both Canada's economy and the security of Canadians. Because of their vitality, they are also, obviously, attractive targets for malicious cyber-enabled activity, such as espionage, data and intellectual property theft, and of course sabotage itself.

These concerns are not just hypothetical. Recently the Canadian Centre for Cyber Security joined Five Eyes' operational partners in warning that People's Republic of China state-sponsored cyber-actors are seeking to pre-position themselves for disruptive or destructive cyber-attacks against the United States' critical infrastructure in the event of a major crisis or conflict with our neighbour to the south.

Cyber incidents are happening in our critical infrastructure sectors on almost a daily basis. In January 2023, CBC News reported that a territorial and Crown corporation, and the sole energy distributor in Nunavut, fell victim to a cyber-attack. In June of last year, the Calgary Herald reported that Canadian energy company Suncor suffered a serious cyber incident that shut down debit and credit processing at Petro-Canada gas stations across the country. We all remember the cyber incidents that paralyzed the Newfoundland and Labrador health care system in 2021.

Bill C-26 would help to defend our critical infrastructure and the essential services that Canadians and Canadian businesses rely on every day. This new act would increase collaboration and information sharing between industry and government and would require designated operators to report cybersecurity incidents to the Communications Security Establishment, which, as colleagues know, is an agency within the Department of National Defence.

By improving the government's awareness of the cyber-threat landscape in these critical, federally regulated sectors, we can warn operators of potential threats and vulnerabilities so they can take action to protect their systems and to protect Canadians as well.

However, the government can’t do it alone. That’s why we’re committed to working closely with our industry partners, through the formal regulatory process, to create a clear, consistent and harmonized regulatory regime across all provinces and territories.

We must and we will work alongside our allies, in particular the United States, to make sure that our interconnected critical infrastructure is protected.

This legislation is consistent with the cybersecurity approaches of our allies, and we have been engaging with international partners to identify opportunities for further collaboration. As recently as Tuesday of this week I participated in a Five Eyes ministerial call, during which Secretary Mayorkas, the U.S. Homeland Security secretary, raised many of the issues we're going to talk about this morning.

We found that stakeholders broadly support the intent of the bill and agree that we must work together to protect our critical infrastructure from cyber threats. However, some expressed concerns about certain aspects of the bill. We have, of course, listened carefully to the points raised by our colleagues in the House of Commons and others concerning transparency, accountability and the protection of Canadians’ privacy.

Fundamentally, this bill will help protect the privacy of Canadians’ personal information. Canada’s critical infrastructure systems, while secure, are not impenetrable. By requiring Canada’s critical infrastructure operators to maintain high levels of cyber security, we are also reducing the likelihood of personal data breaches on their systems.

I look forward to working with you, Mr. Chair, and Committee members, on all these issues. Of course, if the Committee deems it necessary, we are prepared to consider amendments that could strengthen the bill. In addition, we look forward to working with you to ensure that this bill is passed and that Canada remains a safe, competitive and connected country in a more secure environment.

Thank you.

I look forward to hearing what my colleague Mr. Champagne has to say—which is why I’m here this morning—and to answering questions from Committee members.

[The Chair, Liberal, Heath MacDonald]

I call this meeting to order.

Welcome to meeting number 95 of the House of Commons Standing Committee on Public Safety and National Security.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely using the Zoom application.

I would like to make a few comments for the benefit of witnesses and members.

Please wait until I recognize you by name before speaking.

To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from any microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings.

As a reminder, all comments should be addressed through the chair.

Pursuant to the order of reference of Monday, March 27, 2023, the committee resumes its study of Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts.

Appearing before us today are the Honourable Dominic LeBlanc, MP and Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs; and the Honourable François-Philippe Champagne, MP and Minister of Innovation, Science and Industry. Welcome.

Witnesses from the Department of Public Safety and Emergency Preparedness include Patrick Boucher, senior assistant deputy minister, national cyber security branch; Colin MacSween, director general, national cyber security directorate; and Kelly-Anne Gibson, acting director, national cyber security directorate.

Witnesses from the Department of Industry are Éric Dagenais, senior assistant deputy minister, spectrum and telecommunications sector; and Mark Schaan, senior assistant deputy minister, strategy and innovation policy sector.

Please note that the ministers will be with us for one hour and 30 minutes. The officials will stay for the rest of the meeting in order to answer questions from members.

Colleagues, we need about 10 to 15 minutes before the end of the meeting to deal with committee business items, such as budgets and the committee schedule.

Welcome to all.

I now invite Minister LeBlanc and Minister Champagne to make an opening statement of up to 10 minutes each.

Thank you.

Minister LeBlanc, will you start?

[The Chair, Liberal, Heath MacDonald]

Thank you, Ms. Michaud.

We're right on schedule.

I appreciate the witnesses today.

Before asking for adjournment, I want to make people aware that our last meeting for Bill C-26 is Thursday. We're contemplating having the amendments in and ready for clause-by-clause when we come back, so that will be by Wednesday noon next week. I know there is some discretion, so we'll likely have further discussions on that on Thursday. That is the outline.

We're adjourned.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

,

Thank you, Mr. Chair.

I have a fairly simple question. It's the same question that I've asked various stakeholders at other meetings.

Bill C‑26 sets out quite heavy financial penalties for organizations that fail to comply with decisions or demands imposed by the government. We don't know what these demands might be, because the power granted is quite broad.

I asked the stakeholders whether these penalties were excessive. Some said that, instead of imposing penalties, incentives should be introduced to encourage organizations to comply with the government's demands. Others said that the penalties should be maintained, but that incentives for organizations should still be implemented.

Mr. Smith or Mr. Ghiz, what do you think of the penalties targeting companies such as the ones represented by your association?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you for that.

What you're saying is that there are some major difficulties with Bill C-26 that need to be responded to, that the bill itself needs to be considerably improved, and that there are a number of amendments that need to be considered for the bill to do what it purports to do but also to ensure that the protection of information and the transparency are there. Is that not true?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you.

I'd like to move on to Professor Clement.

You signed on, along with a number of important organizations—the Canadian Civil Liberties Association, la Ligue des droits et libertés, the National Council of Canadian Muslims, OpenMedia, the Privacy & Access Council of Canada—pushing for a series of amendments, 16 recommendations that would help to, in the words of the briefing, “restrain ministerial powers”, “protect confidential personal & business information”, “maximize transparency”, “allow special advocates to protect the public interest”, and “enhance accountability for the Communications Security Establishment”. These are very valuable recommendations that you've brought forward to us, that the coalition has brought forward to us.

What are the most important ones, the ones that we need to be absolutely cognizant of in putting forward amendments to Bill C-26?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Okay. Thank you very much.

Ms. Mason, I have the same question for you. To what extent was the Canadian Bankers Association actually consulted on the drafting of Bill C-26?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Okay.

To what extent were you consulted around the drafting of Bill C-26?

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

,

Yes, it did, Mr. Smith. Thank you.

I would like to put the same question to the representatives of the Canadian Bankers Association.

According to the Office of the Superintendent of Financial Institutions, banks are increasingly the target of cyber attacks. We've seen some examples in recent months. I imagine that this may lead customers to worry about the protection of their personal information. As in the case of telecommunications companies, I imagine that banks already have certain mechanisms in place and that, as Mr. Smith was saying, they're already meeting the requirements of Bill C‑26.

What does this mean for banks? Is it a relief or a burden?

In your opinion, what should be better regulated?

[Eric Smith]

It's a very good question.

One of the things is that our members have very robust cybersecurity processes already, and, as Mr. Ghiz mentioned in his remarks, they already collaborate deeply with government. Many of the things that could come about as a result of Bill C-26 are things that the industry is already doing. There is CSTAC, the Canadian security communications advisory committee, which puts out best practices and guidance, etc., for all the telecommunication service providers. Bill C-26 could allow the minister to actually order specific practices, for example input.

In terms of the regulatory burden, I don't know of any industry that welcomes additional regulations, as it does add some burden. Again, our members already have robust practices, so I think the additional burden is mostly around things like the reporting requirement. That's where the legislation could require some improvements. It says that we must “immediately report” an incident. Well, “immediately” is right away, and you wouldn't have enough information to even know if you'd had an incident. Some of those things can be improved.

I hope that has answered your question.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

,

Thank you, Mr. Chair.

I want to thank the witnesses for joining us.

I would like to put my first question to the representatives of the Canadian Telecommunications Association. I'll then put a similar question to the representatives of the Canadian Bankers Association.

Almost everyone agrees that Bill C‑26 is a step in the right direction, and that it's relatively good news that the government wants to tackle the cybersecurity issue. However, there are fairly widespread concerns about the protection of personal information and privacy, in addition to the government's sweeping regulatory and order‑making powers in particular.

You represent carriers and companies that invest in telecommunications networks, such as Vidéotron, Rogers or Bell. I imagine that these large companies are already investing in ways to protect themselves against any cyber-attacks. They have the workforce to do so.

You may also represent slightly smaller companies with fewer customers. This could mean an additional workload for them. Some of them may have already endured cyber-attacks.

At this time, how do the companies that you represent protect themselves against cyber-attacks? What will Bill C‑26 change?

If the bill isn't amended, for example, to better regulate the government's powers, will somewhat smaller companies—such as small and medium‑sized businesses—consider it a burden or a relief?

I know that it's a fairly broad issue.

[Prof. Andrew Clement]

In addition to proportionality, which has been mentioned several times, much greater transparency about the operations of the security agencies and the measures that are being taken is required. At this point, we do not have that kind of transparency.

There have been many recommendations, particularly those within the reports I mentioned earlier, that address greater transparency so Canadians can know what's going on. Those would achieve a much better balance. At this point, Bill C-26 is not balanced in terms of those abilities.

[Professor Andrew Clement, Professor Emeritus, Faculty of Information, University of Toronto, As an Individual]

Thank you, Mr. Chair and committee members.

I am Andrew Clement, a computer scientist and professor emeritus in the faculty of information at the University of Toronto. I co-founded the interdisciplinary Identity, Privacy and Security Institute there.

For the past decade, I have focused on the privacy, security and surveillance aspects of Internet communications. Currently, I co-lead a project with the Canadian Internet Registration Authority on Internet measurement aimed at advancing Canadian cybersecurity, resiliency and sovereignty. The project is funded through Public Safety Canada's cybersecurity co-operation program. Beyond an annual $1,500 honorarium, I receive no funds from either CIRA or Public Safety. While I endorse CIRA's submission to your committee, I am speaking here in a personal capacity.

I strongly endorse the recommendations in the submission by the Citizen Lab and the joint submission by several civil society organizations. Both of these submissions draw heavily on the fine report by Dr. Chris Parsons, “Cybersecurity Will Not Thrive in Darkness”.

There is no debate over whether Canada needs a stronger regime for securing our critical cyber infrastructure. Bill C-26 contributes to establishing a worthy cybersecurity regime. However, it needs substantial amendment to ensure that the sweeping and secretive powers it grants the government do not override other equally vital values, such as privacy, freedom of expression, judicial transparency and government accountability.

For better and worse, the government's leading agency for ensuring cybersecurity is the Communications Security Establishment. It faces a vital and remarkably difficult task. Fortunately, it appears to be staffed by dedicated experts. However, unsurprisingly, given its origins in wartime signals intelligence, CSE operates with an extraordinary degree of secrecy and boundless appetite for data collection. This is quite justified in some areas of its mandate, but as its capabilities have grown to include extensive surveillance of domestic communications, CSE needs to be much more open and publicly accountable.

In 2013, Snowden documents—notably, about CSE's “CASCADE: Joint Cyber Sensor Architecture”—indicated that the agency was embedding extensive interception capabilities within the Internet infrastructure able to capture a very large portion of Canadians' Internet communication.

While CSE is legally prohibited from directing its activities at Canadians, its capabilities of full take of content and metadata, mass surveillance, and the “incidental” bulk collection of personal and even intimate information on every Canadian Internet user pose a significant challenge to privacy rights and democratic governance more generally.

Renowned cybersecurity expert and director of the Citizen Lab, Ron Deibert, noted the following in 2015: “These are awesome [surveillance] powers that should only be granted to the government with enormous trepidation and only with a correspondingly massive investment in equally powerful systems of oversight, review and public accountability”.

Basic questions here are whether the government should make Canadians aware of this mass surveillance, provide them with robust assurances that this bulk collection is necessary, proportionate, and safe, and offer them an opportunity to decide collectively whether such practices are acceptable or not.

As mentioned by previous witnesses, a key concern with Bill C-26 is its failure to restrict the CSE's use of the information it collects under its extensive new Bill C-26 powers. As Kate Robertson made clear earlier, based on NSIRA reporting, if it is not explicitly prohibited from doing so, the CSE will consider itself authorized to use this information across any of its mandates. This accountability deficit must be fixed before granting CSE new powers under Bill C-26.

Privacy is a fundamental human right. It is essential that Bill C-26 be amended to explicitly define personal and de-identified information as confidential and to ensure that the government obtains a court order before requiring its disclosure. The government must not be allowed to use its sweeping new powers to undermine privacy, such as by weakening encryption or communications security. Data retention periods must be attached to the information it collects.

Before closing, I'd like to briefly raise an issue that is missing from Bill C-26, one that your committee has previously considered important—namely, how the government should handle cybersecurity vulnerabilities. Where Bill C-26 requires telecommunications service providers to conduct assessments to identify any vulnerability in their services—

[Angelina Mason, General Counsel and Senior Vice-President, Legal and Risk, Canadian Bankers Association]

Thank you.

Good evening.

I would like to thank the committee for inviting us here today to provide our views on part 2 of Bill C-26, an act to enact the critical cyber systems protection act.

My name is Angelina Mason, and I am general counsel and SVP of legal and risk at the Canadian Bankers Association. I am joined by my colleague, Charles Docherty, assistant general counsel and vice-president, legal and risk.

The CBA is the voice of more than 60 domestic and foreign banks that help drive Canada's economic growth and prosperity. The CBA advocates for public policies that contribute to a sound, thriving banking system to ensure Canadians can succeed in their financial goals.

Banks in Canada are leaders in cybersecurity and have invested heavily to protect the financial system and the personal information of their customers from cyber-threats. We are also a highly regulated industry and comply with robust requirements from the Office of the Superintendent of Financial Institutions in respect of cybersecurity risk, supply chain and third party risk management, and incident reporting.

The security of Canada's critical infrastructure sectors is essential to protect the safety, security and economic well-being of Canadians. The banking industry counts on other critical infrastructure sectors, such as telecommunications and energy, to deliver financial services for Canadians. We have encouraged the government to leverage and promote common industry cybersecurity standards that would apply to those within the critical infrastructure sectors, and we support the government's efforts to achieve this under the act. We recognize that critical infrastructure, such as energy, crosses jurisdictional boundaries. We have also recommended that the federal government work with provinces and territories to define a cybersecurity framework across all critical infrastructure sectors.

Having consistent, well-defined cybersecurity standards will provide for greater oversight and assurance that these systems are effective and protected. Protecting against state-sponsored and other threat actors requires a coordinated approach between the government and the private sector. The government can play a pivotal role in bringing together critical infrastructure partners and other stakeholders and building upon existing efforts to respond to cyber-threats.

While recognizing the importance of the act, we need to get this right. Some of the proposed provisions need to be better tailored to address operational and other risk concerns, including being able to leverage existing robust requirements of specific sectors, like banks, to mitigate duplicative or inconsistent requirements, providing greater safeguards for the protection of confidential information, and improving the threshold and timing for cybersecurity incident reporting.

In addition, there should be appropriate guardrails for the invocation of the government's very broad powers under the act. Consistent with other legislation, the act should also include safe harbour provisions that provide designated operators immunity from civil and criminal proceedings for good-faith compliance with the act's reporting requirements and cybersecurity directives.

Looking beyond mandatory incident reporting, the act should also support broader voluntary sharing of incidents, cyber-threat information and expertise about cyber-protection with the Communications Security Establishment and among classes of designated operators, while also including safe harbour provisions to enable this sharing without creating additional risk. Effective sharing of this type of information is a critical component to cyber-resiliency and should be fostered through the act.

Finally, we believe it is necessary to allow the CSE and CSIS to share relevant intelligence and information with designated operators of critical cybersecurity infrastructure in Canada to help them effectively prevent and mitigate cybersecurity incidents.

We will be following up to provide the committee with additional written details on these recommendations. We want to work collaboratively with the government and with other sectors to ensure that Canada remains a safe, strong and secure country.

We look forward to your questions.

[Robert Ghiz, President and Chief Executive Officer, Canadian Telecommunications Association]

Thank you, Mr. Chair.

Good evening. As said, my name is Robert Ghiz. I'm the president and CEO of the Canadian Telecommunications Association. I'm joined today by our senior vice-president, Eric Smith.

The Canadian Telecommunications Association is dedicated to building a better future for Canadians through connectivity. Our association includes carriers, manufacturers and other companies that invest in Canada's world‑class telecommunication networks.

We appreciate the opportunity to speak to you today about our association's views on Bill C‑26.

The security of Canada's telecommunications system is of the utmost importance. Our members recognize that their services are critical to the social and economic well-being of Canadians, as well as to their security and safety. Accordingly, our members invest significant resources to safeguard their systems and infrastructure from cyber-attacks and other threats.

Members also actively participate in the Canadian security telecommunications advisory committee, or CSTAC, which facilitates the exchange of information between the private and public sectors, as well as strategic collaboration on current and evolving issues that may affect telecommunications systems, including cybersecurity threats. In addition to providing connectivity services, many of our telecommunications service providers also deliver cybersecurity solutions to businesses across the country, helping them protect their operations against cyber-attacks.

In other words, our industry takes security seriously and is committed to the security of the Canadian telecommunications system. As such, we share the Government of Canada's objective of protecting critical infrastructure from cyber-attacks and other threats.

However, Bill C-26 in its current form raises some concerns. We have outlined our concerns and proposed amendments to the legislation in a written submission to the standing committee. I will mention a few of them, all of which pertain to part 1 of Bill C-26 and the proposed amendments to the Telecommunications Act.

First, the bill gives the minister very broad order-making powers that lack appropriate checks and balances. Given the extremely broad scope and potential impact of these powers, the proposed legislation should be amended to impose conditions on exercising them. Specifically, orders should not only be necessary in the opinion of the minister but also reasonably necessary—in other words, proportionate to the potential harm of the security risk and reasonable in the circumstances. The legislation should also require that orders be made only after the minister has consulted with prescribed experts to ensure they are proportionate to the risk posed, have a limited impact on service availability and are economically and operationally feasible for affected service providers.

Second, while orders made under the bill are subject to judicial review, the legislation provides that a judge can base his or her decision on evidence the applicant is not allowed to see and therefore cannot challenge. This process makes no effort to provide for alternative means of testing the government's evidence, including the appointment of a special advocate with the appropriate level of security clearance.

Third, Bill C-26 does not include a due diligence defence for alleged violations of orders made pursuant to the proposed new sections of the Telecommunications Act, even though a defence of due diligence is available for other violations of the act, as well as for violations of orders by others under the rest of Bill C-26. The absence of a due diligence defence is even more striking given that the legislation seeks to introduce significant monetary penalties. Telecommunications providers should have the right, as afforded to others under Bill C-26, to avail themselves of a due diligence defence in appropriate circumstances by demonstrating they took all reasonable care in the circumstances to avoid the alleged violation.

Lastly, part 1 of Bill C-26 should be amended to make clear that compensation may, at the discretion of the government, be awarded for any financial expenditures, losses and costs resulting from complying with an order.

Thank you for giving us the opportunity to share our views on this key issue. We look forward to answering your questions.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

We're basically seeing an incident of that magnitude every two weeks or less at this point. Are you concerned about that number growing? As some witnesses have indicated, if we don't put in place protections, for example with Bill C-26, Canadian financial institutions may increasingly be targets.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you, Mr. Yalkin.

I'll turn my questions over now to Ms. Robertson. Thanks for being with us today.

I'm very interested in hearing more about some of the oversight mechanisms you would like to see put in place. You mentioned them earlier in the line of questioning. Can you expand on those and perhaps comment a bit on how Bill C-26 intersects with the Privacy Act?

Is there anything in there that you see as problematic? How can that be mitigated here in committee? What can we do?

[Kate Robertson]

Yes. In the situation where an individual or institution would seek to challenge the collection powers or orders under Bill C-26, there is a judicial review mechanism that's available. There are other complaint proceedings that are available in law outside of the scope of Bill C-26.

In this case, it contemplates secret evidence. In this case, there is some language that is included. Unlike the minister's discretion to keep secret the orders themselves—and that discretion doesn't appear to have any limits—there is some language in the bill at least with respect to the secret evidence proceedings. However, we've recommended that it be tightened and aligned with that which is set out in the Canada Evidence Act, because there's no justification for diluting that requirement or the court's ability to balance the public interest in disclosure in contrast to the government's interest in confidentiality. That's essential, in our view, with respect to the constitutionality of the scheme.

[Kate Robertson]

Yes, that's a function of the absence of publicity requirements with respect to the orders themselves, as well as the absence of any notice obligation set out under Bill C-26.

We've recommended in our brief that the constraints on secrecy must be defined and strictly curtailed to what is absolutely necessary. Language exists in the bill to support that amendment, as well as the need for notice obligations, which is an essential function for review mechanisms that would be necessary for this level of collection and sharing power, of course.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you.

I'd like to go to you, Mr. Yalkin.

You raised some important issues through OSFI. I have two questions for you.

First off, have you been consulted at all on Bill C-26? Was the banking sector consulted before the legislation was tabled, or afterwards?

Second, how many cyber-attack incidents have we had in the financial institutions covered by OSFI's mandate? How many cyber-attacks were there in 2023? Is that number increasing, decreasing or staying stable?

[Philippe Dufresne]

As it stands, Bill C-26 does not include a requirement to conduct privacy impact assessments. The Treasury Board does, however, have a policy with such a requirement. We consult with departments regularly. We have a government advisory directorate, and we provide advice to departments.

In some cases, the assessments are done after the fact, once the tool has already been used. In fact, I recently appeared before the Standing Committee on Access to Information, Privacy and Ethics on the subject.

It undermines trust when Canadians find out that the government is using a tool or developing a program without conducting a privacy impact assessment first. That's why privacy impact assessments should be conducted at the outset.

In addition, people should know that our office has been consulted. That way, when the information becomes public, they know that we were consulted, that discussions were held and that advice was given.

That is what I'd like to see in Bill C-26, given the potential impact of those powers.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

Thank you, Mr. Dufresne, for your service as law clerk and parliamentary counsel of the House of Commons, as well as your work in your current role as the Privacy Commissioner of Canada.

Thank you to all the witnesses for the information they have shared with the committee.

Commissioner, I have two questions for you.

You mentioned the importance of having Bill C-26 require government organizations to conduct privacy impact assessments.

First, have government or non-government organizations ever consulted your office? The bill was introduced in June 2022, so certainly, there will be an impact.

Second, has an organization consulted your office to learn how to conduct the assessments? What impact will Bill C-26 have?

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Thank you to the witnesses for being with us.

In your opening remarks, Mr. Dufresne, you raised your concerns with respect to privacy. Most of the witnesses we've heard from actually share your concerns.

What you're recommending—that your office be consulted—differs from what most of the other witnesses have proposed. The mandate of the Office of the Privacy Commissioner is to oversee “compliance with the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act”.

You are recommending that, should Bill C-26 be passed, the Department of Public Safety or the minister responsible consult your office.

In the case of other bills, do departments or ministers consult your office on privacy considerations? If so, can you provide an example? It would give us a sense of how things would work.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

We know that during the course of the committee's study on Bill C-26 so far we've heard a lot of stakeholder reaction around privacy rights and information sharing. You touched a bit on this in your opening testimony as well. Do you have any suggestions for how these concerns can be mitigated through regulations, especially when the data is crossing national boundaries?

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you, Chair.

I would just like to point out that if it weren't for Conservative filibusters, we would have been finished with Bill C-26 and we would be on auto theft right now.

If this were such a serious issue, they wouldn't have brought up Emergencies Act motions—at least six of the same thing, just changing how many meetings—and they would have gotten to the point. I believe that, just at the last meeting, it was the first time a Conservative member actually asked witnesses a question on Bill C-26. If it were such a concern, we would have already been studying auto theft—which was Ms. Michaud's motion to begin with, which we all agreed with.

I think it's crucially important that we finish Bill C-26 and move forward with auto theft, and we can do that. We still have to submit amendments and things like that and then get to clause-by-clause, but we can go to auto theft in the meantime.

I will just confirm that the ministers, both Minister LeBlanc and Minister Champagne, are scheduled on Bill C-26 for February 15, and Minister LeBlanc is also confirmed for his appearance for the week when we're sitting in March. He's there on his mandate, and that's been confirmed to the clerk. Those are both scheduled.

I would like to point out that the minister was available sooner, but we were in a different study, and it was decided to invite other witnesses to come before that. I recognize the frustration in terms of scheduling the minister. I have been taking that back, but if it weren't for all of the continuous filibusters, we would have been in a very different place as a committee.

We need to finish Bill C-26. We have only two meetings left after this. We have the ministers and then one more, I believe, and then we can move forward, but if we continue to get filibustering motions from the Conservatives and they're not serious about talking about Bill C-26, then we're not going to be able to get to auto theft. It's a shame that they've done that, since it's really important.

I would very much hope that we can finish this study and move to auto theft, which was always the plan. Again, we would have been there if it weren't for Conservatives wasting committee time and taxpayer money talking about motions that they actually never even wanted to vote on.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

I want to welcome the students from Saint‑Hyacinthe high school and thank them for joining us today.

The motion covers a number of elements, and my preference in those cases is always to have the steering committee discuss the matter. I'm all for inviting the minister, but I think it's unlikely that he'll be able to make time in his schedule on Thursday.

While I think it's important to get started on Ms. Michaud's study, which we all support, as soon as possible, doing so would delay our study of Bill C-26. For the past month, we've had a number of challenges in holding discussions and meeting with witnesses. I think we need to improve Bill C-26 right away. Then, we could move on to the auto theft study, which I think is important.

For that reason, I will be voting against the motion, but I will raise it with the steering committee. I think the committee should meet as soon as possible.

That said, I think we need to work out a schedule and invite the minister again. Mr. Shipley rightly pointed out that the minister has hardly been here, and that needs to change. We can discuss the auto theft issue as soon as we wrap up the study on Bill C-26.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

I'd like to comment on the motion, if I may.

It's been a while since we've had a chance to discuss a motion. I just want to say that it is true that the minister still hasn't been here to talk about his mandate generally, even though that should happen at the very beginning of the year—and even in the middle of 2023, after he was appointed. I therefore agree with that part of the motion.

Since I proposed the auto theft study, I'm certainly not opposed to moving it up. I do want to say, however, that my intention is not to hold up the study on Bill C-26 either. I think it would be reasonable to do both at the same time.

I'm not sure whether the plan was to vote on this motion today, but I would support the motion.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you, Chair.

Thank you to the witnesses for being here today.

Bill C-26 is a very important issue. I'm going to ask for a little time on this. I have no intention of infringing on anybody else's time today, Chair, but I would like to quickly move a motion that's on notice, and hopefully get back to Bill C-26 quickly. It's a short motion.

I move:

That the committee acknowledge that auto theft is a pressing issue facing Canadians and pursuant to the motion agreed upon regarding auto thefts on October 23, 2023, the committee commence this study on Monday, February 26, 2024 and dedicate the following six Monday meetings to this study, while reserving the committee’s Thursday meetings for the study of Bill C-26. Additionally, pursuant to the motion agreed upon regarding the Rights of Victims of Crime, Reclassification, and Transfer of Federal Offenders on Monday, October 23, 2023, that the committee extend its meeting on Thursday, February 15, 2024 for an additional hour and the Minister be invited to appear for the full three hours in order to discuss all matters related to his mandate.

Chair, I feel this is a reasonable approach and motion to prioritize a serious issue. I think all of us around this table agree that auto theft is a serious issue.

The reason we added trying to get a little extra time with the minister is that we have not had a minister report to this committee since May 30, 2023. The last time a minister came for estimates was May 19, 2022. We all passed a motion on October 23, 2023, “that the committee invite immediately the Minister of Public Safety and department officials to appear for two hours to discuss his mandate.” I was hoping to consolidate some of those meetings together and make our time work a little better. Perhaps the minister, if he can fit it in his schedule, could find the time to talk to us about many pressing issues that are going on here right now.

With that, I will cede the floor, Chair.

[Kate Robertson, Senior Research Associate, Citizen Lab, Munk School of Global Affairs and Public Policy, University of Toronto, As an Individual]

Thank you, Mr. Chair and members of the committee. As you know, I attended this committee last week in relation to this bill.

I'm a senior researcher at the Citizen Lab, which is based at the Munk School of Global Affairs and Public Policy at U of T. I have submitted a written brief to this committee along with a colleague, Lina Li of McGill Law, which builds upon the research and analysis of my former colleague at the Citizen Lab, Dr. Christopher Parsons.

Today I will readopt my comments from last week and supplement them as follows.

First, several concerns have been raised throughout these hearings focusing on malicious targeting by, for example, ransomware of aspects of the economy that are outside federal responsibility, such as hospitals. The need for protection in other areas is important, but this committee can also be mindful of the proper scope of its responsibility in its work on Bill C-26.

I also appreciate other committee witnesses raising threats facing Canadian society today. However, it is never a good idea to legislate out of fear. This is an important issue that requires careful due diligence and reflection as to what goes into any amendments. I would suggest the committee carefully look at what it is doing. Making the right decision now could improve the security, safety, privacy and charter rights of all people in Canada for decades going forward. It's incredibly important that lawmakers are thoughtful, nuanced and reflective of the kinds of amendments they propose for the legislation.

Second, our brief sets out recommendation 12—including recommendations 12A through 12C—pertaining to judicial review proceedings under Bill C-26. This includes the recommended appointment of special advocates in judicial review proceedings, and the need to align Bill C-26 with analogous provisions under the Canada Evidence Act applicable to secret evidence. These amendments are not only important but also fair, simple and common-sense enhancements.

Lastly, I also wish to address our recommendation that government entities empowered with new information collection and sharing powers be required to limit the use of that information to cybersecurity and information assurance.

The collection or use of information by national security intelligence agencies like the CSE about Canadians or persons in Canada is a core matter of public and constitutional concern. The concern that the CSE may repurpose information it receives through Bill C-26 into its other intelligence activities is not a speculative one. Recent reporting from the National Security and Intelligence Review Agency, or NSIRA, documents that, at this time, the CSE does not consider itself prohibited under its home statute from repurposing information about Canadians across its mandates.

However, only a few years ago, in Bill C-59, an important equilibrium was struck by Parliament concerning the need for important limits, given the prohibition against intelligence agencies directing their activities towards people in Canada. Bill C-26 could destabilize this important equilibrium. It currently contemplates broad and even secretive government collection and sharing powers about information concerning people in Canada. While the Department of Justice's charter statement on this bill referred to the government's potential use of only technical information and not sensitive personal information, there are no caveats or safeguards to stipulate this in the legislation. Clarity is needed.

Telecommunications providers, for example, are quite literally conveyors of the most private information known to our legal system. I agree with witnesses from CIRA and OpenMedia that this is a core matter of public trust. The public should not have to be asking itself whether the government's cybersecurity bill is actually a spy bill under a different name.

As noted by Mr. Hatfield last week, NSIRA has reported a chronic problem in reviewing the lawfulness of the CSE's activities since its inception. Lawmakers here should be very cautious when considering whether extending additional new powers is appropriate or necessary under Bill C-26, and what corresponding judicial oversight mechanisms are necessary and fit for purpose to protect the privacy of all people in Canada.

Thank you. I'm happy to answer any questions you may have.

[Tolga Yalkin, Assistant Superintendent, Regulatory Response Sector, Office of the Superintendent of Financial Institutions]

Thank you so much.

Good afternoon, Mr. Chair, and ladies and gentlemen of the committee.

The mandate of the Office of the Superintendent of Financial Institutions, or OSFI, contributes to public confidence in the Canadian financial system by regulating and supervising approximately 400 federally regulated financial institutions. In this role, we ensure that these institutions maintain sound financial conditions, continually assess risks and industry trends, and safeguard against threats to their integrity and security, including cyber-threats.

There’s no question that financial institutions are vulnerable to cyber-attacks. In fact, OSFI has highlighted cyber-risk as a key risk to Canada’s financial stability in our annual risk outlook, which is available online.

Given this, it won't surprise you that we have been, for some time, active as a regulator in expecting our financial institutions to adopt appropriate risk management practices in the face of cyber risks. More specifically, we've taken pains to clarify in our guidelines our expectations for how financial institutions should manage technology and cyber risks to prevent things like outages and data breaches and to improve overall technology and cyber resilience.

This also includes an expectation that financial institutions respond to tech and cybersecurity incidents quickly and effectively and, more importantly, notify us whenever an incident happens. That reporting really helps us to identify areas where individual institutions—or the industry more broadly—need to take steps to prevent issues from arising.

We also provide tools to financial institutions. A good example of this would be our cybersecurity self-assessment, which helps them evaluate their current level of cyber-preparedness and develop effective cybersecurity practices. There is also our I-CRT—that stands for intelligence-led cyber resilience testing—framework, which provides instructions to financial institutions on how to implement a sophisticated approach to what is known as red teaming.

These efforts, and others, are critical, in my opinion, as there's little question that cyber-attacks will continue to increase in frequency and sophistication. Moreover, this is a risk environment that, in our experience, changes rapidly, and failure to protect against it can have serious consequences. A successful cyber-attack could impact the confidentiality, integrity, and availability of data and systems, which in turn could result in loss of public trust, reputational damage and financial loss.

That’s why OSFI is so focused on promoting the sound management of cyber-risks and technology risks generally at all federally regulated financial institutions.

As an identified regulator within a critical sector, OSFI is standing by and ready to support committee members in their reflection around Bill C-26. We want to help to improve the resiliency of Canada’s financial system.

I would be pleased to answer the committee members' questions.

Thank you, Mr. Chair.

[Philippe Dufresne, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

Members of the committee, I am pleased to be here to assist the committee in its study of Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

Cybersecurity is an area of significant importance, in Canada and globally. Digital services that are delivered through cyber-systems and telecommunications networks are central to the ways that we live, work and interact, and impact large volumes of personal information and data. That is why it is critical to protect Canada’s cyber-infrastructure from potential threats.

At the same time, we must ensure that efforts to secure these systems and networks also protect and respect Canadians' fundamental right to privacy. This is not a zero-sum game. Privacy and the public interest are not only compatible; they build on and strengthen each other. I strongly support the objectives of Bill C-26 and believe that it's imperative that we as a society have the necessary tools and the ability to address this important public interest goal.

In my testimony today, I will share ways in which the bill could be strengthened in order to further protect the fundamental right to privacy and address potential privacy implications while achieving its important objectives.

Under Bill C-26, specified persons or entities would be able to collect and analyze a wide range of information, including sensitive personal information that is held by banks, telecommunications operators and energy services providers. The bill would also allow for the sharing of that information with organizations such as intelligence agencies, provincial and foreign governments and organizations established by foreign states.

As drafted, these powers are broad. In order to ensure that personal information is protected and that privacy is treated as a fundamental right, I would recommend that the committee consider making the thresholds for exercising these powers more stringent, and placing stricter limits on the use of those powers. One way of doing so would be to require that any collection, use or disclosure of personal information be both necessary and proportionate. This is a core principle for the handling of personal information that is recognized internationally.

Requiring government institutions to conduct privacy impact assessments, or PIAs, and to consult my office on new programs or initiatives created under the authorities in Bill C-26 would also strengthen privacy protections while supporting the public interest and generating trust. PIAs, which are currently a policy requirement under the Treasury Board Secretariat's directive on PIAs but not a legally binding requirement under privacy legislation, are an important tool for identifying, analyzing, addressing or mitigating privacy issues before initiatives are put in place. They can help reduce inadvertent harms to privacy as initiatives roll out. This is why I've recommended that the preparation of PIAs should be made a legal obligation for the government under the Privacy Act.

Bill C-26 would also allow the Minister of Innovation, Science and Industry to prohibit public disclosures of certain orders and directions made under the proposed act. It's important that any such confidentiality provisions that have the effect of reducing public scrutiny regarding the bill's implementation, including the collection, use and disclosure of personal information, be accompanied by appropriate transparency measures. These could include requiring the government to report to Parliament and/or to my office regularly on the number, nature and purpose of such orders and directions, especially when they involve sensitive personal information. This would reassure Canadians that their privacy is protected at all times.

I would also recommend that the bill be amended to include stronger accountability measures to ensure the protection of personal information that is shared outside Canada. These could include additional oversight mechanisms and established criteria that must be included in information-sharing agreements with foreign jurisdictions, such as restrictions on any onward transfers of the personal information, establishing safeguards that must be applied, and penalties for non-compliance.

Finally, should Bill C-26 be adopted, it will be important that my office have the necessary flexibility to coordinate, as appropriate, with other regulatory and oversight bodies that are involved in responses to cybersecurity incidents in cases that may involve a breach of personal information.

I would be happy to take your questions.

[The Chair, Liberal, Heath MacDonald]

I call this meeting to order.

Welcome to meeting number 94 of the House of Commons Standing Committee on Public Safety and National Security.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely using the Zoom application.

I would like to make a few comments for the benefit of witnesses and members.

Please wait until I recognize you by name before speaking. To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from any microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings.

Pursuant to the order of reference of Monday, March 27, 2023, the committee resumes its study of Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

Today we have two panels of witnesses. I would now like to welcome our witnesses for the first panel.

In person, from the Office of the Privacy Commissioner of Canada, we have Mr. Philippe Dufresne, Privacy Commissioner of Canada. By video conference, from the Office of the Superintendent of Financial Institutions, we have Mr. Tolga Yalkin, assistant superintendent, regulatory response sector. From The Citizen Lab, we have Ms. Kate Robertson, senior research associate at the Munk School of Global Affairs and Public Policy, University of Toronto.

Welcome to all.

Up to five minutes will be given for opening remarks, after which we will proceed with rounds of questions.

I now invite Mr. Dufresne to make an opening statement.

Go ahead, please.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you very much.

At the Foreign Interference Commission, a number of experts said that Canada was probably one of the least transparent countries when it comes to national security. We know that the Communications Security Establishment, or CSE, reports to National Defence.

The Standing Committee on National Defence has already made recommendations to the effect that the CSE should be a little more transparent and that it should provide people with more information when there are cyber attacks, for example.

The Standing Committee on Public Safety and National Security is currently studying Bill C‑26, and there are expectations of the private sector. Don't you think that National Defence should set an example and be a little more transparent and proactive when it comes to whistleblowing when there are attacks or computer computer-related issues, instead of that information being somewhat concealed, in a way?

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

I do understand that you're a quasi-judicial body, and that limits what you can respond to here, but we're here to study Bill C-26 to make it better so that when it is delivered out into the world, it does its job. Is there anything you can offer us that will help us do that?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I would encourage you to consider the question to see whether there is an impact.

We also know that Bill C-11 and Bill C-18 gave sweeping new powers to the CRTC. We've heard from witnesses that Bill C-26 as written also grants too much power, mainly ministerial power. How do you recommend amending the act to give Canadians the confidence that there will be proper oversight without overreach and that transparency and accountability will be balanced?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you very much, Chair.

I'll focus my questions on the CRTC. Last year, the Auditor General reported that the CRTC was not doing enough to track the affordability of Internet and cellular services, particularly in rural and remote areas. Has the CRTC undertaken any sort of analysis of the impacts of Bill C-26 as written on the prices that Canadians pay for Internet and cellular services?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Mr. Chair, I'll ask a question on behalf of Mrs. Normandin. I would appreciate some flexibility with my speaking time. If you don't mind, I'll ask her question first and then move on to my own questions.

Ms. Wright, my question concerns the recommendation that the committee received from Citizen Lab, which suggested that we provide relief for smaller telecommunications providers.

Should Bill C‑26's regulatory framework be implemented in a manner that takes into account its impact on smaller telecommunications providers? Should the implementation of this regulatory framework be flexible enough to ensure that smaller companies can easily comply with the components of the bill?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Okay.

I guess I'll ask you one last question before my time is up.

Is there anything that is not in Bill C-26, Ms. Wright, that you would like to see that could provide greater support for the work you're doing?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Would you be able to comment on how Bill C-26 will intersect with the Privacy Act? Is there anything in the bill that affects the applicability of the act?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

One of the main focuses in this committee is on improving the bill and looking for things that are not included in it but that we could include to strengthen it.

Is there anything our trading partner and ally, the United States, is doing that we are not doing and that is not included in Bill C-26 but that you believe should be included?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

I'll follow up on that.

Given the interconnectedness of the energy sector in Canada and that of our largest trading partner and ally, the United States, how important is it, in Bill C-26, for Canada to strengthen our cybersecurity protection?

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you.

I think that somewhere in there there was a little bit of good news for us. As I said, with that number of 5.2 million at the beginning, hearing yours at considerably less than that obviously will help us sleep a little better at night.

How will Bill C-26 change the way you do business overall? Will it help your members and help you? What's the main implication, if and when this is passed, for how it's going to change?

[Leila Wright, Executive Director, Telecommunications, Canadian Radio-television and Telecommunications Commission]

Good morning, and thank you for inviting us to speak with you this morning.

Before I begin my remarks, I would like to acknowledge that we are gathered on the traditional unceded territory of the Anishinabe people.

My name is Leila Wright, and I am the executive director of telecommunications at the CRTC. I am joined today by my colleagues Steven Harroun, chief compliance and enforcement officer, and Anthony McIntyre, general counsel.

The CRTC is an independent and quasi‑judicial tribunal that operates at arm's length from the government. We hold public hearings on telecommunications and broadcasting matters. We make decisions based on the public record.

In the telecommunications industry, our work focuses on increasing competition for Internet and cellphone services. We do this by promoting greater choice and affordability for Canadians, encouraging investment in reliable and high-quality networks, and improving access to telecommunications services in indigenous, rural and remote communities. We also have a team that helps protect Canadians from unwanted emails, texts and online scams.

The CRTC plays a small part in the federal government's effort to protect the security of Canada's telecommunications system.

Other organizations that contribute to this effort include the Communications Security Establishment, the Canadian Security Intelligence Service, Innovation, Science and Economic Development Canada, the Canadian security telecommunications advisory committee and many others.

The CRTC does not have a role to play within the proposed critical cyber systems protection act. Additionally, many of the proposed amendments to the Telecommunications Act establish new authorities exclusively for the Governor in Council and the Minister of Industry, and do not modify the CRTC's regulatory mandate under the act.

However, a few changes would be relevant to the CRTC's work. I'll focus on three changes in particular.

First, the proposed amendment to section 7 of the Telecommunications Act would add a new policy objective focused on promoting the security of the Canadian telecommunications systems. As with other policy objectives set out in the act, this addition would allow the CRTC to expressly consider how its decisions could further this new objective.

Second, the addition of proposed section 15.6 would facilitate information sharing between a broad group of security-focused government departments and agencies and the CRTC. This would be for the purpose of ensuring compliance with orders and regulations made by the Governor in Council and the minister.

Third, section 47 would require the CRTC to take into account any orders or regulations made by the Governor in Council and the minister in its decision‑making.

Should Parliament adopt Bill C-26, the CRTC will be ready to implement the amendments made to the Telecommunications Act that affect our work.

Thank you again for inviting us to speak today. We look forward to your questions.

[Chris Loewen, Executive Vice-President, Regulatory, Canada Energy Regulator]

Good morning.

My name is Chris Loewen. I am the executive vice-president, regulatory, at the Canada Energy Regulator. I'm joined today by Mr. Chris Finley, director of emergency management and security.

Thank you for inviting the Canada Energy Regulator to appear before the committee today to discuss Bill C-26.

We join you today from Calgary. I would like to take this opportunity to acknowledge the traditional territories of the people of the Treaty 7 region of southern Alberta.

I'll start by outlining the mandate of the Canada Energy Regulator, or CER.

The CER regulates infrastructure to ensure the safe and efficient delivery of energy to Canadians and the world. It regulates pipelines, power lines, energy resource development and energy trade on behalf of Canadians in a way that protects the public and the environment while supporting efficient markets.

Safety is at the core of our work. We regulate to prevent harm in all forms, and we understand that this includes the cybersecurity threats that Bill C-26 is seeking to address. The CER takes the matter of cybersecurity threats to Canada's energy supply seriously.

The CER oversees roughly 71,000 kilometres of the oil and gas pipelines in Canada. We regulate pipelines that cross provincial boundaries or the Canada-U.S. border. CER-regulated pipeline companies are required to have proactive measures in place to protect this critical infrastructure from cybersecurity threats.

Regulated companies must have a security management program that anticipates, prevents, manages and mitigates conditions that could adversely affect people, property or the environment. In addition to the physical threats to infrastructure, companies must consider cybersecurity threats in their security management program and implement appropriate mitigation based on the results of a security risk assessment process. These requirements are laid out in the Canadian Standards Association's Z246.1 standard, which is included in the CER Act's onshore pipeline regulations by reference.

Cybersecurity measures must reflect the criticality of cyber-assets, as well as the results of regular assessments of threats, vulnerabilities and overall security risk.

The regulation of electricity generation, transmission and distribution rests primarily within the jurisdiction of provinces and territories. However, the CER regulates approximately 1,500 kilometres of international power lines. The Canadian public rightfully expects us to hold the pipeline and international powerline companies we regulate accountable for the safe operation of CER-regulated energy infrastructure.

The CER is well positioned to administer the obligations of Bill C-26, in particular those that apply to companies we regulate, and, given these obligations, align with those already found in the Canadian Energy Regulator Act.

For example, the bill provides the CER with the ability to issue orders and to take necessary enforcement actions to bring a company back into compliance, so that critical cyber systems are protected.

The CER already uses similar tools. For example, it issues notices of non‑compliance, inspection officer orders and administrative monetary penalties, as needed, to bring companies back into compliance and ensure that they operate safely.

The CER also verifies that companies are meeting requirements through inspections, audits, compliance meetings and emergency response exercises.

The CER uses an integrated government approach. It works with federal, territorial, provincial and international agencies, as well as regulated industry, to ensure that proactive measures are taken to protect federally regulated energy infrastructure from cyber-related risks or attacks.

Thank you very much for the opportunity to speak with you today about this important issue. We look forward to your questions.

[Jennifer Quaid]

There was certainly an opportunity for consultation several years ago. We participated in that with our members, as well, because we reached out to them. It became a trickle-down process, but it would be nice to see something like Bill C-26 running in concert with a national cyber-strategy.

The consultation was several years ago and is now two years behind. I see that coming down the pipeline.

What was the third question?

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

I'd like to congratulate Mr. Motz on asking the first question for the Conservatives on Bill C-26, a month into the study.

I'd like to go back to you, Ms. Quaid, on the issue of consultation.

There's also the question of whether or not we're increasingly a target because of the lack of action and delay around important legislation.

My third question comes back to your recommendation around expenses for joining, if I have this correctly, the Canadian Cyber Threat Exchange. To what extent would that be a cost? You said there is no cost, but I'm sure there would be. Have you evaluated what that would be and what the advantages are from that?

Those are three questions for two minutes.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you, Mr. Chair.

My question is for all the witnesses. They should feel free to answer it.

Bill C‑26 strikes a type of balance between the items already enshrined in the bill and the regulations. I gather that many definitions will come from the regulations, penalties, all the people involved, and so on.

Cybernetics is a fast‑paced sector. While regulating a good portion of the sector can provide some flexibility, it can also hamper efforts to keep smaller companies up to date and informed of the latest developments.

I would like you to comment on the balance between the two.

[Francis Bradley]

Thank you very much.

With respect to the bill not significantly adding to the security, and in fact potentially diverting attention, it is not an issue with the bill itself. It's that the bar has already been raised higher than what's in Bill C-26 as a result of the mandatory standards our sector is already subject to through the North American Electric Reliability Corporation standards regime. That bar has already been set higher.

What has been put in Bill C-26 does not improve upon that. It detracts. It diverts attention to a separate and second parallel reporting structure, as opposed to using those resources to work on a response.

[Francis Bradley]

Thank you very much. Those are two very good questions.

On the first question, with respect to the consequences of delay—and this relates to your second question as well—we've been engaged in discussions about this gap, given that we're a sector that has had mandatory reliability and mandatory critical infrastructure protection standards for a decade and a half. We have been asking the question, “What about those other sectors upon which we rely?”, because the sectors are interdependent. Some sectors have robust programs and, as for others, we just don't know, frankly.

We've been in favour of seeing something broader across different critical infrastructures, those other infrastructures that we depend on. We have a very high level of confidence in the regime that we have, because it is mandatory and enforceable. We would like to see something in place, and this has been the conversation that we've been having with the government for a very long time about other sectors upon which we rely.

I think Bill C-26 does fill that gap. It overlaps—and I did talk about that in my comments—but, with respect to consultation, in terms of agencies and departments of the government, we have been talking about this for more than a decade. This is something that we've been consulted on extensively, certainly, but it is something that has been a gap for quite some time.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you very much, Mr. Chair.

Thanks to our witnesses. You've given us a lot of food for thought. I have a lot of questions. I hope that there are no further disruptions because, quite frankly, my Conservative colleagues haven't asked a single question on Bill C-26 to date, and I think that has to change. This is important legislation.

I have two questions for all three of you.

First, Ms. Quaid, you mentioned that further delays would cause loss of the faith of our partners. The government introduced this in June 2022. We're now in February 2024. We're seeing delays and disruption from the official opposition in trying to process this legislation. Beyond losing the faith of our partners, what are the other consequences? We've had previous witnesses say that, basically, Canada is increasingly becoming a target because we don't have legislation in place. What are the consequences of further delay? That is for all three of you.

My second question is based on your excellent brief, Mr. Bradley, talking about doing consultation during the regulatory process. To what extent has the industry been consulted by the government in the legislation to date? To what extent was there input so that we get this bill right?

I'll start with Mr. Bradley and then go to Mr. de Boer and Ms. Quaid.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you.

I would like to hear from anyone who wants to address the responsibility issue, even if it means a second round.

I'm concerned that, if we completely remove the responsibility of large companies, which could have a team to do the job properly, they may somehow avoid feeling the need to comply with Bill C‑26.

Is there a risk of completely removing the idea of responsibility?

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you.

Ms. Quaid, you recommended that the bill be expanded to include voluntary collaboration among companies. However, this would mean a greater need for workers to implement Bill C‑26.

Was this part of your thought process? Is the widespread labour shortage a potential issue? I put this question to the committee earlier, and to the Communications Security Establishment, or CSE. I was told that this could be an issue.

I want to know whether this is an issue for you too, and if so, whether you have any possible solutions.

[Francis Bradley]

Thank you.

That is absolutely an excellent question.

My remarks and our brief focus specifically on that interface between the bill and our NERC requirements, which are quite onerous. The member is absolutely correct. There are other requirements that come into play at the different levels of government, as well, and also internationally. It isn't solely a matter of Bill C-26 coming into conflict with NERC. There are other levels, as well.

Our particular area of concern, where we see the potential for a significantly increased burden, is that lack of alignment between the NERC requirements, which have been in existence for many years, and what is being proposed in Bill C-26.

[Chris Bittle, Liberal, St. Catharines, ON]

That's excellent. Thank you so much.

Thank you so much to the witnesses for being here.

It's truly disappointing to see, on issues of such importance, the Conservatives attempting to hijack this once again when they stand up and pretend to care about security.

Mr. de Boer, you mentioned mandatory reporting, not only here but with respect to the executive order in the United States. Bill C-26 requires mandatory reporting for affected sectors when there is a cybersecurity incident. Do you believe that this is important, and if so, why?

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Mr. Chair.

I want to thank all the witnesses for coming today, and for their testimony. We're taking notes, and we'll be taking everything you've said under advisement in our consideration of this bill.

Going forward, though, we do have another urgent issue that we're facing in this country, and it is the issue of auto theft. In the interests of allowing this committee to continue working on Bill C-26, but also to walk and chew gum at the same time and deal with the urgent issue of auto thefts in this country, I plan to be moving my motion that I put on notice at the last committee meeting to discuss. However, given that there have been some discussions with the other parties present, we have come forward with proposed amendments to this motion so that we can program this committee to work simultaneously on Bill C-26 while also working on the very important issue of auto theft.

We know that in 2022, the latest year that auto theft insurance statistics were made available, $1.2 billion in auto theft claims were made. We know that over 100,000 vehicles were stolen in Canada last year. This is a growing issue. It has increased, year over year, 50% in the provinces of Ontario and Quebec. It's a cross-Canada issue. Alberta is the third highest on the auto theft issue. This is a very important issue in my riding and I am very concerned.

We do need education to help people know what tools are available to them to help protect their vehicles from auto theft. However, at the same time, if the federal government does not take action to secure our ports and to put these repeat offenders behind bars, I fear that we are going to see an increase in the brazenness of these criminal acts, including violence committed against our citizens, if we don't take action to immediately put a chokehold on this unprecedented flow of Canadians' vehicles out of, particularly, the port of Montreal.

I understand, Mr. Chair, that my colleague, Larry Brock, is on the speaking list and will be next to speak. In the interests of ensuring that this committee can continue with its very important study of Bill C-26, but also continue and accelerate the study that was already agreed upon by this committee on October 23, on the motion put forward by our colleague in the Bloc Québécois, Ms. Michaud, I will cede the floor to my colleague, Mr. Brock, so that he can move the appropriate amendment.

Thank you, Mr. Chair.

[Francis Bradley, President and Chief Executive Officer, Electricity Canada]

Thank you, Mr. Chair.

I'm CEO of Electricity Canada, formerly known as the Canadian Electricity Association. Our members are companies that generate, transmit and distribute electricity in every province and territory in Canada.

My comments today will focus on part 2 of Bill C‑26, which enacts the Critical Cyber Systems Protection Act.

Before I proceed, I want to acknowledge the efforts of federal departments in drafting Bill C-26 and the time spent engaging stakeholders over the past two years. The problems that the bill is trying to solve are hard ones, with lots of moving pieces and far-reaching implications against the backdrop of a constantly evolving threat landscape.

While I commend the efforts, I must add my voice to the witnesses you've already heard from who emphasized the importance of getting this legislation right. While we acknowledge the urgency to pass this type of legislation, it is crucial to carefully consider amendments and resist the pressure to rush through the review the bill.

Mandatory security requirements can help strengthen our overall security posture, but the approach taken by Bill C-26 risks having the opposite effect, adding very little security to our sector and redundantly adding additional layers of regulatory requirements. Today, I will highlight three areas where the legislation falls short and requires improvement.

First, the bill must align with existing regulatory frameworks. The electricity sector is unique in that the assets targeted by Bill C-26 are already regulated by the North American Electric Reliability Corporation, or NERC. This poses a risk of regulatory conflicts, increases the burden on operators and introduces compliance confusion and ambiguity, ultimately impeding the goal of Bill C-26 to enhance the safety of our critical system.

A witness last week recommended that the bill should take a risk-based approach and impose fewer requirements on those with already strong cybersecurity programs. Under this approach, mature organizations could spend more resources on incident prevention instead of compliance activities, and regulators could better focus their time on high-risk operators. Given our sector's strong security posture and the existing NERC standards, we feel that a risk-based approach to Bill C-26 would be a step in the right direction.

Another area needing improvement in the bill is its reporting requirements. The reference to the immediate reporting of cyber-incidents should be revised. Reporting obligations should not divert critical infrastructure operators from their response and recovery efforts during and post incident. Reporting requirements should be well defined and consistent and have a reporting timeline that is flexible enough to allow the effective use of limited resources during incident response and recovery.

Still on the topic of reporting requirements, the goals of the legislation would be better served if it included legal protection for operators. Safe harbour provisions are an important part of promoting information sharing between industry and government, ensuring the successful implementation of the new reporting requirements and promoting voluntary information sharing.

The final aspect I wish to address is the unintended impact of the bill on the existing industry-government collaboration. Imposing mandatory requirements may create a chilling effect on the industry's relationship with government departments and agencies. Without appropriate safeguards, operators would likely receive legal advice to share just enough information to comply with the act and nothing more.

This is counterproductive to the goals of the legislation, but there are a couple of things you could do to mitigate those risks. First, put clear limits on how the government can use the information collected by way of this act. Several provisions in the bill would allow for information sharing among a range of persons and entities, and it does not explicitly limit how recipients use the collected information.

Second, the cyber centre should be carved out from the legislation and exempt from obligations to report information obtained by way of the act to other entities. Critical infrastructure operators currently enjoy a positive and collaborative relationship with the cyber centre. This is grounded in the confidence that the cyber centre does not disclose operators' information to regulators, enforcement agencies or other departments. Protecting the cyber centre from information-sharing obligations is crucial to maintaining this collaborative relationship.

Many other aspects of Bill C‑26 also deserve our attention, but my time's up for this morning.

However, I encourage you to take a look at our brief, which contains 14 recommendations on how to improve Bill C‑26.

Thank you.

[Jennifer Quaid, Executive Director, Canadian Cyber Threat Exchange]

Good morning, Mr. Chair.

Thank you, all.

I have the honour of being here today representing the Canadian Cyber Threat Exchange, which is an organization created by Canadian companies to provide a safe environment for members to share cyber-threat information and collaborate by sharing best practices and ideas. The goal is to build cyber-resilience and create a stronger economic environment for all. With 170 members, representing 15 sectors and more than 1.5 million employees, our members are actively sharing cyber-threat information to help build awareness and resilience in others and to prevent breaches, as well as the corresponding need to report.

Many of our members represent the critical infrastructure sectors impacted by this legislation, while others make up their supply chain. Many of them are small and medium businesses, like so much of the Canadian economy.

I applaud the government for focusing its attention on creating legislation that will help strengthen Canada's critical infrastructure sector. I believe that with a few small modifications, there is an opportunity with this legislation to do more to support resilience among Canadian businesses and to strengthen the Canadian economy beyond the confines of the six critical infrastructure sectors referenced.

Others have spoken eloquently about privacy issues and about the real risks of attributing liability to our CISOs. All are very good points, which we support.

I want to talk about three cost-effective suggestions that are easily implemented and will have a significant impact on cyber-resilience throughout Canada.

First, the legislation should be amended to include language that encourages all organizations to voluntarily share cyber-threat information and to collaborate with others to build resilience. This can be done with the addition of language in the preamble and two small related changes. I'd be happy to provide the committee with some of the proposed text later.

The second change is to make membership in a Canadian cyber-threat information-sharing association an allowable expense for government programs. For example, Canada's industrial and technological benefits policy does not permit membership in an organization as an allowable inclusion. This change would incentivize companies to participate in a sharing and collaborative organization to raise their cyber-awareness and resilience in an ongoing way. It would be a small change with a significant impact at no cost to the government.

Third, this legislation requires only specified organizations to share cyber-incident information with their regulators or with the government. We have an opportunity here to create a legal environment that enables all companies, including those specified, to share information beyond what they are required to by law. The CCTX has Canadian members and Canadian companies whose American extensions are currently sharing information in the U.S. that they can't share in Canada because they are not protected by legislation. They are concerned about civil liability if they voluntarily share information that could help others prevent an incident.

The objective of Bill C-26 is to prevent further cyber-incidents. Mandated reporting of incidents is not enough. It will not protect enough organizations quickly enough. By adding protection from civil liability, this legislation could fix that. You could enable companies to share beyond what is strictly necessary to become compliant and improve the cybersecurity and resilience of the economy as a whole in a cost-effective, meaningful way. Without this protection, critical information will continue to be shared with organizations outside of Canada.

In creating and supporting the CCTX, Canada's business community continuously demonstrates its willingness and desire to share cyber-threat information and to share its expertise and experience to support Canadian businesses. Help it do more. Enable it to do more. If enacted as part of this legislation, these three changes will ensure a more secure supply chain for critical infrastructure, which is the focus of this bill, and for all Canadian businesses, large and small.

Thank you.

[The Chair, Liberal, Heath MacDonald]

I call this meeting to order.

Welcome to meeting number 93 of the House of Commons Standing Committee on Public Safety and National Security. Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely using the Zoom application.

I would like to make a few comments for the benefit of witnesses and members.

Please wait until I recognize you by name before speaking.

To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from any microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings.

All comments should be addressed through the chair.

Pursuant to the order of reference of Monday, March 27, 2023, the committee resumes its study of Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

I would like to welcome our witnesses for the first panel.

From Blackberry, we have John de Boer, senior director, government affairs and public policy, Canada. From the Canadian Cyber Threat Exchange, we have Jennifer Quaid, executive director. From Electricity Canada, we have Francis Bradley, president and chief executive officer.

Up to five minutes will be given for opening remarks, after which we will proceed with rounds of questions.

Welcome to all of you.

I invite Mr. de Boer to make an opening statement, please.

[Chris Bittle, Liberal, St. Catharines, ON]

Thanks so much.

I reached out to a friend of mine who's in the know, and her response was it's false that there are only five officers who are engaged in this. So we don't have the facts. There's dispute about the facts. The importance of the public safety study, which the Conservatives are filibustering, and Bill C-26 focuses on cybersecurity, which I know....

I take Ms. Gallant at her word in terms of being worried about money going to terrorist entities or state actors that Canada is not allied with. That's actually happening on the cyber front. That's being filibustered to prevent us to get to a thorough study. It's great to take a headline and put it into a motion and say, “This is fact.” We could have witnesses here, but the Conservatives don't want that.

It was interesting to hear Mr. Strahl talk about the good old days of the 41st Parliament. I'm sure he remembers fondly the Conservative cuts to CBSA. I believe it was about a thousand CBSA jobs that were cut during their time in office. That's interesting. You can send to my personal email account the motions like this that I'm sure he voted on, which were NDP motions like this that were just to set up a concurrence debate. I'm sure that was permitted quite a bit.

There is work being done by the government and in Parliament. I know the Liberal government is working with the Conservative government in Ontario on a big announcement in terms of money for a response to this. I'm looking forward to the outcome of the auto theft summit, and I really want to get to the public safety study on auto theft. Let's hear from all of these witnesses.

Mr. Strahl is right. A concurrence motion is an appropriate tool—it's in the rules—but the way the Conservatives are using it is to just shut down debate and the important work that Canadians expect us to do.

The motion at public safety was unanimous in terms of having a thorough study on the subject. Let's get to that. I'm sure Mr. Strahl, after this meeting, is going to get on the phone with his colleagues on the public safety committee, insist that they end their filibuster tactics and get us to a point at which we can actually debate something important and come up with actual recommendations from actual experts rather than gripping a headline that may or may not be true and using it as the basis for a motion for a concurrence debate in the House of Commons, which I guess Mr. Strahl is now admitting is the tactic in play.

I can't support this motion since it's based on incorrect information, despite being a serious issue. Let's do it properly. Let's get to the study at public safety.

[Chris Bittle, Liberal, St. Catharines, ON]

Thank you so much.

There are a lot of statements being made that. They don't want to call experts. They're making these statements, and perhaps they're true, but if these statements are true, like combatting terrorism and this money's going to foreign governments to fund wars, I think Ms. Gallant will want to speak to her Conservative colleagues on the public safety committee, who are filibustering at every opportunity our attempts to get to that study. They're even filibustering bringing in additional motions similar to this, even though there's a study on the books already. It's just the Conservatives flailing their arms, trying to cripple Parliament. That's what we're seeing here.

Ms. Gallant accused me of filibustering. It must have been the world's worst filibuster—I think I spoke for five minutes. I think she has spoken for longer than I have. However, I really think she needs to speak to her colleagues on the public safety committee, because that's where this motion and a comprehensive study on it is currently sitting.

We need to get through Bill C-26, which is on cybersecurity. In that case, we've heard from experts that money from cyber-attacks is being used to fund foreign governments, to fund wars and conflicts, and to fund countries like North Korea. What are the Conservatives doing on that, a Conservative Party that cares about security or pretends to, anyway? They're filibustering it. They're filibustering witnesses who appear, whom Parliament's paying to fly in. They're making them sit there and watch filibuster debates, one after another.

I appreciate the crocodile tears from the Conservative Party that those of us on the other side of the table aren't taking this seriously. When the chips are down on the public safety committee, it's the Conservatives who don't care, who are not showing that they want to see action and hear from experts. Here we just have a motion, which is a one-liner that we can send to the House of Commons to cripple debate and continue their obstruction in the House of Commons. It's disappointing. Canadians deserve better.

Again, I ask the members here—and maybe it's not Ms. Gallant but the other Conservative members—to please speak to their members on the public safety committee. I really want to get to that study, and I don't want to do this piecemeal, like a one-line report. Let's hear from the RCMP, CBSA, port officials and experts on criminal justice. Let's actually find out. Maybe Ms. Gallant is right. Maybe this money is going to fund terrorism. If that's the case, why doesn't she want her colleagues to stop filibustering in the public safety committee to get to that thorough study that Mr. Strahl—and I believe him—says he wants? Even though his motion for a study is, I think, one meeting with two witnesses.... It's pretty weak tea from the Conservatives, who pretend to care about public safety. Clearly, the Liberals, the NDP and the Bloc care about this issue and want a significant study to look at the actual details so we can provide recommendations.

We need to be better on this, as a country, at all levels of government: municipal police forces, provincial police services, RCMP and CBSA. We need to be looking at this from a holistic perspective. It's easy and great for fundraising emails to say, “It's the federal government's fault.” There are some opportunities that we need to address, but if you're not going to do it in a serious way, it just shows how unserious the Conservative Party is on issues of security and on a lot of different issues. Pound the table. Get angry.

Housing is another example. During question period, there are 45 minutes when the Conservatives pretend to care about housing and security, but when it gets to actual tangible items, they're nowhere to be found.

Filibustering and obstructing, that's all this motion is. It's truly disappointing, once again, to watch the Conservatives go down this path. They used to be serious on issues of public safety, but not anymore.

[Chris Bittle, Liberal, St. Catharines, ON]

Thank you so much.

I sit on the public safety committee, and this is on the agenda for that committee.

Unfortunately, what we're seeing here is that the Conservatives will delay. They talk a good game in terms of an important issue of public safety, which this is. I don't think there's anyone here at this table who believes that this isn't fundamentally important. However, even though there's a study at public safety, we're seeing Conservatives filibuster day after day. We can't get to that study. Here, what do we have? We're taking a headline, and I'm sure it's true, but the Conservatives don't want to have a study. They don't want to look into evidence. They just want to make a statement to bring a concurrence motion in the House of Commons to delay debate, to further the crippling of the House. This is what this is being used for—not for anything productive, not to get to the bottom of things, not to make a reasonable suggestion. This is all this motion is to do.

Even at this committee they're furious about the Infrastructure Bank, and have to find a way to filibuster to get to a report, which is something they want to do. Even their filibusters are conflicting in terms of where they find themselves.

You can see right through this. Again, I appreciate that this is a very fundamental concern for our constituents across the country, but they're not calling for a study. They're just accepting at face value a line from a newspaper report, which again may be true, but they don't want to get to the bottom of it. They don't want to look into things. They just want to have a concurrence debate in the House of Commons to delay legislation that is fundamentally important to Canadians. Again, they don't want to get to the bottom of it.

Really, what they should do is ask their Conservative colleagues on public safety to stop filibustering Bill C-26, so that we can actually get to a study on public safety and speak to not just the CBSA, but to the RCMP, to police chiefs in the greater Toronto area, to port officials.

With respect, this is not the effort that I would expect for a party that says this is a crisis. This is making a statement and delaying debate in the House of Commons, which will produce no recommendations. It's sad actually, if the Conservatives actually believe this is a serious issue and their response is to filibuster in the committee that's seized of the matter, and to have a throwaway motion in this committee so they can delay debate in the House of Commons, not get any evidence, not listen to the experts, because they have all the answers—not the RCMP, not CBSA, not local police chiefs. They have all the answers on this, and it's disappointing to see.

Opposition Motion—Auto Theft

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, one of my Conservative colleagues was honest enough to tell me how he felt about this. These are tactics.

The Bloc Québécois is an opposition party. As everyone knows, the Bloc Québécois will never come to power in Ottawa. We are here to represent the interests of Quebeckers. Even though the current government is not our favourite and we do not always agree with it, we try to study and improve each bill as much as possible and make gains for Quebeckers.

My Conservative colleague told me that his party, as the official opposition, would oppose any bill introduced by the Liberal government to stop it from passing.

The Standing Committee on Public Safety and National Security is studying Bill C‑26 on cybersecurity, which is extremely important, and the Conservative Party is doing everything it can to delay it. The Conservatives always have an issue or a concern that is more urgent, or a motion to move. They are always filibustering, which is unfortunate. People elected us to do important work here in Ottawa, and we are being prevented from doing it because of these tactics. I want people who may be watching at home to realize this, but it is extremely difficult to get the message across.

In any case, we in the Bloc Québécois continue to do our job, and we are very proud of that.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I am delighted to have the opportunity to elaborate on this subject. As I was saying earlier, the Conservatives are finally paying attention. They now realize that this is an important topic and that it might be a good idea to add it to their arsenal of election slogans.

As my colleague from Saanich—Gulf Islands was saying a little earlier, it is true that investigative journalism brought this problem to our attention a few months ago. There are also organizations that come to Ottawa to tell us about certain issues and raise awareness about them.

Last April, I met with people from the Corporation des concessionnaires automobiles du Québec and the Canadian Automobile Dealers Association and they talked to me about this. It is wrong to say that they do not care about this phenomenon because they make money and they will be able to sell a car if a customer has theirs stolen, since they are reimbursed by the insurance company. It is not true that they do not care, because they are here in Ottawa to talk to us about it. They want the government to do something about this problem.

I first became interested in the subject a few months ago. I met with global car manufacturers, who also spoke to me about it. In October, following the feature story aired in J.E, a television program on TVA, and after the numerous news reports of the Journal de Montréal’s investigations bureau, I announced that I was going to move a motion at the public safety and national security committee. I talked to my colleagues about it, because we often see members of certain parties come totally out of left field with a motion on any given subject, thinking everyone is going to accept it as is. It is important to discuss these things with colleagues first and to make them aware of the issue. That is how I came to talk to my Conservative colleagues about the auto theft problem. They seemed to be very interested. When I moved the motion, all parties voted in favour of it. Everyone had a story to tell, everyone had a friend or colleague who had their vehicle stolen. A Conservative colleague even told me that he personally had his car stolen. There was definitely a consensus that this was something we should look into as soon as possible.

At the public safety and national security committee, we were looking at Bill C-20. That was significantly delayed by the Conservative Party for reasons we may or may not be aware of. The same thing is happening now with Bill C-26. The process has been delayed, and our committee agenda has us looking at the bill on auto theft after that. I do not really understand why the Conservatives are trying to delay this study as much as possible, when they are making it a priority today by talking about it. If it were that important to them, they would be working hard on the public safety and national security committee to finally get it done.

With today’s motion, they may be trying to get material for pre-election, or even election, slogans, because we get the impression that the Conservative Party may already be on the campaign trail. The Bloc Québécois did not get the memo. The Conservatives’ new slogan is in today’s motion, which states, “after eight years of soft on crime policies, this Prime Minister has created the auto theft crisis”. Who knew? The Prime Minister himself created the auto theft crisis. He sure has broad shoulders. I am not saying this to defend him. It is true that the Liberals have not done much in recent years to combat this problem. However, that the Prime Minister single-handedly created the crisis is something we cannot take very seriously.

I would even go so far as to say that the entire argument laid out in the Conservatives’ motion is completely disconnected from reality, despite the fact that the problem is all too real. If one looks at the problem with a minimum of seriousness, it is immediately clear that the COVID 19 pandemic in 2020 caused significant disruptions in the logistics chain around the world. One of the most hard-hit sectors was the industry producing the semiconductors needed for all microprocessors. The microprocessor shortage led to a worldwide reduction in auto manufacturing, which made demand go up. This increased the cost of used vehicles. Crime gangs jumped on the opportunity and quickly specialized in car theft and shipment to other markets. This was already happening on a smaller scale, but the pandemic and the impact it had on supply chains accelerated the phenomenon. Because of its geographical location, Montreal became an auto theft hub.

Why was that? Because Montreal is home to the largest port in eastern Canada that provides access to the rest of the world. Of course other ports are involved as well, such as those in Halifax and Vancouver. However, these ports have not been as affected as the port of Montreal. It is truly a gateway, a hub. As I was saying, the pandemic exacerbated the situation but, on top of that, new technological developments have made auto theft more appealing.

For example, consider the increasingly frequent use of smart keys, which make it easier to steal vehicles. Several news reports have shown how thieves go about it. All they have to do is use a relay to amplify the signal of a smart key inside a house by standing next to the front door. With an accomplice, the thief can then open the car door and start the engine.

They can also connect a computer to the onboard diagnostic port in the car, which enables them to use another key. All they have to do then is force open the door.

It is child’s play for people who know what they are doing.

In Montreal, as in the rest of the country, we have seen people using Denver boots or steering wheel locks to make it harder for thieves to steal their car. I say harder, because thieves have found other ways to remove these devices and leave with a car in no time at all.

This phenomenon is truly becoming a scourge, especially in Quebec and in Montreal. Auto theft has increased over the years. According to Équité Association, roughly 70,000 vehicles were stolen in Canada in 2022. That is huge. Between 2021 and 2022, the number of thefts increased by 50%, or half, in Quebec, by nearly half in Ontario, or 48%, by 34% in Atlantic Canada, and by 18% in Alberta. 2022 was a record year for auto theft. The numbers are not yet known for 2023, but by all indications auto theft has increased yet again.

The reported losses are in the billions of dollars for insurers, and we have seen premiums go up for ordinary people. Le Journal de Montréal reported that between 2012 and 2022, the average car insurance premium increased by 50% as well. This increase is in part tied to auto theft.

Given these facts, one of the questions we need to ask ourselves is why there is this growing interest in auto theft.

It must be said that auto theft is one of the easiest and least risky sources of revenue for gangs, which then use part of the proceeds to finance other criminal activities, such as gun trafficking and human trafficking. Those are the two reasons. It is easy and low-risk.

I explained earlier why it is easy. One reason it is so low-risk is that sentences are so light. In an article in La Presse, Jacques Lamontagne, director of investigations for Quebec and the Atlantic region at Équité Association and a retired Montreal police force criminal investigator, explained—

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I will start again. Unfortunately, I do not think anyone heard me. If the member would put his earpiece in, I think that would work even better.

I am pleased to see that the Conservatives have finally realized that there is an auto theft crisis in Canada. I for one have been talking about it since October. I moved a motion at the Standing Committee on Public Safety and National Security to study this issue. The Conservatives agreed to it. They thought it was a good idea, but all they have done since then is hold up the committee's work. That is what they did with Bill C-20 and Bill C-26.

Why are they doing that? The reason is that they do not think that the auto theft crisis is all that important after all.

Why do they want to talk about it today? Is it because it makes for a good campaign slogan? Is it because they want to crack down on crime? Why has this become a priority for the Conservative Party today?

[Kate Robertson]

The amassing of data in any database brings with it attendant security risks. The extent of them I cannot comment on.

I would indicate that your concerns are connected to amendments that we have raised in our brief regarding the handling of data. Right now, the information-sharing powers within the Canadian government that would be enabled by Bill C-26, if passed unamended, are extremely broad.

One limit that we recommended, for example, is that the use of the information being shared should be constrained to cybersecurity objectives, and not piggybacked objectives that are layered on after the fact. Retention limits should be strictly defined to address the very concern that you're raising.

In that way, while there is understandably a need for some examination of critical information to enable that mandate to be fulfilled, it should be very strictly defined within the legislation itself.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Mr. Chair.

Thank you to all the witnesses for being here today.

My line of questioning will be mostly for Ms. Robertson and Mr. Hatfield.

I'm very concerned by the testimony you've shared with me today, in light of the fact that the government itself certainly has been victim of hacking. I recall that Global Affairs was the victim of a recent hack.

I think this is one of the dilemmas of increasing centralization of information, as Bill C-26 purports to do in collecting information on the cybersecurity plans of the designated operators. Is there any guarantee that, when government collects all of this very confidential and powerful information, it is better equipped than some of the best companies in the world to protect that information from hackers?

[Matthew Hatfield, Executive Director, OpenMedia]

Hi there. I'm Matt Hatfield, and I'm the executive director of OpenMedia, a grassroots community of 230,000 people in Canada who work together for an open, accessible and surveillance-free Internet. I'm joining you from the unceded territory of the Sto:lo, Tsleil-Waututh, Squamish and Musqueam nations.

I’d like to ask us all a question: What does cybersecurity mean to you as an individual, as a family member and as a citizen? For me, and for many people across Canada, our cybersecurity is inseparable from our privacy, as so much of our everyday lives is conducted online—much more so since COVID—and none of us feel secure with the thought of being spied on in our everyday lives, whether by hackers, hostile states or our own government. For most Canadians, our cybersecurity is very much about that sense of personal security.

The draft of Bill C-26 you have in front of you threatens that security. It poses enormous risks to our personal privacy, without basic accountability and oversight to ensure that the people given these powers don't abuse them against us. You must fix this.

Exhibit A is proposed section 15.2 of the Telecommunications Act, which grants the government the power to order telcos “to do anything or refrain from doing anything”. There are no limits here, no tests for necessity, proportionality and reasonableness, and no requirement for consultation. The government could use these powers to order telcos to break the encryption we need to keep ourselves safe from hackers, fraudsters and thieves. They could even use these powers to disconnect ordinary people indefinitely from the Internet, maybe because our smart toaster or an old phone we gave our kids gets hijacked by a hostile botnet. Without a requirement that these orders be proportional or time-limited, these are real risks.

It gets worse. The government would be allowed to keep even the existence of these orders—never mind their content—top secret indefinitely, and even if these orders are challenged by judicial review, the minister could bring secret evidence before secret hearings, which flies in the face of basic judicial transparency.

There's no excuse for this. Our close allies in Australia and the U.K. have shown how cybersecurity can be strengthened without compromising fundamental rights. Why do Canadians deserve lesser protections?

All this comes when Parliament is working on strengthening our privacy laws through Bill C-27. I have to ask, does one hand of our government even know what the other is working on?

We recognize that there are very real problems, though, that Bill C-26 is trying to solve. When we read the government's stated objectives, we're on board. Should we protect the digital infrastructure? Sure. Should we remove risky equipment from hostile states? Of course. Should we force big banks and telcos to better protect their customers? Of course. However, we can fulfill these objectives without sacrificing our rights or balanced, effective governance. Let's talk about how.

First, the government's new powers must be constrained. Robust necessity, proportionality and reasonableness tests are an absolute must. An unbreakable encryption is the fundamental baseline that all of our personal privacy depends on, so there must be an absolute prohibition on the government using these powers to break encryption.

Second, privacy rights must be entrenched. Personal information must be clearly defined as confidential and forbidden from being shared with foreign states, which are not subject to Bill C-26's checks and balances.

Third, the government must not be allowed to conceal the use of its new powers under a permanent veil of secrecy.

Fourth, when the use of those powers is challenged in court, there must be no secret evidence. Special advocates should be appointed to ensure all evidence is duly tested.

Fifth, any information the Canadian Security Establishment obtains about Canadians under Bill C-26 should be used exclusively for the defensive cybersecurity part of their mandate. I hope you all remember that NSIRA, the body explicitly established by Parliament to oversee CSE, has complained for years about CSE not being accountable to them. Knowing how difficult it's proved to keep them accountable for their existing powers, please don't grant them broad new powers without tight and clear use and reporting mechanisms.

As other people have said, when cybersecurity works, it's a team sport. It requires buy-in from all of us. We all have to be on team Canada, and we all have to trust in the regulatory framework that governs it. There's zero chance of that happening with Bill C-26 as is. Adequate transparency, proportionality and independent verification are the necessary baseline that this bill has to earn for it to work.

We're going to be delivering a petition signed by nearly 10,000 Canadians to you shortly, folks who are calling for that baseline protection. We urge you to listen to these voters and adopt the amendments package that civil society has suggested to you to get this legislation where it needs to be.

Thanks. I look forward to your questions.

[Kate Robertson, Senior Research Associate, Munk School of Global Affairs and Public Policy, University of Toronto, Citizen Lab]

Good afternoon.

My name is Kate Robertson. I am a researcher at the Citizen Lab, which is based at the University of Toronto's Munk School.

My comments today draw on the Citizen Lab's research on cybersecurity and telecommunications policy, data security, and transparency and accountability mechanisms that are applicable to the relationship between governments and telecommunications providers. My brief, which was submitted to this committee, was written with Lina Li of McGill Law and provides a charter analysis of Bill C-26. Part three of our brief sets out our recommended amendments, building on a report on Bill C-26 written by my former colleague Dr. Christopher Parsons.

There are key recommended amendments that would act as constitutional safeguards in the legislation. This is not to state that they're exhaustively read here.

To protect the rule of law and free expression, orders issued under the legislation must be published in the Canada Gazette. Any exceptional circumstances that might justify confidentiality of those orders should be expressly and strictly defined in the legislation, and should be time-limited.

For privacy rights, the legislation needs explicit protections for personal information, notice requirements, and tighter controls surrounding the sharing and use of personal and confidential information. You'll find proposed terms for those amendments under recommendations 13, 14, 16, 19, 28 and 29 in our brief.

We also reiterate, as others have, that orders issued must be proportionate and reasonable. In particular, the legislation should make explicit that an order compelling the adoption of particular standards cannot be used to compromise the integrity of a telecommunications service, such as by compromising encryption standards. The terms for those amendments are in recommendations one and five of our brief.

It is notable that these amendments are compatible with the government's objective to play an assertive role in protecting Canada's networks. This is not a tug-of-war between competing public interests. This is important, because the courts do not tend to find it reasonable if constitutional rights are infringed upon in a way that is unnecessary. The desire for expediency through Parliament is understandable, but if these issues aren't fixed now by legislators, then the legislation may well be held up in court litigation for years, which ultimately requires additional legislative time to fix.

Amendments to limit secrecy and to require proportionality also reinforce the government's objective of protecting our networks. I agree that, as was said last week, cybersecurity is a team sport, and I agree with Mr. Warnell's comments on the same subject. Effective cybersecurity integrates expertise from across a range of sources, including regulators, industry, civil society, academic and security researchers, and data journalists.

Dr. Parsons' report on Bill C-26 last year, as well as this committee process itself, illustrates how industry and independent expertise can provide a path forward for improving the legislation without detracting from the bill's core mandate. Public transparency will be an effective way to garner expertise from these sources as the legislation is implemented over time.

The Citizen Lab's recent report, “Finding You”, which is appendix C to our brief, underscores how secrecy at the regulatory level has led to serious “geolocation-related threats associated with contemporary networks”. The report documents persistent vulnerabilities at the heart of the world's mobile communications networks. It notes, “The failure of effective regulation, accountability, and transparency has been a boon for network-based geolocation surveillance.” In other words, when network standards and regulations are shrouded in unnecessary secrecy, this enables network insecurity to fester.

Similarly, without proportionality and transparency, Bill C-26, unamended, could enable successive governments to actually undermine network security, and ultimately human security, through orders that would drill holes in encryption standards in telecommunications networks.

[Todd Warnell, Chief Information Security Officer, Bruce Power]

Thank you, Mr. Chair and members of the committee.

My name is Todd Warnell and I am the chief information security officer at Bruce Power.

Established in 2001, Bruce Power is Canada's only private sector nuclear generator, annually producing about one-third of Ontario's power, as well as life-saving medical isotopes used around the globe to fight cancer and sterilize medical equipment.

I'm grateful for the invitation to participate in your review of Bill C-26. Today, I will focus my comments on part 2 of the bill, namely, the critical cyber systems protection act.

I'm here before the committee to provide a perspective that proceeding with the implementation of Bill C-26 is of vital importance to the safety and security of all Canadians. Canada has prospered over the last four decades through a period of relatively stable and predictable global relations. However, that period of stability and predictability is changing amidst a backdrop of global geopolitical tensions and changing global dynamics. Ensuring the safe and reliable delivery of critical services that Canadians depend upon every day is not, and cannot be, a political issue.

Within Canada's nuclear industry, we have seen and demonstrated that through collaboration with governments, regulators, industry, academia, and individual Canadians, we can be successful in establishing and regulating cyber systems that are important to the safe and reliable operation of critical services.

The critical cyber systems protection act would introduce a broad framework from which all critical sectors, in collaboration with government and regulators, can develop and implement risk-informed and performance-based regulation to enhance the reliability and resilience of critical services. The committee should consider ways of ensuring that appropriate checks and balances are in place for any directives issued to address a risk or threat to Canada's critical cyber systems.

Harmonizing Canada's cybersecurity framework across critical sectors through Bill C-26 would also align our approach with our closest allies and avoid our being left behind as our allies move forward with enhancing their respective national cyber resilience programs and driving innovation that can enhance our collective capabilities in protecting ourselves and detecting and responding to a changing threat landscape.

In conjunction with Bill C-26, we urge lawmakers to review and consider the amendments to the CSIS Act, to enable Canada's intelligence community to exchange and co-operate on cyber-threat intelligence with Canada's public and private sector operators in both a proactive and preventative manner.

Thank you for the opportunity to address the committee today.

I look forward to your questions.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Ms. Bahr‑Gedalia, you spoke earlier about introducing a 72‑hour deadline to give companies time to report an incident to the government.

In the current version of Bill C‑26, it says that incidents must be reported as soon as they occur. You believe that the deadline you are proposing could give businesses a boost. I also think that 72 hours would be a good time frame, particularly to manage the additional paperwork that this bill will create.

As a chamber of commerce representative, you surely talk to companies and must know their opinion on this bill. What are you hearing from them?

What are the arguments behind the proposal to give them a little more time?

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you, Mr. Chair.

Once again, the Conservatives talk tough on crime. Mr. Brock can raise whatever supposed conversation he claims to have heard, because I guarantee it didn't exist, but I heard him talk about not even knowing what committee he was coming in to filibuster or what issues it was on.

It's been demonstrated very clearly that the Conservatives had time to ask questions and didn't bother.

I'll move to the witnesses on Bill C-26.

Mr. Shipley, you talked about the importance of this legislation. You raised examples of a natural gas pipeline that was hacked and what that does for critical infrastructure, including workers who might work in the energy industry. What happens if Canada is not prepared for a cyber-attack in our energy industry?

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

I'm actually really pleased that my colleague did that, because it just goes to show the immaturity the Conservatives are showing every day that we have been studying Bill C-26. They haven't asked a single question.

I overheard Mr. Brock, after his filibuster the other day, ask what we were studying and whether this was the first day we were on it.

They don't care about security or safety.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you, Mr. Chair.

Once again, it's fake outrage for the Conservatives while the cameras are rolling. Once we get through Bill C-26, auto theft is the very next study, which Madame Michaud brought forward, that we would be dealing with. I also find it incredibly ironic that—

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you.

I find it hard to understand why the Conservative Party wants to table a notice of motion on auto theft in the Standing Committee on Public Safety and National Security, when the committee has already voted in favour of a motion on auto theft that I tabled a few weeks ago. I don't understand that. In addition, we are supposed to study this subject in a few weeks, possibly after the study of Bill C‑26. So I'm wondering about the need to table a new notice of motion on the same subject.

Thank you.

[Daina Proctor]

Thank you for the question.

To bring both of your questions together, wherein you were asking about the risk of not acting, in IBM we operate with, partner with and strategically advise over 1,700 organizations. Admittedly, they're not all in the direct scope of this, but they would be impacted through the passing of Bill C-26. Many of those organizations struggle. Many of those organizations are focused on Canada. Many of them are focused on multinational. By not acting within Canada, we are, in effect, encouraging those organizations to pause on Canada.

We don't have the regulations. We don't have the definitions. We don't have the laws in place for them to understand the arena they're playing in within Canada. This bill languishing is causing that pause to get larger.

From a collective individual perspective, it also shifts into the mindset of our resources, our teams and our neighbours. Our graduates—our children coming up through education —challenge what Canada's position is on cyber risk and cybersecurity, not just for the critical infrastructure that we need to run and operate, but for the employment opportunities that we have and that our organizations have.

[Ulrike Bahr-Gedalia]

It is very critical. That's a definite “yes” that we should act in a timely manner.

I would also like to emphasize that we need to get it right and not rush through it in a way that.... I'm a little hesitant to name a time frame because the focus should be on all the challenges we pointed out and addressing these properly.

Comments were made as well on national cybersecurity strategies and plans in other countries and so forth. We don't have our national cybersecurity strategy yet launched. We greatly look forward to what the Canadian Chamber has fed into the submission, because for me and our members it would provide the broader, overarching picture of cybersecurity per se. Bill C-26 would be one part of that strategy. It's a holistic view and a comprehensive approach there.

Lastly, I wanted to make one comment in terms of time and I lost my train of thought there. You had another follow-up question to Mr. Shipley, I think. Could you please remind me what it was?

[Ulrike Bahr-Gedalia]

Mr. Shipley started with one example.

If you think about cyber incidents and threats, I don't think we can even keep up with any records and reporting in terms of how many there are a day. MP O'Connell, you mentioned Atlantic Canada, the Newfoundland health care infrastructure that was impacted as well. It's a snowball effect. If one portion of critical infrastructure gets impacted, it impacts our economy and society, and it also impacts how foreign direct investment will happen in the future. How do foreign entities see us? Do they want to settle in Canada? Do they want to build a future here as businesses, as communities and as talent?

I see it as a two-way.... While we have trouble in front of our own door, within the country, it is also on a global level. How do we get perceived and how do we best align ourselves and ensure that we are...? This is the cyber tag line right now: Lead the global cybersecurity future and be the most secure country on the planet. Canada can be that, and I think Bill C-26 is a step forward, but we need to speed it up a little, as it has already been in discussion for quite some time.

Thank you.

[Daina Proctor]

Perhaps I can clarify that as well. My apologies if, during my opening statement, I indicated otherwise. Adherence isn't necessarily the encouragement that we would be offering. It's more that a number of aspects of Bill C-26 are much more far-reaching than established international standards for mature cybersecurity regimes, of our allies in particular.

It's not necessarily adherence to them, but more a recognition that we don't necessarily need to go beyond what they're already working towards in their private and public partnership and enablement of the industry.

I hope that gives a little bit of clarification. It's not necessarily an alignment to international standards, but a “not going farther than”, as we try to work together to bolster our critical infrastructure.

[The Vice-Chair, Conservative, Doug Shipley]

I would ask the clerk to take a recorded division, please.

(Motion agreed to: yeas 6; nays 4)

We will move on and get back to Bill C-26.

We'll start with six minutes for questions.

I believe Mr. McKinnon is first.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Mr. Motz seems to want to read the entire text of the judge's decision. At our last meeting, he didn't give his colleagues an opportunity to speak to his motion. I don't know if he intends to do the same thing today. I guess we won't have time to ask the witnesses questions.

I'm wondering if he can tell the committee how long he intends to speak on this. We must not waste the witness' time. They made the effort to come here to give us their comments on Bill C‑26.

If not, I will move that we vote on Mr. Motz's motion so that we can get back to studying the bill. That said, I don't know if he agrees with my proposal.

[Daina Proctor, CyberSecurity Service Line Executive, IBM Canada]

Thank you.

My name is Daina Proctor. I'm the Canadian cybersecurity executive with IBM Canada, and it's a pleasure to be with you today speaking on the topic of Bill C-26.

There are three items that I would like to talk about with you today.

The first one is clarifying the core definitions within Bill C-26. Currently, Bill C-26 leaves much of the scope of the legislation to regulations. We believe it's critical to clarify the scope and the definitions in the legislation itself rather than delegate to the regulatory processes. Key terms used in the proposed law, such as “designated operators”, “confidential information” and “security incident”, are either too broadly described or not adequately articulated. We believe this committee should aim to address these definitions as much as possible, as this will enable a common understanding, increase enforceability and speed up the review when it comes time to draft the ensuing regulations.

Second is alignment with international standards. Canada's strategy and approach should be inserted into the collective efforts of our international community. As drafted, Bill C-26 carries various provisions that are not aligned with other mature cybersecurity regimes. The legislation does not differentiate between security levels of breaches. Furthermore, it includes potential incidents within the scope of its incident-reporting obligations, which could serve to overwhelm regulators with unnecessary and unhelpful information and place an unnecessary burden on industry.

The legislation's “immediate” reporting of cyber incidents, without a formal definition as to what would constitute “immediate”, is also problematic. Most jurisdictions allow for a 72-hour reporting window to allow injured parties to understand what has transpired, which in turn ensures that regulators receive a comprehensive report about actual findings.

The court has unfettered and overly broad jurisdiction when, under an act, it can impose criminal conviction, imprisonment terms, uncapped fines and personal liability, with administrative monetary penalties in the amount of $15 million that can accrue. This represents an entirely new regime and significant penalties far above those under other comparable pieces of legislation. The severity of such penalties and the enforcement action that may be taken will invariably create a chilling effect. Respectfully, the enforcement action that may be taken against individuals should be removed, or to the extent that such liability is considered necessary and proportionate, at a minimum there should be a defined standard to demonstrate the objective and substantiated culpability.

Last is avoiding government overreach. While IBM recognizes the need for compliance oversight, we specifically suggest clarification and refinement of the authorized powers belonging to the regulatory authority or persons who have the ability to enforce the provisions: namely, the ability to attend facilities, examine documents and records, and mandate internal audits, as well as unilateral broad discretion to impose remedial actions—all of these. We strongly encourage that these regulatory authorities and government access rights be limited in their scope and limited to certain critical situations that meet specific non-compliance thresholds.

In conclusion, IBM believes that the clarity around key definitions, enhanced harmonization with international standards and clear safeguards from potential government overreach would strengthen Bill C-26's mandate.

Thank you for your time. We welcome and look forward to addressing your questions.

[Tiéoulé Traoré, Government and Regulatory Affairs Executive, IBM Canada]

Thank you, Mr. Chair.

I'm Tiéoulé Traoré. I'm the head of government and regulatory affairs for IBM Canada. On behalf of IBM Canada, I would like to thank this committee for the opportunity to testify on Bill C-26, and more specifically on part 2, the focus of our testimony.

The digitization of the global economy has increased the need for government and businesses to protect themselves from constantly evolving cyber-threats. Strong cybersecurity protocols should be viewed as digital foundations for all entities seeking to maximize the power of tools such as cloud, AI, and quantum computing.

IBM Canada fully supports the principles of Bill C‑26.

Indeed, Canada must ensure that its critical infrastructure is properly protected from cyberthreats. The skyrocketing number of cyber‑attacks is a global phenomenon that does not spare our country, so action is crucial.

However, to maximize the real impact of Bill C‑26, we argue that it should be amended by this committee. The focus should be on three points: clarifying definitions, aligning the bill with international standards and avoiding potential excesses.

My colleague Daina Proctor will now go through each recommendation.

[Ulrike Bahr-Gedalia, Senior Director, Digital Economy, Technology and Innovation, Canadian Chamber of Commerce]

Mr. Chair and members of the committee, good afternoon. My name is Ulrike Bahr-Gedalia, and I'm the senior director of digital economy, technology and innovation at the Canadian Chamber of Commerce. I'm also the Canadian Chamber's architect and policy lead for the digital economy committee's future of artificial intelligence council and the “Cyber. Right. Now.” council.

As Canada's largest and most activated business network, representing over 400 chambers of commerce and boards of trade and more than 200,000 businesses of all sizes from all sectors of the economy and from every part of the country, the Canadian Chamber is pleased to have this opportunity to provide feedback on Bill C-26.

Our “Cyber. Right. Now.” council has been calling on government to prioritize cybersecurity and focus on a prevention-first approach and improved information sharing for close to three years. Today I'd like to share a few key recommendations and why cybersecurity is important to the Canadian Chamber and our members within the Canadian economy.

Over 98% of Canadian businesses are small or medium-sized enterprises. SMEs need greater cybersecurity threat awareness, protection and training to utilize the full suite of tools at their disposal and to keep Canadians safe from bad actors. Like other countries, Canada is facing an increasingly complex and risk-prone digital landscape. With a cybersecurity skills gap of some four million people globally, and an ever-increasing number of connected devices—at least 67 billion and counting—the challenges and costs associated with securing our digitally enabled world are increasing. But while every organization of every size and in every sector is at risk of a cyber breach, few carry the same real-world risk of a crippling cyber-attack as those in the critical infrastructure sector. This threat will only grow as our critical infrastructure increasingly relies on software and connected technology to power and support its operation.

We are pleased to see Bill C-26 proceed to committee study, and we support the bill overall. However, certain amendments are needed to ensure that the bill reaches its full potential. More specifically, our telecommunication members have expressed their concerns with respect to a few provisions in the Telecommunications Act, such as the lack of a due diligence defence for violations under section 15 in part 1, resulting in monetary penalties, and the extent of ministerial order-making powers. I will note that this defence is present elsewhere in Bill C-26, such as in relation to cyber directions in part 2, the CCSPA, as well as full due process for and parliamentary oversight of ministerial orders. I encourage the committee to reach out to the telecommunication providers, as it's important to hear from them first-hand.

With respect to the CCSPA, our members are seeking the following improvements.

The first is a clearer definition of a reportable cybersecurity incident. This will ensure that industry isn't forced to report events that do not pose a material threat to a vital system. Failure to clearly define the parameters for a reportable incident will undermine the purpose of Bill C-26 and overwhelm government authorities, who will have to process and assess each cyber incident reported.

The second is allowing for a 72-hour reporting period for cybersecurity incidents, as opposed to immediate reporting. Allowing for reporting within 72 hours provides organizations the time to investigate, and will harmonize with existing regimes, such as in the United States, one of our key trading partners.

Finally, two-way information sharing is crucial. As currently drafted, the CCSPA only contemplates one-way information sharing from designated operators to the government. We believe this is a missed opportunity and a potential weakness, and it underscores the prevention-first approach I noted earlier. The more information we have, the more we can work together and the better we can help prevent incidents.

Thank you for listening and for the opportunity to participate in the study of Bill C-26.

[David Shipley, Chief Executive Officer, Beauceron Security]

Good afternoon.

My name is David Shipley, and I'm the chief executive officer and co-founder of Beauceron Security Inc. I'm also the co-chair of the Canadian Chamber of Commerce's cyber council. I'm a proud Canadian Forces veteran, having served with the Canadian Army Reserve in the 8th Canadian Hussars.

I'm not a computer scientist. My expertise and perspective today are based on my experience as CEO and co-founder of Beauceron. I do not see cybersecurity as a technological issue. It's a people and business risk issue.

I founded Beauceron Security in 2016. We now serve more than 750 organizations in Canada, the United States, Europe and Africa. We have helped more than 650,000 people learn how to spot, stop and report cyber-attacks. Beauceron Security has demonstrably reduced individual and organizational cyber risk. Our made-in-Canada solution is used by global banks, national telecommunications carriers, educational institutions, health care facilities, government and small business.

We live in a world where North Korean hackers steal billions of dollars of cryptocurrency to fund their nuclear weapons programs. Something that 25 years ago would have sounded too far-fetched to be even the plot of a James Bond movie is an all-too-real reality and is contributing to global instability today. It's also a world where a Canadian federal government IT worker by day becomes one of the most successful ransomware affiliates by night, making millions of dollars as a digital extortionist for an international criminal gang.

I share these real-life examples because they highlight the first point I want to make. When it comes to cyber, anything, even the bizarre, is not just possible but it is the norm. The challenge of managing cyber risk is to balance the incredible creativity of humans with the unpredictability of complex digital systems.

I know that for many this topic can be overwhelming. Many feel that they do not have the technical background to think about these issues. You may also feel, as legislators, that it is difficult to wrestle with this law.

However, please, this is not a technology issue. Throughout my career in cybersecurity and as a CEO of Beauceron, the root cause of every single cyber incident our customers and we have ever helped investigate has always been traced back to a combination of people, process, culture and technology. Cybersecurity has never been about technology alone, and it can never be solved by technology alone. The story is, has always been and will continue to be about the relationship between technology, people and control—which is, by the way, the actual meaning of the word “cyber”.

Reducing cyber risk to Canadians will require legislation and a regulatory regime tailored and developed collaboratively with industry. These regulations and directives must look at people, process, culture and technology-based risk controls.

I support the need for this legislation. We need this law now more than ever. We are far behind our allies, and we are risking the safety and prosperity of Canadians every day we delay. This legislation and the accompanying regulatory regime must ensure that a proactive, positive security culture is instilled and maintained within Canada's critical infrastructure firms. With some fine-tuning, I believe it can accomplish these goals.

I support the recommendations put forward by the Canadian Chamber of Commerce to improve the bill to ensure fairness, effectiveness and proportionality of the proposed legislation. In addition to their recommendation, I urge this committee to look at the following issues.

Number one, add due diligence defences to the proposed administrative monetary penalties. We need to create positive reasons to invest in security and compliance with legislation, and not just negative consequences for failure.

Number two, remove personal liability for individuals. At a time when the cybersecurity labour shortage is most acute, and when as many as 75% of the most senior cybersecurity leaders are considering a career change out of cybersecurity, adding a target on their heads will only make things worse and subvert the objectives of this legislation.

Number three, ensure regulators charged with creating industry-specific cybersecurity directives have the skills required to do so effectively. While regulators such as the Office of the Superintendent of Financial Institutions are experienced, others are being given responsibility for cyber for the first time. This legislation should require government collaboration with industry, such as what has already been done with the Canadian security telecommunications advisory committee.

Lastly, considering the recent news about Global Affairs, this legislation should limit the amount of sensitive data collected by regulators about cybersecurity defences of Canadian critical infrastructure, lest we inadvertently create a one-stop shop for hostile nation-states and criminals to learn how to cripple these vital sectors and firms.

The opportunity before you with Bill C-26 is to ensure that the Canadian people—

[The Vice-Chair, Conservative, Doug Shipley]

I'll ask the clerk for a recorded vote on that, please.

(Motion agreed to: yeas 6; nays 4)

We will start with Bill C-26.

I have a nice preamble here to introduce everybody. To save some time and to give you folks a little bit more time, maybe you could—I know this is very informal—say your name at the beginning of your five minutes, and that will hopefully give you guys a little bit more time, because we've already lost some time going into this.

We will start with our witnesses.

Mr. Shipley, do you want to go first? It rolls off the tongue nicely, doesn't it, Mr. Shipley?

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

I move my motion that we move to the business of Bill C-26.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Mr. Chair, I move that we move to the business of Bill C-26.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

If you want to move a dilatory motion not to go to Bill C-26 and deal with that, then I think you can explain that to Atlantic Canadians today, too.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you, Mr. Chair.

Mr. Motz just made the point. He moved to suspend the debate. There was no clarification on when that debate would then continue. We moved on to Bill C-26. The meeting was not suspended; the meeting was adjourned.

There is a new notice of meeting. Therefore, if you would like to lift the suspended debate back to the floor, you would require a dilatory motion. It doesn't just continue, because the meeting was adjourned and the debate was suspended. However, there was no time and place given, and there was no agreement that it would start off at the beginning. If you can point that out in the blues, I'm happy for you to read that, but I know it doesn't exist.

Therefore, you require a motion to bring the suspended debate back to the floor. Otherwise the notice of meeting is here, and that's what we move forward on, because the meeting itself was adjourned.

Again, we have witnesses here. The Conservatives don't seem to care about safety. I find it interesting, Mr. Chair, on this point, that today we're seeing historic snowfalls in Atlantic Canada, where Canadians, the people there and in Cape Breton in particular, are worried about being able to get out, being able to access resources. In Bill C-26, actually part of this legislation deals with ensuring the sustainability of telecoms so that in the event of a natural disaster, like what we're seeing in Atlantic Canada right now, there are literal lifelines still available—

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Thank you to the witnesses for giving their valuable time to be here with us on this study.

Mr. Shull, I liked your opening remarks. You cut to the chase, as they say. I appreciate that.

I've spoken to a few groups outside this committee, and most of them think that Bill C‑26 is a great step forward. Overall, they feel it's a good thing.

However, they have two key criticisms.

First, they are criticizing the fact that government is being given a great deal of power. This bill gives certain ministers the freedom to issue orders in council and interim orders, but it doesn't necessarily provide any details on that. We don't know how that might look.

Second, they find the sanctions too severe. You talked about tax incentives. If I'm not mistaken, rather than imposing sanctions, you're proposing that tax benefits or incentives be put in place for companies that would be required to set up a cybersecurity framework, for example. You look at the issue from another angle: We should make participation a little more voluntary, while ensuring compliance and making sure the information exchanged is protected.

Can you tell us a little more about that?

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you very much, Mr. Chair. I would like to add my thanks to the witnesses for being here today in person and virtually.

Mr. Shull, I want to start with you.

First, thank you for using your opening remarks to provide solutions and ideas. In fact, that's why we're here. We're looking for ways to improve on Bill C-26 and ensure that we have a bill that protects Canadians while also ensuring that we protect their constitutional rights.

My first question for you is with regard to mandatory reporting for affected sectors and when there's a cybersecurity incident. Why is it important that we have that mandatory reporting?

[Sharon Polsky, President, Privacy and Access Council of Canada]

Thank you very much.

Thank you for inviting me to appear on behalf of the Privacy and Access Council of Canada, an independent, non-profit, non-partisan organization that is not funded by government or industry.

Our members, like everybody in this room and the rest of us who use the Internet, can thank Sir Tim Berners-Lee, whose brainchild became the web we know and love—or love to hate. It's a source of news and views, ones that might be at odds with our own, where we can freely find and share information. It is that very freedom that is now under threat, with democratic governments leading the charge.

Canada's government has said that controlling Internet content is vital to protect democracy and social cohesion and has pointed to the January 6 insurrection in Washington, D.C., which by all accounts was organized online. It has crafted several laws to protect us from potential danger.

Of course, Bill C-26, which is one of them, is to provide a framework for the protection of the critical cyber-systems that really are vital to national security and public safety. Bill C-26 allows Canada to take strong action against threats to the security of its telecommunications sector, but also so very much more. To start, it applies to six critical infrastructure sectors, but that is just the start.

As referenced by Ms. Baron, any service, system and class of operator can be designated as a vital service or system. Every company is at risk of falling under the bill's sweeping powers, and being required to do, or refrain from doing, anything they are ordered to do, such as create back doors and break encryption or go on a fishing expedition to find whatever information the government wants—including what's in your emails and your texts, your cellphone and vehicle locations, purchaser or purchasing information, or donor details—so that it can make an order. The order will be secret until the target realizes something is up, because just disclosing the existence of orders made under this bill will be illegal.

With a nod to eastern European regimes 100 years ago, this bill lets the minister compel any person, under threat of punitive fines, to provide any information, within any time, subject to any conditions that might be specified, or authorize anyone to enter and seize any information and systems, but without the checks and balances that are a mainstay of democracy.

Notably, there is no requirement for those timelines or conditions to even be achievable. The bill does not limit compelled information to corporate or operational. There is reason for that, but it provides a dragnet for unsupervised collection, use, and broad disclosure of personal information, threatening individuals' privacy and making it impossible for organizations to comply with privacy laws or provide accurate responses to access to information requests.

Sadly, the bill makes no mention of consulting the Privacy Commissioner to ensure that personal information is adequately safeguarded. While the bill specifies that corporate information may be designated as confidential, it offers no such consideration for personal information. The bill's vague language opens the door to telcos and ISPs being given unreasonable orders to spy on or deny service to any person, company or group whose conduct or commentary the government deems a threat to the security of Canada.

To encourage voluntary compliance, the penalties are steep and unaffordable by all but the largest of organizations. In the manner of the Salem witch hunts, anyone who fails to pay the penalty or dispute the notice, and anyone who does pay, is “deemed to have committed the violation”. Either way, businesses pass their costs and fines along to consumers, so penalties will reduce competition by eliminating organizations that can't afford the fines. Consumers will end up covering the penalties paid by those that are large enough to afford them.

Incentives like that can be a strong motivator. Some would call it coercive, since companies and people eager to retain their hard-earned money and avoid fines are easily nudged to simply do as they're told, while the government will be shielded from claims of overreach, since it won't be the government but the organizations voluntarily complying with orders that will be the ones violating charter-protected freedoms.

In our view, allowing Bill C-26 to become law in its current form, and granting elected representatives and unelected bureaucrats overly broad and unaccountable authority, will further undermine public trust in the government, public service and federal institutions, and further foster a technocracy built on Sir Tim Berners-Lee's brainchild. Canadians deserve better.

We would be happy to help by providing additional information and suggested amendments.

[Joanna Baron]

Thank you very much.

I'm here, of course, to address Bill C‑26. This is a bill that grants the government sweeping new powers. We have concerns that there is no accompanying regime of checks and balances to safeguard rights. I'd like to speak to some of these points on behalf of a legal charity dedicated to defending fundamental freedoms.

As drafted, the bill threatens to undermine our privacy rights as well as the principles of accountability and due process, which form the bedrock of our democracy. The powers proposed by the bill risk impacts on the charter-protected rights of privacy, freedom of expression, equality and the right against unreasonable search and seizure.

Of course we understand that cybersecurity is a huge imperative. We do not believe or accept that cybersecurity ought to come at the cost of civil liberties.

The proposals that the CCF is pleased to sign on to, along with other civil liberties groups, align with other international approaches such as those taken by our partners in the U.K. and Australia, both of which place a far greater emphasis on proportionality, accountability and privacy rights.

The issues raised by this bill apply to Canadians in our everyday lives. For example, under the bill, if someone's device or smart appliance were hacked and used to target a government website, the federal government could order their telecom service to be shut off in an order that could be kept secret from the public. The affected person or business would never even know that it was the government that ordered their service disconnected.

The bill also does not provide a mechanism for restoring service to individuals or businesses who lose it, which obviously interferes with basic livelihood in 2024.

I'll speak to a few substantive issues.

The bill raises the spectre of new and pervasive surveillance obligations. It empowers the government to secretly order telecom providers to “to do anything, or refrain from doing anything” . This opens the door to new obligations on private companies as well as to other risks of encryption standards, which pose an inconsistency with privacy rights.

There are no guardrails in the bill. The bill lacks proportionality, privacy or other checks that might constrain abuse of the new powers it grants the government. These are powers that are backed by steep fines and even potential imprisonment for non-compliance.

We propose adding a proportionality test and an obligation to consult with experts to help ensure that the minister does not use small problems to justify disproportionate actions. Adding a proportionality requirement will bring Bill C‑26 more in line with our counterparts in Australia and the U.K.

Next, I'd like to talk about some privacy concerns.

The bill empowers the government to collect broad categories of information from operators. It may be enabled to obtain identifiable personal data, which can be distributed to domestic and other, perhaps foreign, organizations. The bill does not have a mechanism for limiting what Ottawa can do with the data it collects, nor does it specify periods for data retention or measures to deal with possible negligence with people's data.

We find that the secrecy provisions undermine accountability and due process. The bill enables the government to shroud its orders in secrecy with no mandatory public reporting requirements. Of course we understand the need for confidentiality, but the public ought to have a sense of how these powers are being exercised, and to what effect, if our elected decision-makers are to be held to account.

This excessive secrecy has clear implications for the freedom of expression rights of the public as well as the media, as protected by section 2(b) of the charter.

Finally, I'd like to speak about the use of secret evidence in court, which is authorized by Bill C‑26.

Even if security orders made under the act are subject to judicial review, the bill could restrict applicants' access to evidence, which is a violation of the rules of natural justice. The minister is permitted to request that some of the government's evidence be heard in camera solely by the judge. The applicant for the review is not permitted to access information that—this is from the statute—“in the judge’s opinion...would be injurious to international relations”—

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Yes.

I know he's an NDP colleague, but I actually like Peter. If we could adjourn this debate on this motion, and in the time that we have remaining go to Bill C-26, I'm fine with honouring his request.

[The Chair, Liberal, Heath MacDonald]

We will continue with the meeting, but before we go any further, Mr. Holland and Mr. Neiman have other engagements, so I'm going to ask....

First of all, thank you for coming. Your testimony will be extremely important for Bill C-26.

I will ask you a question in case we don't have an opportunity to have you back, if that's appropriate, Mr. Clerk, and I hope it is. If we could ask for a brief of your notes that you were going to discuss with us today, we would certainly appreciate that so that we could put those into the report.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

I have a point of order, Mr. Chair.

I'm listening to Mr. Motz, and it seems to me that the motion he's introducing today could be presented to another committee, such as the Special Joint Committee on the Declaration of Emergency, which has already studied the invocation of the Emergencies Act. Do you know that Mr. Motz himself is vice-chair of that committee? He could very well introduce this motion to that committee. That way, the Standing Committee on Public Safety and National Security could focus on studying Bill C‑26. I suggest he do that. It would be much more efficient if this motion were studied by the Special Joint Committee on the Declaration of Emergency.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I don't know. It could be a couple more days, to be honest with you, and I apologize to the witnesses.

The issue that we as a committee and that government should be seized with is remedying the egregious overreach of the act, so quite honestly....

I again apologize to the witnesses. Bill C-26 is important, but to me, this issue supersedes it. Bill C-26 has been on the books since 2022, so—

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you.

I don't know if Mr. Motz could tell us how much longer he will be. I understand that the purpose of introducing his motion today is to delay the study of Bill C‑26 . However, we have guests here who have prepared to testify, who have prepared a brief and who have interesting information to share with us to help us do our work on the study of Bill C‑26. That would be of great benefit to all committee members. We have only a few minutes left to ask them questions. According to the schedule, we will change panels for the next hour of the meeting.

In short, I don't know if Mr. Motz can tell us how much longer he will be. Personally, I find that this shows a great lack of respect for the witnesses here today.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you very much, Chair.

Thank you to the witnesses for being here.

While I and my colleagues certainly agree that Bill C-26 is an important piece of legislation that has been a long time coming, and that we need to protect our critical infrastructure, I'm going to take this opportunity to move the following motion, which has been properly placed before the committee:

That in light of the recent Federal Court ruling, which found that the government's use of the Emergencies Act in February of 2022 was illegal and that the special criminal laws subsequently created by the Liberal Cabinet were an unconstitutional breach of Canadians' Charter rights, the Committee undertake a study, pursuant to Standing Order 108(2), of the Department of Justice's role in supporting the government's illegal and unconstitutional decisions concerning the Emergencies Act, together with the consequences which follow the Court's decision, provided that

(a) the Committee invite the following to appear, separately, as witnesses for at least one hour each:

(i) the Honourable David Lametti, the Minister of Justice and Attorney General of Canada at the time;

(ii) the Honourable Marco Mendicino, the Minister of Public Safety at the time;

(iii) the Honourable Arif Virani, the Minister of Justice and Attorney General of Canada;

(iv) representatives of the Canadian Civil Liberties Association, and

(v) representatives of the Canadian Constitution Foundation; and

(b) an order do issue for all legal opinions which the government relied upon in determining that

(i) the threshold of “threats to security of Canada”, as defined by section 2 of the Canadian Security Intelligence Service Act, required by section 16 of the Emergencies Act, had been met;

(ii) the thresholds required by paragraphs 3(a) or (b) of the Emergencies Act concerning a “national emergency” had been met;

(iii) the situation could not “be effectively dealt with under any other law of Canada”, as required by section 3 of the Emergencies Act;

(iv) the Emergency Measures Regulations were compliant with the Canadian Charter of Rights and Freedoms, including the analysis relied upon by the Minister of Justice in discharging his responsibilities under section 4.1 of the Department of Justice Act, and

(v) the Emergency Economic Measures Order was compliant with the Canadian Charter of Rights and Freedoms, including the analysis relied upon by the Minister of Justice in discharging his responsibilities under section 4.1 of the Department of Justice Act,

provided that these documents shall be deposited with the Clerk of the Committee, without redaction and in both official languages, within seven days of the adoption of this order.

Now, it's critically important that we understand why we are bringing this motion forward. It is very important to remember that the Federal Court rendered a decision last week that was critically important, and it should have been a landmark for this country and for this government.

In order for us to have a clear understanding of what the Emergencies Act was about—how it came to be—and of the decision of this Federal Court and all those sorts of different nuances, I want to take some time just to provide a very paraphrased version, a summary, of the Federal Court—just a couple of pages.

In Ottawa on January 23, the Honourable Justice Richard Mosley of the Federal Court issued his decision. In part, it read as follows:

Summary: Four groups applied for judicial review of the decision by the Governor in Council [GIC] to declare a Public Order Emergency under the Emergencies Act....

The February 14, 2022 Proclamation Declaring a Public Order Emergency [the “Proclamation”] and the enactment of temporary special measures in order to deal with protests in various parts of the country—which included the occupation of the downtown core of Ottawa and blockades of ports of entry—were under review.

The decision went on to say:

This was the first time the Act was invoked since its enactment in 1988. The Proclamation, the Emergency Measures Regulations [the “Regulations”] and the Emergency Economic Measures Order [the “Economic Order”] adopted under the Act had a threefold impact: a) they prohibited a range of activities relating to protests in designated areas, b) they required third parties to assist police in ending the protest and c) they authorized financial institutions to disclose information on designated persons and entities to federal officials, and to suspend their accounts.

The Applicants/Parties raised issues which lead to the following...questions:

1. Was the Proclamation unreasonable?

With respect to the first question, the Court considered the decision under the reasonableness standard of review and concluded that the answer was yes, the Proclamation was unreasonable and illegal (“ultra vires”) of the Act.

Those of you who are lawyers will understand “ultra vires”.

The court said that they acted “beyond one's legal power and authority”. That's what the Latin term “ultra vires” means. It literally means that it's beyond the scope, or in excess of, power and authority.

Judge Mosley's decision continued:

While the Court recognized that the occupation of downtown Ottawa and the blockades of the ports of entry were matters of serious concern calling for government and police action, the threshold of national emergency required by the Act was not met. Under paragraph 3(a) of the Act, a national emergency is an urgent and critical situation that exceeds the capacity or authority of the provinces to deal with it, and that cannot be effectively dealt with under any other law of Canada. The Proclamation applied the temporary special measures in all of Canada's provinces and territories, despite the lack of evidence that it was necessary. Apart from the situation in Ottawa, the police were able to enforce the rule of law by applying the Criminal Code and other legislation.

While the conclusion that the Proclamation was illegal (“ultra vires”) was sufficient to dispose of the applications, the Court addressed the other issues should it be found to have erred in its findings on the first question.

Second, the Court considered the threshold for “threats to the security of Canada.” Section 2 (c) of the Canadian Security Intelligence Service Act [CSIS Act] defines threats to the security of Canada as “activities...directed towards or in support of the threat or use of acts of serious violence against persons or property for the purpose of achieving a political, religious or ideological objective.”

Under s. 17 of the Emergencies Act, the GIC required reasonable grounds to believe that the standard set out in section 2 of the CSIS Act had been met.

The evidence in the record before the Court did not support a finding that the impugned activities reached that threshold.

The second question as put forward by Justice Mosley was as follows:

2. Did the powers created by the Regulations and the Economic Order violate sections 2(b)(c)(d), 7 or 8 of the Canadian Charter of Rights and Freedoms, and, if so, could they be saved under section 1 of the Charter?

What do those sections actually say in the charter? Section 2 says:

Everyone has the following fundamental freedoms:

(a) freedom of conscience and religion;

(b) freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication;

(c) freedom of peaceful assembly; and

(d) freedom of association.

Section 7 talks about “Life, liberty and security of person”:

Everyone has the right to life, liberty and security of the person and the right not to be deprived thereof except in accordance of the principles of fundamental justice.

Section 8 of the charter deals with “Search or seizure”:

Everyone has the right to be secure against unreasonable search or seizure.

Justice Mosley asks if they could “be saved under section 1 of the Charter”. Section 1 says:

The Canadian Charter of Rights and Freedoms guarantees the rights and freedoms set out in it subject only to such reasonable limits prescribed by law as can be demonstrably justified in a free and democratic society.

Justice Mosley continues:

Concerning the Charter, the Court found that the Regulations infringed the guarantee of freedom of expression under s. 2(b), as they were overbroad in their application to persons who wished to protest but were not engaged in activities likely to lead to a breach of the peace.

The Economic Order infringed s. 8 of the Charter by permitting unreasonable search and seizure of the financial information of designated persons and the freezing of their bank and credit card accounts.

The infringement of sections 2(b) and 8 of the Charter were found to be not minimally impairing, and could not, therefore, be justified under s. 1 of the Charter.

The Court found that there was no infringement of the rights to freedom of peaceful assembly and of association in paragraphs 2(c) and (d) of the Charter. Any infringement of s. 7 respecting the liberty interests of the individual was found to be in accordance with the principles of fundamental justice and thus not a breach of the Charter.

Now, I think it's important to understand how things transpired, why we had a protest and how we got to this point in the first place. It has to do with the increasing degrees of overreach and abuse of power by the Liberal government and its trampling of the charter rights of Canadians.

In January 2022, nearly two years after the start of the COVID pandemic, Canadians were growing frustrated with government restrictions and mandates. The straw that broke the camel's back was the order that truckers—cross-border truckers, especially—and other essential workers would no longer be exempted from vaccine requirements. This was a threat to their livelihoods and a violation of their rights. For them, enough was enough.

They gathered from across Canada and came to Ottawa and other locations not just to voice their frustrations but also to be heard by this government. I think it's important to understand that this government had no interest in listening to them, and I know that first-hand.

I personally worked vigorously behind the scenes to arrange meetings between the then-minister of transportation, Omar Alghabra; the then-minister of public safety, Marco Mendicino; and protest organizer Tamara Lich, with the understanding that such a conversation would result in the protest being dismantled. However, they refused all attempts to make that happen personally with them, even on a phone call. The government completely refused.

I think, quite honestly, that their unwillingness to dialogue from the very beginning.... Had they changed their attitude, the situation would certainly have been totally different, and it could have been avoided.

The Prime Minister also added to this. He seemed to be fine stoking division, calling people names and allowing frustrations and tensions to grow to the point that he and his cabinet decided to take their overreach and disregard for charter rights to the next level by stepping outside of the law and their lawful authority by invoking the Emergencies Act for the first time in history.

What exactly what did that order say? I think it's important that Canadians are reminded of what the Emergencies Act actually said.

I will quote from the February 14, 2022, Government of Canada bulletin, which reads:

Whereas the Governor in Council believes, on reasonable grounds, that a public order emergency exists and necessitates the taking of special temporary measures for dealing with the emergency;

And whereas the Governor in Council has, before declaring a public order emergency and in accordance with subsection 25‍(1) of the Emergencies Act, consulted the Lieutenant Governor in Council of each province, the Commissioners of Yukon and the Northwest Territories, acting with consent of their respective Executive Councils, and the Commissioner of Nunavut;

Therefore, Her Excellency the Governor General in Council, on the recommendation of the Minister of Public Safety and Emergency Preparedness, pursuant to subsection 17‍(1) of the Emergencies Act, directs that a proclamation be issued

(a) declaring that a public order emergency exists throughout Canada and necessitates the taking of special temporary measures for dealing with the emergency;

(b) specifying the emergency as constituted of

(i) the continuing blockades by both persons and motor vehicles that is occurring at various locations throughout Canada and the continuing threats to oppose measures to remove the blockades, including by force, which blockades are being carried on in conjunction with activities that are directed toward or in support of the threat or use of acts of serious violence against persons or property, including critical infrastructure, for the purpose of achieving a political or ideological objective within Canada,

(ii) the adverse effects on the Canadian economy—recovering from the impact of the pandemic known as the coronavirus disease 2019 (COVID-19)—and threats to its economic security resulting from the impacts of blockades of critical infrastructure, including trade corridors and international border crossings,

(iii) the adverse effects resulting from the impacts of the blockades on Canada’s relationship with its trading partners, including the United States, that are detrimental to the interests of Canada,

(iv) the breakdown in the distribution chain and availability of essential goods, services and resources caused by the existing blockades and the risk that this breakdown will continue as blockades continue and increase in number, and

(v) the potential for an increase in the level of unrest and violence that would further threaten the safety and security of Canadians; and

(c) specifying that the special temporary measures that may be necessary for dealing with the emergency, as anticipated by the Governor in Council, are

(i) measures to regulate or prohibit any public assembly—other than lawful advocacy, protest or dissent—that may reasonably be expected to lead to a breach of the peace, or the travel to, from or within any specified area, to regulate or prohibit the use of specified property, including goods to be used with respect to a blockade, and to designate and secure protected places, including critical infrastructure,

(ii) measures to authorize or direct any person to render essential services of a type that the person is competent to provide, including services related to removal, towing and storage of any vehicle, equipment, structure or other object that is part of a blockade anywhere in Canada, to relieve the impacts of the blockades on Canada’s public and economic safety, including measures to identify those essential services and the persons competent to render them and to provide reasonable compensation in respect of services so rendered,

(iii) measures to authorize or direct any person to render essential services to relieve the impacts of the blockade, including measures to regulate or prohibit the use of property to fund or support the blockade, to require any crowdfunding platform and payment processor to report certain transactions to the Financial Transactions and Reports Analysis Centre of Canada and to require any financial service provider to determine whether they have in their possession or control property that belongs to a person who participates in the blockade,

(iv) measures to authorize the Royal Canadian Mounted Police to enforce municipal and provincial laws by means of incorporation by reference,

(v) the imposition of fines or imprisonment for contravention of any order or regulation made under section 19 of the Emergencies Act; and

(vi) other temporary measures authorized under section 19 of the Emergencies Act that are not yet known.

I think it's also important for Canadians to appreciate that the Emergencies Act laid out requirements for the government to do certain things during and after the invocation. Subsection 62(1) of the Emergencies Act says that there needs to be a review by a parliamentary review committee. It says, “The exercise of powers and the performance of duties and functions pursuant to a declaration of emergency shall be reviewed by a committee of both Houses of Parliament designated or established for that purpose.” I'll get back to that in just a minute.

The other thing that was required was an inquiry. Subsection 63(1) says, “The Governor in Council shall, within sixty days after the expiration or revocation of a declaration of emergency, cause an inquiry to be held into the circumstances that led to the declaration being issued and the measures taken for dealing with the emergency.”

I think it's important also to appreciate that Justice Rouleau's decision did not provide Canadians with the confidence they were seeking on both sides of this discussion. He made a decision that the very high threshold required was met; however, he did so reluctantly, very reluctantly, and he says so in his decision. He accepted the government's broader interpretation of the Emergencies Act without being given an opportunity to see it. He was troubled by that particular move. He also included in his report that he did not come to this decision easily, and interestingly, he states that the facts that he based his decision on were not overwhelming.

To me, the statement that says it all about how Canadians should lack confidence in his decision is that a reasonable and informed person could reach a different conclusion than he arrived at. That does not actually give Canadians much confidence.

Now, getting back to the parliamentary review committee, it was called the special....

Mr. Chair, with regard to the commentary over there, if the member wishes to participate in this debate, I invite him to do so after I'm done.

Thank you.

[Byron Holland, President and Chief Executive Officer, Canadian Internet Registration Authority]

Mr. Chair and members of the committee, my name is Byron Holland. I am the president and chief executive officer of the Canadian Internet Registration Authority, or CIRA. Thank you for the invitation to share our views and recommendations on Bill C-26.

CIRA is a private, not-for-profit organization best known for operating the “.ca” registry, with 3.4 million .ca domain names under management. CIRA's core mandate is a safe, stable and secure operation of the .ca domain and the global network that ensures that it's available no matter where in the world you are. We also have a broader mission to promote a trusted Internet, which we work toward by providing high-quality registry, domain name system and cybersecurity services, and by investing in the Internet community in Canada.

CIRA participates in numerous fora to promote the security and resilience of the Internet. Recently, this has included ISED's Canadian forum for digital infrastructure resilience and the CRTC interconnection steering committee. We are also long-time participants in global Internet governance. This includes extensive engagement with the Internet Corporation for Assigned Names and Numbers, or ICANN, the global overseer and coordinator of the domain name system that ensures that your web browser can reach websites like Canada.ca. We also contribute to the Internet Engineering Task Force, or IETF, where the technical standards that underpin the Internet are developed.

CIRA also provides cybersecurity services to help Canadians stay safe online. They include Canadian Shield, our free cybersecurity service that protects an estimated four million Canadians from online threats; DNS Firewall, our enterprise-level DNS protection used by more than a thousand Canadian organizations, including numerous critical cyber systems; and Anycast DNS, our global infrastructure that increases the performance and resilience of top-level domains like .ca, and helps mitigate malicious activity such as distributed denial of service attacks from foreign actors. Moreover, CIRA collaborates with several institutions to keep these services up to date, including the Canadian Centre for Cyber Security and the Canadian Centre for Child Protection.

CIRA strongly supports the government's objective to raise the baseline level of cybersecurity across critical infrastructure through Bill C-26.

We offer three recommendations to part 2 of Bill C-26, also known as the critical cyber systems protection act, or CCSPA, to better balance the bill's cybersecurity objectives with well-established best practices and oversight, information sharing and transparency.

First, to promote more effective oversight, the issuance of cybersecurity directions under the CCSPA should be subject to section 3 of the Statutory Instruments Act. This would ensure that cybersecurity directions are examined by the Clerk of the Privy Council in consultation with the deputy minister of justice.

Second, to increase confidence in the proposed information sharing enabled by the CCSPA, conditions on the use of information should be strengthened. Currently, Bill C-26 does not explicitly limit how government entities can use information collected under certain sections. For example, CIRA believes it would not be appropriate for the CSE to use data collected under section 15 of the CCSPA for purposes other than its cybersecurity and information assurance mandate.

Third, to promote transparency, the CCSPA should be amended so that information on cybersecurity directions is reported to Parliament on an annual basis. This would include information on the number of cybersecurity directions issued and revoked, as well as the number of designated operators impacted.

We have provided specific legislative wording for each of our recommendations in our written submission.

In conclusion, CIRA recognizes the need for some level of secrecy and timeliness in matters of national security and public safety. However, secrecy and expedience must be counterbalanced by the addition of provisions in Bill C-26 that would enhance Canadians' trust and confidence in the proposed legislation.

Thank you.

[Trevor Neiman, Vice-President, Policy, and Legal Counsel, Business Council of Canada]

Mr. Chair and committee members, thank you for the opportunity to take part in your study of Bill C-26.

Founded in 1976, the Business Council of Canada is composed of approximately 170 chief executive officers who run Canada's most innovative and successful businesses. Our organization represents a broad cross-section of Canada's critical infrastructure sectors.

Today I will restrict my comments to part 2 of the bill, which is the proposed critical cyber systems protection act.

I'll begin my substantive remarks by underlining that Canada's leading businesses are committed to maintaining a strong and resilient security posture in the face of growing cyber-attacks. Indeed, in a survey of our members, every single chief executive officer indicated that cybersecurity was either a high or very high priority for their business.

Our members are backing their commitment to cybersecurity with significant resources. In critical infrastructure sectors, most of our member companies each invest well over $100 million in Canada per year on measures to prevent, detect and respond to cybersecurity incidents. A plurality of these same members invest over $500 million individually in the same measures.

As cybersecurity risks to the country grow, so too do the resources that our members plan to devote to protecting Canadians. Over the next two years, over two-thirds of our members plan to increase both their cybersecurity spending and their personnel staffing by at least 25%.

However, we cannot lose sight of the fact that defending Canadians against cyber-attacks is very much a team sport, requiring close coordination between government and industry.

That is why the Business Council of Canada supports the objectives of recent government cybersecurity initiatives. This includes part 2, which, if properly drafted and implemented, can improve the overall cyber-resiliency of the Canadian economy by establishing a baseline of cybersecurity across critical sectors.

It's also important to note that the enactment of part 2 would bring Canada's cybersecurity framework in line with the best practices among our closest security partners. In a period of growing global tensions, Canada must move in lockstep with its closest allies and strengthen its cyber-resiliency; otherwise, Canada risks being perceived as a weak link, which could have severe consequences for Canadians' future security and prosperity.

Of course, no public or private sector initiative is perfect. It should therefore be no surprise that Canada's business leaders would like to see targeted amendments to part 2. In the interest of time, I will highlight just three of the most common suggestions for improvements that I've heard from our members.

First, part 2 should be amended to adopt a risk-based methodology that would impose regulatory requirements on designated operators proportionate to their level of risk. Imposing fewer and less onerous obligations on low-risk operators that have well-established cybersecurity programs would allow them to spend more of their finite resources on incident prevention activities. Regulators, on the other hand, could dedicate more of their finite resources toward the high-risk operators that pose the largest threat to Canadians.

Second, part 2 should be amended to place fair and reasonable limitations on the cabinet's power to issue cybersecurity directions. In the absence of statutory safeguards, part 2 would allow cabinet to issue any direction, regardless of whether such a measure would be effective in reducing a risk to a critical system. Directions could also be issued without cabinet first consulting with impacted provinces and territories, negotiating in good faith with designated operators or considering relevant factors, such as the potential cost of a direction, whether reasonable alternatives exist to issuing a direction and the potential consequences of a direction on competition, services or customers.

Third and last, part 2 should be amended to define key terms more precisely, such as “cyber security incident” and “critical cyber system”. The current definitions of these terms are overly broad. This would likely result in reporting inconsistencies, as well as the over-reporting of immaterial incidents, which could overwhelm government authorities.

I'll conclude by noting that part 2 is just one of several national security reforms that are urgently needed to protect Canadians. As a priority, the Business Council of Canada urges that lawmakers also amend the CSIS Act to enable CSIS to proactively share threat intelligence with Canadian companies when it's in the public interest, subject to all necessary safeguards and oversight.

This and nearly 40 other much-needed reforms are included in the Business Council of Canada's most recent report, “Economic Security is National Security”. That report is publicly available on our website.

Thank you for the opportunity to speak. I look forward to your questions.

[The Chair, Liberal, Heath MacDonald]

I call this meeting to order.

Welcome to meeting number 91 of the House of Commons Standing Committee on Public Safety and National Security.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely by using the Zoom application.

I would like to make a few comments for the benefit of the witnesses and members.

Please wait until I recognize you by name before speaking.

To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from the microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings.

This is a reminder that all comments should be addressed through the chair.

Pursuant to the order of reference of Monday, March 27, 2023, the committee is resuming its study of Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts.

Today we have two panels of witnesses. I would like to welcome our witnesses for the first panel.

From the Business Council of Canada, we have vice-president of policy and legal counsel Trevor Neiman. From the Canadian Internet Registration Authority, we have Byron Holland, president and CEO.

Up to five minutes will be given for opening remarks, after which we will proceed with rounds of questions.

Welcome to all.

Now I invite Mr. Neiman to make an opening statement, please.

[Rachel Heft, Manager and Senior Counsel, Transport and Infrastructure Legal Services, Department of Transport]

Certainly. Clause 124 ensures that the Transportation Appeal Tribunal of Canada Act, which oversees some provisions of this legislation in terms of requests for review of administrative monetary penalties.... The provisions of this bill, should they come into effect prior to those of Bill C‑26, will ensure that both amendments to that legislation are effective in that, if this bill amends those provisions and later C‑26 also amends those same provisions of the Transportation Appeal Tribunal of Canada Act, all those amendments will be coordinated and come into force.

[Daniel Couillard, Director General, Partnerships and Risk Mitigation at the Canadian Centre for Cyber Security, Communications Security Establishment]

Thank you for your excellent question.

It touches somewhat on a major dilemma we are currently facing in cybersecurity: on the one hand, reporting can have value; but on the other, it represents risk for reputations or business processes.

I think Bill C‑26 tries to show the advantages of reporting. Indeed, one of the Canadian Centre for Cyber Security’s roles is to help a business in a given sector solve its problem when it reports. This also helps us to know what happened, develop indicators of compromise and quickly send information on an ad hoc basis to the entire sector and all sectors in Canada.

I think one of the very important aspects of the bill is that it will allow us to collect this information, help the victim and help the entire sector and other sectors in Canada benefit from it, as well as small and medium businesses, and even the entire Canadian economy.

[Christine Normandin, Bloc, Saint-Jean, QC]

I understand that certain businesses can be designated as owners or operators of critical cyber systems covered by the bill. However, others will fall into a grey zone, meaning it will be unclear if they own or operate this type of infrastructure. According to the way Bill C‑26 is drafted, will it be enough to push some undesignated businesses into complying independently and voluntarily with the cybersecurity directions outlined in the bill?

If applicable, is there any opportunity for smaller businesses that fall into a grey zone to take advantage of the essence of Bill C‑26? Again, it brings us back to the labour shortage issue; if ever there’s a kind of appetite for this, is there a plan to be able to respond?

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you very much, Mr. Chair.

I thank the witnesses for being here.

I’d like to ask a question about the current context of labour shortages. That subject, among other things, was raised at the Standing Committee on National Defence. Often, we might have a good bill, but its implementation is a problem if, for instance, we don’t have sufficient resources to apply cybersecurity directives to certain businesses.

While the private sector currently seems to have an easier time recruiting staff than the public sector, are you concerned that a lack of staff would make implementing Bill C‑26 difficult, given the additional burden the cybersecurity directives represent?

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Okay.

What new authorities will the government receive under Bill C‑26?

[Chris Bittle, Liberal, St. Catharines, ON]

Thank you so much, Mr. Chair.

Again we see Conservatives filibustering. They talk a big game when it comes to public safety, but we have before us officials who are here on cybersecurity, something that the Conservatives pretend to care about but will filibuster at the same time. They don't want to hear from witnesses. They don't want to hear from experts. They come to ask for a motion. A different version has already been adopted—Madame Michaud's motion with respect to auto theft—by members, understanding that this is an area of concern. That has been adopted. That's something we want to go forward on. But no, let's burn half a meeting. That's the Conservative viewpoint on this. They don't care. It's just about chaos at this point.

We see Mr. Brock throwing municipal police services under the bus. He knows that the federal government isn't responsible for the resourcing of municipal police services. Mr. Motz promotes American-style laws and at the same time says they don't work. I guess when you just go on and talk about nothing in an attempt to filibuster, that's the type of stuff you'll get.

It's truly shocking, Mr. Chair, but that's what we've seen the Conservative Party come to. When there is an issue of security before the committee, an issue of national security and cybersecurity—we spent months talking about it in question period, and here it is, legislation to take action on it—it's delay, delay, delay.

They're right that auto theft is a concern. It was adopted by this committee, I believe unanimously, that we study this. The best way to get to that study, the quickest, is to get through debate on Bill C-26 so that we can get to a study that we all want to get to, but the Conservatives want to delay.

Mr. Chair, I move that we adjourn debate on this subject so that we can get back to the witnesses.

[Sami Khoury, Head, Canadian Centre for Cyber Security, Communications Security Establishment]

Thank you, Mr. Chair and members of the committee, for the invitation to appear today and discuss Bill C-26, an act respecting cybersecurity and amending the Telecommunications Act.

My name is Sami Khoury and I am the head of the Canadian Centre for Cyber Security—also known as the cyber centre—at the Communications Security Establishment.

As you know, the world is becoming increasingly interconnected and our reliance on technology continues to grow. However, this dependence exposes us to new risks and threats, particularly in the realm of cybersecurity and critical infrastructure. It also requires us to adopt new tools to strengthen our cyber-defences and respond to emerging cyber-threats.

We take these threats and the rise in state-sponsored attacks seriously, which is why we are committed to defending the Government of Canada and keeping its systems secure from cyber threats.

I'll begin today by providing an overview of the cyber centre and CSE's mandate to this committee.

The cyber centre, part of CSE, is Canada's technical authority for cybersecurity and information assurance. It's also responsible for serving as a unified source of expert advice. In its operational capacity, the cyber centre shares cyber-alerts and threat assessments across the GC to ensure that our information systems remain secure, responsive and well defended.

The Canadian Centre for Cyber Security uses autonomous sensors to detect malicious cyber activity on government networks, systems and cloud infrastructure.

These sensors allow the cyber centre to detect cyber-threats. Our classified knowledge of threat actor behaviour allows us to defend against and block these threats.

CSE also has a foreign signals intelligence mandate and conducts cyber-operations to support Canada's national security objectives. This allows us to provide intelligence on foreign cyber-threats, including the activities and intentions of state and non-state actors, which is used to defend Canada.

Together, the foreign intelligence branch and the Canadian Centre for Cyber Security work hand in glove to detect and prevent cyber attacks on government networks, critical infrastructure and other Canadian organizations.

I'd like to highlight a few of the key changes included in Bill C-26.

To continue to adapt to the ever-evolving threat environment, Bill C-26 is a critical next step that provides the government with new tools and authorities to better bolster defences, improve security across critical federally regulated industry sectors, and protect Canadians and Canada's critical infrastructure from cyber-threats.

This legislation would also establish a regulatory framework to strengthen cybersecurity for services and systems that are vital to national security and public safety and give the government a new authority to issue cybersecurity directives to respond to emerging cyber-threats.

At the Canadian Centre for Cyber Security, the legislation will facilitate the sharing of information, as necessary, to protect critical infrastructure and investigate reported incidents and provide mitigation advice.

It would also allow regulators to request advice, guidance or services from the CSE by providing information about the designated operator's cybersecurity program and mitigation of risk from the supply chain or use of third party products and services.

We are aware of the privacy concerns raised by some stakeholder groups about the reporting obligation of cybersecurity incidents to the CSE. The CSE and its cyber centre have an important responsibility to protect Canadians' privacy and personal information, and we take it very seriously.

Moving forward, we are hopeful to see the continued progress of Bill C-26 in Parliament.

Members of the committee, I can assure you that as the cyber-threat landscape in Canada continues to evolve, the CSE and the cyber centre remain dedicated to ensuring that the necessary protections are in place to support critical infrastructure and work closely with our partners.

We encourage Canadians to consult cyber.gc.ca for up-to-date advice and guidance related to cyber threats or if they wish to receive more tailored cyber threat information.

We also encourage victims to report a cyber-incident to the cyber centre through our online portal at cyber.gc.ca, so that we can help share threat-related information with our partners to help keep Canada and Canadians safe online.

Thank you for the opportunity to contribute to this important discussion. I'm looking forward to answering any additional questions you may have.

[The Acting Chair, Liberal, Ron McKinnon]

Thank you. All this feels oddly familiar.

I call this meeting to order. Welcome to the public portion of meeting number 90 of the House of Commons Standing Committee on Public Safety and National Security.

Pursuant to the order of reference of Monday, March 27, 2023, the committee commences its study of Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts.

I would now like to welcome our witnesses today. From the Communications Security Establishment, we have Sami Khoury, head, Canadian Centre for Cyber Security, and Daniel Couillard, director general of partnerships and risk mitigation at the Canadian Centre for Cyber Security.

To support the Communications Security Establishment, from the Department of Public Safety and Emergency Preparedness, we have Colin MacSween, director general of the national cybersecurity directorate; and Kelly-Anne Gibson, director of the cyber-protection policy division. From the Department of Industry, we have Andre Arbour, director general of the telecommunications and Internet policy branch.

I now invite Mr. Khoury to deliver his opening statement.

Please go ahead.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

My apologies, Dr. Lewis. The floor is yours.

As I was saying, what is very concerning is that Canada is one of the few G20 nations without a firm regulatory framework around cybersecurity. It's essential at this point, when we're looking at Bill C-33 and Bill C-26, that we keep in mind the need for Canada to act to protect the nation's critical infrastructure and the interconnectedness of these two bills.

We also know that in 2016, member states of the EU passed what was called the most comprehensive cybersecurity bill in the history of the EU. The bill was called the NIS Directive. The EU cybersecurity rules, which were introduced in 2016, were updated and later ratified in 2023. They continue to modernize and create this legal framework, which I think is quite instructive in the Canadian context. It keeps up and it increases the digitization...and the evolving cybersecurity threat, which is something we are attempting to grapple with in the present bills we are contemplating.

Expanding the scope of cybersecurity rules in the new sectors and entities further improves the resilience. We have dealt with resilience in the infrastructure context in this committee. This is also a very important part of what we're talking about in Bill C-33.

We have seen the problems that a huge infrastructure gap can cause, and one of the problems is the ongoing lack of transparency. We have seen, in our situation with the taxpayer-funded Canada Infrastructure Bank, an unacceptable performance over the last seven years. We want to build mechanisms into Bill C-33 to make sure we're not falling into the same traps and shortcomings we've had with other legislation.

Moreover, we have provisions in Bill C-33 that also raise concerns on cybersecurity and response capabilities of the public and private sector entities and competent authorities. In the case that I was discussing before, the EU as a whole can be used as an example of a model that Canada could adopt. When we're contemplating this bill, I think we should look at enabling legislation from different jurisdictions.

We know that most G7 member states are under the umbrella of the EU. The U.S. and the U.K. and Japan have separately implemented cybersecurity regulations to differing degrees, which I think are also instructive in how we confuse Bill C-33 with Bill C-26.

We also have to look at Canadian businesses and how they continue to be impacted by malicious cybersecurity and cyber-activity. This ranges from cyber-attacks to ransomware, and even things that we are exposed to on an everyday basis.

Many of these attacks include those on critical infrastructure. That accounts for nearly half of the attacks, and many of those go unreported.

This is very concerning. The Canadian Centre for Cyber Security has identified attacks on operations networks. They've also identified attacks on how it would impact the physical safety of Canadians. That was published in their biennial publication, the “National Cyber Threat Assessment”.

Now, in this context, when we look at the Ministry of Public Safety, we know that they acted to introduce new legislation, Bill C-26, an act respecting cyber security. I believe it was at the first stage in Parliament sometime in November 2022, and it went through second reading, I think, on March 27, 2023. Bill C-26 currently sits in committee. I believe it's going into law, if it hasn't done so already. When we look at where it is, going through the committee stage, and we look at the fact that Bill C-33 is contemplating sections of this bill, we know that it's very important for us to focus on it, because it may have the capacity of adding teeth to the governance and compliance structure of cybersecurity in Bill C-33.

It's very important that we look at the interconnectedness of these two bills, especially inasmuch as is needed in the area of operational technology where critical infrastructure lies.

Although we don't know how the bill is going to necessarily impact on Bill C-33, between the absence of similar legislation in Canada.... We don't know what the impact is going to be, because this is new. This is untested territory, but we know there is an increasing trend toward increased cybersecurity regulation among our international peers.

Having practised international law for a number of years, I can see the importance of Canadian businesses being prepared. Contemplation of this aspect of the bill and how it will be infused in Bill C-33 is very important at this time.

Canada does not have an overarching governing cybersecurity legislation, let alone require the reporting of vulnerabilities in critical infrastructure breaches, which is extremely problematic. Bill C-26 would empower some regulators to impose fines or issue some summary convictions to ensure governance and compliance. This is something that my colleague, Mr. Kurek, spoke about. It's critical to turn our minds to that, especially as we contemplate this bill.

Now I'll go back to Bill C-26. In its current form it includes four critical infrastructure sections, which I think are related to the transportation aspect of Bill C-33. When we look at the transportation corridors that are contemplated in Bill C-33, we see, in Bill C-26, that it's very important to look at these four critical infrastructure sectors: telecommunications, finance, energy and transportation.

The requirements for organizations in these sections are threefold.

First is to implement, maintain and report on the cybersecurity program, which will essentially address the risks across organizations. It will address the risk in third party services. It will address the risk in supply chain—

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

However, I would get back to the Bill C-26 conversation here, and how it is directly—

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Sure. Thanks, Chair.

You're right, I was getting a little bit off topic there.

I'll tell you, it's easy to be passionate about the billions of dollars in economic impact that my people have—the people I'm proud to represent. It's billions of dollars that they have, yet, unfortunately, the Liberals seem to disregard that. They would toss it away for some dream that certainly is more of a dream than any reality, especially when we could be supplying our partners like Ukraine with clean, green Canadian natural resources.

When it comes to Bill C-26 and its relevance here on the Bill C-33 conversation, we have this connection that exists. Why I went down the path of talking about how proud I am of Canada's energy industry is that it's not always recognized how closely connected physical infrastructure and the security associated with that are to the cyber elements of how that works.

I would provide a local example, Chair.

A pipeline company just opened up a new control centre in Hardisty. This example is very relevant to both the physical infrastructure that Bill C-33 represents and the reference that it has to cybersecurity, which is referenced in Bill C-26. There's this close connection that exists. We cannot dismiss that. It goes further when it comes to our rail systems. It's not out of the realm of possibility to see how there's that close connection that exists between the cyber and physical security side of things.

If we don't see Bill C-26 addressing those things appropriately, if it's not responsive to the economic needs, if it doesn't take into account the privacy concerns of Canadians, if it gives too much power to a few individuals in our nation's capital who may not be responsive, or if, likewise, when it comes to Bill C-33 there's not this appropriate delegation of authority that takes into account.... I often refer to the word “tension” or what could be referred to as the Aristotelian mean. We have to find that correct tension or that mean place where we have that balance. I'm fearful that we simply don't get it when it comes to Bill C-26 and some of the elements that we have discussed at length, although most of the clauses have in fact passed.

There's been a change in who is in charge of the public safety file. I won't get into the host of criticisms that have been levelled by Conservatives against the ministers of public safety. They seem to come and go at an alarming rate.

I would, however, like to read from the Canadian Civil Liberties Association when it comes to some of the concerns surrounding Bill C-26. Then I will be happy to cede the floor to my colleagues, who I know have a tremendous amount to add to this conversation as well.

Although this letter is dated September 28, 2022, there's particular relevance to what we're discussing here today. It's written to the former minister and the leaders of the opposition parties, including Ms. May as the parliamentary leader of the Green Party. I think she's now co-leader of the Green Party.

It is titled, “Joint Letter of Concern regarding Bill C-26”, and I'll read it directly into the record, Mr. Chair:

Dear Minister,

We, the undersigned organizations, are writing to express our serious concerns regarding Bill C-26: An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts.

In your press release announcing this legislation, you were quoted as stating “In the 21st century, cyber security is national security.” We agree, and we share your goal of helping both the public and private sector better protect themselves against cyber attacks.

Isn't this very agreeable up until this point?

The Canadian Civil Liberties Association goes on to say:

However, in its current form, Bill C-26 is deeply problematic and needs fixing.

I would note—because the stickers on my iPad triggered certain members of this committee, I won't show you—that it's actually bolded. Those previous words are bolded because the CCLA wanted to make sure they were emphasized in the context of this conversation.

It says:

As drafted, it risks undermining our privacy rights, and the principles of accountable governance and judicial due process which are the fabric of Canadian democracy. The legislation needs to be substantively amended to ensure it delivers effective cybersecurity protections while safeguarding these essential democratic principles.

As you know, Bill C-26 grants the government sweeping new powers over vast swathes of the Canadian economy. We believe these powers need to be strictly delimited and accompanied by meaningful safeguards and reporting requirements to ensure Canadians can hold their government and security agencies to account.

Next, this is in bold again, Mr. Chair, and I reference that because it's obvious that the CCLA wanted to ensure that this was emphasized:

Put simply, with great power must come great accountability.

With a view to improving this legislation, we share with you the following specific areas of concern:

Opens the door to new surveillance obligations: Bill C-26 empowers the government to secretly order telecom providers “to do anything or refrain from doing anything.” This opens the door to imposing surveillance obligations on private companies, and to other risks such as weakened encryption standards—something the public has long rejected as inconsistent with our privacy rights.

Termination of essential services: Under Bill C-26, the government can bar a person or company from being able to receive specific services, and bar any company from offering these services to others, by secret government order. This opens the door to Canadian companies or individuals being cut off from essential services without explanation. Bill C-26 fails to set out any explicit regime, such as an independent regulator with robust powers, for dealing with the collateral impacts of government Security Orders.

It goes on to mention that it:

Undermines privacy: Bill C-26 empowers the government to collect broad categories of information from designated operators, within any time and subject to any conditions. This may enable the government to obtain identifiable and de-identified personal information and subsequently distribute it to domestic, and perhaps foreign, organizations.

I would just note, Chair, that when it comes to the de-identified side of things, that's often an excuse that gets used. I know from my role on the ethics committee that we had a study that was undertaken when it was learned that the government had purchased a huge amount of data on movements during the COVID-19 pandemic. Although it was claimed to be de-identified, there were massive question marks associated with the amount of data the government received. I know that there was an overwhelming amount of concern that I certainly heard.

A number of people reached out to us when they did not hear back from Liberal members of the committee who didn't echo some of the concerns about how much information was being gathered: things like people knowing that the government could determine when people were going to the grocery store and liquor stores and other things. Certainly, in a free and democratic society, there were concerns about it. It was unclear. Canadians are pretty trusting, but they want to be respected. I talk about that tension or that Aristotelian mean that needs to be found, and I fear that this government has pulled that tension totally out of whack.

However, I digress. I will get back to what the CCLA has to say.

It goes on to say that there are “No guardrails to constrain abuse”.

Bill C-26 lacks mandatory proportionality, privacy, or equity assessments, or other guardrails, to constrain abuse of the new powers it grants the government — powers accompanied by steep fines or even imprisonment for non-compliance. These orders apply both to telecommunications companies, and to a wide range of other federally-regulated companies and agencies designated under the Critical Cyber Systems Protection Act.... Prosecutions can be launched in respect of alleged violations of Security Orders which happened up to three years in the past.

I would just note that in a late show that I was a part of yesterday—and I know that my colleague was actually there, too—I was shocked that the parliamentary secretary from Winnipeg North talked in support of a policy that actually sent farmers to prison. Now, I wouldn't want to go off topic here, so I won't get into the conversation around the Wheat Board, but my goodness, how concerning is it that the government would support policies that threw farmers into prison for wanting to sell their grain without the government controlling it? It is unbelievable that that's the point that these Liberals would go to, and that they still support it even after it was very clear that Canadians and farmers wanted the ability to sell their grain without the government controlling them. Truly it was an unbelievable level of control, which was specifically targeted at the west. It's quite something to have heard, and I'm sure my colleague here would agree with me that it was unbelievable to hear that be brought up in conversation in the House of Commons yesterday, that they would prefer to throw farmers in prison than to have a legitimate conversation around the impacts of, in that case, the carbon tax.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much, Mr. Chair.

I hope everybody was able to have a good short break. I know that was seven or eight minutes of freedom that people had, but I'm sure they're thrilled to get back to the important conversation that we have here before us.

Mr. Chair, specifically due to the two-hour time change, of course, back in Alberta and the riding I'm proud to represent, I would note that my wife has probably just finished putting my kids to bed. To my boys, I love you guys; hopefully you're listening to your mama as she puts you to bed. I look forward to connecting with my wife post 11:30, after this committee wraps. That's one of the big things, when our families are back home holding down the proverbial fort.

Mr. Chair, I left off talking a bit about the wide-sweeping powers associated with Parliament when we live in a democracy where the idea of parliamentary supremacy is absolutely paramount. I believe I unpacked it adequately in the context and certainly I have a whole host of other things to say about that but wouldn't want to dive too deep into that in the short time that we have here.

However, I want to make sure that I get to the recommendations that this article references in terms of Bill C-26. It goes on to say...and I'll summarize this and then have a few other important interjections that I look forward being able to make.

The article said: “Given that the Bill has just been introduced,”—this article is a bit dated, but nonetheless very relevant—“its passage is not guaranteed, and additional changes to the draft law”—or in the Canadian context, bill—“may occur. However, and in the interim, if you are a provider of vital services”—which speaks to that vital connection that we have with Bill C-33 here before us—“and systems as described in the Bill, we recommend that you consider taking the following steps to improve your cyber resilience:

The first is:

Preemptively improve your security posture and processes to conform with the CSE’s best practices and guidance, or industry practices, and ensure that your contracts contain sufficient cybersecurity provisions to protect all parties in the supply chain; and

given the secrecy and potential immediacy of Government orders and directives, Telcos and Designated Operators should draft contracts to flow down potential cyber security risks appropriately.

That's almost unique in terms of some of the recommendations that have been made in the context of this bill. The authors go on to talk about how, if you are a supplier of products and services related to critical systems of designated operators as described in the bill, we recommend that you take the following steps:

Preemptively improve your security posture and processes as described immediately above in anticipation of more strenuous cybersecurity requirements requested by Designated Operators; and

I'll make a final point on this one, and then I'll look forward to getting into a few other aspects of debate here. The final point is:

anticipate shouldering more risk when contracting with Designated Operators and consult with your insurance provider accordingly.

A big thank you to Lisa R. Lifshitz—I believe I'm saying that appropriately—and Cameron McMaster, the authors of this. I believe it provides a good summary and a few very relevant recommendations in terms of the context.

I would note here as well, we're talking about critical infrastructure and, I know, specifically some of the larger conversations surrounding Bill C-33. We have the need for resiliency throughout every aspect of that, whether it's in relation to security, which is very important, or some of the challenges associated with climate. There has to be that security that does exist there, and we have to be mindful of that in the larger context of everything that we are discussing and how relevant that is.

On that note, Michael Den Tandt, if I'm correct on this—and I'm certainly happy to stand corrected—in an opinion piece to the Ottawa Citizen, which I believe is relevant especially for the Bill C-26 aspect here.... Michael Den Tandt ran for the Liberal Party in the 2019 election, if memory serves. He entered on December 4, so it seems like it's been more than a couple of weeks. Just last week, a column by him was published in the Ottawa Citizen.

Although it seems as if it's been more than a couple of weeks, he published this column in the Ottawa Citizen last week. I believe it would be very valuable to this conversation.

Den Tandt said the following in his column, “Canadian government must take the time needed to get its cyber security bill right”:

Bill C-26, the federal government's stab at shoring up the country's cyber readiness, passed first reading in the House of Commons on June 14, 2022. The legislation has two thrusts: first, to keep hardware from adversarial states out of Canada's telecom networks; second, to ensure our critical infrastructure is hardened against a plethora of new digital threats.

Nearly a year later, in late March of 2023, C-26 limped through second reading. The bill now rests with the Standing Committee on Public Safety and National Security, for review and possible amendment.

That this law continues to languish at committee, 16 months after it first saw the light of day, encapsulates one of its core failings which, in fairness, is not unique to this piece of lawmaking: Despite showing signs of having been written in a hurry, presumably in hopes of keeping pace with technological change, it's emerging too slowly.

By the time it passes third reading, then meanders its way through the Senate to Royal Assent, C-26 may well have been overtaken by events. The threats it is intended to counter are multiplying far more quickly than the glacial pace of the legislative process appears able to match.

What are these threats? The latest National Cyber Threat Assessment from the Canadian Centre for Cyber Security encapsulates them in language that, for a government document, is remarkably direct.

Cyber-criminals are rapidly scaling up, evolving ransomware and other attacks into a trans-national enterprise, while state actors—specifically China, Russia, Iran and North Korea—are deploying vast resources to attack and undermine open economies and societies by eroding trust in public institutions and the factual foundation on which their credibility rests. “You may be tempted to stop reading halfway through,” writes CCSE Head Sami Khouri in the foreword, “disconnect all your devices and throw them in the nearest dumpster.”

As a note, Mr. Chair, I had the opportunity to serve on the public safety committee for a short time in the 43rd Parliament. Hearing briefings from experts was eye-opening, to say the least, when we had examples. I believe it was CSIS, in their public report, that said there are 4 billion attempted attacks on Canadian cyber infrastructure in the course of a year. That's absolutely mind-boggling—the growing sophistication of the enemies of freedom and Canada, and the steps they will take to attack us and our infrastructure.

Den Tandt goes on to say the following:

To counter this, the draft bill offers two pillars: first, a revamp of the Telecommunications Act, giving the federal minister of Innovation, Science and Industry sweeping powers to order companies to ban certain products, clients or service providers, with possible daily penalties of up to $15 million a day if they don't comply; and second, the Critical Cyber Systems Protection Act (CCSPA), which would allow the minister and an appointed official to order cyber measures in federally regulated parts of the private sector considered essential to national security.

These include telecom, energy and power infrastructure such as pipelines, nuclear plants, federally regulated transportation, banking, clearing and settlement.

For all those questioning the relevance of this conversation, Den Tandt himself speaks about how closely connected this is to the conversation surrounding Bill C-33.

Seen from 10,000 ft. up, the broad scope of the legislation will appear justified to some; after all, don't significant threats justify dramatic action? But there's a difference between action that is on point, and action so riddled with gaps that it'll need a reboot the day it becomes law.

Christopher Parsons, in a dissection for The Citizen Lab, outlines six major concerns, any of which should be grounds for disqualification. These include an excess of arbitrary power, too much secrecy, inadequate controls on information-sharing within government, potentially prohibitive costs for smaller firms (the legislation draws no distinctions based on scale, or industry sector), vague language, and no recognition of Charter or privacy rights.

Brenda McPhail, in an October, 2022 analysis for the Canadian Civil Liberties Association, echoes many of Parsons’ criticisms, noting wryly that the law joins “an increasingly long line of legislation that would fill a clear need, if only it were better.”

If the goal, broadly, is governance that promotes prosperity, security, accountability, diversity and equity in a democratic society—then C-26, as drafted, should not pass.

Is legislation urgently needed? Absolutely. But have its drafters gotten it right? No. Given the blitzkrieg pace of growth in cyber threat vectors, it makes sense to continue to manage these threats on an ad hoc basis, as the minister has been doing, with assistance from The Communications Security Establishment (CSE) and the CCCS, and take the time needed to get the legislation right.

Thank you, Chair, for indulging me in that, because it's important context, and I would just note that the specificity of the criticisms that Den Tandt brings forward and the fact that he ran for the Liberal Party a short four years ago speak to two things I'd like to reference. I'm sure there's more, which maybe my colleagues would be interested in following up on, that references indirectly, first, that disconnect that exists between Parliament and executive government.

I would just note—and I know my colleague Mr. Strahl referenced this in a different context a number of times—that we had the conversation surrounding Huawei. Parliament, in fact, spoke up a host of times, telling the government that it needed to act. It wasn't a recommendation. It wasn't a suggestion; it was demanding action, yet we see still, in relation to the security of essential cyber networks in our country, that lack of action. The unwillingness for that action to take place sets Canada back what would be a... The pace that technology advances has set Canada back very significantly.

I know that it is key to ensuring that government is responsive not only to the demands of what Parliament is in terms of institution.... There's no other place in the country—and this is something that I think bears special emphasis—that every part of Canada is truly represented. I find it interesting that there seem to be a plethora of advisory boards and consultations, some of which have more legitimacy than others, but it's truly Parliament that is that voice for Canadians.

I'm always a bit hesitant, and maybe more than just a bit, when an advisory panel is set up. Specifically, I know that there are other bills that are before Parliament that set up some of these advisory panels, and this speaks to the disconnect that exists between Parliament and executive government. They set up these panels that sometimes are so disconnected from those who are impacted, and again, fearing that I would venture into something that would not be relevant, when it comes to critical infrastructure and specifically when you look at rail.... I have three main line rail lines that run through my constituency, and I represent about 53,000 square kilometres of what I refer to as God's country. It is a beautiful area in east central Alberta. It's a large area; in fact, it's about the same size as the province of Nova Scotia, just for context for those around the table.

I always find it very concerning when these advisory panels get set up, and they certainly don't often have the best interests of my constituents in mind, and we saw that and are seeing that played out in the so-called just transition.

Truly, there's no justice for my constituents, including the thousands and thousands who work in the energy industry. We saw that this was very directly the case when it came to the coal phase-out. The federal government promised to be there, and yet they were not. They failed my constituents. They failed the people who were told the federal government would have their backs.

I think that speaks to a disconnect between the role that Parliament should be playing—that ability to represent the people of our country—and the fact that quite often these so-called advisory panels end up being nothing more than a platform for the government to spout its same talking points. That's a deeply, deeply concerning trend that we have. One doesn't have to look any further than the appointments of these so-called independent panels.

Chair, there's a reason I bring this up. There's a specificity in relation to this. If we want to ensure that we are passing legislation, when it comes to Bill C-33 or some of the criticisms we've levelled at Bill C-26 and how the government clearly references both here....

They're expecting both to pass, although Den Tandt certainly has a host of criticisms to level at Bill C-26. I'm hopeful that my colleagues in the public safety committee will be fully engaged when this debate comes forward, but I would suggest that one needs to take very, very seriously the role that we have to play here.

That's part one of the criticisms I would suggest when it comes to where some of these things are. The second part here comes to how, as we develop an infrastructure, we have to take seriously our responsibility to ensure that this is done not only in terms of the demands of today, which is key, but also in building that for tomorrow.

I would actually reference something that I am quite familiar with. There are two industries that I am very, very proud to represent—and a pretty significant portion of it. Had we had the opportunity to debate the motion that I was so unfortunately shut down on, I would have talked at length about the impact agriculture has in the close to 5,000 farms, most of which are family-owned small operations or small businesses, not the big successful ones that the Prime Minister referenced in question period today. I'm not quite sure what metric he uses for that when they're paying the carbon tax, but certainly it's small operations.

We see how there is this demand for that infrastructure to be secure. That includes the cyber element of that. We've seen attacks that have shut down significant portions and left critical infrastructure in our country at risk.

I believe I was in junior high at the time, so this is going back a little while, when a power outage took place in the northwestern United States. It was deemed to be an accident, but it shut down New York City in terms of the power. It shut down a host of other jurisdictions, including some in Quebec and Ontario. It spoke to some of the interconnectedness that existed in our infrastructure.

More recently, a cyber-attack shut down the pipeline system on the eastern seaboard of the United States. Certainly, I mentioned agriculture before, but I also represent another significant portion: 87% of Canada's crude oil transits through Battle River-Crowfoot. Some of it is produced there, but 87% of Canada's crude transits through Battle River-Crowfoot.

When my colleagues wonder why I'm so passionate about our energy industry, it's because I get it. Unfortunately, we seem to have what my father would suggest is “city ignorance”. I won't venture too far down that path, but it's unfortunate that sometimes there's not a better understanding of how important some of this critical infrastructure is. That's not only in terms of our economy and the billions of dollars. In fact, if I look at the community of Hardisty, for those from Hardisty....

Who knows? They might be watching this right now. I know they're passionate about educating Canadians on the importance of energy infrastructure and how it is so unfortunate that—

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much, Chair. I certainly look forward to hearing what Dr. Lewis has to say about this. I know she has a great familiarity with this subject matter.

Chair, perhaps I could continue, because I do want to ensure that this is added to the record. I just mentioned how telcos will not be compensated, and I believe I provided a brief interjection about some of the commentary that has been provided at other committees in relation to compensation for financial losses.

Certainly, in the highly regulated telecom environment that Canada finds itself in, that would be a massive conversation that we could have at some point, but that would be venturing into the territory of not being relevant, so I wouldn't want to go there.

I will, however, continue with this summary, which talks about how:

The Amendments introduce new enforcement powers for the Minister of Industry to monitor the Telcos' compliance with the orders or future regulations, including investigatory powers and issuing AMPs of up to $25,000...per day for individuals (such as directors and officers)....

Chair, that summary relates to a significant ability and discretion, and this summarizes from a legal perspective some of the commentary that was in the brief Mr. Strahl provided. I want to ensure this is part of the record, because they're endeavouring not to take a specific position but rather to ensure theirs is non-partisan. As hard as that is for certain members of the committee to believe, if they have seen my debates in the House, it's important and valuable that such a perspective be included.

It then goes on to say, in regard to information sharing and secrecy:

The CCSPA and the Amendments require Designated Operators, Telcos, and any other person to share confidential information with the Appropriate Regulators, and Governor-in-Council and Minister, respectively, in furtherance of the objectives of the Bill. This confidential information may be shared with multiple federal government organizations, provincial and foreign counterparts, as well as international organizations, to pursue the objectives of the CCSPA and the Amendments. While these information exchanges will be governed by agreements and memorandums of understanding between the parties, the Minister may disclose the information if [it] is necessary in the Minister's opinion to secure the telecom system.

Given the national security purpose underlying this Bill, the secrecy of the orders is paramount. The orders from the Governor-in-Council and Minister may be subject to non-disclosure requirements. Moreover, for the sake of secrecy and expediency, the orders and directions of the Governor-in-Council and Minister do not follow the complete process outlined in the Statutory Instruments Act, and thus, are not registered, published, or debated in an open manner.

Certainly when it comes to that relationship, it's important to acknowledge—I know we've had a number of discussions, including on one of the clauses we passed here when I think there was a desire for further debate, but it ended up being moved forward—that a tremendous amount of latitude is being given to executive government when it comes to some of the powers that are associated with Bill C-26 as it relates to Bill C-33, and one has to be aware of the granting of power to executive government. That is certainly something that Parliament is able to do under our Westminster system.

However, it's important to keep in mind the larger tension that needs to exist to ensure that we do not forget at the very foundation—and this is incredibly relevant, not only to this but to everything we do here—that the government is only a function of Parliament.

I know that's something that can be a bit lost in the midst of conversation. I know that this very statement has even been deemed controversial at different points in time. Earlier this week we celebrated the Statute of Westminster, the point at which we brought home the Constitution, and I would note that it was an incredibly significant moment in Canadian history. That is relevant to the conversation here today, because it's Parliament that enacts laws that give the government its authority.

I would just note how we have seen various instances throughout our recent history—in particular the last eight years—where there has been more latitude given than I would suggest is appropriate. There are times when we could ensure that Parliament is able to better fulfill its job by a government that respects the fact that whether it's committees, or whether it's the role that the House of Commons and the Senate play in terms of our bicameral Parliament in ensuring that it is the ultimate arbiter of the land....

In fact, our Constitution and the Charter of Rights and Freedoms actually ensure that that is, in fact, the case with the notwithstanding clause, which I know the Liberals have.... In fact, I believe it was Paul Martin in a previous election—I was getting back to that. I couldn't even vote at the time, if members around the committee table can believe that. It was Paul Martin who, during a press conference, announced that he was looking at getting rid of that. I'm not sure that he understood the consequences, both in terms of the constitutionality or the amending ability of Parliament to be able to do that.

However, when it comes to the relationship to the issue before us, we have these wide-sweeping powers being given to executive government. If there is not the appropriate accountability, as the American Bar Association, in this article, is highlighting, it would be the.... We need to have clear direction to every element of what government is, to ensure that there is that check on executive government.

I do find it interesting. I'll get right back into the ABA. This article has a number of recommendations. I would just note that there are two quite distinguished lawyers who put together this article, which gives this overview of Bill C-26, and how it applies in the context of where Bill C-33 is.

Specifically, Chair, one can never assume that one will be in power forever, whether that's the Liberal Party or the Conservative Party. If we have the honour—and I certainly hope we do—we look forward to those days when we'll have the opportunity to govern on behalf of Canadians.

However, I find one always needs to look in the mirror. In fact, I've asked in the House quite a number of times about what the government would think, if they were in the opposition benches, about something that they were doing. It would not necessarily be the policy, because policy is one thing. You can disagree with policy. However, you need to be very mindful about how you approach the ability for a parliament to function in a manner that respects the very basis of what our democratic system is meant to be.

Chair, when it comes to the wide-ranging powers that are given to executive government, we do have to be very mindful that there's certainly a role that executive government needs to play in the administration of infrastructure, the administration of security and intelligence, and all of the aspects of what we're talking about here. However, when it comes down to it, Parliament is supreme in our country. We cannot forget that.

To ensure that I don't venture off into an area that would be deemed not relevant, I certainly won't spend time talking about a few examples of that, but there are some very pressing issues—one of which would be the designation of the IRGC as a terrorist entity.

Parliament spoke on that, yet we have an executive government that refuses to acknowledge.... I use that as an emphasis, not to get into the details of that issue, although it's certainly one that dominates a lot of our time in light of the atrocities that took place against Israel, and how Iran, and the IRGC specifically, funded and supports Hamas as a terrorist entity.... The fact that there's that disconnect is the point I'm making here. That speaks very closely to why we need to be very circumspect in the way we approach the role of executive government. There's that understanding. It has to come back to respecting Parliament.

If I had had the opportunity to talk about Bill C-234, I certainly would have, at length, talked about how that bill saw a great deal of support, including Liberal support by a few brave Liberals who were willing to support that bill.

Unfortunately, it was not able to get the support that it, I believe, should have received from the other place. Again, I wouldn't want to go into the area of not being relevant. When it comes to recommendations, I would—

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you, Chair.

I'm happy to address the point of order that was just raised. You know, it was not Conservatives who wrote this bill. When the Liberals did so, they did it with a reference to Bill C-26. If that member has concerns about the wider application of this bill, I would suggest he has an opportunity to get on the speaking list to ask those very questions. When it comes to the way in which there is that cross-application, certainly it bears relevance to it. Because of the way it was written, it provides that very application.

I will continue with regard to Bill C-26, Mr. Chair, as follows:

report cybersecurity incidents to the Canadian Security Establishment (the “CSE”);

comply with and maintain the confidentiality of directions from the Governor-in-Council; and

keep records related to the above.

To enforce these new obligations, the CCSPA grants to the Appropriate Regulators investigatory, auditing, and order-making powers, including issuing administrative monetary penalties (“AMPs”) of up to $1 million per day for individuals (such as directors and officers), and $15 million per day for other persons. Additionally, Designated Operators, and their directors and officers, may also be fined—or imprisoned if a director or officer—if either contravene specific provisions of the CCSPA; the amount of a fine is at the discretion of the federal court.

Now, that's the critical cyber systems protection act, but this article goes on to reference, in its summary of Bill C-26, the Telecommunications Act amendments. I found it very valuable in terms of that conversation and how, of course, when we talk about the application to Bill C-33, there is a tremendous amount of overlap when it comes to telecommunications and the critical infrastructure that our country depends on.

It goes on to say the following:

The amendments to the Telecommunications Act (the “Amendments”) establish new order-making powers for the Governor-in-Council and the Minister of Industry (the “Minister”) to direct Telcos to take specific actions to secure the Canadian telecommunications system. Specifically, the Governor-in-Council may, by order,

prohibit a Telco from using all the products and services offered by a specified person; and

direct a Telco to remove all products provided by a specified person.

The Minister, after consultation with the Minister of Public Safety and Emergency Preparedness, may, by order,

prohibit a Telco from providing services to a specified person; and

direct a Telco to suspend any service to a specified person.

Additionally, the Amendments grant the Minister the power to direct Telcos to do anything or refrain from doing anything that is, in the Minister’s opinion, necessary to secure the Canadian telecommunications system, including the following:

It then includes a number of points there.

I would just note and make the connection to some of the evidence that Mr. Strahl brought into the conversation, and some of the briefs entered into the committee, in the context of some of the concerns, especially from civil liberty and privacy groups. I know that there's been a host of experts. Again, as a member of the ethics committee, which deals with privacy, I know there's been a host of concerns brought forward. We have a great deal of them, especially because of the tech industry that has found its home both in my province of Alberta, where there's a huge boom in the high-tech sector, and in other areas across the country. In fact, I stand to be corrected here, but I believe the Ottawa area was known as “Silicon Valley north” at one point in time.

There's certainly the privacy and also the security related to that. There's a specific tension there. Some of the evidence that Mr. Strahl read into the record I think bears specific relevance to this larger conversation and how that applies to the transportation infrastructure of our nation.

The summary goes on to talk about Bill C-26, and it includes a number of summaries here that really succinctly identify some of what Bill C-26 talks about.

It starts off by saying:

prohibiting Telcos from using any specified product in or in relation to Telcos’ network or facilities, or part thereof;

prohibiting Telcos from entering service agreements for any product or service;

requiring Telcos to terminate a service agreement;

prohibiting the upgrade of any specified product or service; and

subjecting the Telcos’ procurement plans to a review process.

Mr. Chair, it goes on to say:

Interestingly, Telcos will not be compensated for any financial losses resulting from these orders.

As was noted, I believe, in the debate surrounding Bill C-26, they wouldn't anticipate there to be a large number, unless it started getting into the firms.... That's certainly an open question that I trust will be answered as Bill C-26 is further studied at their committee, but I wouldn't want to venture off the topic that we have before us.

It goes on to say:

The Amendments introduce new enforcement powers for the Minister of Industry to monitor the Telcos’ compliance with the orders or future regulations, including investigatory powers and issuing AMPs of up to $25,000–$50,000 per day for individuals (such as directors and officers), and up to $10–$15 million per day for other persons. Moreover, contravention of orders or regulations may result in prosecution whereby the Telcos, and their directors and officers, may have to pay fines (whose amount is at the discretion of the court) or face imprisonment.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Certainly, it's not only Conservatives who don't have confidence in those Liberals, but also an increasing number of Canadians who don't have confidence in the Liberals' ability to manage the country. I hear that on a regular basis. Again, if that member wants to be serious, I'm happy to have that conversation.

When it comes to Bill C-26, I'm glad to have the opportunity, after that member's push towards talking in circles, to get back to the matter at hand.

I have an article from the business law section of the American Bar Association that I think bears particular relevance to the conversation we are having. Chair, if you would indulge me, I believe it has context that is important to the discussions we are having. In particular, I find it interesting—and I'll jump into this article in a moment—how this provides important context.

The way the Liberals wrote the legislation does provide a great deal of latitude. There are two separate bills before Parliament, and certainly, they're taking great liberties when it comes to the assumption that things will pass, especially in a minority Parliament. That issue aside, the way the legislation was written, in particular, speaks to the larger conversation and especially to how it's different committees that study different aspects of these bills.

With Bill C-26, there was certainly some concern brought forward. I am a regular member of the ethics committee. There are some challenges in relation to this, and Mr. Strahl, in some of his interventions, referenced this. There are some specific noteworthy impacts. When it comes to the critical infrastructure being addressed in the context of Bill C-33, and the way the Liberals have taken liberty in writing the bill, which has a wide swath of expectations through to another bill, it certainly creates that context as to why this is so relevant.

This article that I will be referencing, Chair, and that I look forward to making part of this discussion, talks about the critical cyber systems protection act. It goes as follows:

The CCSPA introduces a new cybersecurity compliance regime for designated operators of critical cyber systems related to vital services and systems (“Designated Operators”). A critical cyber system is defined as a cyber system that, if its confidentiality, integrity, or availability were compromised, could affect the continuity or security of a vital service or system. Currently, the list of vital services and systems is comprised of the Canadian telecommunications system, the banking systems, and other federally regulated industries, such as energy and transportation. However, the Governor-in-Council may add new vital services and systems, and such Designated Operators will be governed by the CCSPA.

I would just take a brief pause there. I think the introductory paragraph of this article, which I am entering into the conversation, speaks to that direct relevance to the larger conversation related to Bill C-33.

The article goes on to say:

Under the CCSPA, Designated Operators must:

establish a cybersecurity program (details of which are more fully provided in the CCSPA and its regulations) within ninety days of an order being made by the Governor-in-Council;

implement and maintain a cybersecurity program, as well as annually review it;

mitigate cybersecurity threats arising from their supply chains, or products and services offered by third parties;

share their cybersecurity programs and notify appropriate regulators (namely, the Superintendent of Financial Institutions, the Minister of Industry, the Bank of Canada, the Canadian Nuclear Safety Commission, the Canadian Energy Regulator, and the Minister of Transportation) (the “Appropriate Regulators”) of material changes related to the business of Designated Operators and their cybersecurity programs—

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much, Chair.

It's interesting that the member says to keep it serious. I would suggest that when he shut down my earlier conversation about Bill C-234 and the impact that has on my constituents, that was of the utmost seriousness. That member refused to allow that discussion to take place, about the impact that has on my constituents. He should look in the mirror if he thinks it is simply a joke that there are farmers going bankrupt in my constituency and across Canada because of the imposition of that party's carbon tax upon Canadians.

When it comes to the issue at hand and specifically how Bill C-26 has a clear relevance in relation to the—

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much, Chair.

I appreciate the remarks that my colleague Mr. Strahl made, especially in light of the interconnectedness of Bill C-33 and Bill C-26 and how, in light of those connections, it becomes incredibly relevant.

To address a few of Mr. Badawey's previous points, I find it perplexing myself how the Liberals seem to have this tendency to find concern with anyone who is unable to buy what they're selling hook, line and sinker.

Certainly when I hear from constituents, which I do on a very regular basis, they encourage me to do everything I can to ensure I am being their voice in the nation's capital. When it comes to some of the legislation that may not always garner the headlines it deserves—and certainly Mr. Strahl mentioned it in the brief he presented before this committee—I think it is important for Canadians to know how, with the discussions we have, whether before the transport committee or the various other duties that all of us undertake on a regular basis in the nation's capital, there are important connections that do in fact take place.

Just to note, if you would permit me, Mr. Chair, I endeavoured to have a discussion—and I even had an object lesson—on 2019 rural Alberta special areas wheat. I looked forward to discussing that in the context of Bill C-234. Now, I wouldn't want to be off topic from the conversation around the bill we have before us today, but certainly I would express my disappointment that we didn't have the opportunity to discuss that common-sense Conservative bill that would have brought needed relief to families and support to our great farmers from coast to coast.

I want to ensure that I stick to the conversation we have before us when it comes to the way that the bill this committee is studying and the impact that some of the.... As Mr. Strahl stated, when you have a bill that references a previously passed bill, one of the concerns that were highlighted—and certainly it's not limited to this one—is that when briefs are submitted, sometimes they don't get the due opportunity to be engaged in. The fact that Bill C-26 is currently being studied at committee, I think, speaks to this interconnectedness. I know that Conservatives have endeavoured to—

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Thank you, Mr. Chair.

Thank you for giving me a reference point to begin my comments again, which start with:

Furthermore, excessive secrecy surrounding existing orders or regulations would further undermine accountability, as courts or oversight bodies wouldn’t be able to assess whether collection or sharing of information was reasonably necessary and proportionate in furtherance of those secret orders or regulations. In short, it is unclear how the proposed confidentiality and secrecy provisions align with the need for accountability measures to ensure there is not an inappropriate intrusion into s. 8 Charter rights.

27. The Charter statement notes various information sharing agreements that are contained in the legislation. However, there are broad information sharing powers in Bill C-26 that are not subject to any information sharing agreements, or limitations on how the information may be used once shared. Furthermore, the majority of the Supreme Court has previously noted (in the context of other information disclosure powers accompanying supervised warrant provisions in the Criminal Code), that information sharing agreements are not “a panacea”, given that there is “always a risk that a foreign law enforcement agency may misuse the information disclosed.”

Part 3. Towards More Secure, Transparent, Accountable Governments and Telecommunications Networks in Bill C-26

28. This Part 3 summarizes recommendations identified in Cybersecurity Will Not Thrive in Darkness, as well as supplementary comments and recommendations flowing from the Charter analysis set out in Part 2. The report, including its specific textual recommendations, is enclosed as Appendix B. Where recommendations are identified in this brief for the first time, they are numbered with letters (i.e., Recommendation 1A) to maintain the original numbering of the report.

Here are some recommendations:

I. Limiting powers to order modifications to organizations’ technical or business activities

29. To include appropriate safeguards surrounding compulsion powers under Bill C-26, Cybersecurity Will Not Thrive in Darkness makes the following recommendations:

a. Recommendation 1: Orders in Council and Ministerial Orders Must be Necessary, Proportionate, and Reasonable. Currently, the legislation allows the government to issue an order when necessary to secure the Canadian telecommunications system. However, necessity is an insufficient curb on the government’s power; Bill C-26 should impose more conditions regarding the specific circumstances under which the government can exercise its power.

b. Recommendation 2: Orders Should Include a Reference to Timelines. The draft legislation should be amended to include a requirement that telecommunications providers must implement cybersecurity demands or orders within a reasonable period of time in situations where compliance with a demand or order would require significant or material changes to the recipients’ business or technical operations.

c. Recommendation 3: Government Should Undertake Impact Assessments Prior to Issuing Orders. Government assessments of its orders should identify secondary- or tertiary impacts that would have the effect of worsening an organization’s cybersecurity practices or stance. These assessments should be presented to telecommunications providers along with any demands or orders or regulations that are based upon these assessments. Such assessments should be included in any and all proportionality analyses of government demands or orders.

d. Recommendation 4: Forbearance or Cost/Cost-Minus Clauses Should Be Inserted. The government may issue a direction that could severely alter how a telecommunications provider is able to offer a service to customers. The legislation should be amended such that telecommunications providers can seek forbearance of certain orders where implementing them would have a material impact on the providers’ economic viability. Alternatively, if an order or regulation would have a deleterious effect on a telecommunications provider’s economic viability and the government demands that the order be fulfilled regardless, the provider should be compensated on either a cost or cost-minus basis.

e. Recommendation 5: The Standards That Can Be Imposed Must Be Defined. Without a clear definition of what a “standard” in the draft legislation entails, it becomes difficult to assess what kinds of standards the government is seeking to implement and whether it is adopting them safely. The legislation should be amended such that it is clear what kinds of standards are within and outside of the scope of the legislation. The evidence and analysis in Finding You underscore that urgent action is needed to establish mandatory security and privacy standards for telecommunications providers to require security postures that address the vulnerabilities in signalling protocols that enable mobile geolocation surveillance threats.It should also be made explicit that an order or regulation compelling the adoption of particular standards cannot be used to deliberately or incidentally compromise the confidentiality, integrity, or availability of a telecommunications facility, telecommunications service, or transmission facility. The intent of this recommendation is to prevent the government from ordering or demanding that telecommunications service providers deploy or enable lawful access-related capabilities or powers in the service of “securing” infrastructure by way of adopting a standard.

II. Secrecy and Absence of Transparency or Accountability Provisions

30. As noted above, Bill C-26 has “extensive and overly onerous secrecy and confidentiality requirements.” Laws that impose meaningful limits on the freedom of expression must be balanced and reasonably justified. While some confidentiality will be appropriate to ensure that unresolved security vulnerabilities are effectively brought into control, certain powers in Bill C-26 go further than what is required to accomplish cybersecurity and national security objectives. Furthermore, certain powers proposed are unaccompanied by reasonably available measures to protect the public’s interest in access to information concerning an important area of government action. In light of identified deficits concerning excessive secrecy or the absence of accountability provisions, we reiterate the following recommendations from Cybersecurity Will Not Thrive in Darkness:

a. Recommendation 6: Orders Should Appear in The Canadian Gazette. In Bill C-26, orders are required to be published in the Canadian Gazette, but the Minister has the authority to “direct otherwise in the order.” As such, “the result is that the government might issue orders that never appear in the Canadian Gazette, and there is no requirement for the order to ever be published in a complete and non-redacted format.” The potential effect could unjustifiably restrict meaningful public debate on a matter of public importance and, as a consequence, the freedom of expression. The legislation should be amended such that orders must be published within 180 days of issuing them or within 90 days of an order being implemented, based on whichever condition is met first. The legislation should also expressly define circumstances that justify secrecy.

b. Recommendation 7: The Minister Should Be Compelled To Table Reports Pertaining to Orders and Regulations. To better safeguard the public interest, privacy, and the freedom of expression, the legislation should further be amended such that the Minister of Industry is required to annually table a listing of:

the number of orders and regulations that have been issued

the kinds of orders or regulations that have been issued

the number of telecommunications providers that have received the orders

the number of telecommunications providers that have partially complied with the orders

the number of telecommunications providers that have completely complied with the orders

a narrative discussion of the necessity, proportionality, reasonableness, and utility of the order-making power

c. Recommendation 8: Non-Disclosure Orders Should Be Time Limited. Bill C-26 also proposes gag provisions with respect to Orders in Council or Ministerial Orders, which are not limited either temporally (i.e., how long is secrecy necessary?) or substantively (i.e., what circumstances justify secrecy?). As noted at paragraph 15, non-disclosure orders affect not only the recipient of the gag order, but, also, the public's right to information that informs democratic debate. The legislation should be amended to include time constraints surrounding non-disclosure orders.

d. Recommendation 8A: The Circumstances Purporting to Justify Confidentiality in a Non-Disclosure Order Should Be Defined In The Legislation.

e. Recommendation 9: The CRTC Should Indicate When Orders Override Parts of CRTC Decisions. The legislation should be amended to, at a minimum, require that the CRTC post a public notice attached to any of its decisions where there is a contradiction between its decision and an Order in Council or Ministerial Order or regulation that has prevailed over part of a CRTC decision.

f. Recommendation 10: An Annual Report Should Include the Number of Times Government Orders or Regulations Prevail Over CRTC Decisions. The legislation should be amended to require the government to annually disclose the number of times it has issued orders or regulations that prevailed in the case of an inconsistency between a given order or regulation and a CRTC decision, as well as denote which CRTC decision(s) were affected.

g. Recommendation 11: All Regulations Under the Telecommunications Act Should Be Accessible to The Standing Joint Committee for the Scrutiny of Regulations. The legislation should be amended such that the Standing Joint Committee for the Scrutiny of Regulations is able to obtain, assess, and render a public verdict on any regulations that are promulgated under the proposed draft reforms to the Telecommunications Act, as well as on regulations pertaining to the Telecommunications Act and that are modified pursuant to s. 18 of the Statutory Instruments Act.

III. Deficient Judicial Review Process

31. Bill C-26 contemplates that telecommunication providers may initiate judicial review proceedings in respect of orders or regulations issued under the proposed legislation. In pages 22-24 of his report, Dr. Parson identified problems that would arise if Bill C-26 is passed without amending section 15.9. As drafted, section 15.9 would permit a series of mandatory limits on open court principles, which would prevent judges from exercising judicial discretion in balancing the need for secrecy or confidentiality with the public's interest in disclosure. As noted at paragraph 15 in this submission, the Charter protects open court principles that apply in the context of judicial review, including Charter protections for the freedom of expression.

32. Cybersecurity Will Not Thrive in Darkness recommends (Recommendation 12) that Bill C-26 should explicitly enable appointment of amicus curiae or a special advocate during judicial review. The legislation should be amended such that, at the Court's pleasure, amicus curiae or a special advocate can be appointed to contest and respond to information provided by the government in support of an Order in Council, Ministerial Order, or regulation under s. 15.8 in when evidence is sufficiently sensitive to bar a telecommunications provider's counsel from hearing it.

33. We also recommend:

a. Recommendation 12A: Section 15.9 Should Be Amended To Ensure The Judge Retains Authority To Balance The Public Interest In Disclosure Against The Interest In Confidentiality: In general, mandatory limits on open courts (which prevent the judge from balancing the public interests at stake), are generally viewed as excessive infringements on section 2(b) rights. For example, even in analogous provisions of the Canada Evidence Act (permitting secrecy in judicial proceedings for matters injurious to international relations, national defence or national security or endanger the safety of any person), the judge retains the authority to determine that “the public interest in disclosure outweighs in importance the public interest in non-disclosure”. The same safety valve should be incorporated into section 15.9 of Bill C-26, in order to ensure that any limits to openness minimally impair freedom of expression.

b. Recommendation 12B: Where Summaries Are Provided Of Evidence And Information Received By The Court, Pursuant To Section 15.9(1)(C), These Summaries Must Also Be Available To The “Applicant and the Public”. As noted at paragraph 15, the open court principle protects the public’s and the media’s interest in the openness of court proceedings. Practically speaking, the public’s right of access to judicial summaries of this nature is typically accomplished by marking such summaries as an exhibit to the proceedings. The public’s right of access to exhibits is a corollary of the open court principle.

c. Recommendation 12C: The Triggering Threshold Justifying Limits On The Openness Of The Proceedings Should Not Be Higher Than That Which Is Already Contained Under Analogous Provisions Of The Canada Evidence Act. In that regard, we recommend mirroring the language from the Canada Evidence Act through the following amendment:

Section 15.9(1)(a) “…if, in the judge’s opinion, the disclosure of the evidence or other information would [changed from “could”] be injurious to international relations, national defence or national security or endanger the safety of any person”.

IV. Extensive Information Sharing Within and Beyond Canadian Agencies

34. Bill C-26 proposes to create broad information sharing powers within and beyond Canadian government agencies, without accompanying those powers with necessary limits, oversight, or accountability mechanisms. As noted at paragraph 24, the absence of reasonable procedural safeguards to review government powers that infringe upon privacy interests can render legislation invalid under section 8 of the Charter. To impose more appropriate guardrails on the proposed powers to share information within and beyond Canadian agencies, Recommendations 13-20 of Cybersecurity Will Not Thrive in Darkness are the following:

a. Recommendations 13 and 14: Relief Should Be Available If Government Mishandles Confidential, Personal, or De-Identified Information. The legislation should be amended to enable individuals and telecommunications providers to seek relief should the government or a party to whom the government has disclosed confidential, personal, or de-identified information loses control of that information, where that loss of control has material consequences for the individual, or for a telecommunication provider's business or technical operations.

b. Recommendation 15: Government Should Notify Telecommunications Providers How It Will Use Collected Information, and Which Domestic Agencies Information Will Receive The Information.

c. Recommendation 16: Information Obtained from Telecommunications Providers Should Only be Used by Government Agencies for Cybersecurity and Information Assurance Activities. Information should not be used for the purposes of signal intelligence and foreign intelligence activities, cross-department assistance unrelated to cyber-security, or active or defensive cyber operations. These restrictions should apply to all agencies.

d. Recommendations 17 and 18: Data Retention Periods Should Be Attached to Telecommunications Providers’ Data and to Foreign Disclosures of Information. The legislation should be amended to highlight that confidential information will be retained only for as long as necessary to make, amend, or revoke an order under section 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a), or to verify the compliance or prevent non-compliance with such an order or regulation. Similarly, an amendment should also require that the government attach data retention and deletion clauses in agreements or memoranda of understanding that are entered into with foreign agencies. Retention periods should be communicated to the affected telecommunications providers.

e. Recommendation 19: Telecommunications Providers Should Be Explicitly Informed Which Foreign Parties Receive Their Information. Given that foreign parties can use information to launch investigations and bring non-penal charges against providers, the government should provide some notice when telecommunications providers’ information is being, or has been, shared for cybersecurity purposes.

f. Recommendation 20: Legislation Should Delimit the Conditions Wherein a Private Organization’s Information Can Be Disclosed. As drafted, section 15.7(1) appears to set an excessively low threshold for disclosing information, and could enable significant sharing of private, if not confidential, information, to address unspecified threats that are not set out in the legislation. Proposed textual amendments are found on page 30 of Cybersecurity Cannot Thrive in the Darkness (Appendix A to this brief).

V. Costs Associated with Security Compliance

35. As noted above, imposing substantial costs of compliance on telecommunications providers may have the potential to impact upon the accessibility of telecommunication services, the digital divide, and Charter-protected rights or interests. To address concerns surrounding the costs associated with security compliance, Cybersecurity Will Not Thrive in Darkness makes the following recommendations:

a. Recommendation 21: Compensation Should Be Included for Smaller Organizations. There should be a mechanism whereby smaller telecommunications providers (e.g., those with fewer than 250,000 or 500,000 subscribers or customers) that have historically been conscientious in their security arrangements can seek at least some temporary relief if they are required to undertake new, modify existing, or cease ongoing business or organizational practices as a result of a government demand or order or regulation. Such relief may be for only a portion of the costs incurred and, thus, constitute a “cost-minus” expense formula.

b. Recommendation 22: Proportionality and Equity Assessments Should Be Included in Orders or Regulations. The results of these assessments should be taken into consideration by the government prior to issuing an order or regulation, should be provided to telecommunications providers alongside associated orders or regulations, and should be included in any evidentiary packages that may be used should a telecommunications provider seek a judicial review of any given order or regulation.

c. Recommendation 23: Government Should Encourage Cybersecurity Training. The government should commit to enhancing scholarships, grants, or other incentives to encourage individuals in Canada to pursue professional cybersecurity training.

VI. Vague Drafting Language

36. The last set of recommendations pertain to ambiguities in Bill C-26. Notably, Bill C-26 does not specify the kinds of security threats that might be addressed by orders or regulations; fails to define key concepts like “interference”, “manipulation”, and “disruption”; provides the Minister with unnecessarily open-ended powers; and lacks clear guidelines as to how personally identifiable information that is obtained from telecommunications providers is to be treated. As a result, Cybersecurity Will Not Thrive in Darkness makes the following recommendations:

a. Recommendation 24: Clarity Should Exist Across Legislation. The government should clarify how the envisioned threats under the draft legislation (“including against the threat of interference, manipulation or disruption”) compare to the specific acts denoted in s. 27(2) of the CSE Act (“mischief, unauthorized use or disruption”), with the goal of explaining whether the reformed Telecommunications Act would expand, contract, or address the same classes of acts as considered in the CSE Act.

b. Recommendation 25: Explicit Definitions for “Interference,” “Manipulation,” and “Disruption” Should Be Included in the Legislation or Else Publicly Promulgated.

c. Recommendations 26 and 27: Ministerial Flexibility Should Be Delimited (i.e., remove open-ended language around powers such as “among other things”). In the event that a corresponding amendment is needed for Ministerial powers constrained to emergency circumstances, those powers should be subject to judicial review in Federal Court, including assessment for necessity, reasonableness, and proportionality. Decisions emergent from review should be published by the Federal Court.

d. Recommendation 28: The Legislation Should Make Clear That Personal Information and De-identified Information is Classified as Confidential Information. As noted above, the federal government's Charter statement appears to conclude that it is not the intent of Bill C-26 to authorize the collection and sharing of personal information. If that is the case, the legislation should expressly say so. Alternatively, personal and de-identified information should be treated as confidential.

e. Recommendation 28A: Individuals Should Be Explicitly Informed If Their Information Has Been Collected Or Shared. If the federal government does not expressly state that personal and de-identified information should not be included in collection and sharing powers, it should ensure that notice obligations are extended to individuals whose information is impacted by the collection and sharing powers under Bill C-26.

f. Recommendation 29: Prior Judicial Approval Should Be Required for the Government to Obtain Personal or De-identified Information from a Telecommunications Provider. The information is further to be used exclusively for the purposes of making, amending, or revoking an order under s. 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a), or of verifying compliance or preventing noncompliance with such an order or regulation.

g. Recommendation 30: The Government Cannot Disclose Personal or De-identified Information to Foreign Organizations.

Part 4. Concluding Remarks

37. We urge this Committee to take seriously the recommendations that were identified in Cybersecurity Will Not Thrive In Darkness. We note that most of these recommendations have been either reiterated or expanded upon by the Joint Submission to this committee submitted by civil society organizations and individuals. In detailing these recommendations for this Committee's study, we also urge the Committee to consider the additional Charter interests that are engaged by Bill C-26, including equality, non-discrimination, freedom of expression, and privacy, as described in Part 2 of this Brief. We echo Dr. Parsons' view that “cybersecurity efforts through Bill C-26 should seek to build trust between the government and non-government entities, including the general public,” and that independent bodies (including the Privacy Commissioner of Canada, National Security and Intelligence Committee of Parliamentarians, or National Security and Intelligence Review Agency) should be integrated into the government's assessments of the necessity, proportionality, and reasonableness of Orders in Council, Ministerial Orders, or regulations.

38. Citizen Lab's recent report, Finding You (enclosed as Appendix C), documents continuing vulnerabilities at the heart of the world's mobile communications networks. The report's findings underscore that cybersecurity has not thrived in darkness. Historical and continuing deficiencies in oversight, transparency, and accountability of network security have led to serious geolocation-related threats associated with contemporary networks. The report notes that the “failure of effective regulation, accountability, and transparency has been a boon for network-based geolocation surveillance.”

39. While Canada needs to move forward in combating threats to its telecommunications and critical infrastructure, it should not do so at the expense of democratic norms and safeguards, public transparency and accountability, or respect for the Charter and human rights. Rather, a human security and human rights approach to cybersecurity requires the recognition of the importance of accessible and inclusive cybersecurity, public accountability, and public transparency when regulating telecommunications and cybersecurity.

The rest of it is just a bit of a biography of the individuals who were involved in putting that together.

I think I've given you a fairly comprehensive.... It's a lot for the committee to think about when we want to go back to clause 124, which deals specifically with Bill C-26.

I certainly recognize that there are some who didn't want to have this conversation, but I think this provision, with Bill C-26 being such a key part of this clause.... We need to consider whether or not we should support a clause that contains linkage to a bill that clearly has so many glaring errors. So many critical civil society organizations have come forward and said this is something we need to amend. We need to make changes, because there are significant concerns about the impact on privacy, data sharing and government reporting when they collect information from individuals or other entities. I believe we should give strong consideration to voting against this particular clause. The information I provided should formulate part of that discussion, but I know other members have some concerns they want to share with the committee.

Therefore, Mr. Chair, I will turn the floor over to the next speaker. However, while I still have the floor, I would indicate that I would like you to put me at the end of the speaker list, as well. I'd like to hear what my colleagues have to say, and then have the opportunity to follow up. Could you add me to the list and perhaps give us all a reminder, as I turn the floor over, what that list looks like, to make sure I have a place at the end of it?

Thank you, Mr. Chair.

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

I am just getting started, Mr. Chair.

I will read this document to the end. Then I will probably have some other briefs that are very important and give some great insight into Bill C-26, which is extremely relevant. I will speak until I believe my point has been made. Evidently, I still have some work to do to convince some members of the committee that we should be concerned about this bill and its link to Bill C-33.

I'll continue reading this document until it ends. At the end of every brief that I submit to the committee and read into the record, I kind of take stock then and determine whether I believe the point has been received or whether there is further relevant information.

I'm sorry, but I can't give a more specific answer. I know we're eight minutes away from Mr. Iacono's next break. I will continue reading this particular document, because I know many of my colleagues are interested in my picking that back up.

The next section of this brief talks about privacy impacts and section 8 of the charter.

20. Bill C-26 proposes several new information collection and sharing powers, and may include the collection or sharing of personal information. Many of these powers are insufficiently bounded or defined. The potential privacy risks posed by the powers are heightened by the absence of key accountability and oversight mechanisms. The breadth of the unsupervised information collection and sharing powers heightens the risk that the legislation, if passed as drafted, could unreasonably interfere with section 8 of the Charter in at least three [or] four ways.

21. First, the federal government's Charter statement posits that Bill C-26 does not interfere with section 8, in part, as a result of the fact that the “the information being gathered and shared in this context relates to the technical operations of TSPs, which are commercial entities”, as opposed to “personal biographical information that attracts a heightened privacy interest”. However, Bill C-26 does not explicitly draw this distinction between technical information or other forms of personal information when defining collection or information sharing powers in the bill.

22. Instead, Bill C-26 provides authority to compel a broad array of information-holders to disclose a broad array of information. While the Charter statement for Bill C-26 emphasizes the regulatory nature of the scheme in Bill C-26, unlike other statutory inspection powers that have been subject to Charter challenges historically, there is no reason to interpret the statutory powers in Bill C-26 as applying only to information in which there is a low expectation of privacy. Rather, section 15.4 would provide authority to compel “any person” to provide “any information” under “any conditions that the Minister may specify,” so long as the Minister believes it is relevant to its order making powers. The persons and entities subject to this provision in many circumstances play an integral role in the lives of people in Canada, and may well be information-holders in respect of highly sensitive or personal information.

23. Second, while some aspects of Bill C-26 are regulatory in nature, Bill C-26 also creates criminal offences punishable by imprisonment for non-compliance with specified orders or regulations. Statutory powers authorize collecting and sharing information for the purposes of “verifying compliance or preventing non-compliance” with those orders or regulations. The legislation therefore creates risks that information will be compelled or shared during investigations pertaining to the criminal offences created by Bill C-26, or other offences. Furthermore, the breadth of the order making powers under Bill C-26 mean that the collection of information for the purposes of making such orders may cause serious consequences that are separate and apart from any regulatory or criminal prosecution.

24. Third, section 8 also protects privacy by requiring adequate accountability and review mechanisms to accompany information collection powers, even in administrative or regulatory contexts. The Supreme Court states that “[w]hile less exacting review may be sufficient in a regulatory context, the availability and adequacy of review is nonetheless relevant to reasonableness under s. 8.” Canadian constitutional law has long recognized that without clearly defined safeguards (often including prior judicial oversight), legislation that authorizes intrusions on reasonably held expectations of privacy is inconsistent with s. 8 of the Charter. In some circumstances involving searches that are not subject to warrant requirements, the Court still expects that additional safeguards will be established to ensure the requisite level of transparency and accountability, and to help ensure that such powers are not abused. For example, requiring notice to the persons whose information is affected allows the affected individuals to identify and challenge invasions of their privacy, as well as seek a meaningful remedy. Appellate courts have recognized a range of accountability measures when assessing the reasonableness of search and seizure powers, such as: notice requirements (including after-the-fact notice); reporting obligations (to independent institutions or Parliament); the availability of clear mechanisms for review of the exercise of collection powers; clear rules limiting collection powers to what is necessary, reasonable, and proportionate; and record-keeping requirements.

25. Part 3 of this brief will identify several mechanisms that are necessary to improve accountability surrounding the proposed powers in Bill C-26. For example, the draft legislation proposes broad information sharing powers with no notice requirements. This would mean that individuals and organizations whose information has been collected would have no way of knowing of the fact that information has been shared, thus thwarting review and challenge. Individuals who have private information held by, and collected from, third-party organizations would also not be aware that their information has been collected in the first place, let alone shared with other government entities.

26. Fourth, the extensive confidentiality provisions in Bill C-26 may actually further undermine accountability mechanisms surrounding the bill's proposed information collection powers in ways that would be difficult to reasonably justify under s. 8. Section 15.4 of the proposed Telecommunications Act authorizes the Minister to require “any person” to provide “any information” under “any conditions that the Minister may specify.” These conditions would foreseeably include conditions to extend confidentiality obligations to the Minister's use of collection powers. The secrecy provisions in Bill C-26, and the authority to extend those secrecy obligations through further “conditions”, could effectively chill or silence individuals or entities from notifying other persons that their personal information has been collected, or from challenging the exercise of government power. Furthermore, excessive secrecy surrounding existing—

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Thank you very much, Mr. Chair.

Of course, I believe it's quite fortunate that the rights of members to speak are being upheld in this case by the chair and by the clerks. I certainly understand, as has been said, that I'm no longer capturing Mr. Bachrach's attention or offering him something that he feels is compelling, but it's not really my job to keep him entertained. My job is to speak to the bill.

As you said, there is a direct link, whether or not the government now regrets putting it in there, because we're now talking about it. Maybe they hoped that this would be breezed past or that Bill C-26 would be considered irrelevant, even though it's the title of the clause we are debating and even though it specifically refers to what will happen if Bill C-26 receives royal assent.

To somehow believe that it's irrelevant to be talking about a bill that is specifically named and specifically referred to as having an impact on this piece of legislation is truly unfortunate. I appreciate the chair recognizing the relevance of the discussion, despite the fact that Mr. Bachrach and some others clearly might not enjoy the conversation. I don't operate for Mr. Bachrach's enjoyment, entertainment, captivation or any of the other things he's talked about. I will continue to read from the relevant information about the relevant—

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Thank you, Mr. Chair.

I think this is important. Again, the title in Bill C-33 says “Coordinating Amendment”, and then the subtitle is “Bill C-26”. If Bill C-26, which was introduced in the first session of the 44th Parliament and is entitled “An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments other Acts”, receives royal assent, that is what I am talking about. The title does not say, “if clause 18 of that act receives royal assent”, but it talks about the bill, and clause 18 cannot be considered in isolation from the rest of the bill.

I'm sorry. Perhaps, Mr. Bachrach, when he gets the floor in a more extended way, can indicate why he thinks we should focus solely on a certain section. It's very clear in my reading of Bill C-33 that we are discussing whether or not we believe there should be coordinating amendments with a piece of legislation, Bill C-26, which, as the witness just said, is about cybersecurity. Clause 18 is about cybersecurity and it's about how we deal with threats to cybersecurity in the transportation space.

I've highlighted numerous briefings that referenced the transportation sector as being one of the key sectors that are impacted by Bill C-26. Certainly, I don't think we can consider one section of a bill. It's not a private member's bill that amends one section of a bill that we're considering here; this is the entire bill, as is said in the title, “Bill C-26”. If Bill C-26 receives royal assent, then these following issues happen.

I'm expressing, and putting on the record, some very serious concerns about Bill C-26. I remain hopeful as I continue to read these things from people who are very concerned about things like the implications on the rights of Canadians under the charter.

I know Mr. Bachrach is a fan of the charter. Certainly he would want to ensure, in any clause he voted on, that the concerns of individuals who spend their lifetimes defending charter rights are considered. He would want to have knowledge of the impact that this bill, which is referenced directly—the entire bill, not just one section, but the entire bill—could have on the charter rights of Canadians.

I will continue to talk about Bill C-26 in its entirety, because that is a piece of legislation that includes the relevant section that he's talking about. It's not a stand-alone clause that has been introduced by the government. This does not specifically indicate that if clause 18 remains unamended or if it's taken on its own, it could receive royal assent. It talks about Bill C-26 receiving royal assent.

I appreciate the latitude given to members of Parliament to raise their concerns and to share the concerns of Canadians when we're considering a piece of legislation as important as Bill C-33, which cross-references specifically, purposely, Bill C-26, which is also currently before the House.

I appreciate the spirit in which Mr. Bachrach's comments were made. However, I simply don't believe that you can consider clause 18 in isolation when considering Bill C-26. We would do Bill C-26 and what it means to Canadians a disservice if we simply talked about clause 18. I will get to that part when we break down the detailed analysis of the clause, but this is the information that I believe is relevant when considering whether or not we can support clause 124.

I will continue, because I know that it would be extremely out of order to rule that we weren't allowed to talk about a bill in our deliberations here that is specifically referenced by title in the first part of this clause,.

I will hopefully not omit any of the information that I had here. If so, I apologize to Citizen Lab for not getting all of their words in there.

I'll start back again at the text under Freedom of Expression and Section 2(b) of the Charter”, which states that:

14. The current draft of Bill C-26's excessive secrecy and confidentiality provisions jeopardizes the right to freedom of expression under section 2(b) of the Charter. The government's Charter statement focuses on the speech of the commercial entities who will be directly regulated under Bill C-26. The Charter statement posits that because restrictions on commercial speech do not tend to implicate the core values of section 2(b), restrictions can be more easily justified. However, this analysis fails to account for how individuals' Charter rights may be impeded under the current drafting of the legislation. The excessive secrecy and confidentiality provisions in the bill also restrict the public's and media's expressive freedom in Canada.

15. The principles of open courts and open government are derivative components of section 2(b) of the Charter (the freedom of expression). The open court principle requires that court proceedings, including judicial reviews in federal court, presumptively be open and accessible to the public and to the media. Access to information about government actions can also arise as a derivative right to section 2(b), if a denial of access to government information effectively precludes meaningful public discussion on a matter of public interest. Where restrictions on access substantially impede meaningful discussion and criticism about matters of public interest, the government must reasonably justify its infringement of the freedom of expression.

16. Telecommunications and cybersecurity law and policy is undoubtedly a matter of public interest. There is a close nexus between human rights and public policy concerning the regulation of telecommunication services. Canada's telecommunications policy is intimately linked with the “social and economic fabric” of Canada and its regions. Equitable access to telecommunication services is sometimes described as a mechanism for “digital self-determination”, which speaks to the need to protect the potential for human flourishing in the digital era.

17. The recent Citizen Lab report, “Finding You”, highlights several ways in which excessive secrecy surrounding telecommunications oversight has itself endangered the public. The authors note historical deficiencies in oversight and accountability of network security, which have led to geolocation-related threats associated with contemporary networks. Excessive secrecy has contributed to the persistence of the “low-hanging geolocation threat” identified in “Finding You”:

Decades of poor accountability and transparency have contributed to the current environment where extensive geolocation surveillance attacks are not reported. This status quo has effectively created a thriving geolocation surveillance market while also ensuring that some telecommunications providers have benefitted from turning a blind eye to the availability of their network interconnections to the surveillance industry.

18. The geolocation surveillance threats discussed in “Finding You” disproportionately jeopardize human rights defenders and other individuals who face heightened risks of targeted security threats (e.g. corporate executives, military personnel, politicians and their staff, senior bureaucrats, etc). Industry has historically charged large amounts of money to receive information about well-known industry threats, with the effect of impeding non-industry groups such as security researchers and civil society from obtaining and disseminating information about the nature of the threats faced by at-risk individuals, or from advocating for the remedies that would benefit the security and privacy of civil society. The authors note that, in many instances, individuals cannot determine whether their own telecommunication provider has “deployed and configured security firewalls to ensure that signalling messages associated with geolocation attacks, identity attacks or other malicious activity are not directed towards their phones.”

19. Citizen Lab's research highlights the substantial public interest—

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

Mr. Chair, on my point of order, I would be happy to discuss and debate that aspect of clause 124, but it feels like the debate we're currently having does not relate to clause 18. Clause 18 is the only section of Bill C-26 that is referenced in clause 124.

I want to bring it back to the core. This is a very important clause and obviously worthy of detailed debate. I'm hoping you can encourage Mr. Strahl to come back to this very important clause, clause 18, which deals with administrative monetary penalties.

[Rachel Heft]

Thank you.

Clause 18 of Bill C-26 is a provision that ensures that the Transportation Appeal Tribunal of Canada has jurisdiction to review administrative monetary penalty issues or notices of violation that are issued under the critical cyber systems protection act.

When you can issue an administrative monetary penalty under that act, we have to ensure that when that is issued to a transportation undertaking, the proper tribunal has jurisdiction. That's what clause 18 does.

[An hon. member]

Why don't we read Bill C-26 into the record?

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

I know. Bear with me.

It seems like he's reading references to the act that don't pertain to clause 18.

Man, it's hard for me to maintain my train of thought here.

I'm quite fixated on clause18 of Bill C-26. I wonder if the witnesses could help us understand what is in clause 18 so that the chair may determine whether what Mr. Strahl is contributing is relevant to that clause, seeing that Bill C-26 is referenced in clause 124 in Bill C-33.

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

No, but on a serious note, it refers to clause 18 of Bill C-26. I don't think it's in order to refer to the entirety of Bill C-26, but rather only to the portion that is referenced in the clause we're currently debating, which is clause 124. I'm wondering if the clerk or one of the legislative personnel or our witnesses could help me determine—

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

I know. Is he off camera at least? I won't go further down that line of thought—but I digress, Mr. Chair.

Clause 124 just references clause 18 of Bill C-26. I was looking for Clause 18 on my phone, but I'm struggling to make a connection between....

I'm worried you're not going to be able to rule on my point of order, Mr. Chair, if you're not listening. I demand your attention.

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

To this committee and to all Canadians, Mr. Chair, we're grateful for that service. I'm just going to make sure I don't miss any of this important article here.

Following the process of the proposed legislation...and its passing, Federal Government departments will communicate with the companies impacted in the focused sectors with details on how breaches are to be reported and the required timeline for reporting. Furthermore, the companies must “keep records of how they implement their cybersecurity program, every cyber [security] incident they have to report, any step taken to mitigate any supply-chain or third-party risks and any measures taken to implement a government-ordered action.”

Let’s be very clear, although only the four key sectors—Telecommunications, Finance, Energy, and Transportation—are considered in scope by Bill C-26, sectors such as agriculture and manufacturing are likely to be included later, as is the case in the EU. The Federal Government of Canada hopes this legislation will serve as a model for provinces and territories to implement similar legislation that regulates cybersecurity requirements for entities under their purview, including hospitals, police departments, and local governments.

To help companies comply with the requirements of Bill C-26—

They're now talking about their services, and I don't need to give them that free plug, Mr. Chair. I think we have an idea of what they think the merits of Bill C-26 are, as well as some concerns about it. You will note that the transportation sector obviously is mentioned as a key part of Bill C-26, which is likely why there is a reference in Bill C-33 in clause 124 to that piece of legislation. Again, we need to fully understand whether or not Bill C-33 should be coordinating amendments with a piece of legislation on which so many concerns have been raised.

I want to raise some other concerns. Obviously any time you're dealing with cybersecurity and so on, a charter analysis is going to be done. I referred to an article by the Citizen Lab in the Munk School of Global Affairs & Public Policy at the University of Toronto, but I also want to get into the details of a submission that was made to the Standing Committee on Public Safety and National Security concerning a charter analysis of cybersecurity and telecommunications reform in Bill C-26. This again was referenced in the previous article. This is the base documentation that gave rise to that article. I want to make sure we're not just hearing an interpretation of a report but also considering it directly.

This report goes on to say that:

On June 14, 2022, Bill C-26, an Act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other Acts, was introduced in Parliament for the first reading by Canada's [now former] Minister of Public Safety, Marco Mendicino. Hearings on Bill C-26 are scheduled to begin in SECU on December 4, 2023.

That was very recently, Mr. Chair.

Kate Robinson, a Senior Research Associate and Lina Li made a written submission to the Standing Committee on Public Safety and National Security...regarding Bill C-26.

With an emphasis on privacy in particular, this submission tackles the issues Bill C-26 brings up regarding civil liberties and human rights. The fundamental tenets of accountable governance, due process, and our right to privacy are all at risk of being compromised by Bill C-26 in its current form. In order to better protect people’s right to privacy, this submission offers recommendations for how Bill C-26 can be implemented in terms of how the government and telecom companies define, manage, and safeguard people's personal information. The submission suggests that safeguards for the new government powers that the Bill establishes be included in order to address general shortcomings, such as issues with secrecy and transparency.

There is evidence that signaling protocols used by telecom companies for facilitating roaming services also enable networks to obtain incredibly detailed user data. Such extent of access with the telecom service providers poses an unprecedented risk to the privacy of individuals. Owing to the extent of data available with the telecommunications providers, the telecom sector has become a primal target for surveillance actors. In an attempt to address the concerns in the telecom ecosystem, this submission to the Standing Committee on Public Safety and National Security provides a critical response to the federal government’s Charter statement on Bill C-26.

The Citizen Lab welcomes the opportunity to submit to the Standing Committee on Public Safety and National Security. Our submission highlights how Bill C-26 will impact equality rights and freedom of expression while providing recommendations to address a series of thematic deficiencies identified in Bill C-26. To ensure that its actions adhere to Canada’s democratic values as well as the standards of accountability and transparency, the government must make changes to its legislation.

Below is the Citizen Lab’s full submission to SECU regarding Bill C-26.

The next part is called “Part 1. Introduction and Summary”.

1. Citizen Lab researchers routinely produce reports concerning technical analyses of information and communications technologies (ICTs), the human rights and policy implications surrounding government surveillance that occurs using ICTs, as well as the cybersecurity threats and digital espionage targeting civil society. Citizen Lab research has also examined the openness and transparency of government and organizations, including telecommunications providers, with respect to the collection, use, or disclosure of personal information and other activities that can infringe upon human rights.

2. This month, the Citizen Lab published “Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure”, authored by Gary Miller and Christopher Parsons. The report provides a high-level overview of geolocation-related threats sourced from 3G, 4G, and 5G network operators. Evidence of the proliferation of these threats shows how the signalling protocols used by telecommunications providers to facilitate roaming also allow networks to retrieve extraordinarily detailed information about users. These protocols are being constantly targeted and exploited by surveillance actors, “with the effect of exposing our phones to numerous methods of location disclosure.” Risks and secrecy surrounding mobile geolocation surveillance are heightened by layers of commercial agreements and sub-agreements between network operators, network intermediaries, and third-party service providers. Ultimately, vulnerabilities in the signalling protocols have “enabled the development of commercial surveillance products that provide their operators with anonymity, multiple access points and attack vectors, a ubiquitous and globally-accessible network with an unlimited list of targets, and virtually no financial or legal risks.”

3. “Finding You” highlights the importance of developing a cybersecurity strategy that mandates the adoption of network-wide security standards, including a requirement that network operators adopt the full array of security features that are available in 5G standards and equipment. The report’s findings also underscore the importance of public transparency and accountability in the regulation of telecommunications providers. As the authors note, “[d]ecades of poor accountability and transparency have contributed to the current environment where extensive geolocation surveillance attacks are not reported.”

4. In short, it is long overdue for regulators to step in at national and international levels to secure our network services. However, Canada's approach to the regulation of telecommunications and cybersecurity also needs to be transparent, accountable, and compliant with applicable human rights standards. One year ago, Citizen Lab published “Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act”.... The report was authored by Dr. Christopher Parsons. Dr. Parsons critically examined the proposed draft legislation under Bill C-26, including identified deficiencies. In doing so, Dr. Parsons provided necessary historical and international context surrounding the federal government's proposed telecommunications sector reform. Canada is not the first of its allies to introduce new government powers as a result of heightened concern and awareness surrounding real and pressing risks to critical infrastructure. However, Dr. Parsons identified that although the draft legislation may advance important goals, its current iteration contained thematic deficiencies that risked undermining its effectiveness. This report is set out in Appendix B, and is the focus of this brief.

The main submissions in this brief are set out in two parts:

a. Part 2: Bill C-26 and the Canadian Charter of Rights and Freedoms (“Charter”):

You will be very concerned about that.

Part 2 of this Brief discusses the nexus between Bill C-26 and the Charter. It—

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Thank you, Mr. Chair.

Continuing from the Canadian Civil Liberties Association's submission on Bill C-26—which, just to remind colleagues, is referred to in clause 124—we are deciding whether or not we believe that there should be a coordinating amendment with Bill C-26 in Bill C-33.

I am building the case for why I have concerns with that, and I'll just continue reading. Perhaps I'll go back just to make sure that information wasn't missed. It says:

Further, personal data can be anonymized or de-identified, but de-identified information requires additional protections. Anonymization involves permanently deleting identifying data, while de-identification involves stripping away and separating different bits of identifying information from one another or protecting identifying information through encryption or key (but not permanently deleting it). Anonymizing data is irreversible, while de-identified data can be re-identified. De-identified data requires greater protection than anonymized data, so Bill C-26 should ensure de-identified information is explicitly acknowledged as confidential.

As it stands, Bill C-26's proposed amendments to the Telecommunications Act do not designate personal and de-identified information as confidential under section 15.5(1). Nor for that matter does the Critical Cyber Systems Protection Act (CCPSA), which under section 6(1) does not flag personal or de-identified information as confidential. In order to protect this information, both Acts contained within C-26 need adjustment to better align with our privacy rights, freedoms, and democratic values.

“Handling Personal Information” is a new section.

Bill C-26 gives the Minister overbroad powers for handling personal information. Telecommunication companies, and companies likely to be designated under the CCSPA, collect, process, and store vast amounts of personal data and metadata, including call logs, messages, financial data, and location data. But as worded, Bill C-26 allows the Minister to share this type of personal information with anyone they designate...or who is prescribed by regulations..... It is one thing for government to ask designated operators for information about themselves and how they are complying with orders, but there needs to be a significantly higher standard when ordering companies to hand over information about their customers. This is especially important for telecommunication companies, given the high volume of personal information they hold about the public, and how telecommunications data can be used to identify individuals, track their movements, and monitor their communications. Bill C-26 should better protect the privacy of personal information and communications by creating a more effective stopgap between this information and the Minister’s ability to disclose it. The legislation should be amended so that the government must first obtain a relevant judicial order from the federal court before it can compel a telecommunications provider to disclose personal or de-identified information.

Further, Parliament should strengthen the Bill’s privacy protections when it comes to telecommunication providers and designated operators sharing information with foreign parties. In the proposed new section 15.7(1) of the Telecommunications Act:

“Any information collected or obtained under this Act, other than information designated as confidential under subsection 15.5(1), may be disclosed by the Minister under an agreement, a memorandum of understanding or an arrangement in writing between the Government of Canada and the government of a province or of a foreign state, an international organization of states or an international organization established by the governments of states, or any institution of any such government or organization, if the Minister believes that the information may be relevant to securing the Canadian telecommunications system or the telecommunications system of a foreign state, including against the threat of interference, manipulation or disruption.”

The provision's breadth and vagueness would allow not only for tremendous ministerial overreach, but it could also lead to privacy risks that cross provincial and national borders, resulting as well in potential risks to life and security for affected individuals and groups. CCLA strongly urges the amendment of the Bill to preclude the Minister from sharing personal or de-identified personal information to foreign governments or organizations, and that the Minister should inform telecommunications providers and designated operators when—and to whom—information may be disclosed when the receiving party is a foreign state, agency, organization, or party.

Finally, Bill C-26 lacks strong provisions around data retention periods. Data should only ever be kept for as long as they are useful, and storing data indefinitely can increase the risks and harms of potential data breaches. Data retention periods are crucial for ensuring that any information obtained under either the Telecommunications Act or the CCSPA would be held only for so long as is necessary to make a legislative order, or to confirm compliance with such an order. CCLA recommends that the legislation be amended to make this data retention period as limited in duration as possible, and that the legislation include—to the extent that the legislation permits any data sharing—a requirement to attach data retention and deletion clauses in agreements or memoranda of understanding that are entered into with foreign governments or agencies.

The next section is “Ensuring Accountability for Mishandled Information”:

Bill C-26 lacks key accountability measures for privacy issues. Accountability is a core principle of effective government and should similarly be a core principle of Bill C-26.

A key accountability concern pertaining to privacy is that Bill C-26 does not allow individuals to seek relief if the government mishandles personal or de-identified information. Allowing for this recourse is an important step toward accountability for privacy violations. CCLA recommends that Bill C-26 be amended to enable individuals to seek relief if the government or a party to whom the government has disclosed their personal or de-identified information negligently loses control of that information and where that loss of control impacts the individual.

Their conclusion states:

In its current form, Bill C-26 undermines personal privacy and violates due process. Privacy and due process are not only essential to cybersecurity and the protection of our critical infrastructure but are also part of the very fabric of our democracy. The Bill gives government the power to collect broad categories of information about people, without adequate protections for information that should be deemed confidential. The Bill also threatens personal privacy and creates other serious risks and dangers to people by allowing government to distribute this sensitive information to domestic and foreign organizations without proper checks and balances. And the Bill contains inadequate mechanisms for people to seek appropriate redress in cases where their private information has been mishandled and abused.

In this submission, CCLA has recommended remedies to address these concerns while still enabling the legislation to fulfill its stated goals: bolstering cybersecurity across the financial, telecommunications, energy, and transportation sectors, and helping organizations better prepare, prevent, and respond to cyber incidents. We urge the Committee Members to adopt these proposals for strengthening Bill C-26.

The Canadian Civil Liberties Association has very grave concerns and has proposed some significant changes to Bill C-26.

Once again, for the purposes of clause 124, the first words are that if Bill C-26 receives royal assent, then on that day.... We go into whether or not there should be changes to Bill C-33. I think it's very important that we discuss whether or not we believe this clause should be passed, given the incredible concerns there are with Bill C-26.

IT World Canada is another one. If Mr. Iacono wants to go to that website, it's itworldcanada.com. I'll be reading a bit from that.

They have an article here, under their Industry Voices section, entitled “The Bill-C-26 Regulation and Its Implications for The Critical Infrastructures’ Cybersecurity in Canada”. It's by Frank Lawrence and Eric Jensen of Fortinet.

The article states:

As the last G7 nation and one of the few G20 nations without a firm regulatory framework around cybersecurity, Canada must act to protect the Nation’s critical infrastructure assets.

In 2016 member states of the European Commission (EU) passed what was called the most comprehensive cybersecurity bill in the history of the EU; the bill was called the NIS Directive. The EU cybersecurity rules introduced in 2016 were updated by the NIS2 Directive, ratified in 2023. NIS2 continues modernizing the legal framework to keep up with increased digitization and an evolving cybersecurity threat landscape. Expanding the scope of the cybersecurity rules to new sectors and entities further improves the resilience and incident response capacities of public and private entities, competent authorities, and the EU as a whole. Most G7 member states are under the umbrella of the EU; the US, UK, and Japan have separately implemented cybersecurity regulations to differing degrees.

Canadian businesses continue to be impacted by malicious cyber activity, ranging from cyberattacks to ransomware. Many attacks, including those on critical infrastructure that account for nearly half, go unreported. Concerningly, the Canadian Centre for Cyber Security (CCCS) has identified attacks against OT networks as “the most pressing [threat] to the physical safety of Canadians” in their biennially published National Cyber Threat Assessments.

In this context, the Ministry of Public Safety acted to introduce new legislation, Bill C-26 An Act Respecting Cybersecurity. Bill C-26 passed its first step in Parliament in November of 2022 and went through its second reading on March 27th, 2023. [The bill]...sits in committee and is believed to go into legislation and law in the calendar year of 2023.

I'd say the article was a little optimistic there.

The primary focus of Bill C-26 is to add teeth to the governance and compliance of cybersecurity, especially in the much-needed Operational Technology (OT) area where critical infrastructure lies. Although the Bill has not yet received royal assent...between the absence of similar legislation in Canada and the trend towards increased cybersecurity regulation amongst our international peers, Canadian businesses would be wise to prepare.

Canada has yet to pass laws that govern cybersecurity, let alone require reporting vulnerabilities and critical infrastructure breaches; Bill C-26 would empower the regulators to impose fines or issue summary convictions to ensure governance and compliance.

Bill C-26, in its current form, includes four critical infrastructure sectors—Telecommunications, Finance, Energy, and Transportation. The requirement for organizations in these sectors is threefold:

1. Implement, maintain, and report on a cybersecurity program to address risk across the organization, third-party services, and supply chains.

2. Report any cyber incidents involving critical systems to the appropriate regulator and the Canadian Center for Cyber Security.

3. Use, or discontinue any specified product, service, or supplier.

The intended outcome of these requirements is to improve the standard of cybersecurity amongst critical operators and deepen the level of visibility the federal government has into the security operations of these organizations. It is known today that certain companies that are considered high-risk and vital to national security would become the federal government's focus.

Following the process of the proposed legislation (Bill C-26) and its passing, Federal Government departments will communicate with the companies impacted in the focused sectors with details on how breaches are to be reported and the required timeline for reporting. Furthermore, the companies must “keep records of how they implement their cybersecurity program, every cyber incident they have to report, any step taken—

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Thank you.

As I was saying, the Canadian Civil Liberties Association has raised significant concerns with regard to Bill C-26, which, again, is as referenced in clause 124. I'll just read their submission here so that we can consider it in our deliberations on whether or not we believe that we want to approve this coordinating amendment clause in the legislation. They state:

The Canadian Civil Liberties Association...is an independent, national nongovernmental organization that was founded in 1964 with a mandate to defend and foster civil liberties, human rights, and democratic freedoms of all people across Canada. Our work encompasses advocacy, research, and litigation related to the criminal justice system, equality rights, privacy rights, and fundamental constitutional freedoms. Working to achieve government transparency and accountability with strong protections for personal privacy lies at the core of our mandate.

In this submission, CCLA speaks to Bill C-26, the Government of Canada's telecommunications and cybersecurity legislation. This submission addresses the concerns Bill C-26 raises for human rights and civil liberties, with a particular focus on privacy. Cybersecurity is an essential part of national security, and the digital ecosystem in which we increasingly live our lives needs to be safe, reliable, and secure from threats. Cybersecurity is also crucial for our democratic institutions, the economy, critical infrastructure, national defence, and the privacy of our online life. It is important that Canada take steps toward protecting the digital foundations on which modern life is built. However, in its current form, Bill C-26 risks undermining our privacy rights, due process and the principles of accountable governance—all of which are part of the very fabric of our democracy. [Bill] C-26 must not pass without substantial revisions to protect fundamental rights and due process.

This submission makes recommendations for how Bill C-26 can improve the way government and telecommunication companies define, handle, and protect individuals' personal information and thus protect individuals' right to privacy. Privacy is, after all, an essential component of individuals' personal sense of security, both off- and online, and stands to be positioned more centrally in [Bill] C-26. CCLA believes that our recommendations enable the legislation to better fulfill its stated objectives: bolster cybersecurity across the financial, telecommunications, energy, and transportation sectors, and help organizations better prepare, prevent, and respond to cyber incidents.

The amendments outlined in this submission echo the Joint Letter of Concern that CCLA sent with civil society partners in September 2022. In addition, our recommendations are consistent with those contained within the “Fixing Bill C-26 Recommended Remedies Package”, of which CCLA is a signatory, as well as with the recommendations in Christopher Parsons' report, “Cybersecurity Will Not Thrive In Darkness”.

It's the second time that's been referenced. I think we'll be bringing that up again shortly.

The next section is “Defining Personal Information”.

As it stands, Bill C-26 undermines privacy by empowering the government to collect broad categories of information from designated operators, at any time, subject to any conditions, or even no conditions at all. This may enable the government to obtain identifiable and de-identified personal information and subsequently distribute it to domestic, and perhaps foreign, organizations.

Given the sensitivity of the information people in Canada provide to designated operators, this provision poses an extraordinary risk to individuals’ privacy. Measures must be established to constrain the government’s collection, use, and distribution of individuals’ sensitive information.

In general, the privacy of personal information is one of the keys to strong cybersecurity protections. Building privacy into cybersecurity legislation will go a long way toward ensuring the cybersecurity protections proposed in Bill C-26 are successful. Some degree of monitoring is required to protect telecommunications infrastructure from attack, but this should not come at the expense of personal privacy. There is no excuse for governments to surveil and analyze online activity without clear safeguards for personal privacy and individuals' fundamental rights.

One way to reasonably restrict the government's capacity to collect information is to refine how Bill C-26 conceives of information worth protecting. This would involve codifying personal and de-identified information as confidential. Personal information is any information that can be used to identify an individual through association or inference. Many kinds of information qualify as personal in their capacity to identify an individual; these, according to the European Union's (EU) General Data Protection Regulation (GDPR), include names, ID numbers, location data, online identifiers, or “factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity” of a person.

Further, personal data can be anonymized or de-identified, but de-identified information requires additional protections. Anonymization involves permanently deleting identifying data—

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

It's okay. I'll get this quote read eventually.

It reads:

Today's report should set alarm bells ringing on Parliament Hill. As written, Bill C-26 gives the government and its spy agencies a blank cheque to intrude on our private lives and endanger our fundamental Charter rights. Frankly, as currently drafted it is little more than a spy agency wish list. MPs need to fix this risky and deeply-flawed legislation so that it delivers the cybersecurity we need, while protecting the freedoms we hold dear. Canadians deserve nothing less.

That's from Matthew Hatfield, executive director, OpenMedia.

One of the groups he referred to in that article is the Canadian Civil Liberties Association. They have also provided some detailed information on their concerns with Bill C-26, “an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts”.

They made a submission that I'd like to share with the committee as well, because when we're talking about civil liberties and how this bill will be coordinated into Bill C-33, I think it's important that we consider whether or not we believe that we should—

[The Chair, Liberal, Peter Schiefke]

Yes. You're referencing Bill C-26, which is on page 79 of the piece of legislation we are currently looking at.

I'm just sharing that with Mr. Iacono, so he can follow along.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

Mr. Strahl has just said that he was reading something. If that is the case, then he simply needs to provide us with what he is reading.

Mr. Chair, he made a comment about my colleague Mr. Barsalou‑Duval and myself that I find a bit out of line. Both of us have raised points of order to say essentially the same thing, but the member is starting over again.

He says he is reading something. Could we have a copy of what he is reading, so we are in a better position and are better able to follow what he is saying? He has said that Bill C‑26 is referred to in Bill C‑33. If that is the case, why not simply provide us with the document he is referring to?

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Mr. Chair, I would strongly object to anyone suggesting that they get to choose for another member what they bring to the table in terms of background information that should inform us on how we address a specific clause. The first three words.... If my copy of the bill is correct, the title of clause 124 is “Bill C-26”. There's the link for you.

Clause 124 says, “If Bill C-26”, and it continues on. I am talking about a bill that is specifically referenced in Bill C-33, and this is a coordinating amendment. I will raise my concerns with Bill C-26 and the idea that if we pass this clause, we are endorsing Bill C-26 with all of its problems.

Quite frankly, it's not my job to convince other members of Parliament that they, too, should be concerned about that if they're not listening to what I have to say, but I will continue to address the concerns related to this bill, which is specifically referenced in clause 124.

I will just go back to this particular thing that I was reading from. I will start the quote again:

“Today's report should set alarm bells ringing on Parliament Hill—

[Xavier Barsalou-Duval, Bloc, Pierre-Boucher—Les Patriotes—Verchères, QC]

In fact, I had the chance earlier to raise the fact that my colleague was not talking about Bill C‑33, he was talking about Bill C‑26. He told us that he intended to get around to explaining the connection between the two, but I see that he is still telling us about Bill C‑26, not Bill C‑33 or the clause we are now considering.

I don't know whether you have the authority to intervene, Mr. Chair, for him to get around to making a connection with the bill now being considered.

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Thank you, Mr. Chair.

Of course, if we wanted to.... Perhaps during one of the adjournments this evening I can share some information, including Bill C-26, which is clearly referenced here. This is a coordinating amendment, so we need to be having a discussion about what we're coordinating with and the concerns that have been raised.

I'll just continue on here:

The groups and expert individuals campaigning to fix Bill C-26 are: the Canadian Civil Liberties Association, the Canadian Constitution Foundation, the International Civil Liberties Monitoring Group, Ligue des Droits et Libertés, the National Council of Canadian Muslims, OpenMedia, the Privacy and Access Council of Canada, Professor Andrew Clement, and Dr Brenda McPhail.

It ends with a quote here. It says:

“Today's report should set alarm bells ringing on Parliament Hill. As written, Bill C-26 gives the government and its spy agencies a blank cheque to intrude on our private lives and endanger our—

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Thank you very much, Mr. Chair.

I'll go back, just to make sure that people listening can follow along with the train of thought in the article here:

These recommendations reflect the findings of a previous Citizen Lab report, entitled Cybersecurity Will Not Thrive in Darkness, by Dr. Christopher Parsons which was published last October. The legislation has been subject to fierce criticism for its impact on civil liberties since it was first introduced by former Public Safety Minister Marco Mendicino in June 2022.

The groups and expert individuals campaigning to fix Bill C-26 are: the Canadian Civil Liberties Association, the Canadian Constitution Foundation, the International Civil Liberties Monitoring Group, Ligue des Droits et Libertés—

[Xavier Barsalou-Duval, Bloc, Pierre-Boucher—Les Patriotes—Verchères, QC]

Mr. Chair, can you explain this for me, but I am wondering whether Mr. Strahl's speech and comments really relate to the content of Bill C‑33.

In my opinion, everything he has referred to since he started speaking concerns Bill C‑26. If I am not mistaken, that bill is at a later stage. It may even have been enacted.

I would therefore like some reassurance and I would like to know whether the member's comments are in order, according to your interpretation.

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

I'm just going to continue with the article that expressed some concerns about Bill C-26. It says:

Civil society organizations campaigning to fix Bill C-26 have welcomed Citizen Lab's findings, stating that they reinforce long-standing concerns, and that significant amendments are required to uphold civil liberties and strengthen public confidence in the resulting cybersecurity framework. These organizations recently submitted detailed recommendations to make sure the legislation “delivers strong cybersecurity for everyone in Canada, while ensuring accountability and upholding our rights.”

These recommendations reflect the findings of a previous Citizen Lab report, entitled Cybersecurity Will Not—

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Thank you, Mr. Chair.

As we were talking about Bill C-26, which is referenced here, I want to quote from a source called OpenMedia.org, which, on November 28, 2023, had an article called “New report by Citizen Lab finds serious Charter concerns with proposed federal cybersecurity legislation, Bill C-26”. I'm going to read it here. It says:

Civil liberties groups welcome call to make Bill C-26’s impact on equality, freedom of expression, and privacy a central consideration of Parliamentary committee study

It goes on to say:

The federal government’s draft cybersecurity legislation, Bill C-26, contains serious deficiencies and risks impacting the Charter rights of people in Canada to equality, freedom of expression, and privacy.

That’s according to a new report by the Citizen Lab at the Munk School of Global Affairs & Public Policy at the University of Toronto, which highlights that Bill C-26’s Charter implications “should be a central consideration for this Committee, and throughout the Parliamentary process ahead.”

The report has been submitted to the House of Commons Public Safety and National Security Committee which is expected to commence its scrutiny of Bill C-26 shortly.

Again, this is from a few weeks ago.

Among the significant Charter concerns identified by the Citizen Lab report’s authors, Kate Robertson and Lina Li, are:

Equality: The absence of key transparency, accountability, and proportionality requirements in Bill C-26 raises equality risks surrounding its implementation. Bill C-26’s lack of safeguards increases the risk that equality-undermining measures will not be adequately prevented or addressed. For example, adverse impacts could undermine efforts to redress disparities in Internet access between rural and Indigenous communities and the rest of Canada; result in mandated rules that impede access to assistive technologies for persons living with disabilities; or expose certain groups, including journalists, lawyers, and dissidents to a heightened threat of hacking and espionage.

There are also concerns with freedom of expression:

Freedom of Expression: Bill C-26’s excessive secrecy jeopardizes the freedom of expression rights of the public, the media, and commercial entities. Courts and government should be open and accessible or risk impeding meaningful discussion on matters of public interest. Such discussion is especially important in the cybersecurity sphere, and greater transparency in Bill C-26 is required to ensure this.

Privacy: Bill C-26’s new information collection and sharing powers are insufficiently bounded or defined, posing a potential privacy risk exacerbated by the absence of key accountability and oversight mechanisms. The bill permits the government to collect the personal information of Canadians, creates criminal offences which incentivise over-sharing, and its extensive secrecy undermines the ability of courts or oversight bodies to assess whether such information collection is proportionate and necessary.

Civil society—

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

That bill is clearly still before the industry committee, I would assume. With cybersecurity, perhaps it could be with public safety.

I know that we had some serious concerns with that piece of legislation. I think we want to ensure that the rights of Canadians are always protected. When we're considering Bill C-26, which deals with cybersecurity, we know that this is an evolving field and there's an evolving threat level that comes with that. We know that the government, quite frankly, has failed to protect the rights of Canadians when it comes to their security—both personal security and in our communities. When it comes to the online environment, they've been lax. They've turned a blind eye, quite frankly, to threats to cybersecurity. I think we've seen that again and again.

We saw it when this government refused to ban Huawei from the 5G network for years in spite of overwhelming evidence that the communist regime in Beijing was using that technology in the Huawei network as a way to gain access to personal information. That was a security vulnerability.

We saw that our Five Eyes partners in the security establishment—our international partnerships with Australia, New Zealand and the United States—all took action to protect their citizens and their networks from cybersecurity threats. That's something this government did not do. It took them years and they fought it and fought it before they took the decision—much too late—to exclude Huawei from our cybersecurity networks. That resulted, quite frankly, in embarrassing situations where Canada was excluded from high-level meetings of the Five Eyes.

We saw it very recently, when Australia had its deal with the United States to purchase submarines, for instance. There was an exclusion of Canada because Canada's networks were not deemed to be secure enough to allow us to participate in those very important, high-level meetings. These are examples where the government has failed to take cybersecurity seriously.

As I said, we have grave concerns with Bill C-26. It's troubling to see that this bill would cede power to another piece of legislation or have this coordinating amendment, so there would be two pieces of legislation that we believe are flawed coordinating with one another. I think this is the sort of thing where we should be considering what is in Bill C-26 as we discuss this. We can't simply agree holus-bolus to something in another act if we haven't considered that fully, here at this committee.

I think that this particular clause is one where, perhaps as the evening goes on, we will find a way to bring about an amendment or to look at ways we can make sure that the concerns we had with Bill C-26 are addressed.

The summary of Bill C-26 states:

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.

It continues:

Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,

(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;

(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;

(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;

(d) provides for the exchange of information between relevant parties; and

(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.

Cybersecurity, as I've said, is a growing concern for Canadians. It remains a national security concern. It remains an economic security concern. We know we lose when things like patents, trademarked information and secrets are lost because of a failure to ensure we have adequate cybersecurity in place. We know the government doesn't have a legal mechanism to compel industry action to address cyber-threats or vulnerabilities in the telecommunications sector.

Bill C-26 is another example of the Minister of Industry being given sweeping powers, as we heard with Bill C-33, where the minister is given sweeping powers to enact orders that, in his opinion, are necessary to protect port infrastructure, port operations, etc. We just dealt with that in a previous clause. I think this is another example where we need to ensure that the powers given in Bill C-26 are proportional—that there are checks and balances, and that the rights of Canadians are always protected when the minister is exercising the rights and powers given to him or her in the legislation. It's another example of giving the minister broad powers to enact the legislation.

Now, cybersecurity is something that Conservatives have been raising the alarm about for a long time. We did it when we first created, under a conservative motion, the Canada–China special committee. That was an issue that was raised there. In the context of Huawei, it is something we raised time and time again: our concerns that our 5G network was not being protected.

There are opportunities to strengthen our cybersecurity protocols. We need to ensure that not only are the privacy rights of Canadians respected, but that there's also no attempt at censorship for Canadian citizens when they are operating in the cyber-environment. We've seen the government go down that road as well, with Bill C-18 and with Bill C-10. They want to control what Canadians see, and control the algorithms of what will show up in their social media, for instance.

We have a hard time trusting the government when it comes to anything to do with cybersecurity or Internet regulations. They've proven time and time again that they're willing to sacrifice the rights of Canadians in order to promote their own narrow agenda.

Bill C-26, unfortunately, increases regulation and red tape, often, we believe, without adequate oversight and without votes in Parliament.

We've seen, even here today, that the rights of members or parliamentarians, the supremacy of Parliament, are things that this government does not put as the highest priority. If Parliament gets in the way, they simply try to bypass it.

I think Bill C-26 is another example of where that has happened. We have grave concerns with that, as I outlined briefly. There is also—

[Rachel Heft]

It appears that Bill C-26 completed second reading on March 27, 2023.

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Thank you, Mr. Chair.

In this bill, there is a coordinating amendment—if the copy of the legislation I have is correct—that states:

If Bill C-26, introduced in the 1st session of the 44th Parliament and entitled An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, receives royal assent, then, on the first day on which both section 18 of that Act and section 123 of this Act are in force, subsection 2(3) of the Transportation Appeal Tribunal of Canada Act is replaced by the following:

Jurisdiction in respect of other Acts

(3) The Tribunal also has jurisdiction in respect of reviews and appeals in connection with administrative monetary penalties provided for under sections 177 to 181 of the Canada Transportation Act, sections 127 to 133 of the Critical Cyber Systems Protection Act, sections 43 to 55 of the International Bridges and Tunnels Act, sections 129.‍01 to 129.‍17 of the Canada Marine Act, sections 16.‍1 to 16.‍25 of the Motor Vehicle Safety Act, sections 39.‍1 to 39.‍26 of the Canadian Navigable Waters Act, sections 130.‍01 to 130.‍19 of the Marine Liability Act and sections 32.‍1 to 32.‍28 of the Transportation of Dangerous Goods Act, 1992.

I'm hoping that either the legislative clerk or perhaps some of the witnesses can indicate for me what the status is of Bill C-26. Has it received royal assent? If not, where is it in the process? This is just so we know how likely it is that this coordinating amendment will be utilized with Bill C-33.

Perhaps they could just tell me what the status of that bill is.

[Mark Strahl, Conservative, Chilliwack—Hope, BC]

Mr. Chair, I believe that my privileges were actually violated by your not giving me a chance to speak to a clause of a piece of legislation that we are debating by simply calling a vote on it and saying there's no speakers list. By not even calling for debate and simply moving to a question.... How are we to know that we were going to go back into the legislation, when Mr. Kurek was in the middle of debating a motion?

By failing to allow for a debate on a clause of a piece of legislation, you have violated the privileges of all members of this committee. I would like to move a motion that we debate whether or not my privileges were violated by the chair when he refused to call for debate on the previous clause before calling for a vote.

That is the motion that I would move. It's that you have violated my privileges by not allowing us to discuss a clause of this bill by simply slamming the door and moving to a vote.

That is not how we have operated for the entirety of this debate. That is not how we operated for the entirety of our consideration of Bill C-33. To get rammy now and start to push this through in a way that we have not operated in.... I recognize that the chair and the government don't like when members of Parliament in the opposition exercise our rights, use the tools at our disposal to hold the government to account, and move duly accepted and duly moved motions at the time of our choosing, as is our right as members of Parliament. They want to simply end that discussion and move on to something that they would rather talk about.

That is not what the rules allow for. The rules call for members of Parliament to have the opportunity to discuss, debate, consider, amend, propose changes from all sides and then make decisions. It is not for the chair to suddenly say “I call the vote” the very second that Mr. Badawey gets his way and a motion gets shut down.

Mr. Chair, I've always respected your commitment to fairness. I've always respected how you have been neutral in that position, but I can't quite believe what is happening here tonight, where there is a departure and a decision to simply ram these motions through without giving us an opportunity to debate.

You've ruled Mr. Kurek's motion out of order. There is another motion that deals specifically with the transport component of Bill C-26. That motion is in order and does specifically deal with this issue.

It is very clear that the rights and privileges of members of Parliament are protected by our Standing Orders. They are protected, quite frankly, by the Constitution. They are to be limited only in very extreme circumstances.

A privilege motion actually takes precedence. We know this in the House. A privilege motion takes precedence over all other matters. When a privilege motion is moved, all other legislation—anything else before the House—is set aside because the rights and privileges of members of Parliament are to supersede the rights and privileges of the government, which might not want them to be exercised. They are sacrosanct. They are, quite frankly, something that we should be very concerned about when any member, not just those who wear our team colours, is impacted by it.

This is the sort of thing, you can bet, that Liberal members of Parliament, when they were in opposition, would have raised hell about. They would never have accepted this sort of thing, clauses being rammed down our throats without the ability to even discuss them for a minute, or to have a single word brought forward before it was voted on. That supersedes, quite frankly, whether or not the chair is sustained by a vote. This is something that is bigger than that. It is something that touches the very core of what we do in this place.

I know the government is frustrated that there have been concerns raised with Bill C-33. We've heard it in the numerous meetings that we've had with testimonies, none of which spoke about the benefits of the legislation. They were all very critical of the legislation. I know the Liberals didn't like that. They didn't like that we were going clause by clause through the bill. They didn't like that a member of Parliament might want to speak about issues related to the cost of living and the cost of transporting goods. That's the sort of thing that Mr. Badawey shut down with the assistance of the chair.

Standing Order 116(1) states:

In a standing, special or legislative committee, the Standing Orders shall apply so far as may be applicable, except the standing orders as to the election of a Speaker, seconding of motions, limiting the number of times of speaking and the length of speeches.

It specifically talks about the end of debate. Standing Order 116(2) states:

(a) Unless a time limit has been adopted by the committee or by the House, the Chair of a standing, special or legislative committee may not bring a debate to an end while there are members present who still wish to participate. A decision of the Chair in this regard may not be subject to an appeal to the committee.

(b) A violation of paragraph (a) of this section may be brought to the attention of the Speaker by any member and the Speaker shall have the power to rule on the matter. If, in the opinion of the Speaker, such violation has occurred, the Speaker may order that all subsequent proceedings in relation to the said violation be nullified.

Mr. Chair, this is a very serious section. It says very clearly, “while there are members present who still wish to participate”, not who are on a list that didn't exist before debate was closed, before it was shut down. This is a very serious issue, and one that we will take very seriously, because, in attempting to get a bill passed by an artificial deadline, there is now clearly a violation of the rights of the members of this committee.

All of the members on the Conservative side of this table were prepared and willing to speak to the clause upon which debate ended artificially. Again, it says, “A decision of the Chair in this regard may not be subject to an appeal to the committee.” Quite frankly, it doesn't matter that once I stop talking there's an attempt to have the chair's ruling sustained, because, again, this is not a matter for a majority vote of the committee. Members' privileges are not subject to the tyranny of the majority. Members' privileges are protected by our Standing Orders, and they are protected by our role to represent the people who sent us here.

It would be quite something if we could, instead of having our rights protected, have our rights dictated to us by the majority of committee members, who find them to be inconvenient tonight. That is, quite frankly, something that we can't tolerate. This is something that should supersede any of the other things that we were going to talk about here tonight.

We have seen time and time again how there has been an attempt to shut down debate. We know that shutting down debate has been done in the House of Commons a record number of times.

There is a process in place for shutting down debate. In their election campaign in 2015, the Liberals promised they would never use the rules of the House to shut down debate. We've seen them break that promise time and time again, both in a majority and with the help of the NDP in a minority government. They've done that on numerous occasions. Hundreds of times they've shut down debate, but that is by a motion. That is using a process that is in place. The Speaker doesn't simply get up and say, “Debate is over. We're having a vote right now.” That is all—

[Matt Malone]

When you look at the resources that are available, they're not meeting the demand. In 2018, when Public Safety went through a cybersecurity update and threw a lot of money at the RCMP to get more serious about online cybercrime, that was when the initial announcement was made about NC3, the national cybercrime coordination centre.

I wrote about this three years ago and said that we were already waiting a long time to get this rollout happening, but fast-forward three years, and that reporting system is two years behind schedule. If you visit the website right now, it will tell you that the system is still in beta testing and that it accepts only 25 cybercrime complaints a day for the entire country, which is really low. In a series of access to information requests regarding the number of resources that were devoted in terms of personnel, I discovered that there are several provinces that don't have any cybercrime investigators, which is a really shocking statistic. Here in B.C., the third-largest province in the country, we have only four full-time people on the cybercrime team.

I believe these tools need to be rolled out more rapidly. There should be more transparency around them, and legislation should be crafted around what we're seeing, because these tools allow us to understand what types of harms are being perpetuated. There are all kinds of analyses you can run based on the reporting data that comes in, and NC3 shows that more than half the reports that go to NC3 are about ransomware. It's really interesting that Canadian legislation ignores ransomware, which is the biggest cybercrime threat we're facing.

One thing that's interesting to take into consideration when we talk about Bill C-27 is also Bill C-26, which would regulate things like ransomware for critical industries.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thanks, Mr. Chair.

Well, we could see the Conservative script being read, and I'm sure the Leader of the Opposition will give bonus points for accurately reading the script. Perhaps my colleague will even get a question or an S.O. 31 for good behaviour. On the topic of the real issues and the real work before this committee, we've already agreed to do a study.

Mr. Chair, I know there's been some disruption—not disruption, but we've been without a chair in place for a few days—so I would encourage you to line up witnesses for Wednesday's meeting on the study of prison transfers and classification, whichever witnesses are available. It should be the priority that we start this work.

We began the work with the good advice from Mr. Julian in terms of trauma-informed training, and I think that we should continue this work. We have a lot of work to do on this committee. We have a lot of things to study, including prison transfers, including Bill C-26, which is crucially important, and including auto theft, which I know is something that was brought forward by our Bloc members and was well supported on this committee.

Any sort of delay only delays serving Canadians. Canned speeches from Conservatives for brownie points are not actually helpful to Canadians and victims, but the work we do is, so I would encourage you to schedule Wednesday's meeting as quickly as possible, with witnesses on the transfer study.

Thank you.

[The Chair, Liberal, Ron McKinnon]

It was, but we've already modified our plan to do the study on Mr. Bernardo's transfer, followed by Bill C-26.

Why don't we talk—

[The Chair, Liberal, Ron McKinnon]

The clerk has taken notice of the deficiencies and will address them.

I would point out that if we were to pass this motion.... When we finish clause-by-clause on Bill C-20, we still have to ramp up for Bill C-26. We don't know when it is, so this might be an opportunity to fill in between the two studies in an effective, useful way. That's how I think we would approach it if we were to pass this motion.

Mr. Julian, do you wish to respond to those questions?

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

We have spent more than six and a half hours debating a number of motions that all deal with the same thing. The opinion of every party represented here has been heard. I think the Liberals proposed a motion in good faith at our last meeting, and I think Mr. Julian has in good faith moved a motion that provides a reasonable compromise so as not to further delay the study of Bill C‑20.

I'm not sure whether my fellow committee members feel the same, but I struggle to look witnesses in the eye because I'm embarrassed to bring them before the committee. I know this is costing taxpayers a ton of money. I'm not sure whether you know how much, Mr. Chair. Perhaps the clerk can send us the information. Our constituents need to know what we're doing here. The study of a very important bill is being held up.

People are writing us. Every single member here has gotten emails from people who are very eager for our study of Bill C‑20. I've even met stakeholders who are also worried about the study of Bill C‑26, which we are supposed to deal with after the study on Bill C‑20. That means the Bill C‑26 study is also being delayed. I think it's tremendously unfortunate, not to mention disrespectful to the people here, who surely have better things to do. Their expertise could be helping us in our study of Bill C‑20.

As I said, I think Mr. Julian has put forward an acceptable compromise, but I do have a few minor technical questions. The French version of the motion starts off, “Que le Comité permanent de la sécurité publique et nationale tienne immédiatement une réunion de 3 heures, à la suite de l’étude du projet de loi C‑20”. I was wondering whether “immédiatement” is really what's meant, as opposed to “après”, meaning after the study of Bill C‑20. The English version says, “immediately after”, so the meaning may have gotten lost in translation. I'm not sure whether we can sort that so the French version is clear as well, without necessarily going through a subamendment.

I also have a question about the one-hour in camera meeting being requested so the committee can be briefed on trauma-informed questioning at committee. I'm wondering what purpose that will serve, since the people we hear from are not necessarily victims. Is that additional hour really necessary?

As for Mr. Shipley's amendment, we'll be back to square one if we hold three meetings on this. I think inviting the minister for one three-hour meeting and another two-hour meeting is an acceptable compromise. That is five hours of debate, after all. When it comes to inviting former public safety minister Marco Mendicino, he lost his portfolio, so I think we can leave him out of this. It's not his job to answer these questions. The motion already calls on the committee to invite the current Minister of Public Safety to answer our questions.

I'm ready to vote on the amendment and the motion so we can move on to studying Bill C‑20, but I would appreciate it if Mr. Julian could answer my questions.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

As I've said several times since this debate began, I think it's extremely unfortunate that we're spending several hours debating numerous motions that all point in the same direction, when the committee has an agenda to follow: we should be debating Bill C‑20; some people have reminded us of how important it is to them. Indeed, we've all received emails from victims who have been harmed by the Canada Border Services Agency, and they deserve to have parliamentarians take a look at this important bill. Personally, I think it's a shame for these people. I'd even say it's disrespectful to the people who are watching the committee's work, hoping that we'll finally get around to studying this bill. It's also disrespectful to the civil servants who, let's put it this way, are wasting time here while we debate another subject.

I'm not saying this subject isn't important. Of course it's important. There are probably 50 other important topics related to public safety in Canada that we could be debating here. It's just that the timing isn't right. I think we've already wasted too much time and we should be debating Bill C‑20.

That said, I think my colleague Ms. O'Connell has proposed a reasonable compromise in introducing the motion before us. It's the Conservatives' desire to debate this subject, once the study of Bill C‑20 has been completed, and I agree. I would even have gone so far as to say that, since bills are this committee's priority, the debate on this subject could have been held after the study of Bill C-26. However, we agreed to consider this issue directly after the study of Bill C‑20. Ms. O'Connell has proposed a reasonable motion, which I think we could all agree on.

Of course, I'm against the amendments and subamendments proposed by the Conservative Party. We've had ample opportunity to discuss and negotiate behind the scenes so we can't do it here in committee and waste a lot of people's time. The Conservatives always come up with a new proposal to stretch out debate time. They want to politicize the debate and that's really deplorable. It's no secret that they're politicizing the debate. As I've already said, I'd like to take the question even further: should we politicize this process too? The Correctional Service of Canada exists for a reason, it has specific tasks to accomplish, so I don't understand why we're bringing the minister into this.

I agree with a few things Mr. Julian mentioned about public servants, whom we once again allowed to leave after several hours of hearing us debate this.

Out of respect for the people who expect us to do our job, I'd like us to go ahead, vote on the subamendments, on the amendments and on the motion, come to a consensus and proceed with Bill C‑20. There are people who have been waiting for this for a long time.

I said that some of the blame lies with the Conservatives, who are filibustering in Parliament and stretching out debate time on this issue, but it must also be said that the committee spent a lot of time studying Bill C-21 because the government had more or less done its job well. In the case of Bill C‑20, this is the third time in a few years that a similar bill has come before the House of Commons. In the meantime, there has been prorogation and an election; obviously, this is coming from the Liberal side.

So I see political jousting on both sides and I find it deplorable. It's a subject that shouldn't be politicized.

I ask that we vote on the proposal before the committee at this time.

[The Chair, Liberal, Ron McKinnon]

That brings us to one of the points in the report. We agreed in subcommittee that the preliminary witness list, people's nominations for witnesses, should be done by the end of next week.

I bring everyone's attention to the analysts' report, which is a quick summary of Bill C-26, with suggested witnesses. I suggest that as a good starting point. Of course, the clerk will sort out the witnesses according to party standing and the number of meetings, but if we need to extend that, it's open for the committee to do so.

Are we ready to vote? No.

Mr. Shipley, go ahead.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Briefly, I was unable to make it to the subcommittee meeting. Mr. Lloyd was there in my absence. There are just a couple of things I wanted to mention.

First of all, Bill C-26 is a rather large, very in-depth bill, and there is going to be a long list of witnesses. We actually don't have our side's list completely formalized yet. We're working on that as we're transitioning through the offices.

I have a serious concern that five meetings are not going to be enough. This is a very serious bill—just look at what took place this week with our own systems being down—that I think is going to take extra time. I'm concerned that having five meetings is too tight. Perhaps we can check the will of the table to see if we're going to have that set in stone or if we can be more flexible about having five, knowing there could be so many....

[Mark Schaan]

I'd offer a couple of comments. One, obviously, is that the current statement and guidance that we have on critical minerals are, in fact, attempting to ensure that the overall approach to the overall development of the industry is cognizant of the national security considerations at play and that it is setting out the broad framework that should guide key decisions in terms of not only the establishment of foreign direct investment but also the overall establishment of the critical minerals value chain within the Canadian context.

That said, there are a number of other actors, and this speaks again to the capacity building that's required across the entirety of the community, because there are sector-specific regulators, including at the provincial level, who have very key tools within their tool kit to be able to establish the guidance that actually sets out the minimum requirements for their sector specifically.

You raised the telecommunications sector. Obviously, that's exactly what is proposed in Bill C‑26. It is to actually establish the specific guidance in a sector that we have federal jurisdiction over to say that these are the minimum requirements in this sector for how we're going to continue to ensure that security is contemplated and that we have very specific guidelines about high-risk vendors. Those same types of approaches can, and should, in many cases, be mimicked in other sectors to ensure that where we actually have jurisdiction, we are following through.

The goal of the ICA is to set the macro around foreign direct investment with the levers that it has, and then look at other mechanisms. As I said, where we actually have those levers, we've done that. In Bill C‑26, that is very much exactly what we've set out, and then, with the critical cyber systems protection act, we will extend that as well into other sectors to ensure that there are minimum requirements as it relates to the cyber-readiness and the posture of those sectors.

Criminal Code

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, I am pleased to be able to rise and offer my thoughts on Bill C-21 at third reading.

I say that with a bit of amazement because I cannot believe we have actually made it to third reading. This bill received first reading in this House on May 30 of last year. We got through second reading in fairly short order, but at committee stage, things really got lost and all hell broke loose, so to speak.

I remember participating as the NDP's public safety critic. We had scheduled eight witness meetings to look at the first version of this bill. Things were going along quite well. There were some disagreements around the table, but there was not any of the friction that suggested there would be a major catastrophe in the making.

That all changed in November when we arrived at the clause-by-clause portion of the bill. Before that meeting started, every party was responsible for reviewing the witness testimony, reviewing the briefs that had been submitted, and working with legislative drafters to put together our amendments. Once those were submitted to the clerk, as is the normal course of things, the clerk then distributed them to all committee members.

It was quite a surprise when we saw just how big the amendment package was and just how expanded the scope of the bill was going to be. Most of the amendments came from the government. There were a couple in particular that completely sent the committee off its rails.

The amendments landed on our laps at the 11th hour. It was obvious that there had been no warning to committee members. The Liberal members of the committee were introducing those amendments on behalf of the government. They read them into the record, but I do not think they actually had a clue as to the monumental nature of the amendments.

It was clear that the amendments were not backed by any witness testimony because of the significant nature of how they were changing the bill. We, as committee members, never had the opportunity to question witnesses on the bill taking shape.

That completely derailed things. That started in November 2022, and it is only just recently that the committee stage of the bill was finally able to complete its job. That is an incredible amount of time for one committee to be occupied with a single bill.

If we look at the mandate of the public safety and national security committee, it is one of the most important committees. It is responsible for reviewing the policies and legislation of multiple agencies, whether it is the Canadian Security Intelligence Service, the Officer of the Correctional Investigator or the RCMP.

There are two other bills. Bill C-20 is going to provide an important oversight body for the RCMP and the CBSA. Bill C-26 is going to seek to upgrade our cybersecurity infrastructure. Both of those bills have been held up because of the shenanigans going on with Bill C-21.

I listened to the debate all day yesterday when this bill was going through report stage, and today when it was going through third reading. Unfortunately, because of some of the speeches in this House, there is a lot of misinformation out there and a lot of people have the wrong idea of what is included in this bill.

My Conservative colleagues do make a big deal in their speeches about standing up for hunters, farmers and indigenous communities, and I take no fault with that. I proudly stand here and say the same thing. It is troubling because it is alluding to something that is actually not in the bill. That illusion for hunters, farmers and indigenous communities is that their rifle or shotgun, if it is semi-automatic, is going to be prohibited by this bill.

Let me clearly say this for the record: That is not the case. Bill C-21 is not going to do that. If someone has a current make or model of a rifle or shotgun, they are licensed and legally own that firearm, after this bill receives royal assent, they will continue to be able to use it.

That is a fact. So far, when I have brought it up in questions, my Conservative colleagues have been unable to refute that. I have challenged multiple Conservative MPs to name one rifle or shotgun that is going to be prohibited by Bill C-21. In every single instance, they have deflected and swerved away to go back to comfortable talking points, because they cannot do it. I will tell colleagues why. It is because I am not reading Conservative talking points. I am going to actually read from the text of the bill.

In the new section that is going to add to the definition of a prohibited firearm, it mentions that it is:

...a firearm that is not a handgun and that

(i) discharges centre-fire ammunition in a semi-automatic manner,

(ii) was originally designed with a detachable cartridge magazine with a capacity of six cartridges or more, and

(iii) is designed and manufactured on or after the day on which this paragraph comes into force...

The last point is one that everyone seems to skip over, but it is the key part.

Current makes and models are not going to be affected by Bill C-21. Future makes and models that come into the market after this bill receives royal assent will be affected. However, current owners will not be affected by Bill C-21.

Conservatives will then seek to muddy the waters even further. I have heard a lot of reference to the firearms advisory committee. They say that the minister is going to bring this back and staff it with Liberal appointees, who are going to make suggestions about what firearms should be prohibited and then act on the suggestions. I have a news flash for my Conservative colleagues. This is a power that the government already has. It does not need a firearms advisory committee.

I would direct my Conservative colleagues to the existing section 84(1) of the Criminal Code. It says right there that the government can change the definition of what a prohibited firearm is when it mentions “any firearm that is prescribed to be a prohibited firearm”. “Prescribed” is the key word there, because that means it can be done by cabinet decree. If they do not believe me, how did the government get the authority in May 2020 to issue an order in council? Here, 1,500 makes and models were done through the Canada Gazette under existing powers.

All this ballyhoo over a firearms advisory council, as well as all the hoopla that we have heard in this House about the dangers of that council coming into being, is a complete red herring. It is smoke and mirrors. This is a power the government already has. In fact, I would rebut them on that argument by saying that if the minister currently has that power to do this unilaterally through an order in council cabinet decree, would it not be a good thing to have an advisory council to at least talk to the minister about how maybe that would not be a good idea?

If we can ensure that the advisory council has indigenous representation, representation from the hunting community and representation from the sport shooting community, in my mind, that is a good thing. I will let them continue to say that, but they know they cannot argue with me on those facts. Again, I am reading from the bill and from existing provisions of the Criminal Code. If they are going to try to muddy the waters, they can try to argue their way out of it, but the facts cannot be changed.

I want to turn to something more positive, with the airsoft community. Last summer, I had the pleasure of visiting the Victoria fish and game club. I do not know if colleagues have been to Vancouver Island, but in the middle of my riding is the Malahat Mountain. It is the big mountain that separates the Cowichan Valley from the city of Langford and the whole west shore. It is the traditional territory of the Malahat people, but on top of it is where the Victoria fish and game club is, on a beautiful property. Right beside it, there is an amazing forest setting for the club's airsoft games. I went out there with one of my constituency assistants on a weekend. They invited us to come and see a match. We got to don the referee uniforms, so that we could walk out in the middle of a pitched battle. I think one of my constituency assistants accidentally got shot.

It was so fun to see how much fun these players were having, to talk to them about how passionate they were about their sport and to really understand that this is more than a hobby for them. This is something that allows them to get out into the great outdoors with their family and friends.

They were really worried about Bill C-21 because of a section in the bill that would basically turn their airsoft rifles into prohibited devices. I invited some of them, with other colleagues around the committee table, to come to committee, to submit briefs and to say their piece. I have to say that the representatives of the airsoft industry, the manufacturers and the players associations did themselves proud. They made a good argument, and they convinced those around the committee table. They did what is done in a democratic system. They fought for change, and they achieved it.

The NDP amendment that was put forward to delete the offending sections from the bill was passed. That is a victory for the airsoft community. All they are asking for is not the sledgehammer approach of legislation that was in the original version of Bill C-21, but a regulatory approach. They are more than willing to work with government on the regulatory approach. That message was heard, and that is something that all parliamentarians can celebrate.

Let me turn to the handgun freeze and the amendment that we put forward as an attempt to expand the exceptions of the handgun freeze to allow for other sport shooting disciplines. As the bill is currently written, at this third reading stage, the only exemptions that exist are limited to people who are at an extremely elite level. They are Olympic athletes and Paralympic athletes. I use the terms “exemptions” and “exceptions” interchangeably.

After speaking to members of my community who participate in the International Practical Shooting Confederation and speaking to members who are in single-action shooting as well, I felt that these people are athletes. They train for what they do. They are passionate about their sport. They deserve to have exemptions as well. Therefore, I put forward an amendment to try to expand that. That amendment almost passed. There was a little bit of confusion on the Liberal side when that amendment came to a vote.

When I tuned in to watch the committee hearing at that stage, I was pleasantly surprised to see the Liberal member for Kings—Hants speaking in support of our amendment. It was a wonderful surprise to see, except that when it came to a vote, unfortunately, he abstained. It resulted in a five-five tie; of course, this had to be broken by the Liberal Chair. We came really close.

I have received a lot of flak from certain sectors of society for my stance on this. That is okay; I can take it. I am not going to apologize for standing here and making an attempt to fix the bill on behalf of my constituents who simply want to be able to practise their sport. To those who are arguing against that, I would simply point to the submission that was given to our committee by none other than the Canadian Association of Chiefs of Police. They said:

We believe that a handgun freeze is one method of reducing access to these types of firearms, while allowing existing law-abiding handgun owners to practise their sport.

That is what I was basing my amendment on, as well as the interventions made by my constituents. We tried our best at committee to make that change. Unfortunately, because of the votes falling the way they did with the Liberals and Bloc, it did not pass.

I will give another reason. The top IPSC competitors were telling me that they shoot about 50,000 rounds of ammunition a year. That is an incredible amount. We have to understand that a handgun is essentially a mechanical device. If someone is shooting it 50,000 times a year, it will break down. Sometimes, handguns have to be replaced. In my mind, it was unfair, not allowing an exception for an athlete of that calibre to have the means to be able to replace a tool that they use to compete.

We may have lost this particular battle, but what I would say to members of those sport shooting disciplines is that I will continue to pursue this issue. I will find other avenues to fight to make sure that their sport has an exemption.

We have completed the report stage part of the bill, but there has been some controversy from some women's groups who were unhappy with the red-flag provisions of the law, and I understand that. When I approached the committee hearings on this, I understood the controversy that existed around red-flag provisions. There were some women's groups that felt that adding this extra layer of bureaucracy through the court system did not serve women or other people who were in vulnerable situations where firearms might be present. They felt that we should have a properly equipped and responsive police force, and I agree with them.

I will turn critics' attention to members of the National Association of Women and the Law, because when Bill C-21 was reported back to the House, they made some public tweets, which are all up there for people to read. They said that with all the amendments that were proposed, these are some of the ways that the bill would make women safer: “The provision on licence revocation when someone has committed violence is now strengthened and clarified. A licence must be revoked when there are reasonable grounds to suspect that an individual may have engaged in family violence.” They also said, “people who have been subject to a protection order will now be ineligible to hold a licence if they ‘could pose’ a threat or risk to the safety of another person. This way, safety comes first.” That is the onus test.

They went on to say, “The Bill had no timelines for reacting to danger and domestic violence. Thanks to the adoption of our recommendations, there is now a statutory duty to act within 24 hours. This will protect women at the critical time of separation, when risk of violence is at its highest.”

A lot about the bill has been subsumed by the debate over hunting rifles, shotguns, airsoft and the handgun freeze. However, it is important for us to realize that, in the heart of the bill, there are actually some very important measures, which have now been improved by the committee. I have worked with members of the National Association of Women and the Law, and I respect the submissions they have made. If they are willing to come out and publicly endorse the bill in this way, I am glad to have their support as a stakeholder, and I give it a lot of credence.

I also want to talk about ghost guns, which relate to another “unsung hero” part of the bill. We heard from law enforcement, and I want to read into the record the testimony that came from Inspector Michael Rowe, who is a staff sergeant in the Vancouver Police Department. He said:

In addition to what is already included in Bill C‑21, I would ask this committee to consider regulating the possession, sale and importation of firearms parts used to manufacture ghost guns, such as barrels, slides and trigger assemblies. These parts are currently lawful to purchase and possess without a licence, and they can be purchased online or imported from the United States. The emergence of privately made firearms has reduced the significance of the currently regulated receiver and increased the importance of currently unregulated gun parts that are needed to finish a 3-D-printed receiver and turn it into a functioning firearm.

That is the request coming from law enforcement. We know that this is a growing problem, and they asked for a specific legislative fix to the problem. I am proud to see that the public safety committee delivered on that request from law enforcement.

Much has been said about indigenous communities. They are, of course, the ones who led the way in opposition to the bill. I remember, back in December, when the Assembly of First Nations came out with a unanimous emergency resolution opposing those eleventh-hour amendments that were made by the Liberal government. They said that the amendments went against the spirit of the UN Declaration on the Rights of Indigenous Peoples. They helped us to understand, as parliamentarians, that these are not toys or hobbies; rather, they are a way of life. In some indigenous communities, they are necessary for the protection of life. I am glad to see that the committee listened, and no current make or model of a rifle or shotgun that is currently in use in indigenous communities is touched by Bill C-21. The committee went further and added a clause, which now references section 35 of the Constitution Act to show that indigenous rights are upheld.

I will conclude by saying I can honestly go back to the hunters, farmers and indigenous communities in my riding of Cowichan—Malahat—Langford and tell them their currently owned firearms are safe. I am glad we were able to force the government's hand on this matter.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, I spoke to this last week when we were debating Motion No. 25. I made reference to the fact that, for the Conservatives, Bill C-21 is the goose that lays the golden eggs. That is why they have wanted to see it stuck in the House; that hoovering sound we can hear is the sound of the Conservative Party's fundraising machine raking in millions of dollars off this bill. I for one am glad to see that the committee has sent it back to the House, because there are two other important bills waiting to be heard. These are Bill C-20, which deals with important RCMP oversight, and Bill C-26, which looks at cybersecurity; these are both very pressing issues. It is high time the public safety committee got to work in addressing those other key issues.

Government Business No. 25—Proceedings on Bill C-21

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, it is hard to find the words to start given how long I have personally been involved with this piece of legislation. I know there are a few select members of this House who would agree with me. I think for each one of us, this has been our own personal odyssey, and to get to this point is really remarkable. All of the different twists and turns that this one bill, Bill C-21, has taken are going to be studied in parliamentary procedure for years to come.

I have had the privilege of representing my riding of Cowichan—Malahat—Langford for three terms, now being in my eighth year, and I have discovered that in my time here, Parliament has demonstrated that it is indeed the last place to go for an open, honest and logical debate on firearms. A lot of the debate we have seen on this bill and on firearms regulations, policy and legislation in general has done a very real disservice to Canadians. Both sides of the issue have torqued up their arguments. There has been blatant misinformation and labelling, and this has really descended the level of debate into something that I think a lot of Canadians would quite rightly be disgusted by. It is very difficult in this place, when we have all of these torqued up emotions and political agendas, to have a reasoned debate on firearms. That certainly has been the story.

I know a lot of people on Twitter are following this debate very closely. I would say that the Standing Committee on Public Safety and National Security is probably the most watched committee of them all, and I know that my words right now are being analyzed and tweeted about, even in real time. I just want the people who are listening to brace themselves, because I have equal amounts of criticism for both the Liberals and the Conservatives as to why we now find ourselves in this place.

I first want to start by talking about the committee, because ultimately today's motion is one of instruction to the Standing Committee on Public Safety and National Security. One could be forgiven for thinking that all this committee does is study policy and legislation surrounding firearms, because that is indeed all it has really been consumed with since the bill was referred to the committee late last year. In fact, we started Bill C-21 at committee in October 2022, and here we are now, well into May 2023, and we are still only at the clause-by-clause part of the bill.

I think it is useful for people to understand what the mandate of this committee is. It is responsible for reviewing legislation, policies, programs and expenditure plans of a whole host of different government departments and agencies that are responsible for not only public safety, but national security, policing, law enforcement, corrections, the conditional release of federal offenders, emergency management, crime prevention and of course the protection of our borders. When we are doing things like the estimates for the spending plans of Public Safety Canada, quite often we have representatives included from the Canada Border Services Agency, the Canadian Security Intelligence Service, the Parole Board of Canada and the Royal Canadian Mounted Police.

What I am trying to underline here is that this committee is an extremely important committee of the House of Commons, and all the work it does in all of these different areas in looking after our intelligence gathering, law enforcement and border protection has been sidelined by the incredible amount of time that has been consumed. Time is our most valuable resource in Parliament, and once we spend it we do not get it back.

Because of the shenanigans that have occurred with respect to Bill C-21, the public safety committee has quite correctly been prevented from examining all of these other different areas, keeping tabs on those different departments, examining different pieces of legislation and keeping tabs on what the government's policies and practices are going to be with respect to other key areas. That is an important element that we first need to establish when we are talking about where we are today.

As many members will know, including members in my own community, I used to be our party's public safety critic. I found my time on that committee to be personally quite valuable. I found that the subject matter we were dealing with was quite intellectually challenging and stimulating, and it is important work.

I know from my interactions with other members of the committee, whether on the Liberal, Conservative or Bloc Québécois side, that they all conducted themselves very well, and I enjoyed my working relationships with them. That even goes for our work on Bill C-21.

Believe it or not, there was actually a time when Bill C-21 was progressing through committee in relatively good order. We concluded roughly eight meetings with witnesses. The committee then had time to come forward with its amendments, and there seemed to be an acknowledgement that aside from a few differences with a few clauses here and there, the bill was probably on schedule to be reported back to the House for report stage and eventually third reading sometime in December.

We then got to November, and all hell broke loose. This was when the eleventh-hour amendments were dropped by the Liberals. I should correctly say “the Liberal government”, because I do not think they were, by design, from the Liberal members of the committee. They did come from the government.

I do not want to go into the details of the bill too much, because I think that is a well-trodden path and a well-known story, but allow me to take this moment in my speech to levy what I think are some well-earned criticisms on both the Liberals and the Conservatives. I know some of my colleagues will probably laugh at this, particularly the member for Hamilton Centre, because he has heard me joke about this before.

I often feel like the character Mercutio in Shakespeare's play, Romeo and Juliet, when he is expressing his frustration with the Capulets and the Montagues, because I feel that same frustration with the Liberals and the Conservatives. It is difficult sometimes to watch the shenanigans between those parties and the way our level of debate around this issue descends into the depths and scrapes the bottom of the barrel.

Let me start with the Liberals. One day, someone is going to write a book about this sorry episode, and it is probably going to be titled something like “How Not to Amend One's Own Legislation”. It is going to be a warning guide for governments in the future on what not to do and how not to spring a surprise on an unsuspecting committee when they have not done their homework, when they have not done consultation and, most importantly, when they have not consulted with the members of the committee who are actually responsible for shepherding those amendments through.

I want to caution members: My comments are not, in any way, directed to the colleagues I work with, but more to the Liberal Party brain trust. I understand the reasoning behind where they are coming from. Gun violence in our major urban centres is a very concerning thing. It needs to be dealt with appropriately. I want to take a moment to acknowledge the extreme grief that is out there within so many families who are dealing with a loss due to firearms violence.

Sometimes the road forward for the Liberals has been paved with good intentions, but it has led to some pretty awful results. I would ask them to step back and try and heal some of the wounds that exist in that divide between urban and rural Canada. We need to understand that yes, firearms violence is a big issue, but there also has to be a level of respect afforded to Canadians who are lawful firearms owners, who play by the rules and who have done everything right. I would encourage the Liberals to consult more with their rural MPs.

When the Liberals introduced those amendments, one of the groups that were leading the way was indigenous communities—not only hunters and farmers, but indigenous communities, not the least of which was the Assembly of First Nations. In an extremely rare move, the AFN came out with a unanimous emergency resolution on the last day. That is almost unheard of. They were going after the government for those ill-thought-of eleventh-hour amendments.

No consultation had taken place. One could make a legitimate argument that the Liberals, in bringing in these amendments, were not respecting the United Nations Declaration on the Rights of Indigenous Peoples or even the legislation we have passed that enshrines that within our own laws to make sure that all federal laws are in harmony with the declaration itself. It went against the spirit of that.

Now I will turn to my Conservative friends.

What do we say about the reams of ridiculous hyperbole we have seen from that party on Bill C-21? The bill has been a fundraising boon for the Conservative Party. That giant sucking sound we hear is Conservatives hoovering money from the harvest of their rage-farming operation around the bill, and I think a part of me wonders whether the Conservatives do not want to see the bill go forward because it has been so financially viable for them. The evidence is all out there. I do not think there is any interest at all in trying to move the legislation forward, because doing so would essentially stop the goose from laying golden eggs for them. It has been an incredible money-maker for them.

When I look at some of the misinformation that has been put out by the Conservative Party around the bill, I see they are fanning flames of rage over amendments that no longer exist and incorrectly saying that the government wants to take away all their guns. It is just completely off-the-wall bonkers stuff that can be easily disproven, and it is completely not helping the standard of debate we expect of our parliamentarians. It just makes the rest of our jobs harder when we have to fight that completely untrue disinformation that is being actively fanned on social media.

Yes, it is a sorry state due to the actions of both parties in so expertly playing politics with the bill, and that is a large part of the reason we are here today.

We know that the problematic amendments were withdrawn by the Liberals. That is fact number one. All current owners of long guns in Canada are not going to have those firearms impacted, because the problematic amendments were withdrawn. What we now have being proposed as an amendment to the bill would go after firearms that will be manufactured in the future, after the bill receives royal assent. There is also an important amendment, I understand, that would make sure that nothing in the bill takes away from the rights of indigenous peoples. That is recognized and affirmed under section 35 of our Constitution.

Of course, there are incredibly important amendments dealing with the exponentially growing problem of ghost guns. This is a problem that has been brought to the committee's attention repeatedly by law enforcement agencies. I would hope that more attention is paid to those particular amendments, and of course we, the remaining members of the House of Commons, have to reserve our judgment on the bill until we see the final version that the committee ultimately reports back to us.

Now let us turn to the motion of instruction and what it would do.

First of all, we have to understand that as of this morning, the Standing Committee on Public Safety and National Security had already spent approximately five hours on clause-by-clause consideration. If they had been able to complete their meeting this afternoon, and I know it was interrupted by a series of votes, that would have brought the total to eight hours, which is roughly equivalent to four full meetings. The motion being debated today would add a further 17 hours to that, bringing it to roughly 25 hours, which is the equivalent of 12-and-a-half meetings.

I understand from the member for New Westminster—Burnaby, our member on the public safety committee, that he has tried multiple times to extend the sitting hours of the public safety committee so that Conservatives, the Bloc and New Democrats could have additional time to look at the amendments that are being proposed by various members. I understand that in each of those instances, these attempts were either rejected or filibustered so that the committee ultimately could never get to a vote. To hear Conservatives complain that they are being silenced in the House when they have, in fact, had multiple opportunities at committee to extend the sitting hours of that committee does come across as a bit rich.

I would say that because I have had my staff look at bills similar in size and complexity to Bill C-21, Bill C-18 comes to mind. That particular bill, when it went through clause-by-clause study at its committee, had seven meetings, the equivalent of 14 hours, for clause-by-clause study, so that is more than enough time to get through it.

I know from my own experience, because I used to be a member of the public safety committee and have seen a lot of these amendments, that are a lot of them are very technical, small changes to the bill, especially the parts that deal with ghost guns. Not a lot of debate is going to be required on them. In fact, the committee can probably get through them in short order because they are repetitive and many different areas of the Criminal Code and the Firearms Act have to be updated to make sure that those existing statutes are in harmony with each another.

The other thing I want to turn to in my final three minutes goes back to the earlier part that I mentioned at the beginning of my speech, the overall mandate of the public safety committee. We have two really important pieces of legislation waiting in the wings, waiting for their turn to be examined at the public safety committee. They are Bill C-20 and Bill C-26.

Bill C-20 is going to create our first-ever public accountability and transparency network that is independent of the RCMP and the CBSA. In fact, the CBSA has never had an independent oversight mechanism. Looking at the public safety committee's report from the previous Parliament looking at systemic racism in policing and looking at all of the instances of injuries and sometimes death that have happened to people who had been in the custody of the CBSA, we see that these are important measures. We have had so many racialized Canadians, so many indigenous Canadians who have been calling out for these types of oversight measures for years. Why should those pieces of legislation continue to be pushed back while we draw out this process on Bill C-21?

Bill C-26 is an important piece of legislation, which I will be the first to admit needs a lot of work at committee, but it is going to really bring in line a lot of the cybersecurity requirements that are needed for some of our critical sectors, be they in banking, transportation, energy and so on. It is going to be a requirement for many of those private actors to bring their systems in line with a standard that is acceptable to the federal government. Again, a lot of work is needed, but no one in this House can deny or absolve themselves from the fact that these are important issues that deserve to have their turn at the public safety committee.

My ultimate motivation for this motion today is to get Bill C-21 on its way. We have had enough time at the committee. It has occupied so much time at the public safety committee, and it is time for the public safety committee to move on to other bills that are equally important to many other Canadians.

In conclusion, I ultimately am going to reserve my judgment on Bill C-21 until I see what the committee reports back to the House, but I will not agree to let that committee continue to be bogged down, especially when there is so much other important work to be done.

With that I conclude. I welcome any comments and questions from my colleagues.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Madam Speaker, we miss the member on the committee, although we welcome his colleague. His contributions to this bill have been important and he is absolutely right.

Waiting in line at the public safety committee is Bill C-20, a bill that would provide important oversight for the Royal Canadian Mounted Police and the Canada Border Services Agency, something that, for many year, has been called for to enhance that oversight for the RCMP, but also provide oversight for CBSA for the very first time.

In addition to that, we have Bill C-26, which deals with cybersecurity. The member is absolutely correct. We have two important bills waiting, but we cannot get to them until we finish Bill C-21.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, I was glad to hear that the parliamentary secretary started her remarks with an acknowledgement of indigenous communities, because they led the way, with the Assembly of First Nations, in fighting against the amendments the government brought in at the eleventh hour. I am glad to see that those amendments were withdrawn. I would also thank committee members for passing my amendment to save the sport of airsoft. We have had a lot of very positive correspondence from that community, which is glad to see that the government will go back to the drawing board on this.

By my calculation, after tomorrow's meeting, the committee will have had eight hours on clause-by-clause. If this motion passes, there will be an additional 17 hours, which will be the equivalent of 12.5 meetings. By comparison, Bill C-18 only had seven meetings. I think there will be enough time to get this bill through.

Could the parliamentary secretary talk about the other bills that are waiting their turn at the public safety committee, like Bill C-20 and Bill C-26, and how important it is to look at those bills?

[Tim McSorley]

Thank you very much for the question.

It isn't just a concern among civil liberties and civil society groups but across many sectors in Canada that there needs to be a trust developed. There needs to be openness and transparency to the degree that we understand what Canadian agencies, including the CSE, are engaging in when they are engaging in protecting Canada's cybersecurity, engaging in active and defensive cyber-operations and engaging in signals intelligence.

The way to ensure this is happening is to have greater mandatory reporting around the activities that they're carrying out. For example, there's a lack of mandatory reporting in Bill C-26 right now, so it would be very difficult to track not only the ways that it's used but also whether there are any failings so we can improve the system. Oversight and review are simply not only about putting organizations on the defensive and calling them out but also seeing where we can learn from our errors and improve the operations.

Right now, there are the intelligence commissioner and NSIRA, and, as I mentioned, it's not clear that they have a role in reviewing Canada's cybersecurity operations, because they touch on national security but not necessarily in the way that those bodies always review it. Therefore, we think that either there needs to be a new position or there need to be amendments made to their mandate to clarify that they do have that mandate.

[Tim McSorley]

Yes.

I would just share that I think we need a centralized office to engage with cybersecurity. One of the questions we have around Bill C-26 is that it's not clear whether this would fall under existing national security review bodies. Having an agency tasked with not only ensuring cybersecurity is handled properly but also that it's reviewed and accountable, and that there's transparency around it, would be important as well.

[Dr. John de Boer]

Who is responsible? It's unclear. That was part of my testimony. We need to clarify roles and responsibilities, and that clarity doesn't exist right now. We don't have a unity of effort.

When it comes to Bill C-26, it's an important start. We are late to the game when it comes to mandatory reporting on cyber-incidents in critical infrastructure, so we welcome that initiative. However, it's limited to four sectors.

The reality is that there's a lot of policy action happening right now. The critical infrastructure strategy is being renewed. It was drafted in 2009. Cyber isn't even mentioned. Then we have the national cyber security strategy and Bill C-26. All of these need to be united.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Mr. Chair, before you start my clock, I want to give notice of the following motion.

That the committee undertake a study of no less than eight (8) meetings to review how the readiness of the Canadian Armed Forces is impacted by Canada’s procurement processes and the capabilities of our defence industry to ensure that the Canadian military’s needs are being met. And that the Department of National Defence, Canadian Armed Forces, Public Service and Procurement Canada, Office of the Auditor General, Parliamentary Budget Officer, Treasury Board, defence industry, military procurement experts and academics be invited to testify before committee on this matter; and that the committee report its findings and recommendations to the House.

We have that in both official languages, and we'll circulate it.

I will start my lightning round of questions.

First of all, I want to thank all the witnesses for being here.

The government has proposed Bill C-26 as a way to encourage industry to have a stronger cybersecurity defence. There have been a lot of concerns raised that the fines and penalties are overly prescriptive and brutal for individuals and companies, but yet these same types of fines and penalties aren't applied to the government itself.

I'd like to get feedback from Mr. de Boer in particular, as he represents a Canadian industry here. I do miss my BlackBerry phone from back in the day.

Who's responsible for protecting critical infrastructure, including in the private sector? Is it the Canadian Armed Forces, the Department of National Defence, CSE or the Government of Canada as a whole, or is it best that it come from the individual companies? You can also touch on the issue around available people, because the Business Council of Canada says that currently we have 25,000 unfilled positions in the cybersecurity world.

[Tim McSorley]

Thank you very much for that question.

First, it's clear, as you said, that there is need for collaboration among national security agencies. Some of that does require the sharing of information.

However, as you pointed out, what we have seen is that there are deep concerns about how some of that information is shared and the impact it can have.

For example, again the BC Civil Liberties Association found in their research that CSE was sharing intelligence with the CRA in order to bolster their efforts to counter terrorist financing. However, what we have found in our research is that the CRA, through its efforts to counter terrorist financing, has taken a prejudiced approach to Muslim charities in Canada. It has been operating from an idea that because there are terrorist threats from Muslim-linked organizations, the Muslim community must be placed under greater suspicion. That results in greater surveillance, greater information gathering and sharing and greater repercussions as compared to other communities in Canada.

How this ties back to the study at hand is that the intelligence that is shared isn't known publicly to the organization that it's being used against, so they don't have the opportunity to challenge it. We see that also reflected in, for example, Bill C-26, where there's, we believe, an undue amount of secrecy and the ability to use information and to hide information from critical infrastructure companies that are providing telecommunication services to Canadians if they were, for example, to attempt to appeal or challenge an order made by the minister.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Thank you for that.

Yes, it was mentioned within that same lawsuit, in the documents that the BC Civil Liberties Association came out with, the glossary of terms of unselected data and publicly available data and how they are used. Do laws like Bill C-59...? That lawsuit was before Bill C-59. It addressed more the old Bill C-51 problems. Specifically as we look at Bill C-26, do those laws adequately address the threats that civil libertarians are worried about in terms of taking advantage of publicly available data?

[Tim McSorley]

Just very briefly, it's clear that there's a role for the federal government in supporting private companies in increasing their cybersecurity and protecting national security. We think that one thing that's key to this is that there's trust and transparency around that process so that private companies can trust what the government is going to be doing when they provide that support. The public needs that trust and understanding around what those services are. We think that needs to be a central component of legislation like Bill C-26.

[Tim McSorley, National Coordinator, International Civil Liberties Monitoring Group]

Thank you very much, Chair, for the opportunity to speak to the committee today.

The International Civil Liberties Monitoring Group is a Canadian coalition that serves as a watchdog around national security, anti-terrorism and civil liberties in Canada. We have long-standing experience examining Canadian work regarding surveillance and cyber-activities, including the work of the Communications Security Establishment.

We agree that it is vital that Canada take steps to modernize cybersecurity laws to protect the private information of Canadians and the information infrastructure on which we rely. It is also clear that as cyber-attacks increase in activity and sophistication, Canada must take steps to defend itself; however, these actions must not come at the cost of accountability and transparency of government activities, including those of the CSE.

In our work, we have seen how overly broad powers and extensive secrecy result in the violation of the rights of Canadians and people in Canada. This can have real-world impacts, including when the information of Canadians and people in Canada is shared internationally with the Five Eyes as well as with other foreign agencies. When this information is in the hands of foreign jurisdictions, Canada loses control over how the information may be used, including in ways that can result in rights violations, abuse and even torture.

We also disagree with the premise that the private information of non-Canadians outside of Canada is simply fair game for mass collection and retention. This approach reinforces ongoing global systems of mass surveillance and associated rights violations.

This was revealed in detail by Edward Snowden, and while it did lead to promises of reform within Canada, it is unclear to what degree the CSE's activities have truly changed. While many of these concerns are related to the CSE's signals intelligence work, they also apply to CSE's cybersecurity and cyberwarfare activities. For example, while the CSE may have two distinct areas within its mandate, signals intelligence and cybersecurity and information assurance, they do not exist in a silo.

Recently, the BC Civil Liberties Association published material obtained from disclosure in their lawsuit against the federal government regarding the CSE's operations. These documents revealed, for example, that under an agreement with the former department of foreign affairs, information that CSE collected during its provision of cybersecurity support to the department, including the private communications of Canadians, could be shared with its Five Eyes counterparts. While this agreement dates to 2012, this concern persists under the CSE Act adopted in 2019.

Specifically, the National Security and Intelligence Review Agency, or NSIRA, noted in its 2021 annual report that the CSE Act explicitly allows for this kind of information sharing between the CSE's various mandates, including cybersecurity and foreign intelligence. NSIRA raised concerns that this sharing must be narrow and case by case and that the CSE should obtain legal advice on compliance with the Privacy Act. The CSE disagreed.

Why is this important? Bill C-26, currently being studied by Parliament, would formalize the CSE's role in ensuring the protection of cyber-infrastructure and would see the CSE obtain information about the security of critical infrastructure.

This means that a lot more information will flow to the CSE, including potentially private information relating to Canadians. Without adequate safeguards in place, both in the CSE Act and Bill C-26, information collected by the CSE, including information relating to Canadians, could be used in unexpected ways and shared with unaccountable foreign partners.

For more on this, I'd like to direct the committee to an open letter that we co-signed with several other civil society groups regarding a recent report from Citizen Lab entitled “Cyber Security Will Not Thrive in Darkness”. I can send those along to the committee afterwards.

The CSE also has a troubling history of obfuscating the nature of its work and violating its mandate. For example, the CSE tracked the Wi-Fi connections of Canadians at major airports, despite not being allowed to conduct surveillance within Canada. It collected massive amounts of Internet traffic through 200 Internet backbone sites worldwide. Despite prohibition, it regularly collects Canadians' information. It received it from foreign partners, and it violated Canadian law for five years by failing to minimize Canadian information shared with Five Eyes partners.

The CSE also resists fully complying with review and oversight. For example, the CSE refuses to grant NSIRA full access to records that the agency needs to carry out its review function. Instead, the CSE requires NSIRA to submit a request, and CSE staff provide what they say are relevant documents. This approach, NSIRA wrote in its latest annual report, “undercuts NSIRA's authority to decide whether information relates to its reviews and contributes to significant delays in the provision of information to NSIRA.”

The intelligence commissioner has also raised concerns that CSE authorizations for both foreign intelligence and cybersecurity have not included information crucial to the approval process, particularly regarding the outcomes of previous authorized activities or explanations of specific activities based on facts.

Finally, NSIRA has also raised concerns that the CSE is not providing adequate information on the impact of active or defensive cyber-operations nor appropriately delineating between the two kinds of activities, despite each requiring a different approval process.

I do have some recommendations, very short ones, but I will save those for the question period.

Thank you very much.

Telecommunications Act

[The Speaker, Anthony Rota]

It being 3:12 p.m., pursuant to order made on Thursday, June 23, 2022, the House will now proceed to the taking of deferred recorded division on the motion at second reading stage of Bill C-26.

Call in the members.

The House resumed from March 23 consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[Dan Mazier, Conservative, Dauphin—Swan River—Neepawa, MB]

Mr. Speaker, I rise today to speak on Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. Cybersecurity is of the utmost importance to Canadians, and I am glad to see the topic debated in the House today.

Bill C-26 would amend the Telecommunications Act. I should note that any time the Telecommunications Act is changed, I am very interested. Not only am I the shadow minister for rural economic development and connectivity, but I also have a bill before Parliament, Bill C-288, that would amend the Telecommunications Act to provide Canadians better information when it comes to the service and quality they pay for.

The dependence on telecommunications throughout our society continues to grow. The uses of Internet and cellular services are foundational to both the social and economic success of Canada, so I appreciate seeing the government move forward with a bill to secure our telecommunications network through Bill C-26. However, I must ask this: What took so long?

It was over two years ago when this House of Commons passed a Conservative motion that called on the Liberal government to ban Huawei from our 5G network. Despite this motion passing in the House of Commons and the director of the Canadian Security Intelligence Service warning the government in 2018, it took years to ban Huawei from Canada's 5G network. Therefore, is Bill C-26 important? It absolutely is. Did it take too long to get here? It absolutely did.

I should note that I recently asked if the University of British Columbia continues to work with Huawei in any form. The response was, “Yes, we do”. The government has been warned about the risks to our national security over and over again, yet we fail to see concrete action.

Analyzing Bill C-26, I have a few questions and concerns.

In its current form, Bill C-26 allows the Minister of Industry to obtain and disclose information without any checks and balances. If passed, Bill C-26 would grant the minister the power to obtain information from the Canadian telecom companies. It could, “by order, direct a telecommunications service provider to do anything or refrain from doing anything...that is, in the Minister’s opinion, necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.”

There are no specific details on what information can be collected when it comes to personal consumer data, nor is there any clarity on who the minister could share this personal information with. Could the minister share it with other ministers or other departments? As of now, it does not say the minister could not do so.

A recent research report entitled “Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act” stated the following on this matter:

The legislation would authorize the Minister to compel providers to disclose confidential information and then enable the Minister to circulate it widely within the federal government; this information could potentially include either identifiable or de-identified personal information. Moreover, the Minister could share non-confidential information internationally even when doing so could result in regulatory processes or private right of actions against an individual or organization. Should the Minister or [any] other party to whom the Minister shares information unintentionally lose control of the information, there would be no liability attached to the government for the accident.

I think an accident by the current government happens quite a bit.

If Parliament is going to give the minister such powers, it is imperative that checks and balances exist. It is very important that, when we discuss the ability of a government to obtain personal information from Canadians, we ensure that Canadians are protected from the unauthorized use of such information.

I should also add to this conversation the impact Bill C-26 could have on smaller Internet service providers. Small Internet companies are foundational to improving competition within Canada's telecom industry, but they are sometimes left out of the conversation.

Bill C-26 would empower the minister to “prohibit a telecommunications service provider from using any specified product or service in, or in relation to, its telecommunications network or telecommunications facilities, or any part of those networks or facilities” or “direct a telecommunications service provider to remove any specified product from its telecommunications networks or telecommunications facilities, or any part of those networks or facilities”.

We do not know what types of telecom infrastructure and equipment will be deemed a risk to our national security in the coming decades, so imagine that a local Internet service company builds a network using a specific brand of equipment. At the time, no one raises security concerns with the equipment or the manufacturer. The local Internet company is just beginning its operations, investing heavily in equipment to build a network and to compete with larger telecom companies.

Imagine that, five years later, the government deems the equipment the company invested in to be a national security threat, forcing it to remove and dispose of such equipment. The small Internet company trying to compete, which acted in good faith, has just lost a significant amount of capital because of a government decision. There is a strong possibility that this local Internet provider can no longer afford to operate.

I am hopeful this conversation can be had at committee to ensure the government is not unfairly impacting small, local and independent Internet companies. As I said, I am glad the House is debating the issue of cybersecurity, as the discussion is long overdue, but it is imperative that the issues I raised be addressed at committee, it is imperative that the issues my colleagues have raised be addressed at committee and it is imperative that the issues experts have raised be addressed at committee. That is why I will be voting to send Bill C-26 to committee in hopes that these concerns can be addressed.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Mr. Speaker, it is always an honour and a privilege to rise in this place, and it is nice to join the debate on the topic at hand.

When we talk about cybersecurity, there are so many different factors that go into it. I recognize that the bill before us largely has to do with telecommunications companies, bigger companies, and perhaps with government institutions as a whole. However, as we are having this conversation, we need to recognize and address the fact that the risk presented through cybersecurity extends much beyond that. With the current generation of kids being raised, kids are heavily involved in using cellphones, video game systems and computer consoles, for example, and are curious by nature. They are more at risk of clicking on a link that they do not know or realize is harmful. We know that is quite often how a lot of bad actors exploit weaknesses in computer systems in businesses or in homes. It is important to have that context out there early as we start the debate on this bill.

I want to get into a few specific parts of the bill at the start. First, it proposes to amend the Telecommunications Act to make sure the security of our Canadian telecommunications system is an official objective of our public policy, which is not a bad idea in and of itself. Second, it would create a new critical cyber systems protection act. The stated goal is to have a framework in place that would allow for better protection of critical cyber-services and cyber systems, which impact national security and public safety.

Some of the proposals include the designation of services or systems deemed to be “vital” for the purposes of this new act, along with designating classes of operators for these services or systems. The designated operators in question could be required to perform certain duties or activities, including the implementation of security programs, the mitigation of risks, reporting security incidents and complying with cybersecurity directions. Most significantly, Bill C-26 would authorize the enforcement of these measures through financial penalties or even imprisonment.

Anybody hearing these few examples listed in the preamble probably thinks this sounds like common sense, and I would generally agree with them. However, there is a problem, especially with the last one, which has to do with directions, because it is quite vague. These points should raise some obvious questions. How are we defining each of them? What are the limits and the accountability for using these new powers? It is fair to have these general concerns when we consider any government, but Canadians have reason to be especially wary with the one currently in power based on the Liberal record itself.

Unfortunately, the most recent and disturbing revelations related to foreign interference in two federal elections, which allegedly included working with an elected official, are not the only things we need to talk about. Here is another example. For a number of years, the Conservatives were demanding that the Liberals ban Huawei from our cellular networks. Despite all the warnings and security concerns, they delayed the decision and left us out of step with our closest partners in the Five Eyes. We had been calling it out for years before they finally decided to make the right decision thanks to pressure from Canadians, experts, our allies and the official opposition.

It was not very long ago, almost a year, when the announcement to ban Huawei came along. As much as it was the right decision, it should have been made much sooner. To say that is not a complaint about some missed opportunity in the past. The delay caused real problems with upfront costs for our telcos, and it created extra uncertainty for consumers.

Prior to becoming a member of Parliament, I worked for a telecommunications company in Saskatchewan. When we look at how big and vast our country is, we start thinking about how much equipment is required for one single telecommunications provider in one province, like SaskTel, the company I worked for. We can think about how much equipment it would have ordered or pre-ordered and potentially would have had to replace based on the government taking so long to make up its mind on whether or not to ban Huawei. If we look at some of the bigger companies out there, it is the same thing. There are the upfront costs they would have had to incur, and then the new costs if they had to replace all their equipment on top of that. This was simply because the government dragged its feet on such a big decision.

We have learned a lot of other things about foreign interference since then that need to be properly addressed and independently investigated. We need a public inquiry, at the very least, into some of these issues. However, once again, the Liberals are refusing to do the right thing for as long as they possibly can. It is clearer than ever before that we need to get a lot more serious about our cybersecurity, because what we are really talking about is our national security as a whole. These two things are closely intertwined, and having this conversation is long overdue.

We are happy to see the issue get more of the attention it deserves. Canadians have a lot of questions and concerns about it that should not be ignored. That is why it is a priority for Conservatives on our side of the House, and we are not going to let it go.

While we work to carefully review Bill C-26 in this place, we want to make sure that it will be effective and accomplish what it is supposed to do. It needs to protect Canadians living in a digital world. At the same time, it should not create any new openings for government to interfere with people's lives or abuse power.

After all, we are waiting for Bill C-11 to return to the House with all the problems it has, including the risk of online censorship. The problem is that whether it is about Huawei or the latest scandal about foreign interference, the Liberal government has failed to act, and it has undermined trust in our institutions. Therefore, it is hard to take it seriously when a bill like this one comes forward. The government's failure in this area is even more frustrating because we should all agree that there is a real need to strengthen cybersecurity. That is what experts and stakeholders have been telling us over many years. Canadians have had to wait for far too long for the government to bring something forward.

Make no mistake: This bill is flawed, and it will require more work to make sure that we get it right. However, the fact that we are talking about the issue right now is a small and necessary step in the right direction.

There are a few points I would like to mention.

Part 1 of this bill will allow the federal government to compel service providers to remove all products provided by a specified person from its networks or facilities. First of all, that puts a lot of companies at risk of having adversarial agreements signed in the future. If I were a company trying to sign an agreement, I would be doing everything I could to make sure that someone is not going to put a clause in there that if the government forces its removal, there is going to be an extra fine levied on the company. The problem with this bill is that it exposes companies to having these bad contracts negotiated, signed and forced on them by bad actors.

Under the new critical cyber systems protection act, the minister would be able to direct and impose any number of things on a service provider without giving them compensation for complying with the orders. Earlier, I was talking about the upfront costs paid by telcos trying to advance their networks to provide the products and services that their clients and customers want and need, especially as the world moves forward in a more digital fashion. The government is going to force them to do something without any compensation or without the ability to have help dealing with these changes. I think this is something that needs to be reconsidered in this bill.

That leaves service providers in a position where they have to pay for complying with potentially arbitrary orders or face legal penalties, such as the ones I mentioned earlier: fines or even imprisonment.

Again, we do have a desperate need to improve our cybersecurity regime, but these problems show that the bill is poorly written. By seeking to implement personal liability for breaches of the act, it will incentivize skilled Canadian cybersecurity professionals to leave Canada to find jobs elsewhere. This phenomenon, commonly known as the brain drain, is emerging as a severe issue for our economy, in some part thanks to the policies of the government.

Thousands of skilled, highly employable Canadians move to the United States thanks to the larger market, higher salaries and lower taxes, while very few Americans move to Canada to do the same. This issue is bigger than just the cybersecurity sector. Thanks to this government, we are losing nurses, doctors and tech workers to the United States. All the while, professionals who immigrate to Canada are being denied the paperwork they need to work in the field they are trained for because of the ridiculous red tape that plagues our immigration. Given that we are already short 25,000 cybersecurity professionals in Canada, is it wise to keep incentivizing them to go to the States?

Another massive problem with this bill is that it opens the door for some extreme violations of individual privacy. It also expands the state's power to use a secret government order to bar individuals or companies from accessing essential services. While we must improve our framework against cybersecurity attacks, drastically expanding what cabinet can do outside the public eye is always a bad idea. Accountability to the people and Parliament has always been an essential part of how we are supposed to do things in Canada. It is, however, not surprising that the current government would advocate for more unaccountable power. After all, government members have been anything but transparent. They have hidden information from Canadians to protect their partisan interests.

Canadians deserve to know what the government is doing. We must always uphold the principle that everyone is innocent until proven guilty. Giving cabinet the right to secretly cut Canadians off from essential services could threaten to erode this fundamental right.

[Philip Lawrence, Conservative, Northumberland—Peterborough South, ON]

Madam Speaker, while sitting through this debate, I observed that it has been one of the highest in quality since I have been in the House. It has been a substantive discussion of a very important issue. I am proud today, as I always am, to be a member of Parliament and to be sitting in the House of Commons.

Today, we are speaking to Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. More broadly, it is a cybersecurity issue.

From the debate and other academic discussions, we can all agree that this is an area of substantial importance where legislation is required. In fact, it is one of my frustrations, which I think is shared by many Canadians, that this government is not agile enough in responding to a world that is quickly changing. We need to be more agile as a legislature, as the government, to reflect the changes that are going on.

We have had a little bit of talk about important changes, such as artificial intelligence, and the exponential speed in which it is changing is unbelievable. Any type of quick Google search will tell us, from many academics, about the great part artificial intelligence can serve in doing much of the hard work that human beings are now doing. However, those observers also say that its ability to do malicious work is equal, which is obviously very challenging. We see these threats, and as we go forward and see more and more powerful artificial intelligence and computing power, the potential for those threats is growing.

We have certainly seen our share, for lack of a better term, of run-of-the-mill cybersecurity threats just in the last couple of years. I was serving as the shadow minister for national revenue when there were substantial CRA breaches of confidential information. One such breach did not actually transmit any information, but it forced the CRA to shut down its entire system, which shut out over 800,000 people from their My Account or log-in system right around tax filing season, which was obviously a tremendous concern for Canadians who were attempting to file their taxes.

The unfortunate reality, as it stands today, is that we are vulnerable to cybersecurity attacks. My colleague for Kildonan—St. Paul spoke recently about a conversation she had with cybersecurity experts from the minister's department just last year. They warned her about the incredible implications of an attack on our critical infrastructure, such as our electrical infrastructure or pipeline technology.

Of course, it is no surprise to many, but maybe to some of my colleagues from British Columba, that we are in a cold country. We can imagine what the impact could be. Our heating infrastructure, our electrical grid and our ability to get natural gas out to some of the coldest places in the world could literally be a matter of life and death. Members can imagine, for example, a cyber attack on one of our nuclear facilities and what that could potentially mean. All this is to highlight in the House today the significance and importance of cybersecurity legislation.

Another example, which I believe has been discussed and debated but I think deserves highlighting again, was in Newfoundland in October 2020 when cybersecurity hackers stole personal information from health care workers and patients in all four regions, as well as social insurance numbers of over 2,500 patients. This is deeply personal information, and as our information increasingly goes on that magical cloud both in the public and private sector, it is increasingly important that we put the appropriate measures to cybersecurity.

As I said, the spirit of the legislation before us is absolutely right. The intent, I believe, is also right. The timing is a little slow, but we need to get it in place.

The member for Winnipeg North did comment on the need for expediency, and I agree with him in one sense. We need cybersecurity legislation, new cybersecurity legislation, in place yesterday. Unfortunately, they brought this legislation in, and it is not complete. There are a series of regulations that we do not know.

This is our job, and I am honestly not trying to be partisan. Instead, this is a substantive criticism that it would have expedited this legislation if they had brought forward the legislation completely baked to show us the regulations and what they want to do.

Of course, I would feel this way about any government as a Canadian citizen. If we are going to grant them wide swaths of power, and maybe even necessarily, we just want to know what exactly those powers are. Do not do as Nancy Pelosi famously said, as the Speaker of the House of Representatives, to pass the bill and then read the bill.

Let us read it first and understand it because, quite frankly, I think the conversation in the House has been at a very high calibre and the more information one can feed us, the more information we can digest to do our job for Canadian citizens by improving the legislation, especially in matters of, as the member from the Liberal Party rightfully said, not just cybersecurity but also national security. We really, in all candour and all honesty, want to do our due diligence here.

As I said, part one of the act:

amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything

This is obviously a very broad power, and that is what we need to look at and work on at committee. Like I said, this legislation, if fully baked, would have meant less work at committee. It would have meant, perhaps, carrying forward with the debate quicker, but as we are left with many questions, those questions deserve to be answered here in the people's House.

The legislation continues:

Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,

(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;

(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;

(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;

(d) provides for the exchange of information between relevant parties; and

(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.

I hope that I have highlighted the fact that this is an important piece of information and that there are gaps within the information, so my substantive ask would be for the government to publish some of those regulations, so that we can review them, perhaps even before committee, and come to it in a spirit of collaboration and discussion. This is a matter of national security.

Perhaps, as I am getting a little bit less young these days, I get a little bit more skeptical. I would love to see some accountability mechanisms where the minister reports back to Parliament or otherwise because the question with the government is always who will watch the watcher.

We have seen that all governments are not infallible and each can commit its own share of foibles, errors and mistakes, unintentional or intentional, so I would love to see some greater accountability come committee.

[Luc Thériault, Bloc, Montcalm, QC]

Madam Speaker, clause 13 of Bill C-26 essentially allows the government to take new measures to protect critical cyber systems by order in council. That gives it a lot of flexibility. There is more flexibility there than in the legislative process.

Does my colleague think that the bill should be amended in committee so that we can be certain the government will be accountable to Parliament?

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Madam Speaker, it is an honour to speak today in the House on Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

With every passing year, Canadians are increasingly moving their lives online. They communicate with loved ones through email, messaging, photo sharing, video calls and more. They can order their entire grocery orders, rent cars for the weekend and book appointments with a click in an app.

As more and more Canadians choose to put more of their lives online, it falls to us, as members of Parliament, to ensure our cybersecurity laws are as protective of their personal and private information as possible.

The next generation of Canadians are increasingly building their professional and personal lives online. At the same time, they face mounting threats from foreign actors, ranging from scammers to state actors. These actors have shown they would use any tactic, from identity theft to cyber-attacks, to exploit Canadians and attack our institutions.

That is why the legislation we have before us today is essential, and why getting it right the first time is even more important. In particular, it must protect our online information while not crushing our small business start-ups under mountains of red tape.

On this side of the House, my Conservative colleagues and I believe that, as currently constructed, Bill C-26 fails to account for the welfare of small business start-ups by adding more red tape and placing burdensome costs on our homegrown technology sector. As constructed, this bill would directly affect start-ups by adding further bureaucracy that would drive up their starting costs. It would overburden with regulation the small telecommunications providers, the companies that provide our families and businesses with access to a global market online.

Wrapping them in red tape could risk our access to competing on the world stage. The Liberal government has already made it hard enough for start-ups, and the Liberal record on small business has been one committed to mazes of bureaucracy, punitive fines and penalties, and rising inflation. A Liberal economy of high tax and wasteful spending has already made it hard enough for start-ups.

Through the overarching premise of this cybersecurity bill, we know that it is needed. We absolutely need to update our cybersecurity laws, while at the same time we cannot allow Bill C-26 to add unnecessary burdens to business, especially small businesses.

I am particularly concerned about how this bill's regulations would also apply to businesses “irrespective of their cyber security maturity”, implying that providers who already have advanced electronic protection measures would still have to comply with the new regulations of the bill. This means that businesses could not continue using their current, possibly more robust, cybersecurity systems. Instead, they would have to disregard their current cybersecurity measures and replace them with the newly proposed government model.

Even Canadian businesses that have already worked hard to protect their customer security at accepted global standards would still incur more cost despite their robust electronic security measures. They would need to invest in government-regulated security measures, incurring costs such as inspection, extra time, installation and further training. They may have to completely overturn their superior standards for the government's preference.

The thing is, we do not know what the regulations would be or how they would affect businesses, because the actual regulations have not been developed. That is how the government does a lot of its bills. There are great titles, with few details. We are expected to just trust the Liberals to figure it all out later, behind closed doors, with no opportunity to study them at committee with expert witnesses.

Imagine if this regulatory framework were applied to any other business. Suppose we were regulating changes in the banking security industry. We would require that every Canadian bank and credit union tear its building down to the ground, brick by brick, and then rebuild itself from scratch. That really does not make sense.

Now is the time when we should be encouraging competition and bringing in more telecommunications companies. We know Canada has some of the highest telecommunications costs in the world. As more and more Canadians move their lives online, whether for banking, social media or work, adding more tape in this bill, as mentioned, would make this transition far more difficult. Costs never remain in the businesses' ledgers forever; they are inevitably always passed on to the consumer.

As a government, we should encourage the next generation of Canadian entrepreneurs who are innovating.

I will mention, as a sidebar, that I was formerly on the industry committee and we did a quantum computing study, which was, frankly, terrifying. It was about how Canada could be exposed to bad actors, which could affect every part of our online lives. As these technological advances develop, we have to be aware of risks and be able to stay ahead of technology.

These enterprises, businesses and telecommunications providers do not need more red tape; they need a stable market without uncompetitive government interference. We know very well how easy it can be for the government to build regulations that only the largest providers of an industry can shoulder. Without attention to scale, a single fault of noncompliance could instantly wipe out a smaller company. The legislation would allow ministers and bureaucrats to levy fines as high as $15 million without special consideration, such as the size of a company's user base.

Nonspecific details like that are music to the ears of our largest telecommunications providers. Monopolization of our telecommunications sector is something Canadians are already concerned about. We must always proceed cautiously, so as not to turn away innovation and new businesses entering the market, which creates healthy competition. For example, these fines could also be enacted under the vague term of “protecting a critical cyber system”. This vague terminology can leave a lot of leeway for government ministers to injure Canadian businesses with rampant fines.

There is already a shortage of online and electronic security professionals in Canada. According to the Business Council of Canada, an estimated 25,000 personnel are needed in the cybersecurity industry. Instead of dissuading these crucial professionals from joining this industry and helping keep Canada safe from domestic and foreign cyber-threats, let us provide a better framework and encourage them to build new businesses in this essential industry. Let us not scare them off with red tape and penalties.

As members can see, the legislation proposed for Bill C-26 has some significant concerns that require amendments at committee. Regulations being made with a lack of transparency behind closed doors, after the bill passes, is a concern. Conservatives will be looking to make amendments to the bill at committee as we hear from experts.

As I mentioned earlier, my Conservative colleagues and I encourage and support new, updated and secure cybersecurity measures being put in place, especially as more and more Canadians move their lives online. However, by placing more and more red tape on small and start-up businesses and providers that have already been in the industry for years, the bill would effectively dissuade businesses from entering this market and providing more services for Canadians. Large and mature businesses can handle the related costs of Bill C-26, but the associated expenses could crush small businesses.

I have worked, for much of my career, around various regulated industries and have seen, all too often, red tape and regulations making it too hard for small businesses to even start or to stay afloat without being acquired by larger firms, as small companies just cannot keep up with the regulatory compliance.

Cybersecurity threats affect all our communities. In January, an international ransomware group claimed responsibility for an Okanagan College cyber-attack in my region. Let us keep Canada safe by building clear online security measures that would encourage start-up professionals and businesses to help build up our cybersecurity infrastructure to a world-class standard. We will not accomplish this goal if we continue to add burdensome fines, penalties and red tape.

[Jenica Atwin, Liberal, Fredericton, NB]

Madam Speaker, not only would Bill C-26 introduce the new critical cyber systems protection act, or CCSPA, to legally compel designated operators to protect their cyber systems, but it would also amend the Telecommunications Act to enshrine security as a policy objective and bring the sector in line with other critical infrastructure sectors.

Being online and connected is essential to all Canadians. Now more than ever, Canadians rely on the Internet for their daily lives, but it is about more than just conducting business and paying bills. It is also about staying in touch and connected with loved ones from coast to coast to coast and, indeed, around the world. That is also why the Government of Canada is connecting 98% of Canadians to high-speed Internet by 2026 and 100% of Canadians by 2030.

Our critical infrastructure is becoming increasingly interconnected, interdependent and integrated with cyber systems, particularly with the emergence of new technologies such as 5G, which will operate at significantly higher speeds and will provide greater versatility, capability and complexity than previous generations. These technologies certainly create significant economic benefits and opportunities, but they also bring with them new security vulnerabilities that some may be tempted to prey on.

At this time, I want to bring the perspective of my constituents in the riding of Fredericton to this important debate today. Fredericton is home to the Canadian Institute for Cybersecurity at the University of New Brunswick, with a focus on disruptive technology and groundbreaking research. The institute provides hands-on support for community and industry partners as they face emerging threats, with company-specific, cross-disciplinary research.

Led by Dr. Ali Ghorbani, Canada's research chair in cybersecurity, the institute generates datasets to help thwart malicious cyber-attacks and works in tandem with the National Research Council of Canada in an innovative hub model that will lead to discoveries and advancements in cybersecurity, including publications, patents and the commercialization of technology, as well as provide training opportunities for graduate students and post-doctoral fellows.

Innovative cybersecurity research is conducted with a focus on Internet security, artificial intelligence, human-computer interaction and natural-language processing. I was honoured to welcome many ministers to my riding and to connect them with researchers and leaders in the industry to showcase how my community distinguishes itself in this sector. Fredericton is at the forefront of this new age and the challenges it presents, and I could not be more proud.

Even if there is enormous potential for Canadian digital innovation and expertise in cybersecurity, and I am witnessing it every day at home, we also need to face the fact that cyber-threats are growing in sophistication and magnitude. In 2021, close to 200,000 businesses across the country were affected by cybersecurity incidents, and this number continues to grow. Each of those businesses is not merely a business. It is comprises hard-working owners and employees, with families to feed and bills to pay. It is all the more maddening that many of these businesses must spend precious amounts of time and money preventing or fighting back against these incidents, many of which involve stealing money or demanding ransoms.

Canadian businesses have spent billions of dollars over the last years to detect and prevent cybersecurity incidents and, consequently, they have been experiencing downtime and a loss in revenue. Cybercrime is costly, and those who are bearing the brunt of it are Canadian businesses.

We also know that at all levels of government, we have not been immune from these kinds of attacks, even, horribly, hospitals. Earlier this year, the Toronto SickKids hospital was targeted by a ransomware attack affecting its operations. Closer to home, in Atlantic Canada, a ransomware group was behind the 2021 cyber-attack that paralyzed the Newfoundland and Labrador health care system.

Beyond the monetary implications, attacks like these have the real-life potential of impacting the health and safety of the ones we love, and we must do everything in our power as legislators to put in place effective safeguards. The effects on Canadians demonstrate beyond a doubt why we need to strengthen Canada's cybersecurity systems. As lawmakers, the least we can do is ensure that Canada and its institutions and businesses can continue to thrive in the digital economy and that our banks and telecommunications providers can continue to provide Canadians with reliable services.

Bill C-26 would modernize existing legislation to add security to the nine other policy objectives in the act, bringing telecommunications in line with other critical sectors. The bill would also add new authorities to the Telecommunications Act, which would enable the government to take action to promote the security of the Canadian telecommunications system.

As mentioned, in recent years, Canada's cybersecurity status has been tested by a variety of threat campaigns targeting critical infrastructure, businesses and individuals. The increase in digitization has led to the weaponization of digital tools and processes. This results in the disruption of critical systems and causes a lack of confidence in physical, psychological and economic well-being.

I am proud of all the work that has been done to secure Canada's critical telecommunications infrastructure, but I do not want us to lose sight of the work still to be done. The advent of the COVID-19 pandemic was a catalyst for bolstering national and international cyber-defence practices, requiring improved policies, guidance and cyber-intel.

Furthermore, given what is happening in Ukraine with the Russian invasion, we know that there are still military threats in the 21st century. However, we are also dealing with the emergence of new technologies that pose non-military threats.

With rising geopolitical tensions, government-driven hostile cyber-operations are more prevalent now than ever, posing an increased threat level to Canada's national security, economic prosperity and public safety.

In the 21st century, cybersecurity is national security, and it is our government's responsibility to protect Canadians from growing cyber-threats. That is exactly why we have developed Bill C-26.

It contains a multitude of important measures to protect Canadians and Canadian businesses. It is a carefully designed, multipronged approach. Part 2 of this act would enact the critical cyber systems protection act to provide a framework for the protection of the critical cyber systems that are vital to national security and public safety.

It also authorizes the Governor in Council to designate any service or system as a vital service or vital system, and requires designated operators to establish and implement cybersecurity programs, mitigate supply chain and third party risks, report cybersecurity incidents and comply with cybersecurity directions.

Introducing the new critical cyber systems protection act would strengthen baseline cybersecurity and provide a framework for the government to respond to emerging cyber-threats.

It is essential that we keep pace with the rapidly evolving cyber-environment by ensuring we have a robust, legislative framework in place.

In short, Bill C-26 is essential to helping keep Canadians and their data safe. In a world as connected as ours, we cannot take that for granted. Once again, cybersecurity is national security.

I am looking forward to this bill being sent to committee, and I encourage all members to join me in supporting Bill C-26 in subsequent readings.

[Jenica Atwin, Liberal, Fredericton, NB]

Madam Speaker, I am pleased to join the debate on second reading of Bill C-26, an act respecting cybersecurity.

Several of my colleagues have already spoken at length about the importance of the bill and the details therein, but it bears repeating that Bill C-26 is critical to our country's national security, our public safety and our economy.

Not only would Bill C-26 introduce the new critical cyber systems protection act or—

[Larry Maguire, Conservative, Brandon—Souris, MB]

Madam Speaker, as I rise to speak today, all of us in this place are acutely aware of the deeply concerning realities of foreign interference in Canada’s affairs.

The Government of Canada cannot afford to ignore this troubling trend. While there are many angles from which we must consider how best to protect our national interests, as we examine the content of Bill C-26 we are focused primarily on matters related to cybersecurity. There is no question that Canada’s critical infrastructure must be protected from cyber-threats.

In our modern world, computer systems are integral to the provision of health care, powering our homes and businesses, upholding our financial systems and so much more. While these incredible tools of our time may not be visible to the naked eye, they are tremendously powerful and we cannot afford for these systems to be compromised. The consequences from a criminal's or a foreign adversary’s disruption of medical services in our hospitals or of our electrical grid would be incredibly dangerous and potentially deadly.

In its 2021 “Special Report on the Government of Canada’s Framework and Activities to Defend its Systems and Networks from Cyber Attack”, the National Security and Intelligence Committee of Parliamentarians concisely listed what is at stake when cyber-threats arise: things like the personal information of Canadians; proprietary information, intellectual property and research of Canadian businesses and researchers; government policies and policy-making; security and intelligence information and operations; and the integrity of government systems, to name a few.

I was grateful to hear the Minister of Public Safety, when introducing this bill, say that cybersecurity is national security. It is a simple statement, but it is true. If we truly recognize cybersecurity as an essential element of our national security, we are more likely to give it the attention it deserves.

Bill C-26 is not perfect, as has been stated here, and we must ensure we protect the privacy of Canadians, nor will it be a cure-all for every cybersecurity weakness. However, I am fully behind updating our cybersecurity legislation. I hope the Liberal government is open to improving the bill at committee stage, and I will offer my support to get it to committee.

The objective of this bill is solid: to equip government to quickly respond to cyber-threats. As any expert in the field would tell us, rapid response is critical when a serious attack is under way. However, there are key issues that remain with the bill as it is presented to us today. Make no mistake, this legislation would give the government the ability to insert itself into the operations of companies, and therefore their customers.

As Christopher Parsons of the University of Toronto wrote in a critical analysis of the bill, “There is no recognition of privacy or other Charter-protected rights as a counter-balance to proposed security requirements, nor are appropriate accountability or transparency requirements imposed on the government.” As with any new power that a government gives itself, there must be extensive checks and balances. There must be transparency. Most of all, there must be oversight. What this legislation does not do is provide those much-needed guardrails. We need the safety oversight.

Giving a minister the power to order a private company “to do anything, or refrain from doing anything”, particularly when it comes to the private information of its customers, is deeply problematic. While I understand that how the minister can wield this new power might be spelled out in future regulations, I believe it must be clearly outlined in the legislation, rather than leaving it up to cabinet to decide at a future date.

We must also have a fulsome airing of what information the government could collect from companies and their customers. Almost every aspect of our lives is interwoven with digital information. From banking to how we do business and how we communicate, numerous companies have that information on each of us.

Therefore, the question that remains is this. If we grant the government access to information from companies, even for the most altruistic reasons or for national security reasons, who is overseeing those government agencies? I can assure members that the government will not be giving new powers to members of Parliament or parliamentary committees to undertake that role. We can look no further than the stonewalling Parliament is receiving on foreign interference in our democracy now. It is absolutely imperative that oversight and guardrails be built into this legislation, and I implore my colleagues on the parliamentary committee that would be tasked with this legislation to do just that.

The fact is that the government has trouble protecting its own sensitive information from cyber-threats. Many examples of cyber-attacks against the government have already been cited during this debate. There was the attack against the Canada Revenue Agency in August 2020, which resulted in 13,000 victimized Canadians. Global Affairs was attacked in January 2022. Canada Post has filed several breach reports after cyber-incidents, according to records from the Privacy Commissioner. If the government is unable to protect itself from cyber-threats, how can it be expected to protect the sensitive cybersecurity plans of private companies? The Liberal government would do well to lead by example before it can truly ask private companies to beef up their own cybersecurity practices. The weaknesses of the government’s own cybersecurity have been flagged over and over again.

In September 2020, the National Security and Intelligence Committee of Parliamentarians announced its review of the government’s framework and activities to defend its systems and networks from cyber-attack. The review resulted in a number of findings, which deserve mention.

First, the committee found that cyber-threats to government systems and networks “are a significant risk to national security and the continuity of government operations.” It also noted that nation-states “are the most sophisticated threat actors”, although the threats do not come from nation-states alone. Second, the committee found that while the government has implemented a framework to defend itself from cyber-attacks, “[t]he strength of this framework is weakened by the inconsistent application of security-related responsibilities and the inconsistent use of cyber defence services.” In plain language, the report found that not all federal organizations receive cyber-defence protection. The committee review identified that, while Shared Services Canada provides some cyber-defence services to 160 of 169 federal organizations, only 43 of those organizations actually receive the full complement of its services.

Given these findings, the committee recommended that the government “continue to strengthen its framework for defending government networks from cyber attack” and apply and extend cyber-defence policies and practices equally across government. At the time, the Liberal government agreed with the recommendations that were put forward. While this was an important step toward acknowledging the issue, taking action is another thing entirely.

Just days ago, a Globe and Mail headline read, “Ottawa makes little progress shoring up Crown corporations' cybersecurity”. The report noted that this is despite 18 months passing since the National Security and Intelligence Committee of Parliamentarians raised concerns about the possibility that Crown corporations, which are still not subject to the government’s cyber-defence policies, could inadvertently serve as gateways into the federal government’s well-protected systems.

The public safety minister did not mention the NSICOP report and recommendations when introducing this bill, but I hope that the work of this committee, made up of parliamentarians from across party lines, can be helpful in enhancing the government’s own cybersecurity defences. As NSICOP has underscored, “The data of organizations not protected by the government cyber defence framework is at significant risk. Moreover, unprotected organizations potentially act as a weak link in the government's defences by maintaining electronic connectivity to organizations within the cyber defence framework, creating risks for the government as a whole.”

In closing, the government is aware of these risks, but it has been slow to rectify the issue. While Bill C-26 covers another angle of this discussion, it does not address the problem of the government's own house. As I said already, cybersecurity laws need to be updated here in Canada. Bill C-26—

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, I would like to encourage all members to look at the seventh report from the Standing Committee on Public Safety and National Security on Canada's security stance vis-à-vis Russia. A lot of that report covers why a bill like Bill C-26 is necessary.

We can see agreement on the principle of the bill, but like my two colleagues from the Conservative Party and the Bloc, I am going to express some frustration that the Liberals did not anticipate that we in the opposition would have concerns with this first draft of the bill in terms of accountability, oversight and transparency. I wish the Liberals could have anticipated that before releasing this draft of the bill because now it looks like the committee has its work cut out for it to improve those measures. Could my hon. colleague express some comments on that particular part of this?

[Peter Fonseca, Liberal, Mississauga East—Cooksville, ON]

Madam Speaker, let me start off with the point you were just talking about, because in the 21st century, cybersecurity is national security. It behooves us all as parliamentarians to work as hard as we can to protect our businesses, consumers and institutions from cyber-threats. That is why I am so grateful and delighted to be here today in the House to speak to the second reading debate of Bill C-26, which concerns the important topic of cybersecurity.

Cybersecurity is a matter of great concern to my constituents of all ages. I firmly believe both the public and private sectors need to be able to protect themselves against malicious cyber-activity, including cyber-attacks. As parliamentarians, it is our duty to establish a framework for secure critical infrastructure that we can all rely on.

The past few decades have seen remarkable advancements in computer and Internet technology. Online connectivity has become an integral part of the lives of Canadians and people around the world. The COVID-19 pandemic has shown us how we rely on so much on the Internet for everything we do, from education to conducting business and staying in touch with loved ones. With more and more people depending on the Internet, including young children and seniors, our most vulnerable, it is crucial to ensure that we have a secure and reliable cyber-connectivity.

Our government is committed to improving cybersecurity to safeguard our country's future in cyberspace. However, as technology and cyber systems continue to evolve, our infrastructure is becoming more interconnected and interdependent. This brings new security vulnerabilities.

For instance, personal interactions like banking and credit card transactions are now mainly conducted online, making cybersecurity even more important. According to the Cybersecurity and Infrastructure Security Agency, ransomware attacks were among the most significant cybersecurity threats in recent years.

Cybercriminals continue to use sophisticated tactics to gain access to critical systems, steal sensitive data and extort money from victims. In addition to ransomware attacks, other common cybersecurity threats include phishing attacks, malware, insider threats and distributed denial of service attacks. I know members have all received emails or phone calls with these types of threats. We do not know where they are coming from, but they are trying to crack our system and do criminal activity.

As more organizations adopt cloud computing, like we do here, Internet of Things devices and artificial intelligence, these technologies are also becoming significant targets for these cybercriminals.

Cybersecurity threats can have severe consequences for individuals, businesses, all levels of government. These include financial losses, which we have heard are in the billions, reputational damage, legal liabilities and even physical harm. We have read and heard the stories of those who have taken their lives because of these harmful attacks. It is crucial to take proactive steps to prevent and mitigate cybersecurity risks.

Bill C-26 is a landmark legislation that would amend the Telecommunications Act and other consequential acts to enhance cybersecurity. The bill proposes to add more security as an express policy objective of the telecommunications sector, bringing it in line with other critical infrastructure sectors.

The key objectives of the bill are twofold. First, in part 1, the bill proposes to amend the Telecommunications Act to add security expressly as a policy objective. This amendment aims to align the telecommunications sector with other critical infrastructure sectors.

The changes we are bringing about through this legislation would authorize the Governor in Council and the Minister of Innovation, Science and Industry, after consultation with stakeholders, to establish and implement the policy statement “Securing Canada's Telecommunications System”, which the minister announced in May of 2022. The primary objective is to prevent the use of products and services by high-risk suppliers and their affiliates. This would enable the Canadian government, when necessary, to restrict telecommunications service providers' utilization of products or services from high-risk suppliers.

With such restrictions, consumers would not be exposed to potential security risks. This approach would allow the government to take security measures similar to those of other federal regulators in their respective critical infrastructure sectors.

The second part of Bill C-26 pertains to the introduction of the critical cyber systems protection act, or CCSPA, which mandates designated operators in federally regulated sectors such as finance, telecommunications, energy and transportation to undertake specific measures to safeguard their critical cyber systems. It would include the ability to take action on other vulnerabilities, such as human error or storms causing a risk of outages to these critical services. In addition, the act would facilitate organizations' capacity to prevent and bounce back from various forms of malevolent cyber-activities like electronic espionage and ransomware. Notably, cyber-incidents that surpass a certain threshold will necessitate mandatory reporting.

Both parts 1 and 2 of Bill C-26 are required to ensure the cybersecurity of Canada's federally regulated critical infrastructure, and in turn, protect Canadians and Canadian businesses. The need to intensify our efforts is apparent because of the advent of new technologies we are hearing about like 5G.

The COVID-19 pandemic has highlighted our growing dependence on technology. In addition, in my riding of Mississauga East—Cooksville, there is a growing concern about Russia's unwarranted and unjustified invasion of Ukraine, which has resulted in international tensions and a range of potential threats. Such threats include supply chain disruptions and cyber-attacks from state and non-state actors.

We are not starting from scratch in our fight against this threat, though. Our government is always vigilant when it comes to any type of threat, including cyber-threats. Our government has made several investments in cybersecurity in recent years to improve the country's cyber-resilience and protect Canadians' data and privacy. For example, in 2018, we created the national cybersecurity strategy. This was based on the consultations that we initiated with Canadians in 2016. Our government adopted this strategy to establish a framework aimed at protecting citizens and businesses from cyber-threats while leveraging the economic benefits of digital technology.

Cyber-incidents involve a certain threshold at which reporting would be required. This legislation would give the government a new tool to compel action, if necessary, in response to cybersecurity threats or vulnerabilities.

Canada is working alongside other democratic nations around the globe, both in the context of our Five Eyes relationship and in the G7 alliance. These multilateral forums are intensely focused on devising strategies to counter a range of cyber-threats, such as ransomware attacks; the dissemination of false information, which we have seen too often; and attempts by malicious actors to engage in cyber-espionage.

To facilitate this collaboration, we are emphasizing the importance of sharing information and intelligence, thereby breaking down those silos. This would enable us to more effectively combat efforts made to destabilize our economies and undermine Canadian interests. While we are currently engaged in a debate regarding Bill C-26, we are also taking proactive measures to address the current gaps in our domestic cybersecurity landscape, while simultaneously partnering with like-minded nations to confront these challenges in a comprehensive manner.

We have listened to Canadians, our security experts and our allies, and we are following the right path. We will ensure that our networks and our economy are kept secure. A safe and secure cyberspace is important for Canadian competitiveness, economic stability and long-term prosperity.

Bill C-26 aims to enhance designated organizations' preparedness, prevention, response and recovery abilities—

The House resumed consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[John McKay, Liberal, Scarborough—Guildwood, ON]

Madam Speaker, that was an excellent question. I wish I had written it myself, but apparently someone, or something, else already had.

Prior to question period, I was sitting with my colleague from Scarborough—Rouge Park. He wrote a speech for me, through ChatGPT, on my modern slavery bill. We just sat there, and after he had fed in a few words, an entire speech was spit out. Yet again, we have another challenge for us as legislators.

I sometimes think that we are so far behind that we do not even know how far behind we are. Cheney said that we do not even know what we do not know. Bill C-26 is an opportunity to bring ourselves into the game.

[John McKay, Liberal, Scarborough—Guildwood, ON]

Mr. Speaker, in some respects, Bill C-26 is quite complicated, but it is also quite simple. It aspires to have the risks of cybersecurity systems identified, managed and addressed so we are at much less risk because of our cyber system.

In the last while, I have had the good fortune to be the chair of the public safety committee in the previous Parliament, and I am now the chair of the defence committee. As such, I have listened to literally hours of testimony from people who are quite well informed on this subject matter. My advice to colleagues here is this: It behooves us all to be quite humble and approach this subject with some humility because it is extremely complex.

The first area of complexity is with respect to the definitions.

For instance, cybersecurity is defined as “the protection of digital information, as well as the integrity of the infrastructure housing and transmitting digital information”. Cyber-threat is defined as “an activity intended to compromise the security of an information system”.

Cyber-defence, according to NATO, is defensive actions in the cyber domain. Cyberwarfare generally means damaging or disrupting another nation-state's computers. Cyber-attacks “exploit vulnerabilities in computer systems and networks of computer data”.

Therefore, with respect to the definitions, we can appreciate the complexity of inserting yet another bill and minister into this process.

Let me offer some suggested questions for the members who would be asked to sit on the committee to look at this bill if it passes out of the House. I do recommend that the bill pass out of the House and, if it does, that the committee charged with its review take the appropriate amount of time to inform itself on the complexities of this particular space.

The first question I would ask is this: Who is doing the coordination? There are a number of silos involved here. We have heard testimony after testimony about various entities operating in various silos.

For instance, the Department of Defence has its silo, which is to defend the military infrastructure. It also has some capability to launch cyber-attacks, but it is a silo.

Then there is the public safety silo, which is a very big silo, because it relies on the CSE, CSIS and the RCMP, and has the largest responsibility for the protection of civilian infrastructure.

While the CSE does not have the ability to launch cyber-attacks domestically, it has the ability to launch a cyber-attack in international cyberspace. It is a curious contradiction, and I would encourage members to ask potential witnesses to explain that contradiction, because the more this space expands, the more the distinctions between foreign attacks and domestic attacks become blurred.

The bill would charge the Minister of Innovation, Science and Industry with some responsibility with respect to cybersecurity.

I would ask my colleagues to ask questions about how these three entities, public safety, defence and now the Minister of Innovation, Science and Industry, are going to coordinate so that the silos are operating in a coordinated fashion and sharing information with each other so that Canada presents the best possible posture for the defence of our networks. Again, I offer that as a suggestion of a question to be asked. We cannot afford the luxury of one silo knowing something that the other silo does not know, and this is becoming a very significant issue.

CSIS, for instance, deals in information and intelligence. The RCMP deals in evidence. Most of the information that is coming through all of the cyber-infrastructure would never reach the level of evidence, whether the civil or criminal standard of evidence. This is largely information, largely intelligence, and sometimes it is extremely murky. Again, I am offering that as a question for members to ask of those who come before the committee as proponents of the bill.

The other area I would suggest is to question is how this particular bill would deal with the attributions of an attack. To add to all of the complications I have already put on the floor of the House, there is also a myriad of attackers. There are pure state attackers, hybrid state criminal attackers and flat-out criminals.

For the state attackers, one can basically name the big four: China, Russia, North Korea and Iran. However, there are themes and variations within that. Russia, for instance, frequently uses its rather extensive criminal network to act on behalf of the state. It basically funds itself by with proceeds of its criminal activities, and the Russians do not care. If one is going to cripple a hospital network or a pipeline or any infrastructure on can name, then they do not care whether it happens by pure criminal activity or hybrid activity or state activity. It is all an exercise in disruption and making things difficult for Canadians in particular. We see daily examples of this in Ukraine, where the Russians have used cyber-attacks to really make the lives of Ukrainians vulnerable and also miserable.

The next question I would ask, and if this is not enough, I have plenty more, is on the alphabet soup of various actors. We have NSICOP, CSE, CSIS and the RCMP. I do not know what the acronym for this bill will be, but I am sure that somebody will think of it. How does this particular initiative, which, as I say, is a worthy initiative to be supported here, fit into the overall architecture?

Finally, CAF and the defence department are now doing a review of our defence posture, our defence policy. Cyber is an ever-increasing part of our security environment and, again, I would be asking the question of how Bill C-26 and all of its various actors fit into that defence review.

The House resumed consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

Business of the House

[Mark Holland, Liberal, Leader of the Government in the House of Commons]

Mr. Speaker, I am sure the hon. member across the way, having not had an opportunity to ask the Thursday question and not having been granted that opportunity, might be somewhat confused about the nature of the Thursday question or what it would be about, so of course we excuse him for that.

This afternoon, we are going to be concluding second reading debate of Bill C-26, concerning the critical cyber systems protection act. I would also like to thank all parties for their co-operation in helping to conclude that debate.

As all members are aware, and as I am sure you are aware of and quite excited for, Mr. Speaker, the House will be adjourned tomorrow for the address of the United States President, President Joe Biden.

On Monday, we will be dealing with the Senate amendments in relation to Bill C-11, the online streaming act.

Tuesday, we will continue the debate at second reading of Bill C-27, the digital charter implementation act, with the budget presentation taking place later that day, at 4 p.m.

Members will be pleased to know that days one and two of the budget debate, which I know members are anxiously awaiting, will be happening on Wednesday and Thursday, respectively.

On Friday, we will proceed to the second reading debate of Bill C-41, regarding humanitarian aid to vulnerable Afghans.

Telecommunications Act

[Martin Champoux, Bloc, Drummond, QC]

Mr. Speaker, as we know, technology is evolving at a frightening and unpredictable pace. It is exponential, according to all the experts.

I wonder if my colleague could comment on quantum computing, which is an extremely impressive technology that is evolving at an unbelievable pace.

I am wondering whether the contents of Bill C‑26 and the agility we write into legislation are sufficient to respond to any concerns we may have about evolving technologies, which often mean that governments become outdated.

I would like my colleague to comment on that.

[Tako Van Popta, Conservative, Langley—Aldergrove, BC]

Mr. Speaker, I am reading from the summary of Bill C-26, which would amend the Telecommunications Act to “authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure” our telecommunications security.

Although it is a laudable goal, those are very broad powers to give to a minister. Does my colleague feel it is necessary to give such broad and unfettered authority to one person?

[Laila Goodridge, Conservative, Fort McMurray—Cold Lake, AB]

Mr. Speaker, it is wonderful to have an opportunity to speak to Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

I think this is such an important topic, and it is something we need to be very aware of, especially in this increasingly digital era. We are seeing more and more attacks on cybersecurity happening here in Canada and around the world. I support the overall concept of the bill, and I want to see it go to committee so that we can have further study, as well as some amendments to alleviate some of the concerns that I, some of my colleagues and different stakeholders have brought forward. However, I have some questions I want to pose and put forward in the hope that the minister will have a plan to address some of them.

One big question I have is that the bill is pretty vague when it comes to the definition of “critical infrastructure”. Coming from northern Alberta, critical infrastructure can look very different from what it would look like in a larger centre in an area further south. One of the things I immediately thought of was whether a pipeline would count as critical infrastructure. Frankly, in northern Alberta, at the very minimum, pipelines not only export our oil but also bring up gasoline and natural gas, which are the ways we heat our homes. Most homes, at least in the Fort McMurray area, are heated with natural gas. In the wintertime, specifically and especially, if somehow a natural gas pipeline were to be the target of a cybersecurity threat, that could actually have devastating consequences and cause thousands of people to freeze.

I think this is the kind of question we have as to what exactly critical infrastructure is.

One of the other big pieces is that critical infrastructure seems to be defined in terms of what small and medium-sized businesses and not necessarily different government actors have. Different layers of government have different pieces of infrastructure that could also be attacked by cybersecurity threats. I think of provincial governments. Some of the big pieces for cybersecurity threats would probably be in hospitals, but it could go far beyond just a hospital, depending on the community. In the case of a specific emergency, like a fire, flood or some other natural disaster, the definition of critical infrastructure might be very different.

While I understand the idea of keeping it broad, a hacker or bad actor could specifically target an area in the case of an emergency or natural disaster because they know we are already in a weaker state. I think it is important to have some pieces in place so there can actually be plans to ensure that is not going to happen. That is something the legislation needs to define, and I would urge us to define it and specifically include pipelines as part of critical infrastructure. This is especially the case because we have gone into this space where so much is digitized.

There is digitization in just about every aspect of our world, so it becomes a question of actually having to define some of these pieces. We cannot just leave this all up to regulation. I think some baselines need to be set out in this piece of legislation in order to make sure we are actually talking about the same things. In this way, we can plan for future pieces of infrastructure we do not currently know are important and part of this plan.

While the legislation would give absolutely broad and sweeping powers to government, it does not seem to have any safeguards in place. I think the lack of safeguards is very concerning. I think back to the floods that were experienced in southern Alberta in 2012. Through the process of those floods, for a number of reasons that were not necessarily well defined, the RCMP decided to go into High River and seize guns. The RCMP made a decision not to seize guns in Calgary or other communities, but in High River, it decided to go in and seize guns.

This is a piece where we need to be very careful and make sure we have some safeguards in place. Then, in the case where there is government overreach in trying to prevent a security threat, there is recourse available that is defined in the legislation. It should not be left to regulation, where it could be changed at the whim of a minister. This is so important.

Another big, important piece that is scary to me is the fact that the government has all this work in place to make sure that small and medium-sized businesses, and other businesses, have security plans, which they must send to the government. However, what work is the government doing specifically to ensure that it is prevented from being part of a security threat? How many times has the federal government been hacked? In recent memory, it has been hacked a number of different times in different ways. This may be our email system or the House of Commons intranet. Some of these pieces are very much at risk. Is it a smart idea, from a security standpoint, to have everything housed in one place? What kinds of safeguards would we have such that information is not accessible should that aspect of the government be hacked? In turn, we want to make sure hackers do not find out all of our security plans so they can get around them or mess with things they identify as unprotected. That is one of the interesting pieces.

The bill also stipulates that businesses are to share with government but not that the government has to share with businesses. While I understand part of why the government would do that, I think having a two-way dialogue when it comes to this information is going to be important. We should be trying to work towards best practices whenever possible. An organization in one part of the country might be doing something that is innovative and substantially safer for all Canadians that prevents security threats compared with another part. Such information should be shared, not just held by government, so we can build on best practices in case there is an emergency at some point.

The other big question I have with respect to this bill is: What has the government done to work with municipalities, provinces and first nations governments to ensure that this is going to respond to their cybersecurity threats and cybersecurity needs? This is a piece where I do not want to let perfect be the enemy of good. Quite frankly, we are not going to know what the next big threat is; however, we need to make sure we are protected and must try to apply as many best practices as possible so that we do not open ourselves up to unintended risks.

This is about making sure we are taking care of all the little links in the chain. We can have a very robust system and an amazing plan in place, but if we have one weak link, it counts for nothing. That is why we need to send the bill to committee now. We need to have some very robust conversations with security experts from around this country and the world to make sure we do not have any weak links in the chain. All it will take is one weak link for this entire pyramid to collapse. It will crumble apart. This is something that, as Canadians, we all need to be prepared for and ready to address, as well as having meaningful and robust conversations around it.

With that, I am thankful for this opportunity.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, it is a pleasure to rise and join the debate this morning in the House of Commons. I will be sharing my time with the member for Fort McMurray—Cold Lake.

Bill C-26 is a bill that addresses an important and growing topic. Cybersecurity is very important, very timely. I am glad that, in calling this bill today, the government sees this as a priority. I struggle with trying to figure out the priorities of the government from time to time. There were other bills it had declared as absolute must-pass bills before Christmas that it is not calling. However, it is good to be talking about this instead of Bill C-21, Bill C-11 or some of the other bills that the Liberals have lots of problems with on their own benches.

Cybersecurity is something that affects all Canadians. It is, no doubt, an exceptionally important issue that the government needs to address. Cybersecurity, as the previous speaker said, is national security. It is critical to the safety and security of all of our infrastructure. It underpins every aspect of our lives. We have seen how infrastructure can be vulnerable to cyber-attacks. Throughout the world, we have seen how energy infrastructure is vulnerable, like cyber-attacks that affect the ability to operate pipelines. We have seen how cyber-attacks can jeopardize the functioning of an electrical grid.

At the local level, we have experienced how weather events that bring down power infrastructure can devastate a community and can actually endanger people's health and safety. One can only imagine what a nationwide or pervasive cyber-attack that managed to cripple a national electrical grid would do to people's ability to live their lives in safety and comfort.

Cyberwarfare is emerging as a critical component of every country's national defence system, both offensively and defensively. The battlefield success of any military force has always depended on communication. We know now just how dependent military forces are on the security of their cyber-communication. We see this unfolding in Ukraine, resulting from the horrific, criminal invasion of that country by Putin. We see the vital role that communication plays with respect to the ability of a country to defend itself from a foreign adversary, in terms of cybersecurity.

I might point out that there is a study on this going on at the national defence committee. We have heard expert testimony about how important cybersecurity is to the Canadian Armed Forces. We look forward to getting that report eventually put together and tabled, with recommendations to the government here in the House of Commons in Canada.

We know that critical sectors of the Canadian economy and our public services are highly vulnerable to cyber-attack. Organized crime and foreign governments do target information contained within health care systems and within our financial system. The potential for a ransom attack, large and small, is a threat to Canadians. Imagine a hostile regime or a criminal enterprise hacking a public health care system and holding an entire province or an entire country hostage with the threat to destroy or leak or hopelessly corrupt the health data of millions of citizens. Sadly, criminal organizations and hostile governments seek to do this and are busy creating the technology to enable them to do exactly this.

The Standing Committee on Access to Information, Privacy and Ethics conducted three different studies while I was chair of that committee that were tied to cybersecurity in various ways. We talked about and learned about the important ways in which cybersecurity and privacy protection intersect and sometimes conflict. We saw how this government contracted with the company Clearview AI, a company whose business is to scrape billions of images from the Internet, identify these images and sell the identified images back to governments and, in the case of Canada, to the RCMP.

We heard chilling testimony at that committee about the capabilities of sophisticated investigative tools, spyware, used by hostile regimes and by organized crime but also by our own government, which used sophisticated investigative tools to access Canadians' cellphones without their knowledge or consent. In Canada, this was limited. It was surprising to learn that this happened, but it happened under judicial warrant and in limited situations by the RCMP. However, the RCMP did not notify or consult the Privacy Commissioner, which is required under Treasury Board rules. This conflict between protecting Canadians by enforcing our laws and protecting Canadians' privacy is difficult for governments, and when government institutions like the RCMP disregard Treasury Board edicts or ignore the Privacy Commissioner or the Privacy Act, especially when they set aside or ignore a ruling from the Privacy Commissioner, it is quite concerning.

This bill is important. It is worthy of support, unlike the government's somewhat related bill, Bill C-27, the so-called digital charter. However, this bill, make no mistake, has significant new powers for the government. It amends the Telecommunications Act to give extraordinary powers to the minister over industry. It is part of a pattern we are seeing with this government, where it introduces bills that grant significant powers to the minister and to the bureaucrats who will ultimately create regulations.

Parliament is really not going to see this fleshed out unless there is significant work done at committee to improve transparency around this bill and to add more clarity around what this bill would actually do and how these powers will be granted. There have been many concerns raised in the business community about how this bill may chase investment, jobs and capital from Canada. The prospect of extraordinary fines, without this bill being fleshed out very well, creates enormous liability for companies, which may choose not to invest in Canada, not fully understanding the ramifications of this bill.

There is always the capture. We have seen this time and time again with the government. It seems to write up a bill for maybe three or four big companies or industries, only a small number of players in Canada, and yet the bill will capture other enterprises, small businesses that do not have armies of lobbyists to engage the government and get regulations that will give them loopholes, or lawyers to litigate a conflict that may arise as a result of it. I am always concerned about the small businesses and the way they may be captured, either deliberately or not, by a bill like this.

I will conclude by saying that I support the objective. I agree with the concern that the bill tries to address. I am very concerned about a number of areas that are ambiguous within the bill. I hope that it is studied vigorously at committee and that strong recommendations are brought back from committee and incorporated into whatever the bill might finally look like when it comes back for third reading.

[Chandra Arya, Liberal, Nepean, ON]

Mr. Speaker, I rise today to speak to Bill C-26, an act about cybersecurity. In the 21st century, cybersecurity is national security, and it is our responsibility to protect Canadians from growing cyber-threats. We have to take the necessary steps to protect Canadians and our telecommunications infrastructure. Canadians must have confidence in the integrity, authenticity and security of the products and services they use every day.

This bill reflects the values of Canadians and is in line with our closest allies, including our Five Eyes partners. That is why we are investing in cybersecurity, ensuring respect for the privacy of Canadians and supporting responsible innovation. We will continue to protect Canadians from cyber-threats in an increasingly digital world. As said in our international cybersecurity overview, a free, open and secure cyberspace is critical to Canada’s economy, social activity, democracy and national security.

Canada faces cybersecurity risks from both state and non-state actors. Protecting Canada’s and Canadians’ cyber-infrastructure from malicious actors is a serious challenge and a never-ending task. Canada works with allies and partners to improve cybersecurity at home and to counter threats from abroad. This includes identifying cyber-threats or vulnerabilities and developing capabilities to respond to a range of cyber-incidents.

A few years back, we put forward the national cybersecurity strategy, a vision for security and prosperity in the digital age. As mentioned there, virtually everything Canadians do is touched by technology in some way. We are heavily interconnected and networked, a fact that not only enhances our quality of life but also creates vulnerabilities. From commercial supply chains to the critical infrastructure that underpins our economy and our society, the risks in the cyberworld have multiplied, accelerated and grown increasingly malicious.

Major corporations, industries and our international allies and partners are engaged in the global cyber-challenge, but many others are not and that represents a significant risk. The strategy's core goals were reflected in budget 2018, where $500 million was invested in cybersecurity. Part of the funding was for the new Canadian Centre for Cyber Security, which is Canada’s technical authority on cybersecurity. It is part of the Communications Security Establishment, and it is the single, unified source of expert advice, guidance, services and support on cybersecurity for Canadians and Canadian organizations.

It regularly publishes the “National Cyber Threat Assessment”, and I would like to quote from their latest one for 2023-24. It states:

Canadians use the Internet for financial transactions, to connect with friends and family, attend medical appointments and work. As Canadians spend more time and do more on the Internet, the opportunities grow for cyber threat activity to impact their daily lives. There’s been a rise in the amount of personal, business and financial data available online, making it a target for cyber threat actors. This trend towards connecting important systems to the Internet increases the threat of service disruption from cyber threat activity. Meanwhile, nation states and cybercriminals are continuing to develop their cyber capabilities. State-sponsored and financially motivated cyber threat activity is increasingly likely to affect Canadians.

In the latest assessment, they chose to focus on five cyber-threat narratives that they judge are the most dynamic and impactful.

First, ransomware is a persistent threat to Canadian organizations. Cybercrime continues to be the cyber-threat activity most likely to affect Canadians and Canadian organizations. Due to its impact on an organization’s ability to function, ransomware is almost certainly the most disruptive form of cybercrime facing Canadians. Cybercriminals deploying ransomware have evolved in a growing and sophisticated cybercrime ecosystem and will continue to adapt to maximize profits.

Second, critical infrastructure is increasingly at risk from cyber-threat activity. Cybercriminals exploit critical infrastructure because downtime can be harmful to industrial processes and the customers they serve. State-sponsored actors target critical infrastructure to collect information through espionage, to pre-position themselves in case of future hostilities and as a form of power projection and intimidation.

Third, state-sponsored cyber-threat activity is impacting Canadians. State-sponsored cyber-threat activity against Canada is a constant, ongoing threat that is often a subset of larger, global campaigns undertaken by these states. State actors can target diaspora populations and activists in Canada, Canadian organizations and their intellectual property for espionage, and even Canadian individuals and organizations for financial gain.

Fourth, cyber-threat actors are attempting to influence Canadians, degrading trust in online spaces. Cyber-threat actors' use of misinformation, disinformation and malinformation, collectively referred to as MDM, has evolved over the past two years. Machine learning-enabled technologies are making fake content easier to manufacture and harder to detect. Further, nation-states are increasingly willing and able to use MDM to advance their geopolitical interests.

Fifth, disruptive technologies bring new opportunities and new threats. Digital assets, such as cryptocurrencies and decentralized finance, are both targets and tools for cyber-threat actors to enable malicious cyber-threat activity. Machine learning has become commonplace in consumer services and data analysis, but cyber-threat actors can deceive and exploit this technology. Quantum computing has the potential to threaten our current systems of maintaining trust and confidentiality online. Encrypted information stolen by threat actors today can be held and decrypted when quantum computers become available.

Simply put, cyber-threats pose a growing risk to all Canadians and institutions. We are confronting this threat head-on. Our government regularly engages with domestic and international cybersecurity partners to protect Canada’s critical infrastructure and the systems that underpin essential services. We are working closely with critical infrastructure stakeholders and partners to ensure that they are better prepared to face cyber-based threats.

Our cybersecurity framework continues to detect, deter and disrupt state and non-state actors attempting to take advantage of the Canadian cyber-landscape. Our government is, and will always be, ready to respond to any malicious cyber-acts that threaten Canadian interests.

To conclude, the purpose of this act is to help protect critical cyber systems in order to support the continuity and security of vital services and vital systems by ensuring that, first, any cybersecurity risks with respect to critical cyber systems are identified and managed; second, critical cyber systems are protected from being compromised; third, any cybersecurity incidents affecting, or having the potential to affect, critical cyber systems are detected; and finally, the impacts of cybersecurity incidents affecting critical cyber systems are minimized.

The House resumed from March 6 consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

Finance

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is a pleasure to rise to talk about the important issue of finances and the direction in which the government has been leading Canada in order to support Canadians in every region of the country.

Before I get into that, I want to quickly make reference once again to the Conservatives' bringing forward a concurrence motion in order to prevent government legislation from being debated. In fact, today, we were supposed to be debating Bill C-26, which is about cybersecurity, something important to Canadians. However, it is not the first time we have seen the Conservative Party show disrespect for important issues Canadians want us to deal with. In fact—

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Thank you, Mr. Chair.

Thank you to the witnesses for being here. It's great to see Ms. Cianfarani here again.

I would follow up on what Ms. Mathyssen was just saying. You mentioned the difficulty in getting people the national security clearances and top secret clearances. When we have a shortage in the workforce, that becomes even more difficult. We're having discussions around Bill C-26 right now, and the Business Council of Canada is saying we're short 26,000 people in the cybersecurity industry as it is right now. There are that many unfilled positions.

Aside from trying to produce more people here through our education system, would it be appropriate to employ foreign nationals who are coming from Five Eyes nation partners and who have been approved through their processes?

Digital Charter Implementation Act, 2022

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, that is why I was reflecting on Bill C-26. If we look at the debate that took place yesterday on cybersecurity, dealing with the digital world, at the end of the day, Conservative member after member was standing up saying that, yes, they were going to support the bill but that they had a lot of problems with the legislation, and that the principle of Bill C-26 is something that they support.

I kind of made a leap, and apparently the wrong leap, by seeing the Conservatives, in principle, support the privacy of Canadians and the legislation that will give an enhanced privacy legislation. I guess I should not have made that particular leap.

Inconsistency from the Conservative caucus is fairly well known. I will try my best not to make that sort of mistake going forward.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is a pleasure to rise to speak to Bill C-27 today. As I put forward to my friend in the form of a question, when we think of Bill C-27, I like to think that the government is on the right track in continuing to protect the privacy of Canadians in many different ways. Yesterday we had a debate on Bill C-26 on cybersecurity.

If we take a holistic look at what the government has been able to accomplish through legislation and, ultimately, in certain areas in terms of developing the industry through budgetary measures, Canada is indeed in a very good position in comparison to our peer countries around the world. I do not say that lightly, because I know that all members are very concerned about the issue of privacy. That is in good part why we have the legislation today.

The last time these changes we are proposing happened was two decades ago. Let us reflect on that time of 20 years ago. We did not have iPhones, and Facebook did not exist. Going back a little further than that to when I was first elected, when one clicked into the Internet, the first thing one heard was a buzzing sound, the dial tone and then clicking. Then one was magically connected to the world. How far we have advanced in a relatively short period of time. Last week, I was on the Internet making a purchase that would be delivered. I never had to go to the store. It involved my doing a little bit of design work on the computer before making the purchase. I was told yesterday that it was delivered to my home.

The amount of information out there is absolutely incredible, and it is very hard to imagine the types of data and the risk factors out there. That is why it is so important that, as a government, we bring forward substantive legislation that is going to protect the privacy of Canadians, to ensure companies are held accountable and, in the context of yesterday's debate, to protect them from security threats that are very strong and very viable. It was interesting yesterday listening to the debate for a number of hours.

I get the sense that a wide spectrum of support is shaping up today. The NDP is supporting the legislation. My understanding is that the Conservatives are supporting the legislation. The Bloc, in principle, is supporting the legislation. The Province of Quebec has actually made some significant gains on this whole front, so I am not surprised that the Bloc or members from Quebec within the Liberal caucus are very strong about these issues, whether they are cybersecurity issues or the privacy issues of Bill C-27 that we are debating today.

I raise this because I believe that it does not matter what side of the House one happens to sit on, as this is legislation worth supporting. As I indicated, it has been 20 years since we have seen substantial changes to the legislation. The expectation is very high that we will not only introduce the legislation but that, with the cooperation of members opposite, we will see it pass through in a timely fashion.

Being an optimist, I would like to see the bill pass before the summer, and it is possible. I realize that it would require a great deal of co-operation from opposition parties, but I do believe it is doable, especially after the comments I heard this morning.

The legislation is not meant to address every matter that Canadians are having to face in the digital world. That is not what it is designed for. As I indicated, the legislation, whether this one or Bill C-26, goes a long way in establishing a solid base for a framework that would enable the government of the day, which is held accountable by the opposition, to have the opportunity to do a lot of work in an area where we need to see a higher sense of security and protection.

One member across the way asked about engagement. There has been a great deal of engagement. I can assure the member that, whether it is from a constituency perspective, a ministerial perspective or, I would even suggest, the member would have to take some credit in terms of an opposition perspective, there has been a great deal of dialogue. This is not a new issue. This issue has been in the making for years now.

There have been some factors that are beyond the government's control in terms of the manner in which it can bring forward legislation, for example the worldwide pandemic and the requirement for substantial legislation in order to support Canadians and have their backs. There were issues of that nature, along with numerous other pieces of legislation. I would not want to give a false impression that this is not an important issue for the Government of Canada.

At the end of the day, based on comments I have heard on both Bill C-26 and Bill C-27, I believe the legislation would establish a solid footing or framework, whatever terminology we might want to use, and, at the very least, we should see it go to committee. The principles of the legislation are in fact endorsed and supported by all sides of the House, from what I can tell, and please correct me if I am wrong. No doubt we will have other legislation that might be somewhat more controversial, where there is real opposition to the legislation, and this would enable more time for debate on that type of legislation.

If we could somehow recognize the value of this legislation, given that there is so much support for its principles, we would allow it to go to committee, where members of Parliament are afforded the opportunity to get into the nuts and bolts, the details, where there is representation from different stakeholders at committee to express their thoughts and opinions on the legislation, and where members can find out directly from the minister what kind of consultation has taken place. The member does not to have to take my word for it, but I can assure him that there has been a great deal of consultation. He would be able to hear that first-hand from departmental officials, the minister and so forth.

I believe the government has done its work in bringing the legislation to the point where it is today. We have seen ministers, in their opening remarks and in their response to questions, in co-operation with opposition members. The government has demonstrated very clearly in the past that it is open to amendments that can improve upon legislation for the benefit of Canadians, and if there are ways we can improve this legislation, we will accept those types of amendments. We will support those types of amendments. I believe this is one of the areas where the Prime Minister has been very good in sending that message. It could be because of years in opposition, when the opposition never had amendments accepted by former prime minister Stephen Harper.

At the end of the day, if there are ways to do it, we can improve upon this bill. I heard yesterday on Bill C-26, and already today on Bill C-27, that members have genuine concerns. I do not question those concerns, but I do believe that it would be helpful if they can look at those concerns. If they already have ideas that they believe will improve the legislation, nothing prevents members of the opposition or government members from being able to provide those amendments or thoughts in advance to the ministry, which would potentially allow for a deeper look into it to see if, in fact, something is doable.

The NDP talked, for example, about digital rights for Canadians. There is a great deal of concern that we need to ensure and recognize them, whether they are consumer rights or privacy rights. These are things we all hold very close to our hearts. We all want to make sure the interests of Canadians are being served.

When I took a look at the specifics of the legislation, I highlighted three parts I wanted to make reference to. CPPA would strengthen privacy enforcement and oversight in a manner that is similar to that of certain provinces and some of Canada's foreign trading partners. It is important that we do not just look internally. There are jurisdictions, whether nations or provincial entities, that have already done some fine work in this area. We do not have to reinvent the wheel, and working with or looking at other forms of legislation that are there is a very positive thing. In particular, the CPPA would do so by granting the Privacy Commissioner of Canada order-making powers that can compel organizations to stop certain improper activities or uses of personal information and order organizations to preserve information relevant to an OPC investigation.

This is significant. We need to think in terms of the technology that I make reference to. I can remember a number of years back when a pizza store was becoming computerized. As someone called in and made an order, they recorded the telephone number, the name and the address, personal information such as that. I remember talking to the franchise owner, whom I happen to know quite well, explaining how the collection of data, if used appropriately, can not only complement the business, but also complement the consumer, and this was maybe 20 years ago.

We can contrast that to an iPhone and looking at some of those applications we see. The one that comes to mind is a true Canadian application and a true Canadian franchise: Tim Hortons. My wife never followed hockey, but nowadays she does because of Tim Hortons. One can win free cups of coffee by picking who is going to score goals or get assists. I am not exactly sure how it works, but Tim Hortons comes up with a program that is actually collecting data from people. It is a program that allows it to send out all kinds of notifications. It could be sales of product. It could be something like NHL standings. It really engages the consumers. An incredible amount of data is actually being collected.

Tim Hortons is not alone. One can go to virtually all the major franchises and find the same thing. It is not just the private sector. Yesterday we were talking about cybersecurity, and one can easily understand and appreciate the sensitivity of collecting information, even if one is a Tim Hortons or a Home Depot, but also many government agencies. For example, there is the amount of personal information Manitoba Health has, which is all computerized. There are also doctors' offices. The digital world, in a very real and tangible way, has changed to such a degree that many, including myself, would argue that things like Internet access have become an absolute and essential service nowadays. It is something we all require.

The incredible growth of data banks, both in the private sector and in the government, and I would throw in the non-profits and the many other groups that collect data, has been substantive in the last 15 or 20 years. That is the reason why today we have the type of legislation we have before us. Bill C-27 would ensure that we have something in place to provide consequences for offences. To give members a sense of those consequences, the new law would enable administrative monetary penalties for serious contraventions of the law, subject to a maximum penalty of 3% or $10 million of an organization's global revenue, whichever is greater, and fines of up to 5% of revenues or $25 million, whichever is greater, for the most serious offences.

I said I wanted to highlight three things, so I will move on to the second point. The personal information and data protection tribunal act would establish a new tribunal, which would be responsible for determining whether to assign administrative monetary penalties that are recommended by the Privacy Commissioner following investigations, determining the amount of penalties and hearing appeals of the Privacy Commissioner's orders and decisions. The tribunal would provide for access to justice and contribute to further development of privacy expertise by providing expeditious reviews of the Privacy Commissioner's orders.

The third point is that the AIDA would impose a duty to act responsibly by requiring organizations designing, developing, deploying or operating high-impact artificial intelligence technologies to put in place measures to proactively mitigate risks of harm and bias in the development of these technologies.

I have less than a minute left to talk, and I have not even touched on the AI file. I made reference at the very beginning to the financial investments of this government in encouraging the growth of that industry in the different regions of our country. The Government of Canada is not only bringing in the type of securities that are absolutely important for Canadians from a privacy perspective, to encourage continual growth in the area and have these protections in place, but also doing so through budgetary measures to ensure that we continue to enhance the opportunities of Canadians. If we take a look at the digital world today, it is very hard to imagine where it is going to be tomorrow, at least for myself, in witnessing the growth of the digital world over the last 20 or 30 years and how far it has gone.

This legislation is a modernization. It is legislation we can all get behind and support. I would encourage members, no matter what party they are from, to support it. Let us see it go to committee, where the committee can do its fine work and see if we can even improve—

Telecommunications Act

[Clifford Small, Conservative, Coast of Bays—Central—Notre Dame, NL]

Mr. Speaker, there is a pressing need to secure Canada's critical infrastructure against cyber-threats.

Computer systems, which run our health care, energy and financial systems, are targets for criminals and foreign adversaries to attack. Disruption of medical services at a hospital or electricity through a grid would have severe consequences, possibly including injury or death.

This is exactly what happened on October 30, 2021, in my province of Newfoundland and Labrador. My hon. colleague across the way agrees with what I am saying because he, his family members or his friends, I am sure, had some of their personal information breached in that attack.

Personal information belonging to thousands of patients and employees was obtained through a cyber-attack on Eastern Health. In fact, over 200,000 files were taken from a network drive in Eastern Health's IT environment. Over 58,000 patients and almost 300 staff and former staff had their personal data breached.

The information taken included health records, medicare plan numbers, dates of birth, names and addresses. In fact, some even had their social insurance numbers taken. The immediate result was that a complete shutdown of the health care system took place throughout the entire province.

Patients who had waited through the pandemic found that critical care for such things as cancer and heart disease were put on hold. Many had to wait weeks or even months to have their appointments rescheduled. Some of these folks had poor outcomes. In fact, people's lives were shortened in some cases as a result of the cyber-induced shutdown of the health care system in Newfoundland and Labrador.

This is very serious stuff. This was not the first time such a cyber-attack happened in Canadian health care. In October of 2019, three hospitals in Ontario were victimized in a similar fashion.

On another note, a pipeline company in the United States fell victim to hackers in 2021. This led to diesel and jet fuel shortages, disrupting most of the economy of the eastern seaboard of our neighbour to the south.

These are just a few examples of catastrophic outcomes resulting from cyber-attacks in recent years. Canadians need protection from these types of attacks. This legislation is intended to align with the actions of our allies in the Five Eyes. This bill would give clear legislative authority to the government to prohibit high-risk entities, such as Huawei, from assuming critical roles in our cyber-infrastructure.

This legislation is filled with good intentions. Currently, a cybersecurity incident is defined as:

an incident, including an act, omission or circumstance, that interferes or may interfere with

(a) the continuity or security of a vital service or vital system; or

(b) the confidentiality, integrity or availability of the critical cyber system.

There is no indication given as to what would constitute interference under the bill. Does this mean that the cyber-attack on Newfoundland and Labrador health care would not be classified as interference?

In addition, there is no timeline specified in this bill for the reporting of cybersecurity incidents to the CSE and the appropriate regulator. The bill says that reporting must be immediate. “Immediate” is not interpreted in this bill. Is it one hour, one day or one week? This is something we need to know.

In terms of civil liberties and privacy, technical experts, academics and civil liberties groups have serious concerns about the size, scope and lack of oversight of the powers that the government would gain under the bill.

In late September 2022, the Canadian Civil Liberties Association, the International Civil Liberties Monitoring Group and the Privacy and Access Council of Canada, as well as several other groups and academics, released their joint letter of concern regarding Bill C-26.

While stating the collective's agreement with the goal of improving cybersecurity, the joint letter goes on to state that the bill is “deeply problematic and needs fixing”, because “it risks undermining our privacy rights, and the principles of accountable governance and judicial due process”.

The joint letter outlines several areas of concern, including increased surveillance. The bill would allow the federal government “to secretly order telecom providers to ‘do anything, or refrain from doing anything’” necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.

While this portion of the bill goes on to list several examples of what “doing anything” might entail, including, for example, prohibiting telecom providers from using specific products or services from certain vendors or requiring certain providers to develop security plans, the collective expresses the concern that the power to order a telecom to do anything “opens the door to imposing surveillance obligations on private companies, and to other risks such as weakened encryption standards”.

Bill C-26 would allow the government to “bar a person or company from being able to receive specific services, and bar any company from offering these services to others, by secret government order”, which raises the risk of “companies or individuals being cut off from essential services without explanation”.

The bill would provide for a collection of data from designated operators, which could potentially allow the government “to obtain identifiable and de-identified personal information and subsequently distribute it to domestic, and perhaps foreign, organizations.”

There is a lack of “guardrails to constrain abuse”. The bill would allow the government to act without first being required to perform “proportionality, privacy, or equity assessments” to hedge against abuse. This is concerning to the collective, given the severity of the penalties available under the statute.

There is the potential for abuse by the Communications Security Establishment, the federal agency responsible for cybersecurity but, more prominently, signal intelligence. The CCSPA would grant the CSE access to large volumes of sensitive data. However, it would not constrain its use of such data to its cybersecurity mandate.

The civil liberties of Canadians are already under attack. Bill C-26 does not accurately enough define how our civil liberties would be protected. Given the need for protection from cyber-attacks, a bill like this is quite necessary, no doubt.

In its current form, with so many unknowns for Canadians, I will not be able to support it. However, I do support sending it to committee for some input from Canadians and for some fine tuning, to turn it into an instrument to protect us all from cyber-attacks.

[Fraser Tolmie, Conservative, Moose Jaw—Lake Centre—Lanigan, SK]

Mr. Speaker, it is always an honour to rise in this House on behalf of the people of my riding of Moose Jaw—Lake Centre—Lanigan.

The safety and security of our nation is of paramount importance, and I understand the need to enhance the safety and security of Canadians, both here at home and abroad. This would include many of our international corporations, which are large contributors to our economic base, and of course our own government institutions and interests. Having the opportunity to speak to cybersecurity in Canada gives us an opportunity to enhance or increase our country's ability to protect us from cyber-threats.

A significant concern for all Canadians is security. This concern has increased in recent times, as we see the rise in organized crime and gang-related offences, which have gone up 92%. The question I ask myself when I see this increase is this: Will the Liberal government be led by evidence and act on the evidence that has been reported?

Cybersecurity is extremely important for our nation to protect itself from inside and outside threats. I welcome Bill C-26, but I do have some concerns pertaining to the success of the bill, and one concern is about accountability. This is a question that we in opposition bring up every day in this House and regularly.

Bill C-26 is essentially divided into two different parts. The first part is to amend the Telecommunications Act to promote the security of the Canadian telecommunications system, adding security as a policy objective; to bring the telecommunications sector in line with other infrastructure sectors; and to secure Canada's telecommunications system and prohibit the use of products and services provided by specific telecommunications service providers. This amendment would enforce the ban on Huawei Technologies and ZTE from Canada's 5G infrastructure and would remove or terminate 4G equipment by the year 2027. What stands out to me, which has been a concern, is the time that it took the government to react to enforce the ban on Huawei.

The second portion of this bill is to enact the critical cyber systems protection act, or CCSPA, designed to protect critical cyber systems and “systems that are vital to national security or public safety and that are delivered or operated...within the legislative authority of Parliament.” As a report by Norton Rose Fulbright notes, the purpose of the CCSPA is, first, to “[e]nsure the identification and effective management of any cybersecurity risks, including risks associated with supply chains and using third-party products and services”; second, to “[p]rotect critical cyber systems from being compromised”; third, to “[e]nsure the proper detection of cybersecurity incidents”; and finally, to “[m]inimize the impacts of any cybersecurity incidents on critical cyber systems.”

The impacts of this bill would be far-reaching, and here are the things that need to be considered when this bill is in place. The government would have the power to receive, review, assess and even intervene in cyber-compliance and operational situations within critical industries in Canada; to make mandatory cybersecurity programs for critical industries; and to enforce regulations through regulatory and legal enforcement, with potential financial penalties. With this in place, the Governor in Council and the Minister of Industry would be afforded additional powers.

As the report notes:

If any cybersecurity risks associated with the operator’s supply chain or its use of third-party products and services are identified, the operator must take reasonable steps to mitigate those risks. While the Act doesn’t give any indication of what kind of steps will be required from operators, such steps may be prescribed by the regulations [at committee].

It goes on:

The Act also addresses cybersecurity incidents, which are defined as incidents, including acts, omissions or circumstances, that interfere or could interfere with the continuity or security of vital services and systems, or the confidentiality, integrity or availability of the critical cyber systems touching upon these vital services and systems. No indication is given as to what would constitute interference under the Act. In the event of a cybersecurity incident, a designated operator must immediately report the incident to the CSE and the appropriate regulator. At present, the Act does not prescribe any timeline or give other indication as to how “immediately” should be interpreted.

Some deficiencies in Bill C-26, as it is presently drafted, can be listed as follows:

The breadth of what the government might order a telecommunications provider to do is not sufficiently bounded.

The secrecy and confidentiality provisions imposed on telecommunications providers threaten to establish a class of secret law and regulations.

There is a potential for excessive information sharing within the federal government and with international partners.

The costs associated with compliance with reforms may endanger the viability of smaller providers.

The vague drafting language means that the full contours of the legislation cannot be assessed.

There exists no recognition of privacy or other charter-protected rights as a counterbalance to the proposed security requirements, nor are appropriate accountability or transparency requirements imposed on the government.

Should these recommendations or ones derived from them not be taken up, the government could be creating legislation that would require the public and telecommunications providers to simply trust that it knows what it is doing and that its actions are in the best interests of everyone.

Is it reaching the right decision to say that no need exists for broader public discussion concerning the kinds of protections that should be in place to protect the cybersecurity of Canada's telecommunications and networks? The government could amend its legislation to ensure its activities conform with Canada's democratic values and norms, as well as transparency and accountability.

If the government is truly focused on security for Canadians, should we not start by reviewing the gang and organized crime evidence showing that our present policies have failed? Should we not look at safety and security in our bail reform to protect innocent Canadians who become victims?

If Bill C-26 is a step in protecting Canada from cybersecurity threats, what is the review process to ensure compliance? What is the review process to ensure effectiveness and goals are met when we look at Bill C-75 regarding bail reform? The NDP-Liberal government is not interested in reviewing bail reform even though the evidence clearly shows that Bill C-75 failed.

Cybersecurity is important to our country's security, as are the victims of crime after their safety and security are violated. I am deeply concerned that the government is struggling with evidence-based information to review Bill C-26, as Bill C-75 and Bill C-5 are not supported by evidence. In fact, offenders and criminals are a higher priority than their victims are. My concern is if Bill C-26 requires amendment or review.

Bill C-26 proposes compliance measures intended to protect cybersecurity in sectors that are deemed vital to Canadian security. Therefore, although late out of the gate, Bill C-26 is a start.

In conclusion, I would like to see some clear accountability to ensure the objectives of this bill are met and that a proper review process is conducted that holds individuals, corporations, and most importantly, our government accountable.

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Mr. Speaker, I salute my colleague from Avalon. It is true I do not have a good batting average. In three leadership races, I have never backed the right horse. However, I am very happy being a member of the Conservative Party of Canada, and it is where I belong. That is part of democracy.

We are straying from the topic. I invite my colleague to ask me a more specific question about Bill C-26, if he has one.

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Mr. Speaker, as the member for Portneuf—Jacques-Cartier, I am pleased to rise today to speak to Bill C-26. I want to say hello to all of the families who are taking advantage of March break to do fun activities in the beautiful riding of Portneuf—Jacques-Cartier.

As I was saying, Bill C‑26 seeks to add the promotion of the security of the Canadian telecommunications system. It also seeks to provide a framework for the protection of the cyber systems that are vital to national security or public safety and create frameworks for the exchange of information.

It goes without saying that these issues are very important to the official opposition, of which I am very proud to be a member. It is no secret that my Conservative Party of Canada colleagues and I are, and always have been, great defenders of public safety. It is part of our DNA.

Industry and experts have asked the government many times to create cybersecurity standards, but it is important to act intelligently.

There is a lot of instability in our modern world, and threats can come from anywhere. Cyber-threats are nothing new. This is not a recent thing. It is clear that this weapon is used as much by foreign governments, which have their own motives, as by individuals or groups seeking to do harm or make money, for God knows what motives. It happens everywhere, on both small and very large scales.

Here are a few examples that illustrate this reality: data stolen from institutions or companies and held for ransom; the leak of personal information that affected millions of Desjardins members or customers in Quebec; and possible election interference from Beijing.

No, we are not going to question the outcome of previous elections here. We do not believe that interference changed the overall outcome of those elections. However, electoral integrity is the foundation of our democracy, and it must be ensured and maintained. As a Canadian, I have the privilege of going abroad, and people recognize that we are concerned about protecting our democracy. We need to put measures in place to continue that.

The fact remains that, over the past eight years, the government has been slow to crack down on cyber-threats. This is yet another example of a foot-dragging government finally coming up with a bill, but it turns out that bill has flaws that call for more thorough study in committee.

I know for a fact that this issue is really important to Canadians. We will do the work to make sure this bill is the one Canadians need and deserve. Yes, people want to be safe. Actually, since I was elected in 2015, my constituents have regularly told me they are increasingly concerned about this issue, especially over the past year.

What it comes down to is that confidence in the government and its ability to provide what people need and to keep its promises is essential. It is hard to have confidence in a government that keeps messing up pretty much everything.

I could go on and on about Bill C-13 as an example of a government that makes promises but does not deliver. The government recognizes the decline of French across the country, even in Quebec, but it is trying to impose a bill that does little to address that decline. I know that that is not the subject today, but everyone knows how much I care about official languages, and I had to pass on the message.

I would like to conclude by sharing a very real situation that occurred in my riding. One of my constituents wrote to me about a serious handling error made by Passport Canada.

I would like to inform the House that this is the first time this situation has been discussed publicly. He sent me a letter, and I would like to read it.

Dear Sir/Madam:

I am taking the time to write you a brief note to let you know about what I would describe as a “serious” security flaw within Passport Canada pertaining to the confidential information of Canadian citizens.

It is very important in terms of a timeline.

In early January, 2023, I applied for passports for my three children at Passport Canada.

On February 1, 2023, I received three envelopes containing our passport applications, which were rejected because we forgot to tick a box.

Inside the envelope I also received the rejected application of a woman from British Columbia. I therefore had in my possession her full identification, her passport and her credit card information. I returned those very sensitive documents by express post with a tracking number to Passport Canada.

I filed a complaint out of principle thinking that, although it was just a mistake, it was still worth reporting through Passport Canada's website, so I followed the official procedure. I got a call back. Passport Canada apologized. Nothing more. They refused to compensate me for the cost of returning the documents belonging to the woman from British Columbia. I was told, however, that our applications would be prioritized.

On February 15, 2023, I received four envelopes. I was quite pleased, as I thought we'd finally received our children's passports, but we have three children, not four. As it turns out, our children's passports weren't inside those envelopes. Instead, there were the passport applications (including full identification, passport, original birth certificates, complete credit card data, etc.) of four people from across Canada. These are four different people who have no connection to one another.

What is not stated in the letter is that these people were from Sherbrooke, Ontario, Manitoba and Alberta. That is incredible.

A few days later, we finally received our three children's passports.

As it is obvious, I don't feel I need to explain in my letter the seriousness of receiving the full identification of these people and information that could be used to carry out fraudulent financial transactions by total strangers.

We can't fathom that such mistakes would be made by a recognized federal organization such as Passport Canada, which manages the personal and financial information of so many Canadians. We can't believe that these are two isolated incidents.

This is a very simple task that requires putting the right documents in the right envelope. That's it.

I no longer trust Passport Canada's administration at all. That is why I am entrusting you with the identity documents, which don't belong to us.

I no longer trust Passport Canada's “internal” complaint process, as it will certainly try to cover up this failure, and will only offer an apology.

I am most pleased to read the following excerpt from the letter:

We trust our MP.

I'm always available to answer any questions.

Yes, cybersecurity matters, but the government also needs to take responsibility for the existing systems. It cannot even handle paper documents, but now it wants to allow a minister to step in and be able to manipulate and control information. I am concerned.

I have shown that we have a problem in Canada. We recognize that. We have a problem when it comes to cybersecurity, but we have a problem on other levels too. I would like to see this government take responsibility.

Like my constituent who gave me the documents mentioned, I had to ask myself, what do I do with these documents now? Do I return them to Passport Canada, or do I give them to the minister responsible here? That is a very important question.

Let us get back to the subject at hand, Bill C-26. I am very interested in having measures in place to protect us. It is important that we have confidence in our systems. As a member of the Conservative Party of Canada, I have a lot of confidence in the Conservative members who sit on the committee, as well as members of the Bloc Québécois, the NDP and even the Liberal Party. Things are normally supposed to be neutral in committee.

I must say that I believe in the future. Having said that, we need to put measures in place to have concrete results. Let us work in committee.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Madam Speaker, it is an honour to rise again in the House to speak to Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. My Conservative colleagues and I, as has been indicated, support this legislation being sent to committee for further study, as it needs a lot of further work and amendments.

For those watching this debate, who have not had time to review the legislation, the bill has two main parts, as has been explained throughout the day. The first part would amend the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.

The second part of the bill would enact the critical cyber systems protection act, which is a new act, that attempts to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are designed to operate as part of a work, undertaking or business that is within the legislative authority of Parliament. Services and systems that would initially be designed and designated as vital are telecommunications systems, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems, banking systems, and clearing and settlement systems. Any additions to this list of vital systems can be made and added to by the Governor in Council.

The critical cyber systems protection act would have several components to it. It would authorize the Governor in Council to designate any service or system as a vital service or vital system; it would authorize the Governor in Council to establish classes of operators in respect of a vital service or vital system; it would require designated operators to, among other things, establish and implement cybersecurity programs, mitigate supply-chain and third-party risks, report cybersecurity incidents and comply with cybersecurity directions; it would provide for the exchange of information between relevant parties; and would authorize the enforcement of the obligations under the act and impose consequences for non-compliance. Those would be significant consequences, I might add.

On its face, it seems that the Liberals have finally awoken after eight years of doing absolutely nothing on this file, yet somehow they hastily scrambled to cobble together a proposition for sweeping changes to a regulatory framework, which this legislation would enact.

The Civil Liberties Association said, “The problems with the Bill lie in the fact that the new and discretionary powers introduced by C-26 are largely unconstrained by safeguards to ensure those powers are used, when necessary, in ways that are proportionate, with due consideration for privacy and other rights. The lack of provisions around accountability and transparency make it all more troubling still.” We understand that a modernization in this field may be required to do so without the caveats of being necessary, proportionate and reasonable to take it one step too far for Canadians to accept.

For support of this argument, the Liberals only need to look at the research report from Citizen Lab, written by Christopher Parsons. The report is called “Cybersecurity Will Not Thrive in Darkness, A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act”. That report provides 30 recommendations that clearly lay out common sense changes and how this legislation could be improved to include transparency or at least apply limitations on the government's authoritarian use of power. For the benefit of the careless drafters and my Liberal colleagues across the way who would happily vote on any flawed legislation their leader tells them to without bothering with independent thought or even reading its criticisms, I will take some time and share the flaws.

Citizen Lab also seems to address what appears to be a recurring theme with the government: a lack of transparency and limitations on the government's authoritarian use of power. It too addresses that, “The minister may, by order, direct a telecommunications service provider to do anything or refrain from doing anything...that is, in the Minister’s opinion, necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.”

That, too, seems a little broad. Amendments need to be applied that include a limitation on the minister's powers, ensuring that actions are necessary, proportionate and reasonable. This government has proven that it cannot be trusted with powers without strict limitations. It is simply unable to self-regulate.

The Canadian Civil Liberties Association and Christopher Parsons agree again on the lack of privacy and broad provisions around information sharing.

The CCLA writes:

Also concerning are the very broad provisions around expanding information sharing with a long list of potential recipients including Ministers of Foreign Affairs and National Defence, the Canadian Security Intelligence Service (CSIS), and also, once an agreement is signed, with provincial governments, foreign governments, or international state organisations, again, at the Minister’s discretion. The Communications Security Establishment (CSE), Canada’s signals intelligence agency is also a key recipient of information.

The Citizen Lab review echoes how the government ought to have included provisions that respect information privacy. To any Canadian listening, this does not sound like too much to ask. Specifically, the Citizen Lab report recommends that “information obtained from telecommunications providers should only be used for cybersecurity and information assurance activities".

It also recommends that “government should explain how it will use information and reveal the domestic agencies to which information is disclosed”. The report says “information obtained for telecommunications providers should only be used for cybersecurity information assurance activities”. It should only be used for “data retention periods”, and that it “should be attached to telecommunications provider's data”. Citizen Lab states that “data retention periods should be attached to foreign disclosures of information”. It also indicates that “telecommunications providers should be informed which foreign parties receive their information”, and “legislation should delimit the conditions wherein a private organization's information can be disclosed”.

Why does the government need to be told that its legislation has these fundamental flaws by outside organizations? Many are asking: Do these Liberals have no shame when it comes to the privacy of Canadians?

The CCLA further points out that, although there is an appeal process through judicial review, when the subject of an order finds it to be unreasonable or ungrounded, it suggests that, under Bill C-26, the government overlooks the basic, fair process that even a national security threat would receive. The Citizen Lab, on the other hand, discusses that the government fails to compensate for government intrusion into small business. Mr. Parsons proposes that the legislation should be amended such that telecommunications providers can seek moderation of “certain orders where implementing them would have a material impact on the provider's economic viability”.

In conclusion, while it is notable that the Liberal government has finally awakened to this topic, the legislation has again missed some pretty traditional marks of Liberal legislation. It leaves citizens at risk of major government overreach. It takes the privacy and information of Canadians for granted. It relies on a system of review that falls short of due process, and it leaves businesses susceptible to bearing the costs of an overbearing government. Lastly, this is typical lazy Liberal legislation.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I suggest that the member ask the member for Carleton, the Leader of the Opposition, to answer that question because I cannot speak for him other than to state that he has put out a very clear, definitive statement condemning the hashtags that were put on some videos, which he knew nothing about. I will leave my comments at that.

The last time I checked, we are debating Bill C-26, legislation that is needed to protect Canadians. It needs to be improved and debated to get it right so we can deal with threats of political interference from foreign states, such as the Communist Chinese government. That is of utmost importance to Canadians.

[Alex Ruff, Conservative, Bruce—Grey—Owen Sound, ON]

Madam Speaker, I will take maybe a different tack today to contribute to this debate on cybersecurity. I am going to tell a story about Tom and how he has been impacted by technological changes over the last couple of decades. Before I tell Tom's story, I have to share Emily's story with technology and why this legislation and changes to cybersecurity in Canada are so important and so needed.

Before I get into that, I think it is important to first lay out in simple terms what this bill is about from my current understanding. There are really two parts to the bill.

The first part is about amending the Telecommunications Act to address and fix the security needed for our Canadian telecommunications system. The bill would do this by addressing it through two means. First, it would “direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.” As well, it would establish some monetary penalties tied to those changes.

The second part of the bill is all tied to the critical cyber systems protection act. It would provide the framework for the protection of our critical cyber systems, which are vital to national security and public safety. It would do that through five different aspects. First, it would authorize the government to designate those services that are vital to Canadians, those critical sorts of services, what they are and what systems are tied to them. Second, it would authorize the government to establish who is responsible for maintaining those systems. Third, it has how these cybersecurity incidents would be reported and how Canadians and institutions comply with those changes. Fourth, it lays out how information would be shared and, arguably, needs to be protected. Finally, it gives the “so what” of the enforcement and the consequences for non-compliance with the legislation.

In reality, this bill is quite lengthy and very technical, so I am going to focus most of my speech around two important aspects of the bill. The first aspect is the threats to cybersecurity. The second is information sharing and the need to protect Canadians' privacy rights while highlighting the important need for transparency. How would the government ensure the accountability of any institution affected by this bill, particularly the government itself, with the additional powers this legislation would grant it?

Let us get back to Emily. She is a senior citizen and a retired teacher. She uses a mix of online banking and billing, although she still prefers to handle the majority of her financial transactions right at the bank. She has a fledging social media presence mainly to stay in contact with her grandchildren and friends. She even has a TikTok account at her grandchildren's urging. We will see if she is going to change her mind and delete that sooner than later.

Being online and connected is essential to all Canadians now, more than ever, as a lot of Canadians rely on the Internet for their daily lives. It is about more than just conducting business and paying bills. As I have mentioned, we have seen an increased dependency on the Internet, especially for government services. In the last few years, under the Liberal government, it continues to shift more and more government services online, while unfortunately decreasing service delivery for those without access to the Internet at the same time. I will not go into detail on all the shortfalls I see with the current approach, considering that a large portion of rural Canada still do not have access to high-speed or dependable Internet.

What threats does Emily face? She complains about getting emails and phone calls from people alleging to be affiliated with her bank or service providers. She wonders about the advertising that shows up on her social media feeds that align with something she only mentioned in an email to a friend. How is all of this happening?

To quote the director of CSIS from December 4, 2018, over four years ago, during a speech that he gave to Bay Street, which I have extracted from Stephanie Carvin's Stand on Guard, Mr. Vigneault stated that the greatest threat to our prosperity and national interest is “foreign influence and espionage.” While terrorism remains the number one threat to public safety, “other national security threats—such as foreign interference, cyber threats, and espionage—pose greater strategic challenges”.

In her book, Professor Carvin clearly lays out the risks associated with cyber-attacks, whether malware, ransomware, a targeting of critical infrastructure, denials of services or others. She talks about cyberterrorism, cyber-espionage and cybercrime, so how do we deal with this?

We deal with this not only through this legislation, but also, mainly for some of the challenges we have, as my colleague from Selkirk—Interlake—Eastman talked about in much greater detail earlier today in his speech, our Canadian Armed Forces, the Communications Security Establishment and even our federal police services, which have ways to deal with this. My colleague hinted that sometimes the best defence is a good offence.

Offensive cyber-operations are really not the bailiwick of this legislation, although I would offer that there is some overlap, as we look at a lot of these threats Canadians and Canadian institutions are facing are financed through cyber-attacks and more here at home. We need to tackle this and get the balance right.

The bottom line is Emily and Canadians like her being affected by all of these cyber risks. Professor Carvin pointed out that at least 10 million Canadians had their data compromised in 2017 alone. Unfortunately, this number is likely under-reported, and neither the government nor the private sector fully understand the scale of the problem. To sum up, the threats are huge.

Bill C-26 must balance privacy rights while ensuring national security. Increased use of encrypted apps, data being stored in the cloud on servers outside of Canada, IP protection and more factor into the challenges of getting this legislation right. In order to deal with these threats, the legislation would need to enable our security establishments with robust, flexible powers. However, these robust powers must come with clear guidance on how far and when to inform the public. This is essential in rebuilding our trust in our democratic institutions.

The Business Council of Canada has already publicly expressed concerns over the current draft of this legislation. It rightly identified that large companies, and also small- and medium-sized enterprises, are concerned that the sheer amount of red tape tied to this bill is extremely high.

We need to get the balance right. It is vital, and it is going to require significant expert testimony at committee. Although I would argue the legislation is desperately needed, and I would argue even late in coming, it needs to be done right and cannot be rushed through debate or review at the committee stage.

I have some final comments. This legislation is needed to protect Canadians. However, this legislation needs to be reviewed regularly and needs to include safeguards. I know if he gets the chance, the member for Winnipeg North might ask about what amendment we are recommending. There is no annual reporting mechanism in this bill, so the government should have to table an annual report to Parliament outlining the progress on this legislation, and include an updated cyber threat assessment to Canadians and what it has been hearing back from the companies impacted by this legislation.

Sean McFate, in this book The New Rules of War: Victory in the Age of Durable Disorder, wrote, “ Secrets and democracy are not compatible.... Democracy thrives in the light of information and transparency.”

Finally, I will conclude with Tom's story and how he has been impacted by technology. The bottom line is that he has not been. He does not have a cell phone. He does not use the Internet. He only pays in cash and does not have a credit card. The only way he is currently being impacted is when he shows up to try to get some federal services from the government. He cannot do it because he does not have any of that, and he cannot get anybody to show up in an office to work.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, today I will be talking about the bill we have been discussing for the past few hours, Bill C‑26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts.

From the outset, I would like to mention that in 2019, when I arrived in the House of Commons, the topic on everyone's lips was the data breach at Desjardins. To put things into context, at the time I was a member of the Standing Committee on Access to Information, Privacy and Ethics. I was determined to find out how we might protect privacy and decorrelate the social insurance number that we were using far too readily as a means of identification. My colleagues see where I am going with this.

It took a scandal for the government to do something about this. Now I am no longer a member of the Standing Committee on Access to Information, Privacy and Ethics, I am vice-chair of the Standing Committee on Procedure and House Affairs. Again, it took a scandal being uncovered by the media for the government to truly listen to us.

This is a case of being lax when it comes to the security of the electoral process and national security. I am addressing all those who are listening to us; I hear their concerns. For the past six months, the Standing Committee on Procedure and House Affairs has been looking into Chinese interference in our electoral process. It is likely that there will be an announcement in the near future that will once again demonstrate that we really need to sound the alarm to get things moving. Of course, the Bloc Québécois will always be vigilant. The Bloc Québécois will be there every time it is important to get to the bottom of various allegations or scandals. We will force the government to take action for our constituents, because they deserve it.

In light of all that, it goes without saying that Bill C‑26 is a step in the right direction. The bill introduced by the Minister of Public Safety aims to strengthen the security of Canada's telecommunications system. That said, I want to be honest. I have serious concerns. Over the past few years, my confidence in the government on security issues has been eroded. The government must not stick its head in the sand. Quebeckers need assurances. They need to be assured that this paternalistic and so-called well-intentioned government is doing its job, particularly in its areas of jurisdiction. That is all we ask and all we expect.

We know that China, Iran and Russia can be considered hostile powers that do not wish us well. When someone does not wish us well, we have to protect ourselves. The government absolutely has to come up with systems to guard against what we have seen since the latest scandals. We demand an explanation, and answers are to be expected, yet the government says everything will be fine and we should move on to other things. Unfortunately, our constituents feel betrayed and lack confidence in this government because it is not taking things seriously, as all the numbers indicate.

Regarding what is going on with Beijing specifically, I wonder if there is something we do not know. Why are we taking action so late in the game? Why are we always reacting? I am fed up with all this dissatisfaction. Every time I go back to my riding, my constituents want to talk to me about this, and I get why they are feeling discouraged.

As members know, I will be going to the United Kingdom. We are going to be taking a look at the procedures in different Commonwealth countries so we can implement other countries' best practices with respect to national defence and protection against interference in our elections.

I know that when having discussions with my colleagues, I am going to have to tell them that the process is ongoing even though the British and the Australians understand the situation and have taken action. The Americans, too, understand and are taking action. I am wondering if our closest allies, our Five Eyes partners, still have confidence in us.

For quite some time, the Bloc Québécois maintained that the government needed to tighten control over broadcasting. That is unequivocal. It was part of the discussion on the Huawei and 5G infrastructure file. We continued to call out the government for its indecision, which went on too long. This proves once again that we were right. However, international pressure from our closest allies was needed to make the government take action.

Everything is always so urgent. Urgency seems to be an imperative that really drives this government. We would like to see the government change its ways and become more proactive rather than reactive. With Bill C-26, I think we finally have a starting point. Obviously, there is a lot of work to be done to go further in terms of accountability, in terms of the legitimacy of disclosure on all sides, so we can prevent situations like the one we are in.

I agree that it is a noble goal. Of course I agree with everything about the security of our critical systems. Do we have everything we need right now to deal with both internal and external threats? The answer is no. That is what we have been told and what we continue hearing, at both the Standing Committee on Procedure and House Affairs and the Standing Committee on Access to Information, Privacy and Ethics. We must act. This bill must be quickly sent to committee to be fine-tuned and given some teeth. It is urgent.

I am making a wish and sending it out to the members of the government. I am asking them to always keep in mind our collective security. I trust that they will. We have faith, but we need to be proactive, smart. We also need to talk to our constituents, to speak to people's intelligence. They have suggestions. The G20 countries have good practices that we need to adopt as quickly as possible. We need to set aside partisanship in the interest of our democracy. We need to ensure that the legislation resulting from Bill C-26 really makes people feel safe and lets them know that there is a public, non-partisan institution there to watch out for threats.

The bill names six public organizations that will be given the power to order investigations to make sure things are being done right. I am talking about the Superintendent of Financial Institutions, the Minister of Industry, the Bank of Canada, the Canadian Nuclear Safety Commission, the Canadian Energy Regulator and the Minister of Transport. These are critical sectors of our society and our economy. We must not take threats lightly. Is this enough? We will need experts to tell us whether this is truly legitimate, both for whistle-blowers and for the dissemination of information, because people need to know.

Since I only have about 30 seconds left, I would like to say to those who were just here that the government took action with regard to TikTok because, once again, there was an urgent need to do so. I hope that any future interventions will be undertaken proactively.

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Madam Speaker, it is a pleasure to rise on behalf of the good people of Central Okanagan—Similkameen—Nicola.

I welcome this debate because essentially what the government has put forward in the bill is two words: “Trust us”. We should trust the government and give it all these powers for the Telecommunications Act, expanding it drastically. We should trust the government when it comes to designating cybersecurity systems as being of such importance that a whole host of new rules should be put upon them. That is what the government is asking us to do.

This is the same government that took years to answer the question of whether we will allow Huawei in our 5G infrastructure. It is a question that has infuriated our allies because they expect Canada to be a trustworthy party in the Five Eyes' intelligence and sharing. It has also infuriated the companies themselves, as many had hoped to utilize the technology. Now, I was against the use of Huawei, but these enterprises are in a competitive venture and will take any particular opportunity to compete and try to lower their prices. However, this government wasted years for that infrastructure to be procured. I believe this also infuriated many Canadians who wanted a simple yes or no on Huawei.

I think the government went through three public safety ministers who said that an answer was coming. Finally, it said no, answering Conservative calls for “no way to Huawei”. However, now it has put forward a bill that would essentially give the power to the government. For example, the government would be able to bring forward an order that could not be reviewed by Parliament. In fact, the Statutory Instruments Act is being exempted from both the telecommunications component in Bill C-26 and the new cybersecurity part, the critical cyber systems protection act.

I am the co-chair of the Standing Joint Committee for the Scrutiny of Regulations, which is a committee tasked by the House and the other place to ensure that when the government creates an order or regulation, it does not exceed the authority granted to it by Parliament. We are able to make sure that when a department or ministry is charged with a delegated authority that it does so justly, and in light of the legislation, that it does not, ultra vires, exceed it.

However, in the legislation before us, the government is effectively saying that it gets to place secret orders that cannot be reviewed by Parliament. Now, members may say that they can go to a justice to be able to have a case heard in court. Again, who can be designated under this proposed bill is an open question. Someone could go in front of a justice, but guess what, Madam Speaker? The government reserves the right to actually make its accusations in a closed-door fashion where a person or company does not have to be there to defend themselves against the evidence that is brought to the court. There, a person or company may be subject to an order that is so secret that it cannot even be said within a closed hearing with an independent judge.

Now, some may say, “Well, so what? It is for national security.” However, we actually do not know. There are so many different organizations that can make powers here. Everyone from the responsible minister to the appropriate regulator, the minister of foreign affairs, the minister of national defence, the chief of the defence staff, the chief or an employee of the Communications Security Establishment, the director or an employee of the Canadian Security Intelligence Service or any other person or entity that is prescribed in the regulations can exert power.

“Trust us”, says the government. The government wants us to give it this power, and it will choose who can use it on whom; Parliament will never know anything about it. Even if a person or company protests, they will not be able to hear the evidence in court as to why they must comply.

Granted, I believe that, within Canada's interests, we should have the ability to work with providers around concerns, but I have great reservations on this. This bill says, “Trust us.” The government says this repeatedly. When we ask questions about foreign interference or share concerns about Huawei, the answer is, “Trust us.” This is not a respectful way to do it.

Let me tell everyone about a respectful way to do these things. Having brought forward a bill, it would perhaps be respectful to bring it to the committee stage first. There is a process where a committee can have hearings on potential legislation before it comes to this place for second reading. This offers the committee the flexibility to begin hearings and mould whether those powers are going to be broadly met in this House. In a minority setting, that would have been ideal.

However, that is the past; the government has brought forward this bill and we are at second reading. What would have been even better is to look at the example of Australia, which decided to hold a number of different inquiries over a period of years. I know the government is very sore around the subject of inquiries these days, but these commissions were set up and asked what information government should have, as well as how and with what kinds of regulations data should be regulated by government. Essentially, it took the approach that someone's personal data is their own, and they should be able to direct it.

Over a series of commissions, some with 800-page reports, they decided on a process for making changes. They would focus on privacy, deciding what the government could keep and could not keep, and they went through that legislative process. Then they said they were going to regulate industry by industry. We should notice that the proposed critical cyber systems protection act casts such a wide net that it could be anything from pipelines to sewage water treatment plants or air transit systems.

We do not know because the government just says to trust it. However, I know, and I am sure others know as well from experience, that every industry uses different technology. Therefore, a one-size-fits-all, big, bossy government, as the member for Carleton would probably call it, does not have the touchpoints or the understanding. All we know is that these orders can be placed on any industry at any time and that those orders will never be looked at by Parliament. To me, the government is asking for too much.

Again going to the Australian model, Australia said it was going to start with data privacy rights in telecommunications, energy systems and banking. It picked the industry that it was going to focus on and made sure it got it right before putting forward the new rules that allowed for a steady process. Instead of a holus-bolus process where everything gets thrown into Bill C-26 with the government telling Canadians, members of Parliament and members of the other place to just trust it, we could have had smart legislation that would be reviewed at committee. Hearings could be held, and we could find out what is reasonable for each industry and what is not. From a privacy standpoint, we could also ask what the government means when it designates someone under this act. Does it mean a person or a company? What are their rights and responsibilities? Unfortunately, this is all on the government side; it decides, saying, “Trust us.”

My colleagues and I will be seeing this bill go to committee. However, I have to protest in this place that this is not the way to make our systems better and provide more trust in our institutions. “Trust us” is not an argument, and the government should know better by now.

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, six years ago Statistics Canada found that more than one-fifth of all Canadian businesses were impacted by cybersecurity incidents, a sobering statistic in its own right. That was six years ago.

What we need to understand is that cyber-technology moves at a mile a minute. What is groundbreaking one year can become ordinary or obsolete even just a year later. I do not doubt that cyber-defence systems in Canada, both by the government and by private businesses, have become much more sophisticated throughout the last several years, but the technology used for cyber-attacks, whether by foreign or by domestic actors, has developed even more quickly.

We are seeing this play out in real time. Just a month ago, Indigo fell victim to a ransomware attack. Online purchases became impossible. In-store purchases could still happen, but only if one was carrying cash. Most alarming of all, information about the chain's employees was accessed. The situation continues to drag on, Canada's largest bookstore chain held for ransom. The emergency that Indigo finds itself in is terrible, but back in January the Russia-tied group that carried out this attack, LockBit, did something far more cruel when it hacked the SickKids Hospital in Toronto.

Those are just two examples of how cyberwarfare transpires in Canada, amongst thousands of other examples every single year. Today, particularly at a time when we know foreign powers are actively seeking to undermine Canada, its institutions and its critical infrastructure, it is time for the government to step in and put forward a cybersecurity strategy. It almost goes without saying that in this digital age, online systems run just about everything that keeps this nation up and running, including hospitals, banking and the energy that heats our homes.

What the government has failed to realize until now is that as these systems become more digitized, so too do they become more vulnerable. This was on full display when SickKids was hacked. Lab results, imaging results and the hospital's phone lines were wiped out for days before order was finally restored. Just in 2020, CRA was hacked, compromising the accounts of 13,000 Canadians. Bold action is what is needed to fight against attacks of that scale, and it is Parliament's job to provide that action.

When I look at a bill like Bill C-26, I start by thinking about what it would let the government do and whether that would be an improvement on our existing cybersecurity regime. In that regard, there is actually a lot to like here. Now more than ever, cyber-attacks can take place in little more than the blink of an eye. An attacker could dig its claws into a company's online system, inflict all the damage it wants, take all the information it wants, and it might be hours later than the affected company realizes what it is being done to it.

Having a rapid response to those incidents is absolutely critical. It is clear to me that the type of broad, sweeping powers contained in this bill would allow the government to provide that rapid response. It would also bring some much-needed cohesion to the link between the state and telecom providers. Right now, telecoms can decide to work with the government and prepare for a cyber-attack, but this is entirely voluntary. They can share information with the government, but only if they really feel like it.

As far as having a unified cybersecurity strategy goes, ours is laughable. It is about time that we act accordingly and fall in line with our Five Eyes allies. This bill covers such an important policy area, yet in so many ways it just does not get it right. It is another page in that long Liberal book entitled, “Having the right intention and making the wrong move”. I should not have to say this in a room full of parliamentarians, but here we are: the written text of a law actually matters.

A law needs to be clear. It needs direction. It needs guardrails. That is why it is so strange to come across a bill that lets a minister go up to a telecom provider and make them “do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.” All the power goes to the minister with nothing in the way of guardrails constraining their power.

When I read this part of the bill, I was reminded of one of my favourite Abraham Lincoln quotes. Abraham Lincoln said, “Nearly all men can stand adversity, but if you want to test a man’s character, give him power.” That is what this section does, it provides immense power to the Minister of Industry, which is not abridged or protected in any way.

There is nothing wrong with a law that gives the government new powers, but in this case, with the cyber-threats that we are currently facing, that type of law is exactly what we need to get right now.

The problem here is that we are debating a bill today where those new powers are not specified and are not restricted whatsoever. Alongside the Canadian Civil Liberties Association, I am seriously concerned about the way that Bill C-26 would infringe on the privacy rights of Canadians.

This bill would allow the government to collect data from telecoms. With guardrails in place, this would actually make a lot of sense. The government might want to see the weak spots in a company's cybersecurity system, for example. With the government being able to get these companies to do anything, we do not have a clue what it will demand to collect.

As it stands now, there is no way of stopping them from collecting personal data and juggling it between various departments. Foreign affairs, defence, CSIS, anyone could take a look if the state decides that it is relevant.

At the minister's discretion, the data could even go to foreign governments. Again, this all comes back to the problem of unchecked power. With zero restraints in place, we can only assume the worst. Like so many bills under the Liberal government, what we are seeing here is a government-knows-best approach.

I am really not sure how it can defend this level of information sharing. “Well, yes, we could share one's personal information, but we definitely will not do that.”

It wants Canadians to give it the benefit of the doubt. The government is well past the point of being given the benefit of the doubt.

The Canadian Civil Liberties Association says that the bill is “deeply problematic and needs fixing”, because “it risks undermining our privacy rights, and the principles of accountable governance and judicial due process”.

A number of organizations and individuals have raised red flags. The Business Council of Canada wrote to the Minister of Public Safety, expressing the business community's concerns about Bill C-26, including the potential of brain drain, as the result of personal liability and unduly high monetary and criminal penalties.

The council also expressed concerns that information sharing is one-way. Operators are required to provide information to government but receive nothing back from government.

The bill misses the opportunity to implement an information-sharing regime that could benefit all operators subject to the law.

Aaron Shull, managing director of the Centre for International Governance Innovation said that Ottawa should deploy a wide range of strategies, including tax breaks to individual small businesses, to take cybersecurity more seriously.

The Munk School issued a report on Bill C-26 where they itemized a series of deficiencies including that “the breadth of what the government might order a telecommunications provider to do is not sufficiently bounded.”

There are massive, glaring issues in Bill C-26.

What is so unfortunate about this is that I think that enhancing Canada's cybersecurity is something that all parties can get behind. I am willing to see this bill move forward but it is going to need some major amendments in committee, amendments that protect civil liberties and constrain abuse.

There needs to be a threshold test, providing that an order being given by the government is proportionate, reasonable and, above all else, necessary. The minister should have to table reports, annually perhaps. How many orders did they issue in a given year? What kinds of orders, broadly speaking?

If the government mishandles someone's personal information, which it likely will, this bill needs to make it clear that those people will be compensated.

We find ourselves debating another highly important, poorly crafted bill, courtesy of the Liberal government.

I want to see this bill go to committee so that experts, especially those with a focus on civil liberties, can help make this bill work.

To be clear, if the issues in this bill concerning privacy and impacts to businesses are not addressed, the Conservative Party is ready to pull its support immediately and put up a very strong defence to stop this bill from going beyond committee.

After all, if the Liberals cannot manage Canada's cybersecurity, they can just get out of the way and let Conservatives handle it.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Madam Speaker, it is with great pleasure that I rise to discuss Bill C-26, an act respecting cybersecurity. I will be addressing elements of the legislation that deal with securing Canada's telecommunications system.

As Canadians rely more and more on digital communication, it is critical that our telecommunications system is secure. Let me assure the House that the Government of Canada takes the security of that system seriously. That is why we conducted a review of 5G technology and the associated security and economic considerations. It is clear that 5G technology holds lots of promise for Canadians: advanced telemedicine, connected and autonomous vehicles, smart cities, clean energy, precision agriculture, smart mining, and lots more.

However, our security review also made it clear that 5G technology will introduce new security concerns that malicious actors could exploit. Hostile actors have long sought and will continue to seek to exploit vulnerabilities in our telecommunications system. The Canadian Security Intelligence Service recognized this in its most recent public annual report. The report said, “Canada remains a target for malicious cyber-enabled espionage, sabotage, foreign influence, and terrorism related activities, which pose significant threats to Canada’s national security, its interests and its economic stability.”

The report said that cyber-actors conduct malicious activities to advance their political, economic, military, security and ideological interests. These actors seek to compromise government and private sector computer systems by manipulating their users or exploiting security vulnerabilities. The CSIS report also highlighted the increasing cyber-threat that ransomware poses.

The Communications Security Establishment has similarly raised concerns about threats like ransomware in recent public threat assessments. We have seen how such attacks by criminal actors threaten to publish victims' data or block access to it unless a ransom is paid. It is not just cybercriminals doing this. CSIS has warned that state actors are increasingly using these tactics, often through proxies, to advance their objectives and evade attribution.

To be sure, Canadians, industry and government have worked hard to this point to defend our telecom system, but we must always be alert and always be guarding against the next attacks. This has become more important as people are now often working remotely from home office environments, and the challenges are accentuated by the 5G technology. In 5G systems, sensitive functions will become increasingly decentralized to be able to be faster where speed is needed. We all recognize cell towers in our communities and along our highways, and 5G networks will add a multitude of smaller access points in order to increase speeds. The devices the 5G network will connect to will also grow exponentially. Given the greater interconnectedness and interdependence of 5G networks, a breach in this environment could have a more significant impact on the safety of Canadians than with the older technology. Bad actors could have more of an impact on our critical infrastructure than before.

The security review we conducted found that, for Canada to reap the benefits of 5G, the government needs to be properly equipped to promote the security of the telecommunications system. We need to be able to adapt to the changing technology and the threat environment.

Now, for these reasons, we are proposing amendments to the Telecommunications Act. The amendments would ensure that the security of our telecommunications system remains an overriding objective. This bill would add to the list of objectives set out in section 7 of the Telecommunications Act. It would add the words “to promote the security of the Canadian telecommunications system.” It is important to have these words specified in law. It would mean that the government would be able to exercise its power under the legislation for the purposes of securing Canada's telecommunications system.

The amendments also include authorities to prohibit Canadian telecommunication service providers from providing and using products and services from high-risk suppliers in 5G and 4G networks if deemed necessary after consultation with the telecommunications providers and other stakeholders. They would also give the government the authority to require telecommunications service providers to take any other actions to promote the security of the telecom networks, upon which all critical infrastructures depend.

We have listened to our security experts, Canadians and our allies, and we are following the right path. We will ensure that our networks and our economy are kept secure. A safe and secure cyberspace is important for Canadian competitiveness, economic stability and long-term prosperity.

It is clear that the telecommunications infrastructure has become increasingly essential, and it must be secure and resilient. Telecommunications present an economic opportunity, one that grows our economy and creates jobs.

The amendments to the Telecommunications Act accompany the proposed critical cyber systems protection act. This bill will improve designated organizations' ability to prepare, prevent, respond to and recover from all types of cyber incidents, including ransomware. It will designate telecommunications as a vital service.

Together, this legislative package will strengthen our ability to defend telecommunications and other critical sectors, such as finance, energy and transportation, that Canadians rely on every single day.

The legislation before us today fits with the Government of Canada's telecommunications reliability agenda. Under this agenda, we intend to promote robust networks and systems, strengthen accountability and coordinated planning and preparedness.

Canadians depend on telecommunications services in all aspects of their lives, and the security and reliability of the network has never been more crucial. They are fundamental to the safety, prosperity and well-being of Canadians.

We will work tirelessly to keep Canadians safe and able to communicate securely. This legislation is an important tool to enable us to do that.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Madam Speaker, I am proud to rise in the House today to speak to this important legislation on behalf of the good people of Barrie—Springwater—Oro-Medonte. I am pleased to see Bill C-26 come forward in the House. Improving the resiliency of our critical infrastructure is of the utmost importance to our national security and the everyday safety of Canadians.

This legislation consists of two separate parts. The first portion, among other things, would give the Governor in Council powers to order telecommunications providers to secure their systems against threats and to remove malicious actors from our telecommunications infrastructure. The second portion would create the critical cyber systems protection act, which would establish a cybersecurity compliance framework for federally regulated critical infrastructure operators. This would specifically regulate the sectors of finance, telecommunications, energy and transportation.

I believe that in principle, this legislation appears promising. I think we can all agree that we need a robust cybersecurity framework in Canada. However, it is worth noting that under the current government, we have done the least to bolster our resilience to cyber-attacks compared to all other Five Eyes partners. We lag behind our western allies in national security, and as such, Canada has failed to secure our critical infrastructure against complex and ever-evolving cyber-threats in the modern world. Therefore, before I get into the specific merits and deficiencies of this legislation, I want to speak about the emerging threats to our critical infrastructure and the pressing need to protect our national security.

Threats to our critical infrastructure are real and imminent. In fact, Caroline Xavier, chief of the Communications Security Establishment, or CSE, recently testified before the public safety and national security committee and stated, “cybercrime is the most prevalent and most pervasive threat to Canadians and Canadian businesses.” She also noted, “Critical infrastructure operators and large enterprises are some of the most lucrative targets.”

While there are several forms of cyber-attacks that our critical infrastructure operators are vulnerable to, the Canadian Centre for Cyber Security has noted in its most recent annual national cyber-threat assessment that ransomware is the most disruptive form of cybercrime facing Canadians and that critical infrastructure operators are more likely to pay ransoms to cybercriminals to avoid disruption. For example, in 2018, cybercriminals deployed a malicious software and successfully held the city hall of a municipal government in Ontario hostage, which resulted in that government paying $35,000 to the hackers to avoid disruption. However, this is not always an effective strategy. A survey of Canadian businesses found that only 42% of organizations that paid ransoms to cybercriminals had their data completely restored.

In 2021, the CSE stated that it was informed of 304 ransomware incidents against Canadian victims, with over half of them in critical infrastructure. However, it acknowledged that cyber-incidents are significantly under-reported, and the true number of victims is much higher.

The enormous economic toll that these cyber-breaches have on Canadian companies is worth noting. According to IBM, in 2022, the average cost of a data breach, which includes but is not limited to ransomware, to Canadian firms was $7 million. There is currently no framework to ensure that companies report when they are victims of these attacks. I will acknowledge that the legislation before us takes steps to address this pervasive issue that Canadians are facing; however, it is certainly an overdue effort.

We saw the damage a cyber-attack of this magnitude can cause in May 2021, when a U.S. energy company was subject to a ransomware attack carried out by a Russian-based criminal group that successfully extorted roughly $4.3 million in coin-based currency. As members may remember, this attack disrupted the largest fuel line in the U.S. for five days and led to President Biden calling a national state of emergency. In 2021, at the U.S. Senate committee on homeland security, the CEO of that company testified that he had no emergency preparedness plan in place that specifically mentioned “ransom or action to ransom”. This incident underscores the fact that we as a country must enhance preparedness and improve the resiliency of our critical infrastructure in order to avoid similar incidents.

Therefore, I am pleased to see this proposed legislation come forward. However, it is worth noting that this is the first substantive legislative response to this issue during the government’s tenure, despite a steady increase in cyber-threats over the years.

The entirety of our federally regulated critical infrastructure is connected to the Internet in some way, and it is extremely important to prevent malicious actors from setting up on our infrastructure and attacking it. Previously, there has been no mechanism for the government to formally remove a company from our telecommunications networks.

The clearest example of the need for this mechanism would be the controversy surrounding Huawei, a company that was part of the design of our 5G networks despite glaring national security concerns related to its activities and relationship to the Communist Party in Beijing. It is a significant move that this company will be kicked off our servers, but it is a delayed one. We know that under China's national intelligence law, the CCP has the authority to instruct any company to hand over information to support, assist and co-operate with state intelligence work. Accordingly, we ought to be cautious and avoid contracting with companies that could potentially compromise the security of our critical infrastructure.

It is certainly positive that Canada will be able to kick malicious actors such as Huawei off our networks. However, many have noted that we lessened our credibility among the Five Eyes nations due to our delayed response to this issue. Indeed, the United States lobbied Canada for years to exclude Huawei from our 5G mobile networks and warned that it would reconsider intelligence sharing with any countries that use Huawei equipment.

In some respects, this legislation is a positive step toward establishing a baseline standard of care for organizations whose functions are integral to our critical infrastructure. As I have previously mentioned, incidents of cyber-attacks often go unreported or under-reported. This legislation's mandatory reporting mechanism, which specifies that a designated operator must immediately report an incident to the CSE and the appropriate regulator, is a welcome step toward addressing this issue. However, the act does not prescribe any timeline or give any other information as to how “immediately” should be interpreted by an operator.

As I have just laid out, there are aspects of this legislation that my Conservative colleagues and I fully support. However, I have concerns with several elements of the bill.

First and foremost, there is a complete lack of oversight over the sweeping new powers afforded to the cabinet ministers, regulators and government agencies mentioned in this legislation. Alongside a lack of oversight, there is little information on the breadth of what the government might order a telecommunications operator to do.

It is evident that this bill draws on much of Australia's legislative model, which was first introduced in 2018 and eventually amended. However, we did not follow suit in terms of the oversight measures Australia included in its critical infrastructure protection act. Notably, Australia introduced political accountability mechanisms alongside its legislation, including a requirement for regular reporting, an independent review and the production of a written report. The Conservatives would like to see annual reporting from the minister on what actions have been taken and a public disclosure of the orders that the government is making under these newly afforded powers.

In terms of concerns from the public, we have heard from a number of organizations that are concerned that elements of this legislation undermine the privacy rights of Canadians. In September of last year, several privacy rights organizations signed an open letter to the Minister of Public Safety, which laid out their concerns with Bill C-26. For example, they were concerned about the sweeping new powers this legislation would give to the government over access to the personal data of Canadians and the data of companies. They noted that Bill C-26 “may enable the government to obtain identifiable and de-identified personal information and subsequently distribute it to domestic, and perhaps foreign, organizations.”

I think we can all agree that while enacting measures to improve the resilience of our critical infrastructure is of the utmost importance, civil liberties and privacy must be fully respected when drafting those measures. On the other hand, we have heard from stakeholders who are concerned about the regulatory burden this legislation may have on businesses, especially small and medium enterprises.

Many stakeholders have noted that the high costs and business impacts of a cyber-incident already incentivize companies to ensure rigorous cybersecurity protocols. Recent statistics released by Statistics Canada found that in 2021, Canadian businesses spent over $10 billion on cybersecurity, a 41% increase compared to 2019. Many stakeholders have noted that the proposed penalties related to this act, which reach up to $15 million and five years of jail time, are touted as being intended to promote compliance rather than to punish. However, I think we can all agree that a $15-million fine would indeed be unduly punitive on a small business that may be subject to this act. Therefore, we must ensure that fines and compliance costs are distributed evenly so as not to stifle competition and endanger the viability of small and medium enterprises in our critical infrastructure sectors.

Finally, we face a problem related to definitions and the scope of this bill. Various terms are not defined, including what constitutes a cyber-incident, and it is not immediately clear how the government will determine who is subject to this legislation. I look forward to receiving an explanation from the government to demystify some of the vague language found within it.

To conclude, a threat to our critical infrastructure is a threat to our national security. I think all parties agree that the government must take strong and immediate action against cyber-attacks. We support this bill in principle, but we believe that it needs to be amended significantly to ensure greater transparency and accountability from the government and future governments. I look forward to studying and amending this bill at the public safety committee with my colleagues across all parties.

[Don Davies, NDP, Vancouver Kingsway, BC]

Madam Speaker, I think everybody in the House agrees that we need to up our game in this country to protect Canadians and our society from cyber-attacks.

My specific question has to do with certain specific vulnerable groups. I am thinking of young people, particularly teenagers between the ages, say, of 13 and 19. Even more particularly I am thinking of young girls and women who may be subject to all sorts of cyber-bullying and other offences, as well as seniors who can be victims of cyber-fraud.

I am wondering if my hon. colleague has any thoughts as to how Bill C-26 might impact those particularly vulnerable groups and what suggestions he may have legislatively to help protect them.

[Kyle Seeback, Conservative, Dufferin—Caledon, ON]

Madam Speaker, it took eight long years for the Liberal government to recognize that cybersecurity threats exist in this country and around the world. Congratulations to them for coming to the party a little late.

The Liberals have now presented a bill to try to address issues of cybersecurity in the country. As I said, it took them eight years to get there, but I have to say I am pleased that the Liberals have decided to finally do something. I look forward to this bill being passed so that it can be extensively studied at committee.

There are some things in this bill that are good. I know praising the Liberal government is strange territory for me, but I will say that the bill would give the government some tools to respond quickly to cyber-threats. There is currently no explicit legislative authority in the Telecommunications Act to ensure that telecom providers are suitably prepared for cyber-attacks. This is a good reason why this bill should probably move forward to committee to be studied.

The challenge I have, though, includes a whole number of things. My issue with the government is trust. While I do want this legislation to go to committee, I have extraordinary concerns about this bill. Many of these concerns have been raised by many groups across the country, and I do want to speak to some of those in the probably somewhat whimsical hope that the government will listen and take some of these amendments seriously.

There has been a very bad track record of the government responding to concerns from the opposition or from outside organizations with respect to legislation. There is a view that the Liberals are going to do what they want to do on pieces of legislation and that they really do not care what other people have to say. I am very concerned that the government is not going to listen to the very serious concerns that have been raised about this bill.

I have my own concerns when I look at how the government has behaved with respect to other pieces of legislation. We have to look at Bill C-11. There has been a multitude of organizations that have said the bill needs further amendment. Margaret Atwood has said that she has grave concerns about the legislation, that she supports the intent but has grave concerns about the implementation and how it is going to affect artists and content creators. We have had folks who compete in the YouTube sphere who have raised all kinds of concerns about Bill C-11, and the government's response has been that it does not care what they have to say, and that it is going forward with the legislation as it is.

The Senate has made a number of amendments to Bill C-11. I suspect the government's attitude is going to be the same, which is that it does not care what the amendments are and that it is going to proceed with the bill as it sees fit.

We also have only to look to Bill C-21 as well. We had the minister clearly not aware of what constituted a hunting rifle and a hunting gun. The Liberals introduced amendments at committee, and it took extraordinary push-back from Canadians from coast to coast to coast to get them to wake up and withdraw those amendments that they had put in at the last minute.

What it speaks to is that, despite having at its disposal the entire apparatus of the Canadian government, the Liberals are still unable to get legislation right. It takes an enormous amount of effort and hue and cry across the country saying that this has to stop and that this has to be changed. If there is not a massive uprising, the government tends not to listen to the legitimate concerns of other constituents or other groups when it introduces legislation.

With that context, it is why I have real concerns that the government is not going to listen to some of the serious concerns that have been raised with respect to Bill C-26. I am going to go through some of those.

The Canadian Civil Liberties Association has some very serious concerns. It has issued a joint letter that says that the bill is deeply problematic and needs fixing, because it risks undermining our privacy rights and the principles of accountable governance and judicial due process. This is a big bell that is going off, and I hope the government is listening. As I have said, I do not have a lot of faith, given other pieces of legislation where thoughtful amendments have been put forward and the government decided not to do anything with them.

I want to enumerate a few of the concerns from the Canadian Civil Liberties Association. On increased surveillance, it says that the bill would allow the federal government “to secretly order telecom providers” to “do anything or refrain from doing anything necessary...to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption”.

That is a pretty broad power. Where is the government putting the guardrails in that would limit the effects of this or protect the privacy rights of Canadians? That is something I think is incredibly concerning.

On the termination of essential services, Bill C-26 would allow the government to bar a person or a company from being able to receive specific services and bar any company from offering these services to others by secret government order.

Where are we going to have the checks and safety checks on this? Unfortunately, I am not in a position where I think I can trust the government to do the right thing on these things. We have seen it through vaccine mandates, in the legislation on Bill C-21 and in how the Liberals are trying to push through Bill C-11 without listening to reasoned amendments. If reasonable concerns are raised about Bill C-26, I just do not have faith the Liberals are going to take those concerns seriously and make the amendments that are necessary. I really hope they do.

On undermining privacy, the bill would provide for the collection of data from designated operators, which would potentially allow the government to obtain identifiable and de-identified personal information and subsequently distribute it to domestic, and perhaps foreign, organizations. When someone takes the de-identified personal information of Canadians and does not say how they are going to deal with it or what protections they have in place to make sure it is not misused, what happens in the event that they take that information and somehow there is a government breach? Where does that information go? These are things I think we should be extraordinarily concerned about.

There was also an analysis provided with respect to this by Christopher Parsons, in a report subtitled “A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act”. Parsons raises concerns about vague language. The report notes that key terms in the bill, such as “interference”, “manipulation” and “disruption”, which trigger the government's ability to make orders binding on telecom service providers, are unidentified.

Where are the guardrails in the legislation to prevent government overreach and therefore protect Canadians? This is something that I think all Canadians should be watching and be very concerned about. They should be letting their voices be heard by the government on this.

The report talks about how the minister of industry's scope of power to make orders is also undefined. We would be giving a whole host of undefined powers to the minister and the government that would allow them to have all kinds of sensitive information. These are things that may be necessary, but I do not know. They are highly concerning to me. They should be highly concerning to Canadians, and I hope the government will hear from real experts at committee.

Let us not have a two-day committee study where we think Bill C-26 is perfect as it is and bring it back to the House of Commons, bring in time allocation or closure and pass it through. We have seen that story before, and we do not want to see it with the piece of legislation before us. My really big hope is that the government is going to take the time to really consider the seriousness and breadth of Bill C-26 and make sure we have the ways to protect Canadians.

I just want to add that the Business Council of Canada has released its own letter to the Minister of Public Safety, expressing its incredibly deep concerns with respect to the bill: there is a lack of a risk-based approach, information sharing is one-way and the legal threshold for issuing directions is too low.

There are three reports, right there, that are outlining significant concerns with Bill C-26, and I, for one, just do not believe the government is going to listen or get it right. It does not have the track record of doing so, but I am hoping it will, because cybersecurity is incredibly serious as we move toward a digital economy in so many ways. I really hope the government is going to listen to these things, take them seriously, do the hard work at committee and bring forward whatever amendments need to be brought forward, or, if the amendments are brought forward by the opposition, listen to and implement those amendments.

The House resumed consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, it is an honour, as it always is, to rise in the House of Commons of the Canadian people and speak to Bill C-26, an act respecting cybersecurity, which seeks to amend the Telecommunications Act and make subsequent amendments to others acts.

I want to say from the outset that cybersecurity is a critically important issue. For those of us who have been watching the news, we have even seen bookstores like Indigo impacted by ransomware, and we know that no Canadian, business or government agency is immune to cybersecurity threats. As Conservatives, we obviously support taking robust action on cybersecurity and we look forward to the bill going to committee, where we can hear from stakeholders who have expressed uncertainty about what the impact of the bill is going to be. Certainly, I hope we can work across lines to make a better piece of legislation and address the very real challenges we are facing in this cybersecurity age, in this cyber age that we are facing.

I am going to go into a bit of background on the bill, because my constituents might not have heard of this legislation. For their benefit, I am going to give a bit of summary of what I understand the changes to be.

The threat of malware in our telecommunications sector and critical infrastructure does pose a serious threat to Canada. It is important that we respond to these threats proactively, in light of the inevitable future attacks that will happen in our cyberspace. As I said, Conservatives will support legislation to defend our telecommunications sector and our other critical infrastructure from threats, the likes of which, as I stated earlier, have been levied against Canadian individuals, corporations and government agencies repeatedly.

In order to evaluate this legislation, I would like to take some time to consider how the proposed bill might impact our economy, our national security and our commitment to protecting the civil rights of Canadians. Although legislation relating to cybersecurity threats is now long overdue, we should remain vigilant to protect the rights of Canadians and our domestic corporate actors, who could be seriously impacted by the unintended consequences of this legislation. Notably, I am somewhat concerned by the sweeping discretionary powers that are granted to the minister and the Governor in Council in this legislation. I would also like to talk about some of the objectives of the bill and then describe how this current proposed legislation could fail in achieving its intended purpose.

The bill is presented in two parts. The first would amend the Telecommunications Act to promote the security of the Canadian telecommunications sector, and the second part of the act would enact the critical cyber systems protection act. The amendments to the Telecommunications Act are intended to protect against ongoing threats of malware, which poses a threat to the Canadian telecommunications system, and the critical cyber systems protection act aims to strengthen the cybersecurity systems that are so vital to our national security and public safety, and it would allow the government to respond to these cyber-threats.

The aim of this legislation would implicate operators in a broad variety of fields, including the finance, telecommunications, energy and transportation sectors, just to name a few, all critical parts of our infrastructure. With these aims in mind, it is important to consider how expansive the government powers being talked about here are, new powers to the government, how these new powers will affect all these sectors that affect our day-to-day lives, and whether these new measures are proportionate and necessary to be implemented.

To begin, the powers afforded to the minister present economic and financial risk for critical systems operators and telecommunication system providers. The first consideration is the minister's ability to direct telecommunication service providers to comply with an order to prohibit a provider from using or providing certain products or services to a specific individual or entity. Those are pretty broad powers. The bill would implicate the operations of private telecommunications organizations, and therefore the legislation requires safeguards to protect the economic viability of these companies. The bill would also allow the minister to compel telecommunications companies to obey government directives or face the consequences of significant monetary penalties.

In giving the minister such expansive powers, the government may have failed to consider the potential economic impact of these unchecked provisions on service provisions. Telecommunications revenues contribute over $50 billion to Canada's GDP, yet the government has not provided clear and adequate safeguards in this legislation to limit the extent to which or the frequency with which it might use these service provisions and how they might be restricted under the instance of even a minor cyber-threat.

Large, medium and small regional market players would be impacted by this legislation if appropriate safeguards are not adopted in the amendment stage. Large telecommunications service providers make up about 90% of the market share, and any directive to suspend a service by these large market players could impact a significant amount of the Canadian population. Although we hope that such orders will seldom be issued, the vagueness of the language in the bill does not guarantee this.

Meanwhile, we see small and medium-sized players who disproportionately service under-serviced areas in Canada; I am thinking of rural and remote communities. These small and medium-sized players often have trouble dealing with the regulatory complexity and the financial investments needed to meet regulatory thresholds, and we could see these small and medium-sized players just fold up or get bought out at a fraction of what their value would have been. We would really see this as a consequence for rural and remote communities, which are struggling, even today, to get access to basic services like high-speed Internet.

For these reasons, the overbroad provisions in the bill do not lend themselves to a standard of proportionality.

A stakeholder group, Citizen Lab, released a research report on Bill C-26 from the Munk School, authored by Dr. Christopher Parsons. The report outlines, in its recommendations, that the legislation should be amended to allow telecommunications service providers to obtain forbearance and/or compensation for orders that would have “a deleterious effect on a telecommunications provider’s economic viability”.

The Business Council of Canada is likewise concerned about the CCSPA requiring that all critical systems operators undertake the same precautionary actions to protect themselves from cyber-threats. The Business Council of Canada notes that the legislation would require a singular standard of all service providers “irrespective of their cyber security maturity”. We know that there are highly funded firms with a lot of resources that have highly superior cybersecurity systems, and then we have our more infant, junior tech companies that are trying to grow so that they can attract capital. These regulatory requirements of holding them to the same standard could have a negative effect on growing the tech ecosystem here in Canada.

Moreover, the Business Council of Canada notes that the legal threshold for issuing the directives is too low. The low threshold to issue these orders to an operator would allow the possibility of lost revenue for operators because of an absence of due diligence on the part of the government, a government that has had its own cybersecurity problems. I have serious reservations that a government that is unable to run its own IT systems will have a better capability of telling private companies how to run their IT systems.

The council further notes that the monetary penalties are unduly high and are not proportionate, given the benefits of compliance in the event of a perceived or actual cyber-threat. These companies in Canada want to live by the rules. They want to work with the Canadian government. Their reputations are at stake, yet the government is treating them like they are bad actors by putting these fines in place, when maybe we should be looking at working and engaging more with our telecom sector to have a more friendly relationship on this issue.

Another group, Norton Rose Fulbright, noted that there is still considerable uncertainty as to how detailed the cybersecurity plans must be and how it would alter industries' existing policies and agreements. Clearly, there is a lot of uncertainty about this, but it is too important to let it go aside, so I am looking forward to this coming to committee, where we can have some of these stakeholder witnesses come and talk about things so that we can clear up the uncertainty and we can have targeted cybersecurity measures that actually result in benefits to Canadians.

Other technical experts, academics and civil liberties groups have serious concerns about the size, scope and lack of oversight around the powers that the government would gain under this bill. Civil liberties groups are particularly concerned about the government's ability to direct telecommunications providers to do anything needed by secret order. While the legislation lists what might be included by the minister or Governor in Council, the ambiguity of the wording leaves open the possibility of compelling a telecommunications company to do more than is officially stated. This is particularly noteworthy because of the significant monetary penalties that can be levied against these companies, to the tune of up to $10 million a day.

Liberals, in many cases, have perhaps neglected to consider the privacy of Canadians through this legislation.

Bill C-26 would allow the government to bar any person or company from receiving specific services, which raises concerns about the discretion the government has in making these decisions. Again, it is very unclear. This is too important. We should bring the bill to committee and vote on it, but there are lot of things we need to get right in the legislation. We look forward to looking at that.

[Ted Falk, Conservative, Provencher, MB]

Madam Speaker, it is my pleasure to rise in the House today to share my thoughts and those of my constituents on Bill C-26. I am very pleased to have this opportunity.

Bill C-26 is a risky and tricky piece of legislation. On the one hand, we have serious and growing issues of cybersecurity, and on the other hand, we have the importance of personal privacy. We also have questions related to government accountability and oversight. I am sorry to say that the government has not done a stellar job on either one of those fronts to date. I am hopeful that members of this House can work together collaboratively to craft a piece of legislation around what has been proposed in Bill C-26 that balances both of those vital yet often competing priorities.

I grew up in the 1960s under the spectre of the Cold War. When I was a kid, the threat of foreign attack came from the air above us, from nuclear missiles from Russia or China. While our adversaries remain the same and current events have sadly brought the spectre of nuclear disaster to the forefront again, the method of attack to which we are most susceptible today is far more sophisticated and far more insidious.

Rather than bombs from the air above us, the weapons of our enemies are in the air all around us: Men and women are sitting at computers in dark rooms, in government agencies or at the local library sending out digital viruses. These cancers attack the Internet, telecommunication waves and the platforms we have become reliant on to what I would consider to be an unhealthy degree.

That is where I will pause for a moment, because I think the best thing we can do, the first step to securing our national security and the well-being of Canadians, is what nobody wants to do, which is to take a little step backwards to take a look at this. We need to divest ourselves of our all-consuming reliance on digital platforms, devices and infrastructure, and ensure that our most vital infrastructure always has a physical fail-safe to fall back on.

Let me give an example. Let us talk about digital currency for a second. Digital currency exists. Most Canadians have a credit card, a debit card and online banking. I do and I use them; it is convenient. However, that is not to say for a minute that I think progress demands that we do away with hard currency. It is exactly the opposite. Canadians have become more reliant on digital currency, forms of digital ID, smart phones, smart cars, smart homes, smart cities, smart bombs, smart banking and smart hospitals, and the really smart thing to do is ensure that we always maintain physical infrastructure and ensure we are in control and not crippled by the worst that could happen.

Nothing is impenetrable. No matter how good or amazing the technology that we create is, no device, no platform and no code has been created that cannot be hacked. Anything people make, people can break, and if they cannot, they will develop a machine that can break it.

I was reminded of a story last week of a military computer virus called Stuxnet. Stuxnet single-handedly destroyed one-fifth of Iran's nuclear centrifuges. Actually, that is not totally correct. The worm that Stuxnet was caused these sophisticated machines to self-destruct. It got into their systems, learned how they operated and then caused the powerful turbines to spin in reverse, shredding the machines. We have artificial intelligence so advanced that it can make decisions, and the people who created the technology do not even know how the decisions came about. It cannot even tell them. It is a little scary.

Digitized records are important. We have all come to rely on them, but I believe keeping a hard copy is also important. Ensuring that we maintain a hard physical currency is very important too, as is recognizing the value of currency produced by the Royal Canadian Mint. We need to ensure that our power grid still has a physical switch and that our hospitals and banking systems cannot be crippled by a bright kid with a laptop or a foreign actor with a more malicious intent.

The government has been very slow to address cyber-threats. Under its watch, the CRA was hacked. It said 5,000 accounts were affected, yet that number turned out to be 50,000. It did not address the issue. There were lots of excuses from the minister, but what really happened? One year later it happened again, and another 10,000 Canadians had their personal data accessed by hackers. Last year, the National Research Council was hacked.

I am sure that after this past week, the government is tired of talking about foreign interference in our elections, so I will not belabour that point, except to say that we did have foreign interference in our elections. The Prime Minister knew about it and he did nothing. Worse than that, he still refuses to tell Canadians the truth about what he knew and when he knew it. Like everything else, he refuses to take responsibility. I wonder sometimes just how much longer those on the government benches will allow him to do so. I would bet that right now the Reform Act is looking pretty attractive to them.

Last year, Rogers' network went down suddenly. Canadians could not access their banking. Businesses could not function. Emergency services were affected. Rogers and the government said it was a glitch, a hack. We will probably never know for sure, but the effect was the same: chaos. That is what our enemies want, and we do have enemies, both foreign and domestic, people who want to see anarchy and to cause chaos, fear and division. It sounds eerily familiar.

What legislative response have we seen from the government to date? I am seriously asking, because when I think back over the past seven years that the Liberals have been in power, I am not aware of any substantive action, either proactive or reactive, that they have taken to address our cybersecurity and the glaring vulnerabilities that exist with respect to it. To that end, I am glad that we are now finally having this important discussion. We need to beef up our security systems, beef up our cybersecurity system and keep Canadians safe.

As the government always says, Canadians have a right to be safe and to feel safe. The obvious irony is that it only says it when it is clear that Canadians are neither safe nor feeling safe. Canadians should be able to feel safe, should be safe and should have confidence in the cybersecurity system they rely on.

My time is almost gone, and that is a shame because there are so many things we need to talk about with respect to this bill, although I am confident that my colleagues will be able to further articulate some of the concerns. However, I do want to say one word about privacy.

Many Canadians are concerned about the ever-increasing size, scope and reach of government in this country. The Prime Minister has increased the size of government by some 30%, and this bill gives such sweeping powers to the government that it has prompted numerous civil liberties groups, including the Canadian Civil Liberties Association, the International Civil Liberties Monitoring Group and the Privacy and Access Council of Canada, in addition to several other groups and academics, to express their very serious concerns about this legislation. They call it “deeply problematic” because it “risks undermining [the] privacy rights [of Canadians], and the principles of accountable governance and judicial due process”. That is a lot to unpack in just one sentence.

Had this legislation come forward three years ago, I would have probably said that it was a no-brainer and that we should get it done as national security trumps personal privacy. However, after the violations of civil liberties, even basic liberties, that we have witnessed over the past three years from the government, I would not be so eager to say that we should just get it done. There is also the government overreach, the control and the abject absence of even a semblance of accountability.

As vital as our national security is, the government, the ministers and the Prime Minister simply cannot be trusted with more power, and that is what this bill does. It gives the government of the day more power through the Governor in Council and through its agencies to establish regulations and to further limit and restrict the freedoms and privacy of individual Canadians.

It is my hope that as members in this House, we can strike the right balance after hearing from all sides and craft a piece of legislation that accomplishes everything we want and need in it. However, as it stands, Bill C-26 gives way too much power to a government that has proven time and time again that it is unable and unworthy to wield it.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, we all have to be concerned about the rapid deployment of new technologies and how they can be used nefariously to attack Canadians. This comes back to Bill C-26 as well. Again, the government would be putting all the onus on corporate Canada to protect us, but at the same time, I wonder who will do the R&D, who will step up to ensure our technology and our ability to defend ourselves is deployed across the spectrum, whether it is government agencies, government departments, our provincial and territorial partners or corporate Canada. How are we going to ensure the safety of Canadians when it comes down to their personal information and ID, especially if we are seeing new malware out there that will harvest and hack passwords in a matter of seconds?

We have to be investing in R&D. The government has a responsibility and role to get it done, but we do not see that in Bill C-26.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, when look at Bill C-26, I want to assure the member that the government has made very clear the importance of privacy rights. In fact, it was a Liberal administration that brought in the Charter of Rights, understanding and appreciating just how important privacy rights were. The legislation, which the Conservative Party is voting in favour of, and I grateful for that, is there to protect the integrity of the system. As we move more and more into that digital world, cyber-threats are very real and can have a profoundly negative impact. That is why we have to bring forward the legislation.

Given the potential threats to things such as the delivery of health care services to interactions on the net by Canadians, would the member not agree that it is important that legislation of this nature continue not only to deal with the threats but to build confidence in the system with Canadians?

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I am pleased to be able to rise in this place today and speak to Bill C-26, a bill that we as Conservatives are supporting to get to committee.

I have a lot of concerns around the bill itself, in terms of making sure that the government did not make a number of errors in judgment in putting it together. These concerns are based on the feedback we have received from Canadians and from organizations, especially on the issues surrounding privacy and the costs that have been offloaded to the private sector.

I also have to raise my concerns. Here we are, eight long years under the Liberal government, and we know that, when it has come down to cybersecurity, it has been slow in responding. A good case in point was banning Huawei from our critical infrastructure, our 5G network. We know that the Liberals sat on their hands and tried to do nothing for most of the past seven years, before they were finally forced to act after a great deal of pressure was brought upon them by our allies, especially within the Five Eyes.

Cybersecurity and national defence go hand in hand. When we talk about our national defence and national security, we know that hybrid warfare has evolved.

It is now about more than just targeting military assets; it is about targeting the entire government as it is at play. All we have to do is look at what is happening in Ukraine today, as well as what has happened to a number of other allies we have, through NATO, in eastern Europe.

We see the troll farms in St. Petersburg constantly attacking, on Facebook and on Twitter, the military individuals, the soldiers and troops, serving there. They also attack things like critical infrastructure in countries where Canadians are currently deployed, like Latvia. As we have witnessed in Ukraine and Estonia, they have not just gone after them through direct kinetic means to take out critical infrastructure, but they have also gone through cyberwarfare as well.

The Russians have done this very effectively in knocking down financial systems, knocking down transportation systems, and taking out power and water infrastructure in places like Estonia. As a prelude to the war in Ukraine, before they had actually started bombing these civilian targets in Ukraine, they were attacking them on cyber. It is part of hybrid warfare and it is the evolution of war.

There is a responsibility upon the Government of Canada to ensure that we are protecting not just our national infrastructure and the Government of Canada, that we are not just using CSE, or Communications Security Establishment, to protect national defence, but that we are also using a plethora of capabilities to ensure that our infrastructure here in Canada is protected.

That includes preventing our adversaries from going after our soft targets. That is what I think Bill C-26 is trying to accomplish, to ensure that telecommunications companies in Canada are stepping up to do their share to protect Canadians from cyber-attacks. We know that cyber-attackers have gone after things like our health care systems. They have gone after the medical records of Canadians. They have gone after the education records of students at schools and at universities. They go after retailers. They can go in through a retailer's back door, harvest all sorts of personal data, especially credit card information, and then use that for raising money, for transnational criminal gangs or for ransomware, as we have witnessed as well.

We must remember that we have a number of a maligned foreign actors at play here in Canada now and against our allies. It was just reported, again, that the People's Liberation Army was found guilty of hacking into U.S. critical infrastructure.

We know that the People's Liberation Army, under the control of the communist regime in Beijing, continues to attack cybersecurity assets around the world, including trying to break through the Canadian cybersecurity walls of our government and national defence on a daily basis.

As I mentioned, Russia has become very good at this. That does not mean that it is concentrating only on its near sphere of influence, NATO members in eastern Europe like Estonia, Latvia and Lithuania, but it is also targeting Ukraine. We know that it is targeting Moldova. We know that it has gone after countries like Romania, but it also does cyber-attacks here in Canada and in the United States.

Russia continues to be an adversary and we have to stand on guard to protect Canadians from those attacks.

We know that Iran, the regime in Tehran, is continuing to be a government that attacks its neighbours and attacks Israel and Canada through cyber-means. North Korea has developed an entire cybersecurity and cyberwarfare unit and continues not to just wreak havoc with the democratically elected, peaceful South Korea, but has also gone after Japan and the Philippines, and is going after U.S. infrastructure as well. Therefore, we have to take the necessary steps to make sure we can deal with transnational criminal organizations, with nefarious foreign states and with those who are trying to get rich through ransomware.

Here in Canada just a couple of years ago, we saw a situation in regard to the Royal Military College in Kingston, which the member for Kingston and the Islands is certainly aware of. The Department of National Defence stated that RMC had been a target. It originally called it a mass phishing campaign, but a month after the incident, it was established that the phishing campaign was actually a cyber-attack going after financial information and personal data of cadets. These had been compromised and published on the dark web, and were made available to a lot of people who participate on the dark web to profiteer from that information.

According to several observers who looked at the hack of RMC Kingston, it was attributed to a cybercriminal group called DoppelPaymer that did not seem to be connected to a nation-state actor. There are criminal organizations out there that are going about their criminal activities in such a way as to extract dollars from governments, retailers and private citizens, as well as from other corporations, to line their pockets and continue doing other nefarious things that sometimes go beyond the cyberworld.

I have said in the past, when we have talked about other legislation here dealing with cybersecurity, that we not only need the ability to defend, but also that the government has the responsibility, especially under national defence, to attack using cybersecurity. We cannot just be here deflecting the arrows; sometimes we have to be able to shoot down the archer. The way we do that is by having a very robust cybersecurity system. We need the best capabilities and the best personnel who are able not only to sit here and defend, that is to put up shields and fight off the attacks, but also are able to go out there and take out the adversaries, to knock out their systems, so that we are safer here at home.

With regard to some of the criticisms that have come out, I know that letters have come in from the Canadian Civil Liberties Association, and the Business Council of Canada wrote a very detailed brief, as did the Citizen Lab in looking at the bill. When we read through the documentation, we see that one of the concerns that has been raised, especially by the Business Council of Canada, is that there seems to be an imbalance. We are telling members of corporate Canada to go out there and make sure they have the proper cybersecurity systems in place, but at the same time we realize that it is not just up to them to do the defending. What we see is that the corporations are saying that either they have to do it or we are going to fine them up to $15 million or five years of jail time, and that the individuals who work for them could also be held criminally responsible for not doing enough.

Sometimes resources are not available. Sometimes there are new companies that may not have the ability to put in place the proper security systems. I look at a lot of the Internet service providers that we have, for example. They are covered under the Telecommunications Act, yet, as new start-ups, they may not have the personnel or the equipment to properly defend their networks. Would we go ahead and fine these companies up to $15 million? Then what would we do in regard to jail time and fines for those criminal organizations that are profiteering through cyber-attacks? Where is the balance in this? That is one of the concerns we have and one of the things we have to look at through our study at the industry committee when it brings this forward.

A huge concern has been raised, especially by the Canadian Civil Liberties Association, on how this would be implemented and how it may affect the privacy rights of Canadians at the individual level. Corporations have broader responsibilities and do not necessarily fall under the charter, but their clients who they are going to protect and the information they are going to be required to share with the Government of Canada could very well be violations of their clients' privacy rights.

When we look at section 7 of the Charter of Rights, we have to balance the right to life, liberty and security of a person with section 8 of the charter which says that we have freedom from search and seizure. When we drill down on section 8 and go to some of the legal analysis of our charter, as all the rights and freedoms are laid out, it tells us that the underlying values of freedom from search and seizure when it comes to individual privacy is the value of dignity, integrity and autonomy. Again, I think we are all concerned that when we look at Bill C-26 at committee, we ensure the bill balances those rights of the individual to be both secure and safe from cyber attacks, but do it without compromising privacy rights and charter rights as described in freedom from search and seizure. The way we do that is through warrants.

We know that through National Defence, the Communications Security Establishment, or CSE, which has a long-standing history of defending the Canadian Armed Forces, has to comply with the charter. It has to comply with all Canadian legislation and it cannot do indirectly what it is prohibited doing directly. Therefore, CSE cannot go to the National Security Agency, or NSA, of the United States, say that it is concerned that a Canadian maybe talking to a terrorist organization offshore and ask the agency to spy on that individual because CSE is prohibited from spying on the person and listening in through the Communications Security Establishment. CSE cannot go to the NSA and ask it to violate Canadian law on its behalf to find out what is happening in the same way CSIS cannot go to the FBI or the CIA and ask it to spy on Canadians. It cannot do indirectly what it is prohibited from doing directly under Canadian law. The way to get around that is to apply for warrants.

Judicial appointments are made to have supernumerary justices over these organizations to ensure that charter rights are protected, even when conversations take place inadvertently. In the past, CSE has listened in on people who may have been in Afghanistan funding the Taliban or al Qaeda. They may have family in Canada and were talking back and forth about something that had nothing to do with operations on al Qaeda or the Taliban. However, because it involved a Canadian citizen, it had to go through the proper processes to ensure that his or her charter rights were protected by getting a warrant to listen to those conversations. Whether they were listening electronically or through wire taps, it is all mandated to watch that we do not trip over the rights of Canadians under legislation.

Bill C-26 would not address this like we have under the National Defence Act, under the Criminal Code and under the whole gamut of cybersecurity that has been in place up to date. The privacy rights are paramount.

To come back to Bill C-26, the Supreme Court of Canada said in 1984, as well as in 1988, that privacy was paramount and was “at the heart of liberty in a modern state”. Again, did the Liberal government ensure the bill was tested first to ensure those privacy rights were protected? This is what we will have to find out when we get Bill C-26 in front of committee.

We can look at information that has come from places like the Business Council of Canada. One of the concerns it raises goes back to this whole issue of huge fines on Canadian corporations, as well as the employees of those corporations, if they are found to have been not responsible enough to put in place proper security protocols to protect their clients from cyber attacks. Because it goes against individual employee as well, we will create another brain drain from Canada.

We are unfairly targeting Canadian employees who are going to be working for these cybersecurity firms, working in the telecommunications sector and in our financial institutions. If they are found to have erred, which a lot of times it is by error or by a lack of resources, then they are held criminally responsible and they are fined. The question becomes why they would want to work in Canada when they are afforded better protections in places like the United States, the European Union, the United Kingdom or Australia, which was held up by the Business Council of Canada as the gold standard we should be striving to achieve, and what it has done through their own cybersecurity protocols.

We want to ensure that we protect critical infrastructure, but we do not want to chase away very good Canadian employees and force them, with their skills, to go offshore where they have better protection and probably better pay. We want to ensure we keep the best of the best here. We want to ensure we do not go through a brain drain, as we have witnessed before when the Liberals have targeted professionals in Canada, such as lawyers, accountants, doctors or anyone who set up a private corporation. Now I fear the Liberals are going after individuals again who we need in Canada to protect us here at home, that they are creating a toxic work environment and those individuals will want to leave.

The Citizen Lab wrote a report entitled “Cybersecurity Will Not Thrive in Darkness”. It brought forward a ton of recommendations on how bad this bill was. It suggested that there needed to be 30 changes made to the act itself.

We realize that the government has not done its homework on this. We need to ensure we get experts in front of us who are going to look at everything, such as there is responsibility upon government to help corporate Canada ensure we have the proper security mechanisms in place to prevent cyber attacks. We have to ensure that those corporations are not being coerced into sharing private information with the Government of Canada that could be a violation of private rights, which may be a violation of the Personal Information Protection and Electronic Documents Act, PIPEDA. We want to ensure that privacy rights will be cohesive, but, at the same time, collectively, we need to balance all federal legislation that is in contravention of each other.

We need to bring in the legal experts. The Canadian Civil Liberties Association needs to be before committee. The Citizen Lab, which is very concerned about individual privacy rights, has to be front and centre in the discussion. We need to ensure the Business Council of Canada, the Canadian Chamber of Commerce and others are brought forward, along with the department officials who were responsible for drafting this bill at the direction of the Liberal government.

I will reiterate that I will be voting in favour of the bill to ensure it goes to committee and the committee can do its homework. I would hope that the government will allow the committee to do a thorough investigation, as well as a constructive report with recommendations on how to change and amend the legislation.

Finally, I would remind everyone that the Supreme Court of Canada said, “privacy is at the heart of liberty in a modern society”, and we have to take that to heart to ensure we protect Canadians from cyber attacks, as well as to ensure they have their privacy, dignity, integrity and autonomy respected.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, there have been serious concerns about how, within the telecommunications infrastructure, Bill C-26 would allow Canada's national security and spy agencies to permanently implant themselves within that infrastructure, have access to all kinds of sensitive data and possibly share it.

I do not know what the specifics are at this point. I think the committee will be empowered to look at that. I want to make sure that, everywhere in Bill C-26 where ministers are able to issue these types of orders, or if they are kept secret, there would be accountability mechanisms built into the bill.

Can we give the standing joint committee on regulations the ability to review those orders, since they could be prevented from being published in the Canada Gazette? That is one particular example, but there are many others.

I agree with the premise of the member's question in that there is a lot of work that needs to be done with Bill C-26 at committee.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, the member for Cowichan—Malahat—Langford shared some concerns in his speech. I am sure he saw the open letter from eight groups, including the Canadian Civil Liberties Association, the National Council of Canadian Muslims and OpenMedia. One of their concerns is power without accountability for the CSE, or Communications Security Establishment, our cybersecurity agency.

Can he share more about what could be done to address this concern in Bill C-26?

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, a 20-minute speech does not give a lot of time to go over the multitude of concerns with Bill C-26. Yes, there are a lot of privacy concerns with this bill. We have had those concerns outlined not only by the Canadian Civil Liberties Association, but also by OpenMedia.

The way we allay those concerns is that we empower committee members on the public safety committee to give this bill a thorough going-over, and to make sure those expert witnesses are brought forward so they can identify the specific clauses of this bill that are problematic. We need to give members of the committee enough time to draft the amendments.

What I ultimately want to see when this bill is reported back to the House is an acknowledgement that there is a very real threat; that the bill would empower the government to counteract that threat; and that the bill would also provide a very important layer of parliamentary oversight and accountability, which I think should include some of our dedicated public servants, like the Privacy Commissioner and others.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, given that there are concerns about our privacy rights being infringed upon and that Bill C-26 is not doing enough to protect our privacy rights, I would like to hear what the member thinks needs to happen to make sure this bill is improved.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, the hon. member has a point. I would identify the system that deals with our democratic process, including all of the actors involved, as being a critical system. It is probably the most critical system. However, while I do acknowledge there are definitely state actors who are trying to undermine our system, they are trying to undermine democratic systems all over the world. We see evidence of that.

I have a lot of confidence in the public servants who work at Elections Canada and who work for the office of the Commissioner of Canada Elections. They are doing their utmost to protect the sanctity of our democratic system. That being said, we cannot rest on our laurels, and it is up to us, as parliamentarians, to acknowledge these evolving threats and to equip our dedicated public servants with the tools they need to counteract these threats actively.

I would agree with the member's saying that these threats are real. They do need to be acknowledged. We owe it to ourselves to get Bill C-26 right so our public servants have the tools to counteract those threats.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, in my opinion, based on what I have heard, it is artificial intelligence and its capabilities in the hands of nefarious actors.

We heard from Caroline Xavier, the chief of the Communications Security Establishment, at committee. She identified China, Russia, Iran and North Korea as countries that are actively trying to undermine Canada's national security. If we combine that with what Mr. Jérémie Harris has identified as what AI is capable of now and what it could be capable of, I am very concerned that those countries that are actively trying to undermine Canada's national security interests will use this emerging technology to construct malware, the likes of which we have never seen.

That is why a bill such as Bill C-26 is important, but it is important that we get it right. We absolutely must make sure that our critical systems are beefed up and secured against not only those particular nation states, but also others that are actively trying to undermine our interests.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, Bill C-26 would assist in empowering our laws and legislators to ensure there is a higher sense of Canadian confidence in the digital world, given the importance of the critical systems that are at work. Whether they are in health care services or consumer purchases, we have witnessed a great deal of advancement over the last number of years in cyberspace.

I am wondering if the member could provide his thoughts on why it is so important that legislation is brought forward to support Canadian confidence and protect privacy at the same time, and deal with the issue of the security of our Internet.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Madam Speaker, I am very pleased to be joining the debate today to offer some of my thoughts and perspective on Bill C-26, a much awaited bill on a cybersecurity infrastructure.

Bill C-26 is a good reminder to members that the Department of Public Safety and its subject matter is so much bigger than just firearms, because, of course, firearms and Bill C-21 have been dominating the news cycle for the last couple of months. That bill, in particular at the public safety committee, has occupied so much time and wasted so many resources. Bill C-26 is a good reminder that with cybersecurity we have so many other agencies that are dedicated to national security under the umbrella of public safety. Cybersecurity is a big subject matter. We also have Bill C-20, which is an important bill on oversight and accountability for both the CBSA and RCMP.

Today, we would not find many members in the House of Commons who are arguing against the need for better cybersecurity. All of the evidence out there points to this being a new and evolving threat. Artificial intelligence systems offer some interesting advantages, but with those advantages come threats and with those threats come actors who are determined to use them in nefarious ways that will harm and have harmed Canada's interests. We need a whole host of options to counter this threat. We need our national security agencies to take these threats with increased importance. We also need legislation to fill in the gaps and make sure that all of Canada's laws are up to date.

I have spent a lot of time on the public safety committee. We did a couple of reports that directly touched on this area. One of our first reports identified violent extremism. Our most recent study looked at the threat posed by Russia. We know that since Russia conducted its invasion of Ukraine, which has recently passed the one-year anniversary, it has also increased the threats that it offers to Canada and to like-minded countries. One of those areas is cybersecurity.

Our committee has not yet tabled its report, which should be tabled in the House of Commons soon so that members of the House and the public can not only see the results of the deliberations, but also see the important recommendations that the committee is going to make. However, we heard a lot of testimony during those committee hearings on the cyber-related threats from Russia. Many witnesses identified that those are among the most serious and relevant for Canada's public safety and national security, particularly in relation to critical infrastructure.

I want to set this table before I get into the nuts and bolts of what Bill C-26 is offering, but also set some of the problems that are in evidence with this first version of the bill.

We have to understand a few basic terms. The Government of Canada refers to critical infrastructure as the “processes, systems, facilities, technologies, networks, assets and services essential to the health, safety, security or economic well-being of Canadians and the effective functioning of government”, whether that is the federal government, the provincial governments or our municipal governments. Because so many of those pieces of critical infrastructure are now tied into computer systems that are vulnerable to attack, a bill like this becomes quite necessary.

I could go on and on about all of the critical systems in our modern society and the range of sectors, from our energy production to our food distribution systems to our electricity grid and transportation networks and how our ports and our banking system work. If one were to interrupt any one of those services, it could create absolute havoc within any Canadian community or countrywide.

One of the witnesses we had during our public safety meetings on the topic of the threats posed from Russia, and this was just talking about the cyber-threat more broadly, was Jennifer Quaid, Executive Director of the Canadian Cyber Threat Exchange. She reminded our committee that there are nation-states that are conducting espionage and statecraft through the Internet, but there are also criminals who are engaging in cybercrime for financial gain.

In some cases, those criminal groups and the nation-states are working together. There is evidence of this not only in Russia but in places like North Korea and China, where it is almost like the policy that was in place back in the 1700s and 1600s, where privateers would go out and do a nation-state's bidding. In this modern-day version of that policy, there are criminal organizations that are working hand in glove with some nation-states to give them some plausible deniability, but the systems they are using do pose a very real threat to Canada.

One of our key witnesses during the study was Caroline Xavier, Chief of the Communications Security Establishment. She was not able to go into much detail or specifics, given the very sensitive nature of the topic, but she was able to assure the committee that cybercrime is absolutely the most prevalent and most pervasive threat to Canadians and Canadian businesses. She observed that the state-sponsored cyber programs of China, North Korea, Iran and Russia posed the greatest strategic threat to Canada, and that foreign cyber-threat activities have included attempts to target Canadian critical infrastructure operators, as well as their operational and information technology.

Leaving aside the government, it is important for members to realize that most of Canada's critical infrastructure is, by and large, in the hands of the private sector. This is going to underline some of the important elements of Bill C-26.

We also had testimony from David Shipley, Chief Executive Officer of Beauceron Security. He was relaying the same stuff about Russian criminal organizations working in tandem with the government, and saying that criminal gangs have crippled Canadian municipalities. They have gone after health care organizations. The range of malicious cyber-activity has absolutely extended to many small and medium-sized enterprises.

When we look at the reporting requirements of Bill C-26, one of the biggest gaps that we have in our system is the fact that many businesses, private enterprises, are loath to report the fact that their systems have experienced a cyber-attack. They may be threatened to not do so. There is also a very real concern about the institutional harm that could come from the public release of said information. A large corporation that relays to its customers that it has experienced a cyber-attack may find people are loath to do business with it if they are unsure that its systems are up to par.

I also want to highlight a recent example from 2021, where the Government of Newfoundland and Labrador experienced a health records cyber-attack on October 30. The investigation revealed that over 200,000 files were taken that contained confidential patient information.

One can just imagine that in a province the size of Newfoundland and Labrador the fact that over 200,000 files were taken, that is a shocking theft of personal and confidential information. It really underlines just how important addressing this is.

I also want to touch briefly on the topic of artificial intelligence. I want to read a quote from a recent Hill Times article. This is from Jérémie Harris who is one of the co-founders of Gladstone AI, which is an artificial intelligence safety committee. He says:

But perhaps more concerning are the national security implications of these impressive capabilities. ChatGPT has been used to generate highly effective and unprecedented forms of malware, and the technology behind it can be used to power hyperscaled election interference operations and phishing attacks. These applications—and countless other, equally concerning ones also enabled by new advances in AI—would have been the stuff of science fiction just two years ago.

He goes on to say:

...ChatGPT is a harbinger of an era in which AI will be the single most important source of public safety risk facing Canada. As AI advances at a breakneck pace, the destructive footprint of malicious actors who use it will increase just as fast. Likewise, AI accidents—now widely viewed by AI safety specialists as a source of global catastrophic risk—will take more significant and exotic forms.

Something all members of the House really have to be aware of is how, just in the last two years, AI has advanced so quickly. We can think about what AI will be capable of two years or a decade from now. Just as Mr. Harris said, what it is doing right now was inconceivable just two years ago. The fact that AI is now being used to generate unique code for malware indicates there is no telling what it can be used to do and how it could be used to wreak havoc. That underlies just how important this issue is and how seriously we, as parliamentarians, have to take it as we serve our constituents and do the important work of equipping our nation with the tools it needs to keep Canadians, and the critical infrastructure they depend upon, safe.

When I was a member of the public safety committee, I had a chance to speak with Mr. Harris. I actually put a motion on notice that the committee should be undertaking a study on the range of threats posed to Canada's public safety, national security and critical infrastructure, specifically by AI systems. I hope one day the committee can take that study up, but it is a committee with a very heavy workload. It is still trying to find its way through Bill C-21. It is waiting for Bill C-20 to arrive on its door and, of course, this bill, Bill C-26, would also keep committee members quite busy.

I would like now to turn to the specifics of Bill C-26 and what it is attempting to do. It is separated into two main parts. According to the summary of the bill:

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.

There are a number of orders that the Minister of Industry could issue. For example, he or she could prohibit a TSP from using any specified product or service in its networks or facilities; direct a TSP to remove a specified product from its networks or facilities; impose conditions on a TSP’s use of any product or service; subject a TSP’s networks or facilities, as well as its procurement plans for those networks or facilities, to a specified review process. Those are just a few examples of how the minister's orders could be issued. The bill does require the Governor in Council or the Minister of Industry to publish these orders in the Canada Gazette, but there is an allowance in the bill to allow these provisions to be prohibited, so the government can prevent the disclosure of these orders within the Gazette if they feel they need to be kept secret.

Part 2 would enact a brand new statute of Canada, a critical cyber systems protection act, which would “provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety”. In schedule 1 of the government's bill there is a brief list. Vital systems and services can include telecommunication services, interprovincial or international pipelines and power line systems, and nuclear energy systems. Those are a few examples. A really important point is that the Governor in Council, through this bill, would be able to establish classes of operators and require designated operators to establish and implement cybersecurity programs.

This is where the bill would affect the private sector and make sure those cybersecurity programs are in place, especially when that private sector is involved in critical infrastructure. As a brief outline, with those cybersecurity programs, the expected outcomes would be that they could identify and manage any cyber-risk to the organization, including supply chain risks; prevent their critical cyber systems from being compromised; detect cybersecurity incidents; and limit the damage in the event a cybersecurity incident did occur.

I want to talk about concerns with the bill, because there are a lot of concerns. I have had the chance to speak with a number of organizations, but first and foremost was OpenMedia. I had a great conversation with the people there. There is a section on its website that specifically deals with Bill C-26. OpenMedia absolutely realizes that new cybersecurity protections are needed to protect Canada's infrastructure, but it believes they have to be balanced by appropriate safeguards, and this is to prevent their abuse and misuse.

We rely on these essential services, and their protection is important, but Bill C-26, as it is currently written, would give the executive branch huge sweeping powers. In my reading of the bill, there would not be enough accountability and oversight; there would not be enough review mechanisms for Parliament to check the power of the executive, and I think this is a critical point. I think, in principle, we have a good idea with the bill, but a lot of work will be needed at committee to ensure that this executive power would be checked and that it would fit within the parameters of the law. We absolutely must have that kind of parliamentary oversight.

I also know of the Canadian Civil Liberties Association, which said:

The problems with the Bill lie in the fact that the new and discretionary powers introduced by C-26 are largely unconstrained by safeguards to ensure those powers are used, when necessary, in ways that are proportionate, with due consideration for privacy and other rights. The lack of provisions around accountability and transparency make it all more troubling still.

I think, at this stage, we want to ensure, with the minister's powers to order or direct service providers, and the requirement to comply with these orders, that these powers are being subjected to the appropriate safeguard mechanisms. They are quite broad, as currently written.

In conclusion, I want to see a bill that protects vulnerable groups from cyber-attacks. So many Canadians rely on these critical systems, and we know so many have been targeted and are being targeted as we speak, and we know these dangers are going to multiply and get worse the longer we go on. We want to make sure they are protected, but we want to make sure that we do not have broad unchecked ministerial powers with no public oversight. That is the balance that must be achieved.

I must express, in my closing minute, my personal frustration with how the Liberals draft their bills. The idea behind Bill C-26 is a good one, but the problem with how the Liberals drafted the bill is that it would give huge sweeping amount of power to the executive branch. I just wish they would have had the foresight to understand that, of course, these provisions would be met with opposition. It seems the Liberals are putting the work on committee members to fix the bill for them, rather than having had the foresight and intuition to understand that these are problematic elements of the bill.

I think a lot more work could have been done on the government's side to have presented a better first draft. I guess we have what we have to work with, but a lot of work is going to be needed to be done at committee, and I look forward to seeing members do that work.

I also look forward to voting for the bill at second reading and sending it to committee. I welcome any questions or comments from my colleagues.

[Rob Morrison, Conservative, Kootenay—Columbia, BC]

Madam Speaker, in the last several months, we have seen accountability raise its head here in Parliament with Bill C-5, Bill C-75 and Bill C-11. Without accountability, it is as though the government does not actually care what we are doing because with a majority government, the NDP and Liberals can make decisions based on what they think is right and there is no accountability.

With Bill C-5, the evidence is not there. Bill C-21, taking legal guns from legal gun owners, is another non-evidence-based process. With Bill C-26, which we are talking about today, it is time that we start building in some processes for accountability so the government is actually accountable for what it is doing.

[Rob Morrison, Conservative, Kootenay—Columbia, BC]

Madam Speaker, the member is right. When we get to committee, we can iron out some of the flaws that we have seen in Bill C-26. It is going to be important to focus on accountability and the member did not address that. That is where this bill can either succeed or fail. We need to ensure there is an accountability process for the government, so when it follows through with Bill C-26, we have a process and we can go back and say we need to tweak or change something because cybersecurity changes so fast.

[Rob Morrison, Conservative, Kootenay—Columbia, BC]

Madam Speaker, it is always an honour to rise in the House, especially when I can talk about safety and security.

I always try to enhance safety and security for Canadians at home and abroad, for our corporations that are major contributors to our economic base, and of course, for government institutions. Today, discussing cybersecurity in Canada is an opportunity to enhance our country's ability to protect us from cyber-threats.

Security is a significant concern for all Canadians. Lately, with the rise in organized crime and gang offences to the tune of a 92% increase in gang crime, I have to wonder when the government will be led by evidence, or in other words, provide evidence-based action. It is extremely important for our country to have cybersecurity to protect itself from threats, and I welcome Bill C-26. However, I am apprehensive about how successful this bill may be since accountability is a question that the opposition brings up every day in this House.

Bill C-26 is basically divided into two parts. The first part aims to amend the Telecommunications Act to promote the security of the Canadian telecommunications system. It aims to do this by adding security as a policy objective to bring the telecommunications sector into line with other infrastructure sectors.

By amending the Telecommunications Act to secure Canada's telecommunications systems and prohibit the use of products and services provided by specific telecommunications service providers, the amendment would enforce the ban on Huawei Technologies and ZTE from Canada's 5G infrastructure, as well as the removal and termination of related 4G equipment by 2027. Of concern is the time it took the government to react to enforce the ban on Huawei.

The second part aims to enact the critical cyber systems protection act, the CCSPA, which is designed to protect critical cybersecurity and systems that are vital to national security or public safety or are delivered or operated within the legislative authority of Parliament. The purpose of the CCSPA is to ensure the identification and effective management of any cybersecurity risks, including risks associated with supply chains and using third party products and services; protect critical cyber systems from being compromised; ensure the proper detection of cybersecurity incidents; and minimize the impacts of any cybersecurity incidents on our critical cyber systems.

The effects of this bill will be far-reaching, and there are some points to consider: The government would have the power to review, receive, assess and even intervene in cyber-compliance and operational situations within critical industries in Canada. There would also be mandatory cybersecurity programs for critical industries, as well as the enforcement of regulations through regulatory and law enforcement with potential financial penalties.

Under both provisions, the Governor in Council and the Minister of Industry would be afforded additional powers.

If any cybersecurity risks associated with the operator's supply chain or its use of third party products and services are identified, the operator must take reasonable steps to mitigate these risks. While the bill does not indicate what steps would be required from the operators, such steps may be prescribed by the regulations during a committee review.

The act also addresses cybersecurity incidents; a cybersecurity incident is defined as an:

incident, including an act, omission or circumstance, that interferes or may interfere with

(a) the continuity or security of a vital service or vital system; or

(b) the confidentiality, integrity or availability of the critical cyber system

touching upon these vital services. It does not indicate what would constitute interference under the act.

In the event of a cybersecurity incident, a designated operator must immediately report the incident to the CSE and the appropriate regulator. At present, the act does not prescribe any timeline or indicate how “immediately” should be interpreted. Again, there is an opportunity to address this at committee.

There are some concerns with Bill C-26 as it is presently drafted. What the government might order a telecommunications provider to do is not clearly identified. Moreover, the secrecy and confidentiality provisions of the telecommunications providers to establish law and regulations are not clearly defined.

As has been brought up today, potential exists for information sharing with other federal governments and international partners, but it is just not defined. Costs associated with compliance with reforms may endanger the viability of small providers. Drafting language needs to be in the full contours of legislation, and that could be discussed at committee as well. In addition, there should be recognition that privacy or other charter-protected rights exist as a counterbalance to proposed security requirements, which will ensure that the government is accountable.

Some recommendations, or ones derived from them, should not be taken up, such as that the government should create legislation requiring the public and telecommunication providers to simply trust that the government knows what it is doing. Of course, this is a challenge. Telecommunications networks and the government must enact legislation to ensure its activities support Canada's democratic values and norms of transparency and accountability.

If the government is truly focused on security for Canadians, should we not be reviewing our gang and organized crime evidence? Our present policies have failed. Should we not look at the safety and security of our bail reform in an effort to prevent innocent Canadians from becoming victims?

Bill C-26 is a step in protecting Canada from cybersecurity threats. What is the review process to ensure compliance and effectiveness, as well as that goals are met?

In terms of bail reform, even though the evidence clearly shows that Bill C-75 has failed, we see that the NDP-Liberal government is not interested in reviewing bail reform. Cybersecurity is important to our country's security; so are victims of crime after their safety and security has been violated.

I am concerned that the government is struggling with evidence-based information to review Bill C-26, as it has with Bill C-75 and Bill C-5. These bills are not supported by evidence. In fact, offenders and criminals have a higher priority than victims do. My concern is as follows: If Bill C-26 requires amendments and review, will the government follow up? It is so important to be flexible and to be able to address changes, especially in a cybersecurity world, which changes so rapidly.

Bill C-26 proposes compliance measures intended to protect cybersecurity in sectors that are deemed vital to Canadian security. Therefore, although late out of the gate, Bill C-26 is a start. However, since this bill proposes compliance measures intended to protect cybersecurity in sectors that are deemed vital to Canadian security, I would like to see individuals, corporations, and most importantly, the government held accountable. There should also be measures to ensure that the objectives of the bill are met and that there is a proper review process.

As I have stated, government accountability has not been a priority. For the proposed bill to succeed, there have to be processes for review and for updating the critical cyber systems protection act.

The failure of Bill C-75 on bail reform is clear with recent violent acts by murderers and individuals who should never have been out on bail. Today we are debating Bill C-26, and I would hope that there are lessons learned from our failure to review Bill C-75. In addition, we can learn from the failure of Bill C-5, as gang violence and organized crime rates are up 92%. Surely the government will open a door for review and making required changes to Bill C-26 on cybersecurity.

I am thankful for the time to speak on the responsibilities related to cybersecurity.

[Gerald Soroka, Conservative, Yellowhead, AB]

Madam Speaker, I will be splitting my time with the member for Kootenay—Columbia.

I am pleased to rise in the House today to speak to Bill C-26, the critical cyber systems protection act, introduced in June 2022 and split into parts 1 and 2. The former aims to amend the Telecommunications Act to include:

the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.

The latter outlines the introduction of the critical cyber systems protection act, which would create a new regulatory regime requiring designated critical infrastructure providers to protect their cyber systems.

I would like to emphasize that the safety and security of our telecom industry, with particular reference to foreign adversaries such as the Beijing Communist Party, has been a broad theme in communications lately. This is especially concerning the controversial Bill C-11, the online streaming act, or, should I say, government censorship, and new revelations from the Canadian Security Intelligence Service, CSIS, flagging election interference from those involved with the Beijing Communist Party.

We Conservatives believe it is of paramount importance to defend the rights and interests of Canadians from coast to coast to coast. Thus, Canada's national security should be strongly well equipped to be prepared for cyberwarfare threats that could be presented by emerging digital technologies, intelligent adversaries or authoritarian artificial intelligence.

The NDP-Liberal government has had a long record of denying Canadians the truth. Instead of protecting their rights and freedoms, the government uses deflection tactics to divide Canadians, pitting them against one another to distract from the real issue: that the NDP-Liberal government has been too slow to address cyber-threats. For this critical lack of action, Canada has seen several serious incidents occur with no substantive legislative response for over seven years. After years of chronic mismanagement and utter failure, it is time for the government to step aside and let the Conservatives turn Canadians' hurt into hope.

We support the stringent and thorough examination of this legislation. We will always defend and secure the security of Canadians, especially with regard to cybersecurity in an increasingly digitized world. There is a pressing demand to ensure the security of Canada's critical cyber-infrastructure against cyber-threats. Let us not forget that these very systems lay the foundation of the country as a whole. It is these cyber systems that run our health care, banking and energy systems, all of which should be guarded against the cybercriminals, hackers and foreign adversaries who want to infiltrate them.

Akin to several other Liberal ideas, a number of aspects of this bill require further review, and it should thus be sent straight to committee where it can be further dissected and refined to ensure that all flaws are addressed. One can only imagine the disaster that a hospital system crash would add to the already horrible wait times in emergency rooms and shortages of medical professionals thanks to the NDP-Liberal government. The results would be disastrous. Furthermore, disruption of critical cyber-infrastructure in health care can bring severe consequences, such as enabling cybercriminals to access confidential patient health care information.

While we understand that it is imperative to provide the resources necessary to effectively defend against cyber-threats, it is still equally important to ensure that the government does not overreach on its specified mandate through Bill C-26. A research report written by Christopher Parsons called “Cybersecurity Will Not Thrive in Darkness” highlights some recommendations to improve Bill C-26. Among these recommendations is an emphasis on drafting legislation to correct accountability deficiencies, while highlighting amendments that would impose some restrictions on the range of powers that the government would be able to wield. These restrictions are critical, especially concerning the sweeping nature of Bill C-26, the critical cyber systems protection act, as outlined in parts 1 and 2, which I have explained in my opening statement.

The sweeping nature of this legislation is not new, particularly for the Liberal government. It even goes back to Bill C-11, the online streaming act, which essentially placed the Liberal government as the online content regulator controlling what Canadians see or listen to online. If members ask me, the government policing what Canadians view online is a cyber-threat in its own way, but I will not get into that right now.

There are other flaws in Bill C-26 that I would like to highlight, which brings us back to having Bill C-26 closely reviewed in committee.

In terms of civil liberties and privacy, some civil liberties groups have flagged serious concerns regarding the scope and lack of oversight around the powers that may be granted to the government under Bill C-26. In September last year, the Canadian Civil Liberties Association, along with other groups, released a joint letter of concern regarding Bill C-26, highlighting that the bill is “deeply problematic”, like several other questionable Liberal policies. They went on to further explain that Bill C-26 “risks undermining our privacy rights, and the principles of accountable governance and judicial due process”.

From an economic perspective, the bill lacks recognition of foreseeable impacted enterprises, such as small and medium-sized businesses, which will undoubtedly bring forth unintended consequences. According to the Business Council of Canada, some concerns include the lack of transparency seen through the one-way sharing of information. This brings about serious concerns. Operators are required to provide information to the NDP-Liberal government, yet those same operators are not entitled to receive any information back from the government or other cyber-operators. This whole information-sharing regime is lacking and, simply put, completely misses an opportunity to implement a transparent information-sharing system that would benefit all parties involved.

There is also concern regarding government overreach. Considering what powers would be granted to the government to order what a telecommunications provider has to do under Bill C-26, I would have expected to see sufficient evidence to support this overreach. However, that was not addressed at all, if not vaguely, in this bill. This, on top of blatant disregard for the recognition of privacy and other charter-protected rights, proves how the government only cares about granting itself more and more power, even in the face of blatant transparency and accountability concerns like election interference or the Bill C-11 censorship bill.

I only highlighted a few of the several highly valid concerns regarding this critically flawed bill. Obviously, it is important to defend national cybersecurity and defend against cybercriminals or foreign threats. However, there is a fine line between upholding the best interests of Canadians and just using another faulty bill as a power grab for the NDP-Liberal government, despite concerns regarding cyber systems, privacy and security infrastructure.

We Conservatives believe that it is of paramount importance to truly defend the rights and interests of Canadians from coast to coast to coast. One of the best ways this can be done is by securing Canada's cyber-infrastructure from attacks. While we welcome the idea of protecting the interests of Canadians in terms of cybersecurity, we want to flag that Bill C-26 has some highly concerning content that should be closely reviewed and discussed in committee to correct flaws and prevent potential overreach from the NDP-Liberal government. In the interest of protecting Canada's cyber-infrastructure, we must also guard against the sweeping government powers outlined in the critical cyber systems protection act.

The House resumed from December 1, 2022, consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

Business of the House

[Mark Holland, Liberal, Leader of the Government in the House of Commons]

Mr. Speaker, I appreciate my hon. colleague's very sincere effort, I am sure, to lay that on the record. I am sure he is in shock that there was not unanimous consent. However, my hon. colleague can rest assured that, when it comes to climate change, we will not allow inaction to be the rule of the day and that we will absolutely continue to take action to make sure climate change does not ravage this planet.

I do want to pick up on the second-last comment that the hon. opposition House leader made, which were comments with respect to Family Day. I hope that he, and indeed all members in the House, take time with their families and with their constituents, and that they return to this place in good health.

Tomorrow, we will resume debate on Bill C-34 to amend the Investment Canada Act at second reading.

Upon our return on Monday, March 6, we will call Bill C-27 on the digital charter, at second reading.

Tuesday shall be an allotted day.

On Wednesday, we will commence debate on Bill C-33 concerning the port system and railway safety.

Thursday will not only be the opportunity for my hon. colleague's favourite time of the week, another Thursday question, but we will also resume debate on Bill C-23 respecting historic places, at second reading.

On Friday, we will continue second reading debate of Bill C-26, the cybersecurity legislation.

[Anthony D. Rosborough, Researcher, Department of Law, European University Institute, As an Individual]

Thank you.

Good afternoon, Mr. Chairman and honourable members of the committee.

I'm a lawyer and doctoral researcher in law at the European University Institute. I'm also a practising member of the Nova Scotia Barristers' Society. In the past I've taught in the intellectual property area at the Schulich School of Law at Dalhousie University. My doctoral thesis investigates the design, function and implications of TPMs across the automotive, consumer electronics and agricultural equipment industries. I have published several peer-reviewed articles on the right to repair and TPMs, including a forthcoming publication in the Berkeley Technology Law Journal, which analyzes the right to repair in Canada and the bill under discussion today, along with Canada's international trade obligations. I've included open access links to these works in a brief I've submitted to the committee.

I firmly support the right to repair and the substance of this bill, but my focus this afternoon is not to reiterate the numerous social, economic or ecological benefits of repair. Rather, my aim today is threefold: first, to explain why repair restrictions enabled by TPMs are a misuse of copyright; second, to explain how the bill could be strengthened; and finally, to respond to the core arguments put forward by those who have opposed the bill.

To begin, looking at copyright misuse, access control TPMs in physical devices are best understood as an aberration in the history of copyright. TPMs were first recognized in the 1996 WIPO Copyright Treaty as measures that are used by authors in connection with the exercise of their rights and that restrict acts in respect of works that are not authorized or permitted by law.

TPMs were originally conceived as legal protection to safeguard copy control technologies to assist the digital content industry, but today's access control TPMs in physical devices often bear little, if any, relationship to copyright infringement. They bear only a superficial resemblance to copyright. They function principally to protect technologies, rather than works or the rights of authors, so when device manufacturers rely on anti-circumvention to prevent diagnosis, understanding or repair of computerized devices, this contorts copyright policy to perform the work of a patent or a trade secret. Put simply, this is a misuse of copyright.

As for how the bill could be strengthened, one approach would be to transpose it into a system of comprehensive regulation under section 41.21 of the act. That section allows for regulations that could exclude certain TPMs, or classes of them, from protection and to conduct review and consideration of specific implementations. This may also assist in providing a path forward for Bill C-294, which aims to create a new exception to anti-circumvention for the purposes of interoperability between embedded computer systems. A regulatory framework under section 41.21 could safeguard a whole host of socially beneficial activities. It could also address new and unforeseen uses of TPMs.

To respond to the opponents' claims, opponents have put forward three main themes in their remarks. The first is cybersecurity concerns. The second is health and safety risks, and the third is carve-outs for certain industries.

With respect to cybersecurity, we have scant evidence that repair activities can or will undermine cybersecurity. In any event, cybersecurity should not form part of TPM policy under the Copyright Act. This is not the role of copyright law. A more appropriate framework for cybersecurity considerations is under Bill C-26, currently under consideration, or the Telecommunications Act.

As for health and safety risks, these fears seem to misunderstand what the bill seeks to do. No longer making it unlawful to circumvent a TPM does not equip anyone with new powers or capabilities. The fact is that anyone who wishes to manipulate or modify a device for unlawful purposes can already do so. Any system can be hacked. If the repair of devices poses health and safety risks, the government should consider amending the Consumer Product Safety Act or other legislation. We should ask more of manufacturers and not rely on copyright law to ensure the health and safety of Canadians.

As for industry-specific carve-outs, opponents of the bill have often sought to exempt certain industries or limit the bill's application to consumer products. The reasons for this have not been convincingly argued.

The Copyright Act's purpose is to create a system of rights and incentives, including exceptions and limitations, which govern the use of works. It's not the role of copyright law to distinguish between different technologies or physical devices. In fact, Canadian copyright law has long rested on the principle of technological neutrality. This means that copyright policy should not discriminate against any technology or medium of expression, so to create a TPM distinction based on the type of product or device would amount to a clear violation of this principle.

To conclude, TPMs are increasingly used by manufacturers as a tool for protecting a series of interests that are unrelated to copyright. Repair is not infringement.

The purpose of copyright law is to incentivize the production of artistic and literary works. It encourages authors to bring ideas into the public realm.

Repair-inhibiting TPMs undermine these goals. They function as absolute barriers to the diffusion of knowledge. They are indefinite in duration and receive legal protection in the absence of any connection to copyright.

I ask this committee to move the bill forward and to include it as part of a comprehensive regulatory scheme that ensures that TPMs in devices are protected to the extent that they are connected to copyright.

Thank you.

[Dr. Wesley Wark]

I'm sorry that Aaron can't take that question. I'll try to answer for both of us to the best of my ability.

I think the suggestion that Mr. Shull made about tax incentives is certainly one way forward. Regulation, at least of what we might determine to be critical data infrastructure and communications, is another. Bill C-26 may have an interesting impact in that regard, depending on what Parliament does with it. It's certainly worthy of study.

I think the conclusion that we've come to, which CSE has also spoken to, is that, while there are pretty high levels of cybersecurity capabilities, awareness and implementation on the part of the major private sector actors in Canada, including the financial sector and other aspects of critical infrastructure, the real problem is with small and medium-sized enterprises. They have neither the resources nor, perhaps, even the understanding of the degree to which they are vulnerable to cyber-attacks

I think the small and medium enterprises are the area of focus, as well as figuring out ways to help them up their game in cybersecurity in ways that are affordable and understandable to them. That is the challenge.

[Dr. Wesley Wark]

I would say we have a long way to go in deciding what we want to do about critical infrastructure. Let's put it that way.

We're waiting for a critical infrastructure strategy, which has been under study by the federal government. You will have seen a reference to Bill C-26, which refers to critical infrastructure. We have a list of critical infrastructure that dates back to 2009. In other words, it hasn't been updated since that time, which is the last time we had a critical infrastructure strategy.

The starting point is going to have to be to decide what we mean by “critical infrastructure”. Once we've done that—that will be an important but not an easy step—then we can think about regulating the terms under which critical infrastructure functions and what we expect of them in terms of, particularly, cybersecurity strategies.

There's some of that under way, obviously informally. Some aspects of critical infrastructure have done a terrific job in terms of ensuring they have very high levels of cybersecurity. The major banks are probably a key example of that. Across the board, the system is very diverse.

[Sami Khoury, Head, Canadian Centre for Cyber Security, Communications Security Establishment]

Thank you, Mr. Chair and members of the committee, for the invitation to appear today.

My name is Sami Khoury. My pronouns are he and him. I am the head of the Communications Security Establishment's Canadian centre for cybersecurity, known as the cyber centre.

I am joined today by my colleague, Alia Tayyeb. She is the deputy chief of CSE's signals intelligence branch.

I'm glad to appear before the committee to discuss cybersecurity and cyber operations.

As this is the first meeting of your study, I'd like to begin by providing an update on the current cyber-threat landscape and what CSE is doing to protect Canada and Canadians. I will largely focus on the cybersecurity aspect of our mandate, whereas my colleague, Ms. Tayyeb, will focus on the foreign intelligence piece of CSE's mandate, our support to partners, and our active and defensive cyber-operation capabilities.

Now, more than ever, we understand that cybersecurity is the foundation of Canada's future: for our digital economy, our personal safety and privacy, and our national prosperity and competitiveness. In October, the cyber centre released its third national cyber-threat assessment. This report outlines the current cyber-threat environment.

One of the key points in the report is that cybercrime remains the largest cyber-threat to Canadians and that critical infrastructure is the main target of cybercriminals and state-sponsored threat actors.

Ransomware, specifically, was prominent in the past two years, and it remains a persistent threat to Canadian organizations. The state-sponsored cyber-programs of China, Russia, Iran and North Korea continue to pose the greatest strategic cyber-threat to Canada. In the face of these threats, and as Canada's technical and operational authority on cybersecurity, CSE defends Government of Canada networks and the cyber centre leads the government's response to cyber-incidents. However, cybersecurity is not solely a federal government responsibility or concern, as cyber-threats continue to target and impact Canadian individuals and organizations.

CSE works with partners in the industry, including those outside government, sharing information about threats and best practices in cybersecurity. The Canadian Centre for Cyber Security regularly publishes guidance and expert advice for Canadians.

Moving forward, to continue to adapt to the evolving threat environment, bolster defences and help better protect Canada and Canadians, we hope to see the continued progress of Bill C-26, an act respecting cybersecurity, in Parliament. This legislation would establish a regulatory framework to strengthen cybersecurity for services and systems that are vital to national security and public safety and give the government a new tool to respond to emerging cyber-threats.

We also look forward to continued work to support public safety in the renewal of Canada's national cybersecurity strategy. The renewed NCSS will articulate Canada's long-term strategy to protect our national security and economy, deter cyber-threat actors and promote norms-based behaviour in cyberspace.

For CSE, the renewal of the strategy provides an opportunity to review the situation and build on what the Canadian Centre for Cyber Security has achieved over the past five years. The creation of the centre was actually one of the main initiatives set out in the National Cyber Security Strategy, developed in 2018.

Finally, as we work to build relationships with Canadian industry and other levels of government, we are also focused on collaboration with our international partners, in the Five Eyes and beyond.

I will now hand it over to my colleague, Ms. Tayyeb, to speak to her area of responsibility.

[Marco Mendicino, Liberal, Minister of Public Safety]

Mr Chair, thank you for the opportunity to present to you and committee members today.

I would like to begin by commending the committee for studying the so-called police stations, which are a suspected vector of foreign activities steered by the People's Republic of China and operate in Canada as well as other democracies around the world.

The reports of the PRC attempting to enhance its clandestine footprint on Canadian soil reflect two incontrovertible trends. First is that the geopolitical landscape is increasingly complex, with hostile actors looking to disrupt the international rules-based order that has been in place since the end of the Second World War; and, second, like other democracies, Canada has increasingly become a target of foreign interference, which is a direct by-product of the agenda driven by hostile actors whose objective is to undermine our national interests.

Today, I will outline the concrete steps the federal government is taking to mitigate the threat of foreign interference. Before I do so, let me emphasize that Canada has a strong and resilient democracy that is bolstered by a community of national security and public safety agencies that work around the clock to protect our institutions. These agencies have important resources, technologies and tools at their disposal to ensure national security.

The federal government does not undertake this work alone. Rather, we work collaboratively with other levels of government, as well as key allies in the Five Eyes, G7 and NATO. Together, the whole of government is positioned to assess, mitigate, investigate, prosecute and report on threats to Canadian national security.

We need to be always vigilant, because those threats are constantly evolving and manifesting in different ways, including through state and non-state hostile activities, foreign interference, cyber-attacks and threats to the security of our democratic, economic, academic, environmental and public health institutions.

In the face of these threats, the federal government is vigilant, and we are acting. I'd like to highlight five priority areas of our work.

First, we have put into place robust measures to protect our democratic institutions, including our elections.

We introduced Bill C-76 to crack down on foreign funding from third parties to federal campaigns and candidates. We created the security and intelligence threats to elections task force, or SITE. We created the critical incident reporting protocol to communicate transparently and impartially with Canadians during elections in the event that there is a threat to the integrity of a federal election. We also introduced the digital citizen initiative to promote democracy and social inclusion by building resilience against online disinformation and building partnerships to support a healthy information ecosystem.

The SITE task force looked at the federal elections of 2019 and 2021 and independently concluded that in both cases the integrity of the election was not compromised.

Second, we implemented a national cybersecurity strategy and action plan, which resulted in the launch of the Canadian Centre for Cyber Security.

In budget 2022, we allocated more than $850 million to enhance the Communications Security Establishment's ability to conduct cyber operations and better protect the privacy of Canadians.

Moreover, last spring, I introduced Bill C‑26, our new legislation on cybersecurity, which prioritizes critical infrastructure protection as it relates to the financial, telecommunications, transportation and innovation sectors.

Third, we have introduced national security guidelines for research partnerships that are backed by a research security centre and a $12.6-million investment, in order to protect the integrity of our academic institutions. The purpose of these guidelines is to integrate national security considerations into the overall assessment of research partnerships. Among other things, the guidelines require clear information about who researchers intend to partner with, what researchers intend to research and what additional due diligence will be taken to mitigate if the subject of research involves a sensitive area. In addition to the guidelines, research partnerships are subject to rigorous admissibility screening and required to comply with existing authorities that regulate exports and imports.

Fourth, when it comes to protecting our economy, the government vets foreign investments under the Investment Canada Act and has the capacity to reject those deals when they are contrary to our national security. The government, as you know, is proposing to further augment the authorities under the ICA.

We also have a new national critical minerals strategy in place. It will help leverage Canada's national resources in a sustainable way, in partnership with indigenous peoples.

Fifth, and finally, we've also modernized our foreign policy with the Indo-Pacific strategy. This strategy calls for the strengthening of our intelligence capabilities in the region, in order to enhance our cyber-diplomacy and deepen our partnership with allies. It is supported by an investment of over $100 million for these particular areas. Within the Indo-Pacific strategy, vis-à-vis our relationship with China, Canada states its commitment to challenge, compete, co-operate and coexist. Put simply, we will never apologize for defending our national interest.

Taken together, these give the committee an overview of the government's approach to managing threats, including foreign interference.

In closing, I would like to say a few words about the activities of foreign governments in Canada. Under international law, all foreign government representatives have a duty to respect our laws and regulations. Any foreign state that threatens, harasses or intimidates Canadians and Canadian residents is in violation of these international agreements.

I assure you that the RCMP is working with the intelligence community and our law enforcement partners to address these so‑called police stations that appear to be operating in the greater Toronto area. Its goal is to ensure that the public feels safe in its own communities. It's about building trust and, where possible, enforcing the law or disrupting activities.

The only way to build trust, Mr. Chair, is by being transparent. That is why we have grown the arsenal of national security tools. However, we have simultaneously raised the bar of transparency through the creation of NSIRA, NSICOP and more frequent public reporting by our intelligence agencies. In a similar vein, we have expressed that we will explore ways to further enhance transparency with regard to our fight against foreign interference. All options are on the table. These could include requiring foreign agents to be properly registered.

However, we must bring all Canadians into this discussion as we reform our institutions so they are more diverse, inclusive and free from systemic discrimination, biases and racism.

The objective of these and other ongoing efforts is to recognize that the threat of foreign interference is not static and that we must continue to develop the tools available to Canada to deal with this evolving threat.

Colleagues, as I close, I will underline that our national security and intelligence agencies continue to investigate and monitor reports of Chinese overseas police stations in Canada. There will be no tolerance for this or any other form of intimidation, harassment or harmful targeting of Canadians or individuals within Canada.

Canada will continue to stand for its interests and values, both at home and abroad.

Thank you.

[Marco Mendicino, Liberal, Eglinton—Lawrence, ON]

In addition to Bill C-26—and you've given some highlights of it—we will work with industry and regulators to protect our critical infrastructure in a number of priority areas, including telecommunications. As you may recall, part 1 of Bill C-26 seeks to add, expressly, the objective of ensuring the security of our telecommunications sector. Beyond that, we have the protocols and policies that govern procurement, which we do in partnership with PSPC.

We also have the authorities granted to the service under the CSIS Act, which include the threat reduction measures this government introduced in 2019, but with the corresponding transparency and accountability, as granted by both NSIRA and NSICOP. There are reviews coming up for that legislation.

Mr. MacGregor, I hope that is something you and I will be able to work on, along with other parliamentarians.

We are making additional investments right across the national security and public safety apparatus so that Canadians can be assured we will be vigilant 24-7 in protecting our critical infrastructure and institutions, so we can keep them safe and preserve the Canadian interest, both here and abroad.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Thank you.

I'm sorry to cut you off, but I want to get one last policy-related question to the minister.

Minister, your government has introduced Bill C-26, which is a wide-reaching bill in terms of the powers it will give the executive branch. We know the United States has taken similar steps. Bill C-26 requires designated operators to establish and implement security programs and mitigate supply chain and third party risks. That's the legislative fix.

However, in absence of that bill—because, of course, it has not yet passed Parliament—where are the gaps we need to be focusing on? Is this your government's answer to closing those gaps?

Immigration and Refugee Protection Act

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Mr. Speaker, I would like to thank my hon. colleague from Edmonton Strathcona, who has done incredible work on this file.

Throughout the debate today, I have heard issues raised about the lack of clarity in this bill and the fact that there is not enough parliamentary oversight into the sanctions regime. I am just wondering if my hon. colleague could tell the House if that would inform her committee strategy. Does she see that there might be opportunities amongst the government and opposition sides to reach a compromise to make sure that the important aspect of parliamentary oversight is there?

I have noticed that, in public safety bills introduced earlier in this session, notably in Bill C-20 and in Bill C-26, there was a clear lack of parliamentary oversight specified. That will inform our strategy going forward. I am just wondering if the member could add some further comments on that.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Mr. Speaker, in several other public safety bills, notably Bill C-20 and Bill C-26, I have noticed, in the way the bills are written, there is a lack of avenue for parliamentary oversight.

One thing that has been missing with this sanctions regime is also a lack of parliamentary oversight. Would Conservatives join with New Democrats at committee to look for avenues in which this bill could be strengthened to buttress up parliamentary oversight so members of the House could make sure the government is doing its job when it should be doing its job?

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Thank you very much, Mr. Chair.

As I was saying, I'm the vice-chair of the public safety and national security committee, and it's a real pleasure to be with industry today. I appreciate and applaud my colleagues for bringing forward this very comprehensive motion to investigate a very critical issue, which I think many Canadians are paying attention to. The Prime Minister, of course, has weighed in on this as has the Minister of Public Safety.

I would like to hear more from Minister Champagne, given that he is the industry minister lead, of course, and I think it does impact a number of different areas of government, national security and, of course, industry. We can also look at the impact this will have on setting a precedent should we allow these types of contracts to continue.

Now, the government has said that it is pausing this contract, but I do have concerns given that the company that received the contract is ultimately owned in part by the company Hytera, as mentioned by my colleague, which is based in the People's Republic of China. We know that some of that technology in this contract is already being implemented in Ontario and Saskatchewan. I have not heard from Minister Champagne or the Prime Minister or the Minister of Public Safety whether this pause of the contract will mean that this government will be insisting on the removal of that technology that's already in place, again, for surveillance purposes, for RCMP. It's quite shocking when you consider that the parent company, which is in part owned by the People's Republic of China, is now sort of responsible for the surveillance technology of our RCMP.

I would have thought that would be one of the first things they would have committed to. If there were any threat to our national security, in setting a precedent in this surveillance industry that we have in Canada, whether it's for national security or within our telecoms utilized by, for example, the Department of National Defence, you would think they would set a clear standard that this is unacceptable and it would be removed immediately.

We did see, with the Liberal government, they took about five years to commit to removing the Huawei technology, and, because it took so long, it will cost hundreds of millions of additional dollars that will be passed down to the consumer. Huawei and the 5G technology we saw have so infiltrated our telecommunications systems that it will be very hard work to remove that.

I have those same concerns with what's happening here. As my colleague mentioned, earlier this year, I believe on February 22, the U.S. Department of Justice unsealed a federal indictment showing that there were 21 charges of conspiracy to commit theft of trade secrets against Hytera.

We see that in the United States they're being very aggressive and transparent with the threat from Hytera, which again is sort of the parent of the parent company that owns Sinclair. We see the Americans taking very strong action on this, yet we have not seen the Prime Minister or the Ministry of Industry or the Minister of Public Safety make a very clear statement that this surveillance technology that is being provided by this ultimately Chinese-owned company, so to speak, will be removed in Ontario and Saskatchewan.

I'd like to hear that and I'd like the Minister of Public Safety and the Ministry of Industry to come to this committee and make that commitment.

Further to that, Mr. Chair, I am concerned that there may be other contracts like this and that has not been made clear. This was found because of very solid journalism in this country. That's great, but are there more? You would think if there's one, there are likely others. We know that recently the Minister of Foreign Affairs put forward her Indo-Pacific strategy, and that falls under the Canada-China committee, which I also sit on.

There was certainly appreciation for the tougher stance that was communicated in that Indo-Pacific strategy, but what I would say is that the government on one side is saying that procurement is independent. They're blaming the independent system of procurement of this government. They're saying it's independent and they don't agree with it, but it is independent. They're sort of blaming others for what has happened under their watch, but what I would say is that every independent agency of government certainly has to follow the ethos, the values set forward by the Prime Minister and his cabinet.

I would argue that perhaps if the Indo-Pacific strategy for which the Conservatives have been calling for quite some time had been brought forward sooner, the procurement agency would have had a better idea of the threat analysis of China and companies that are partly Chinese-owned that provide surveillance technology and other technologies. Perhaps they would have had that lens to apply to this contract.

I don't believe that it is an appropriate assessment by the Prime Minister to sort of kick this over to the independent procurement agency and say it's all on them. If they had brought forward the Indo-Pacific strategy, which makes quite a bit more clear the threat analysis of China, perhaps the independent procurement agency would have had a more clear picture in order to enter any contracts with companies like this with eyes wide open.

I know there is some discussion around whether this falls under public safety, whether this falls under foreign affairs, whether this falls under the China committee or whether this falls under industry. Certainly, Minister Champagne is bringing forward bills like Bill C-27, which is in part related to the Minister of Public Safety's Bill C-26. Bill C-26 ultimately is a bill to deal with telecommunications in this country and other companies that are providing national security critical infrastructure types of services.

I would say that both committees and both ministers play a role. Given that Bill C-26 and Bill C-27 are closely related in some ways, and given what I know about the industry committee, I think it would make sense and would not be out of scope to have the ministers come forward to this committee.

I hope that members consider that, given that this may be an industry-wide problem, even beyond telecommunications and surveillance. This could be in data management. We can see health services and the privacy information therein. There are countless industries across Canada that may very well have contracts owned in part or in full that are connected to the People's Republic of China.

This is a national security concern. My point is that it also impacts a number of industries, and that's why we're seeing similar bills under Minister Mendicino and Minister Champagne.

I do feel that it is appropriate to set the standard for industry at the industry committee that these types of contracts will not be tolerated any longer. Certainly, we must bring to the attention of the Minister of Procurement and other ministers impacted by this, that, given the very clear message—or, I would say, clearer message—set forth in the Indo-Pacific strategy, there needs to be a whole-of-government approach to reviewing all contracts provided.

The last thing I will mention is that it is not just government contracts that are of concern. There are other private contracts that are of concern in multiple different industries, or there may be. If there's one that got through the procurement vetting process with the Government of Canada, it is very likely that there are a number of private entities that have contracts that would impact our national security and that really go across a number of industries.

I appreciate the very comprehensive 106(4) motion put forward. It certainly is exhaustive, and I think that's important because we want to make sure we don't have any cracks. It is very critical that we ensure that the veil is lifted on this so to speak. By passing this 106(4), the industry committee sends a very clear message to all industries that may have contracts with the People's Republic of China—which may impact data security, surveillance and the like—to take note. The industry committee taking a leadership role in that, I think, sends a very strong message across industries that are critical to our national security.

I hope that the committee considers that. I hope it considers taking that leadership position and certainly leads by example at this committee and sets a very clear tone, so that any industry impacted by national security concerns shall be made aware.

Those would be my remarks. Thank you, Mr. Chair.

Telecommunications Act

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague from Saint‑Hyacinthe—Bagot, who said he wished that we could talk a bit about what is being done proactively, and that is what I intend to do.

As members know, we cannot discover new worlds until we have the courage to not see the shore. Those who know me know that I would rather talk about the “why” than the “how”. I like to clearly define what we are talking about.

Let us start with the word “security”. Security is an absence of worry. It is peace of mind, a form of safety. It is rather easy to define.

Now, what is the definition of the prefix “cyber”? Cybersecurity is a word that is used in all kinds of ways. We want to combat cybercrime with cybersecurity. We want to prevent cyberstalking. Sometimes it can be confusing. What is the meaning of the prefix “cyber” that is used everywhere?

The origin of the word will help us to understand it. It was coined after the Second World War by an American researcher named Norbert Wiener. This brilliant mathematician was hired by the Massachusetts Institute of Technology, or MIT, to work on a research project on new types of weapons. More specifically, he was asked to develop missiles that could take down V‑1s and V‑2s, the unmanned German aircraft filled with explosives that were causing so much damage in England.

To that end, Professor Wiener had to model the behaviour of a pilot who knew he was being chased in order to better understand the decision-making mechanisms of humans in general. We will use the term human so as not to offend anyone. In 1948, Norbert Wiener named this field of research “cybernetics”, a new area of science that studies the mastery of machines. He was inspired by the Greek term kubernao, which means to pilot and from which the terms “government” and “governance” are also derived. It means “to steer”.

In 1949, Wiener's book was deemed one of the most important works of the 20th century. The New York Times praised it and predicted that cybernetics would be a leading branch of science in the future, which has come to pass. This book still contributes practical knowledge to today's world because one of the main concepts underlying this new theory is that of regulation. That is what we are discussing today.

With the Internet, everything becomes cyber, but the societal challenge is huge because in cyberspace we no longer know what is the cause and what is the effect. We are no longer certain who governs and who is governed. We no longer strive to determine if the chicken came before the egg or if the egg came before the chicken. In cyberspace, we cannot make sense of the chickens and the eggs.

When we talk about the Internet, we are talking about space and time. Space and time are concepts that, throughout history, have allowed us to place and understand ourselves. In philosophy it is said that nothing exists without space and time because everything is always somewhere in space and in a given moment, it is situated in time.

However, the Internet is everywhere and nowhere. In fact, when we talk about the web we picture an entanglement of threads without a centre. Humans, with their neurolinguistics, have a hard time placing themselves when there is no centre. We are always looking for the end. The Internet does not have one. In space, there is no centre and time is eternal. The Internet is always, never, and in perpetuity. It is therefore very hard to understand and associate with the cyber point of view.

Bill C‑26 is divided in two parts. In the first part, it says that it seeks to reinforce the security of the Canadian telecommunications system. Then there are indications of how it will change this and how it will change that. In the second, it says it will create the new critical cyber systems protection act to do this or that. I am summarizing the bill.

I noticed when I read Bill C‑26 that there is a lot of “how” and not a lot of “why”. What is the “why” behind Bill C‑26? In my opinion, there is just one reason why and that is to ensure that citizens can trust in the mechanism that protects them in the area of cybernetics and cyberspace.

Trust is complicated because it is not something that is easily granted. I will use the example given by my colleague from Saint‑Hyacinthe—Bagot. I know him and he is conspicuous in his absence, even though I am not allowed to say that. I do not have eyes in the back of my head.

It is pretty easy to build up trust between two individuals. However, trusting an entity, a company or a government is harder. Trust means having peace of mind, without needing supporting evidence. It is difficult to achieve in the public sphere. It is essential, however, and I think that is what Bill C-26 seeks to accomplish.

Trust begins with education and insight. Since this has been explored in speeches throughout the day, I will not dwell on it, but the geopolitical world is changing these days, and the balance of power is shifting. In addition, it is hard to know where the centre is, as I explained a little earlier.

The Canadian government's foreign policy is vague at best. It took years for the government to acknowledge that there was a problem with Huawei. It was the only Five Eyes nation that did not see the inevitable, that did not see the evidence right under its nose.

I am talking about education, but the bill does not contain any provisions for education in cybersecurity. I am talking about education in terms of privacy and facial recognition. Education would help people avoid the temptation to commit the act that we are trying to prohibit here.

We also know that we are stronger together. It is interesting to see who has already thought about these issues. One of our colleagues said that other institutions have thought about this. Yes, there is a concept known as cyber diplomacy, which involves co-operation and dialogue between nations. Moreover, to answer a question that has not been asked, which is the nature of philosophy, the Council of Europe could offer some very interesting answers and solutions in this matter.

This brings me to another question. Despite the many measures, there are quite a few things I do not see in this bill. I do not see measures that would prevent our devices from being taken over by malware, for example, or by a foreign power. Device takeover is something we recently studied at the Standing Committee on Access to Information, Privacy and Ethics. It is not the stuff of science fiction; it is actually happening now.

Also, I do not see how this bill prevents intellectual property infringement. I could name 200 other things I do not see in this bill, but I will mention just one more. I do not see how we are going to regulate what is known as the dark web. However, the bill names six organizations that will have the power to act as regulators.

However, I would like to ask the following question: Do these organizations have the necessary knowledge to do that? It is not always clear. In previous bills on other subjects, we were told, for example, about the CRTC, which was responsible for implementing some provisions. We saw that the CRTC was an outdated organization. The organizations in question now are not much better.

Cybersecurity is not something that is easy to regulate. That is why it is a good idea to look up and try to see a little further. I agree that the bill is well-intentioned, but intention without courage is meaningless.

A poet that I recently met in Montmartre told me that there is no love, only shows of love. It is the same thing here, except that we are talking about shows of courage, and so I hope that the government will show courage with Bill C‑26 and turn its intentions into action.

Let us send Bill C‑26 to committee as soon as possible.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, Bill C‑26 does contain some good solutions and some interesting elements.

The only thing is, we will have to look at the details and see what is next. Are we giving the minister too much power? At the same time, we may have to think twice about giving more power to the minister at the expense of Parliament when we are not sure whether the minister will fulfill his commitments. There have been promises followed by waffling in the past. There are definitely things that need to be looked at, yes, but at least this bill is motivated by good intentions. For that alone, it deserves to be supported at this stage.

[Francis Scarpaleggia, Liberal, Lac-Saint-Louis, QC]

Madam Speaker, it is an honour for me to rise at second reading stage of Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts.

When we consider the opportunities and challenges before us in this area, we see that the theme of collaboration underpins all that we do. Take, for example, the prevalence of cybercrime in an increasingly online world, improving cyber-defence posture in an unstable global environment, deep thinking about what the future holds in a world where innovation and change are exponential, a critical look at whether our policies and laws are up to the task, and the protection of content and intellectual property as data becomes one of the world's most precious resources.

In Canada, being online and connected is essential. Now more than ever, Canadians rely on the Internet for their daily lives. It is about more than just conducting business and paying bills. It is also about staying connected with loved ones across the country and around the world. We should be able to do all these activities safely and securely.

I would like to offer a few words about what we are doing here in Canada to get that balance right. I would like to reinforce the importance of our commitment to protecting the cyber systems that underpin our critical infrastructure.

The emergence of new technologies such as 5G is one clear reason we need to redouble our efforts. Think about our increased reliance on technology in light of the COVID-19 pandemic. Think about international tensions amidst Russia's unprovoked and unjustified invasion of Ukraine, with threats ranging from supply chain disruptions to state and non-state malicious cyber-activity.

Through all of these remarkable events, the government has been working tirelessly to keep Canadians safe. We recognize that, now more than ever before, secure and reliable connectivity is a necessity for our daily lives and our collective safety and security. It underpins the delivery of critical services, such as energy production, financial transactions, safe transportation and emergency communications.

As part of his mandate, bestowed by the Prime Minister, the Minister of Public Safety is seized with the opportunity and the challenge of developing a renewed national cybersecurity strategy. We need to make sure we articulate Canada's long-term plan to protect our national security and economy, deter cyber-threat actors, and promote norms-based international behaviour in cyberspace.

The Government of Canada is working to enhance the cybersecurity of the country's critical infrastructure. The work to identify cyber-threats and vulnerabilities, and to respond to cyber-incidents, is ongoing. Unfortunately, we have seen that malicious actors continue to attempt to take advantage of the current environment to exploit certain sectors.

However, we are not starting from scratch in our fight against this threat. Since 2018, the Government of Canada has invested a total of approximately $2.6 billion in cybersecurity. Through the national cyber security strategy, the Government of Canada is taking decisive action to strengthen Canada's defence, preparedness and enforcement against cyber-threats.

The strategy was paired with the largest investment in cybersecurity ever made by the Government of Canada, totalling nearly $800 million in the 2018 and 2019 federal budgets. In the 2021 budget, the government allocated an additional $791 million to improve and defend cyber-networks, enhance data collection and protect taxpayer information.

In the 2022 budget, another $852.9 million was committed to enhance the Communications Security Establishment, or CSE, and its ability to conduct cyber-operations, make critical government systems more resilient, and prevent and respond to cyber-incidents on critical infrastructure.

Under the strategy, two flagship organizations were established. One is the Canadian Centre for Cyber Security, under CSE, and the other is the National Cybercrime Coordination Centre, or NC3, under the RCMP.

The Canadian Centre for Cyber Security is a single, unified team of government cybersecurity technical experts. The centre is the definitive source of technical advice, guidance, services, messaging and support on cybersecurity operational matters for government, critical infrastructure owners and operators, the private sector and the Canadian public.

The NC3 coordinates Canadian police operations against cybercriminals and established a national mechanism for Canadians and businesses to report cybercrime to police.

Public Safety Canada's Canadian cybersecurity tool also helps owners and operators of Canada's critical infrastructure to evaluate their cyber-maturity against established benchmarks and by peer comparison. It offers concrete guidance on how they can become more cyber-resilient.

Public Safety Canada also coordinates and delivers cybersecurity exercises for the critical infrastructure community to test and develop capabilities to respond to and recover from malicious cyber-activities. More broadly, the department, as the federal lead on cybersecurity policy, promotes communication and collaboration to raise awareness of cyber-threats and risks, including with our international partners.

Public Safety Canada works closely with CSE's Canadian Centre for Cyber Security to enhance the resilience of critical infrastructure in Canada. The Canadian Centre for Cyber Security shares valuable cyber-threat information with Canadian critical infrastructure owners and operators, in addition to providing public advisories.

Today, I am very proud to say that we can start debating a new bill to further strengthen what we have built. Today we are starting the debate on Bill C‑26, an act respecting cyber security. The objective of this bill is twofold.

First, it would amend the Telecommunications Act to add security as a policy objective, bringing the telecommunications sector in line with other critical infrastructure sectors. This would allow the government, if necessary, to mandate any action necessary to secure Canada's telecommunications system, including its 5G networks. This includes authority to prohibit Canadian telecommunications service providers from using products and services from high-risk suppliers.

Second, it introduces the new critical cyber systems protection act. This new act will require designated operators in the federally regulated sectors of finance, telecommunications, energy and transportation to take specific actions to protect their critical cyber systems, and it will also support organizations' ability to prevent and recover from a wide range of malicious cyber-activities, including electronic espionage and ransomware. Cyber-incidents involving a certain threshold will be required to be reported.

The bill will also give the government a new tool allowing it to take action in response to threats and vulnerabilities with respect to—

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Madam Speaker, I will be sharing my time with the fantastic member for Lac-Saint-Louis.

It is with great pleasure that I rise to discuss Bill C-26, an act respecting cybersecurity. I will address elements in the legislation that deal with securing Canada's telecommunications system.

As Canadians rely more and more on digital communications, it is critical that our telecommunications system be secure. Let me assure this House and in listening to the debate today I think we all agree that the issue of cybersecurity is of utmost importance. The Government of Canada takes the security of this system seriously, which is why we conducted a review of 5G technology and the associated security and economic considerations.

It is clear that 5G technology holds lots of promise for Canadians for advanced telemedicine, connected and autonomous vehicles, smart cities, cleaner energy, precision agriculture, smart mining, and a lot more. Our security review also made clear that 5G technology will introduce new security concerns that malicious actors could exploit. Hostile actors have long sought and will continue to seek to exploit vulnerabilities in our telecommunications system.

CSIS, the Canadian Security and Intelligence Service, acknowledged this in its most recent publicly available annual report. The report states:

Canada remains a target for malicious cyber-enabled espionage, sabotage, foreign influence, and terrorism related activities, which pose significant threats to Canada's national security, its interests and its economic stability.

The report states, “Cyber actors conduct malicious activities to advance their political, economic, military, security, and ideological interests. They seek to compromise government and private sector computer systems by manipulating their users or exploiting security vulnerabilities”.

The CSIS report also highlighted the increasing cyber-threat that ransomware poses. The Communications Security Establishment has similarly raised concerns about threats like ransomware in recent public threat assessments. We have seen how such attacks by criminal actors threaten to publish a victim's data or block access to it unless a ransom is paid. However, it is not just cybercriminals doing this. CSIS warned that state actors are increasingly using these tactics, often through proxies, to advance their objectives and evade attribution.

To be sure, Canadians, industry and government have, to this point, worked hard to defend our telecom system, but we must always be on the alert, always guarding against the next attacks. This has become more important as people now are often working remotely from home office environments.

5G technology is adding to these challenges. In 5G systems, sensitive functions will become increasingly decentralized in order to boost speeds when required.

Cell towers are a familiar sight in our communities and along our highways. The 5G networks will add many smaller access points to increase speeds. As well, the number of devices that the 5G network will connect will also grow exponentially.

Given the greater interconnectedness and interdependence of 5G networks, a breach in this environment could have a more significant impact on the safety of Canadians than with older technology. Bad actors could have more of an impact on our critical infrastructure than before.

The security review we conducted found that in order for Canada to reap the benefits of 5G, the government needs to be properly equipped to promote the security of the telecommunications system. We need to be able to adapt to the changing technological and threat environment. For these reasons, we are proposing amendments to the Telecommunications Act. The amendments will ensure that the security of our telecommunications system remains an overriding objective.

This bill will expand the list of objectives set out in section 7 of the Telecommunications Act. It will add the words “to promote the security of the Canadian telecommunications system”.

It is important for those words to be in the act.

It means government will be able to exercise its powers under the legislation for the purposes of securing Canada's telecommunications system.

The amendments also include authorities to prohibit Canadian telecommunications service providers from using products and services from high-risk suppliers in 5G and 4G networks if deemed necessary and after consultation with telecommunications service providers and other stakeholders.

It would also give the government the authority to require telecommunications service providers to take any other actions to promote the security of the telecom networks upon which all critical infrastructure sectors depend.

We have listened to our security experts; we have listened to Canadians; we have listened to our allies and we are following the right path. We will ensure that our networks and our economy are kept secure. A safe and secure cyberspace is important for Canada's competitiveness, economic stability and long-term prosperity.

It is clear that the telecommunications infrastructure has become increasingly essential. It must be secure and it must be resilient. Telecommunications presents an economic opportunity, one that grows our economy and creates jobs. The amendments to the Telecommunications Act accompany the proposed critical cyber systems protection act. This bill will improve the ability of designated organizations to prepare, prevent, respond to and recover from all types of cyber-incidents, including ransomware. It will designate telecommunications as a vital service. Together, this legislative package will strengthen our ability to defend the telecommunications and other critical sectors, such as finance, energy and transportation, that Canadians rely on every single day.

The legislation before us today fits within the Government of Canada's telecommunications reliability agenda. Under this agenda we intend to promote robust networks and systems, strengthen accountability and coordinate planning and preparedness.

Canadians depend on telecommunications services in all aspects of their lives, and the security and reliability of our networks has never been more crucial. These services are fundamental to the safety, prosperity and well-being of Canadians.

We will work tirelessly to keep Canadians safe and able to communicate securely. This legislation is an important tool to enable us to do that. I look forward to working with members in this House to getting this right and making sure that our telecommunications system is as strong as it can be.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, the right to access is absolutely key. We have seen some incredible technological advancements that have helped those who face disabilities in a wide variety of things. Outside of the context of what Bill C-26 directly addresses in terms of cybersecurity, there is a particular connection, because if we do not have things like secure networks, if we do not ensure that our telecoms have consistent and stable networks that we can trust as a country, then access becomes a real issue. Malicious foreign-state actors could take advantage of that, which would disadvantage all Canadians, but specifically those who depend on technology to mitigate things like disabilities.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, it is an honour to enter into debate in this place, especially when it comes to issues that are so very pressing in relation to national security and some of the challenges that our nation is facing. I would suggest the whole discussion around cybersecurity is especially relevant, because we are seeing highlighted, each and every day, a drip of new information related to foreign interference in our elections.

It highlights how important the conversation around cybersecurity is. It is often through computer and technological means that these malicious, foreign state actors will attack Canadian infrastructure. It is particularly relevant that I rise to debate Bill C-26, relating to the Liberals' recently introduced bill on cybersecurity, and I would like to highlight a couple of things.

The first thing is about seven years of inaction. I find it interesting, after seven years, how it was heard at the ethics committee from a whole host of experts in the field, including on cybersecurity and a whole range of issues, that the government is missing in action. It is not just about the government's inaction, but it is missing in action when it comes to some of the key issues surrounding things like cybersecurity. It has the direct consequence of creating uncertainty in terms of the technological space in the high-tech sector, which has massive opportunities.

We hear the Ottawa area referred to as silicon valley north. We have the Waterloo sector that has a significant investment in the high-tech sector. In my home province of Alberta, there is tremendous opportunity that has been brought forward through innovation, specifically in the Calgary area where we are seeing massive advancements in technology, but there is uncertainty.

Over the last seven years, the government has not taken action when it should have been providing clear direction so that industry and capital could prosper in our country. That is on the investment and economic side, but likewise, on the trust in government institutions side, we have seen an erosion of trust, such as the years-long delay on the decision regarding Huawei.

I and many Canadians, including experts in the field, as well as many within our Five Eyes security partners, were baffled about the government's delay on taking clear and decisive action against Huawei. Even though our Five Eyes, a group of countries that shares intelligence and has a strong intelligence working relationship, sees how inaction eroded the trust that these other nations had in Canada's ability to respond to cyber-concerns and threats. There is the fact that a company, a state-owned enterprise, has clear connections to a malicious foreign actor.

That delay led to incredible uncertainty in the markets and incredible costs taken on by private enterprise that simply did not have direction. Imagine all the telecoms that may have purchased significant assets of Huawei infrastructure because the government refused to provide them direction. There were years and years of inaction.

I will speak specifically about how important it is to understand the question around Canadian institutions. I would hope that members of the House take seriously the reports tabled in this place, such as from the public safety committee, which in the second session of the last Parliament I had the honour of sitting on. There is a whole host of studies that have been done related to this.

Then there are the CSIS reports tabled in this place containing some astounding revelations about foreign state actors and their incursions and attempts to erode trust in Canadian institutions. Specifically, there was a CSE report for 2021, which I believe is the most recent one tabled, that talks about three to five billion malicious incursions in our federal institutions a day via cyber-means. That is an astounding number and does not include the incursions that would be hacks against individuals or corporations. That is simply federal government institutions. That is three to five billion a day.

There are NSICOP reports as well. The RCMP, military intelligence and a whole host of agencies are hard at work on many of these things. It highlights how absolutely important cybersecurity is.

I find it interesting, because over the last seven years the Liberals have talked tough about many things but have delivered action on very few. Huawei is a great example. Cybersecurity is another. We see a host of other concerns that would veer off the topic of this discussion, so I will make sure that I keep directly focused on Bill C-26 today. The Liberal government is very good at announcing things, but the follow-through often leaves much to be desired.

We see Bill C-26 before us today. There is no question that action is needed. I am thankful we have the opportunity to be able to debate the substance of this bill in this place. I know the hard work that will be done, certainly by Conservatives though I cannot speak for the other parties, at committee to attempt to fix some of the concerns that have been highlighted, and certainly have been highlighted by a number of my colleagues.

The reality is Canadians, more and more, depend on technology. We saw examples, when there are issues with that technology, of the massive economic implications and disruptions that take place across our country. We saw that with the Rogers outage that took place in July. Most Canadians would not have realized that the debit card system, one of the foundational elements of our financial system, was dependent upon the Rogers network. For a number of days, having disruptions in that space had significant economic implications. It just speaks to one of the many ways Canadians depend on technology.

We saw an example in the United States, so not directly in Canada, when the Colonial Pipeline faced a ransomware attack. A major energy pipeline on the eastern seaboard of the United States was shut down through a cyber ransomware attack. It caused massive disruptions.

Another Canadian example that has been reported in talking to some in the sector was Bombardier recreational products. The Quebec company is under a cyber-lockdown because of hostile actions. There are numerous other examples, whether in the federal government or in the provinces, where this has been faced.

There are a number of concerns related to what needs to take place in this bill to ensure that we get it right. It needs to align with the actions that have taken place in our Five Eyes allies. We need to ensure that the civil liberties question is clearly answered.

We have seen the government not take concern over the rights of Canadians to see their rights protected, their freedom of speech, whether that is Bill C-11. I know other parties support this backdoor censorship bill, but these are significant concerns. Canadians have a right to question whether or not there would be a civil liberties impact, to make sure there would not be opportunity for backdoor surveillance, and to ensure there would be appropriate safeguards in place and not give too much power to politicians and bureaucrats as to what the actions of government would be.

As was stated by one stakeholder in writing about this, the lack of guardrails to constrain abuse is very concerning. In Bill C-26, there is vague language. Whenever there is vague language in legislation, it leaves it open to interpretation. We have seen how, in the Emergencies Act discussion and debate, the government created its own definition of some of the things that I would suggest were fairly clearly defined in legislation. We have to make sure it is airtight.

Massive power would be given to the Minister of Industry in relation to many of the measures contained in this bill.

I look forward to taking questions. It is absolutely key we get this right, so Canadians can in fact be protected and have confidence in their cybersecurity regime.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, I will be sharing my time with the member for Battle River—Crowfoot.

I am proud to rise on behalf of my constituents in the not-quite-fully-connected riding of Renfrew—Nipissing—Pembroke. As the longest-serving member of the national defence committee, I fully appreciate the need for Canada to secure critical cyber systems.

For too long, the government remained indifferent while Canada's telecom companies were being infiltrated, robbed of intellectual property and sabotaged. It took the collective pressure of our Five Eyes allies before the government put up any resistance to the Huawei expansion throughout Canada’s telecom infrastructure.

Only after having been thoroughly shamed and threatened with being cut off from critical security intelligence has the government finally responded with legislation. However, as is so often the case with all governments, having finally been shamed into action, the executive branch overreacted. It now falls upon Parliament to moderate the executive overreach.

Cybersecurity is not a partisan issue. No party ran on a platform to make Canada insecure again. The Conservatives support sending this bill to committee for carefully considered amendments. I hope my colleagues across the aisle will be open to working in a collegial way to ensure that we as parliamentarians strike the right balance. This legislation must balance security with privacy and transparency. It must balance expeditiousness with efficiency and effectiveness.

I appreciate that the members opposite will place greater trust in this government than most Canadians will, but what about the next government or the one after that? Our duty as parliamentarians is to keep in check not just this government but future governments as well. To that end, I encourage all parties to work together at committee and bring back a bill that we can all support.

There are four main issues that need high-level scrutiny. However, as we saw with the invocation of the Emergencies Act, even when Parliament gives clear definitions, the executive branch believes it can extrapolate or simply opt for an overly broad interpretation. While the government has been forced to defend its decision on the use of the Emergencies Act in a public inquiry, Bill C-26 lacks any significant accountability measures while granting even more extraordinary powers, including issuing secret orders.

It should not fall upon the operators of critical cyber systems to guess what the government means by “immediately”. The bill currently grants the government the power to order telecom providers to do anything necessary to secure the telecommunications system. Granting the executive the power to do anything would be a dereliction of our duty as parliamentarians. To give the government the power to do anything while enabling those things to remain secret would be an outright betrayal of our duty.

It is understandable and reasonable that some secrecy is required to combat foreign espionage, but there must be clearly defined limits. There must be avenues for operators to appeal and for Parliament to scrutinize the government’s actions. By “Parliament” I mean Parliament. I do not mean some government committee of parliamentarians but a parliamentary committee.

This bill grants the government the power to deny services to any company or person by secret order. Had this law already been in place, there would be nothing to stop a government from cancelling the Internet and phone service of protesters the government disagrees with.

Granting the government the power to deny services to individuals using secret orders clearly violates the legal rights of Canadians. I do not want to trust the government with that kind of power. I expect my Liberal colleagues would not trust that kind of power when the Conservatives form government, hopefully very soon.

To paraphrase a great comic character, with great power must come great accountability. There are serious cyber-threats and those threats are growing. The government must have the tools to respond quickly and decisively, yet when governments move quickly, mistakes are made. That is why it is all the more important for there to be a robust set of measures to review their actions and ensure accountability when the government makes a mistake.

This legislation takes the extraordinary step of placing personal liability on individual employees of critical infrastructure operators. We threaten people with jail time to ensure they are accountable for their companies' cybersecurity, yet we do not hold government employees or ministers to the same standard. Just as the House must find the appropriate balance between security, secrecy and accountability, so too must we find the balance between privacy and transparency.

The government learned first-hand the public’s reaction to its undisclosed use of mobility data from millions of cellphone users. Canadians had demonstrated a willingness to abide by public safety measures, even extraordinary measures, but the minute the government started tracking our cellphones, even for a public health purpose, Canadians reacted strongly. Even Canadians who supported forced vaccination and punishing the unvaccinated drew a line at cellphone tracking.

The legislation before us would grant even more power to collect data from telecom providers with no restrictions on distributing it to other departments. Even if this data was held by the CRTC, Canadians would be concerned about their privacy. However, it would not be the CRTC doing the data scoop; it would be the Communications Security Establishment.

I appreciate the government feels the CSE is best equipped for countering cyber-threats, but the main purpose of the CSE is collecting intelligence from abroad. The CSE does not report to the public safety minister, who is responsible for keeping Canadians secure. The CSE does not report to the industry minister, who is responsible for telecoms regulations. The CSE reports to the defence minister. It is a fundamentally different type of organization from CSIS or the CRTC.

The legislation would fail to place sufficient limits on what the CSE can do with the data it can secretly order telecoms to provide. In no way is this meant to disparage the work done by the CSE, but as we expand the powers of the CSE, we must also constrain the scope of what it can do with those powers.

These are just some of the trade-offs we must consider when the bill goes to committee. Groups such as the Canadian Civil Liberties Association, the Citizen Lab and the Business Council of Canada have raised several more. However, the one area none of these groups have touched on, at least to my knowledge, is the role private citizens can play in securing Canada against cybersecurity threats. Parliamentarians have studied this both at the defence committee and with our fellow legislators at the NATO Parliamentary Assembly. Canada can take a lead role internationally in cybersecurity by enlisting the aid of ethical hackers, commonly referred to as “white hats”.

White hat hackers represent an untapped resource for a country as large as ours. Our critical infrastructure spans a continent. The job of securing it exceeds the capacity of the federal government and infrastructure operators. If we can develop a framework that protects and incentivizes white hat hackers, we may have a solution. As with the measures already in the legislation, such a framework would involve trade-offs. Even an ethical hacker could unwittingly cause significant cyber-disruption and damage, but they can just as easily expose flaws and gaps.

Regardless of whether the government acknowledges the existence of ethical hackers, they will continue to operate, and it is better for critical infrastructure operators, public servants and the Canadian public if we find a way to incorporate them into our defence strategy. We need to enlist ethical hackers because we simply do not have the resources as a nation to confront the threats.

Globally, cybercrime costs reached over $600 billion U.S. in 2021. Investments in cybersecurity were only $220 billion U.S. last year. Between criminals, terrorists and authoritarian states, the potential for significant damage is accelerating. Our enemies are going to match the best cyber-defences in the world. We do not have the resources to match the United States or the EU. That is why we must be even smarter than our adversaries and our allies.

The legislation is all stick and no carrot. Governments are quick to punish because it is easy. If company X fails to properly secure a critical system, they get a fine, but what if the company innovates and not only prevents an intrusion into their system but detects the source? The bill would require companies to immediately report intrusions, but what about failed attacks? If Bell, Telus and Rogers were to all successfully fend off an attack on the same day, would that not be something we would want the CSE to know about? Punishing failure is an important deterrent, but rewarding success is a powerful incentive.

In this cyber age, we need data to flow both ways. We can enhance our cybersecurity by taking both a carrot and a stick approach. We must pass robust cybersecurity legislation, but it must not compromise the rights of Canadians. We need a cyber-shield and a cyber-sword. As a vast, underpopulated nation full of remote critical infrastructure, we must be smart and creative in how we utilize every possible resource available, including enlisting white hats.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague from Kingston and the Islands for his speech, which was informative as always.

However, I would like to know how this bill will enhance public trust in the Internet. What mechanism in Bill C‑26 will help guarantee public trust?

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Madam Speaker, I thank the member for Whitby for sharing his time with me.

It is very important that we talk about such an important piece of legislation that has been brought forward, Bill C-26. The reality is that the changes in technology are happening so incredibly quickly. At times, it seems a daunting task to keep up with them and to make sure that we are always ahead of those actors out there, whether state or non-state, who are trying to engage in activities that could seriously cripple our economy or other aspects of society in Canada.

It seems as though it was just yesterday that we did not have the Internet. I remember vividly when I signed up for my first Internet connection, a dial-up connection, and having access to the Internet. That was when I was a computer engineering student at a local college in Kingston back in 1995 or 1996. Downloading something as simple as a single image sometimes would take two or three minutes to get the full image on the screen.

[Denis Trudel, Bloc, Longueuil—Saint-Hubert, QC]

Madam Speaker, I am not a cybersecurity expert either.

A few weeks ago, I attended a demonstration in Montreal with 10,000 people to support the people who are fighting for their freedom in Iran, which, as we know, is not a democratic state. I have also strongly supported people from the Uighur community, who I have met with many times here in Ottawa. We know that they are facing genocide in China. The small white square that I am wearing is a sign of support for people who, at this time, are rising up against the health measures in China, as well as the people in Russia who are protesting against the war in Ukraine.

I want to know if there are concrete measures in Bill C‑26 that would prevent Iran, China and Russia from carrying out cyber-attacks on social networks and, for example, hacking my account and interfering in my life as an MP? I would like my colleague to clarify that.

[Ryan Turnbull, Liberal, Whitby, ON]

Madam Speaker, as part of the mandate bestowed upon him by the Prime Minister, the Minister of Public Safety is seized with the opportunity and challenge of developing a renewed cybersecurity strategy. We need to make sure we articulate Canada’s long-term plan to protect our national security and economy, deter cyber-threat actors, and promote norms-based international behaviour in cyberspace.

The Government of Canada is working to enhance the cybersecurity of the country’s critical infrastructure. The work to identify cyber-threats and vulnerabilities, and to respond to cyber-incidents, is around the clock and ongoing. Unfortunately, we have seen that malicious actors continue to attempt to take advantage of the current environment to exploit certain sectors. I would like to use one example that is relevant for my riding and the region I come from.

My riding is the riding of Whitby, and Durham District School Board is the public school board in our area. On Friday, November 25, just very recently, there was a cyber-incident at the Durham District School Board. It resulted in online classes being cancelled. They were forced to postpone scheduled literacy tests. They have had phone lines down and email service down. They even do not have access to emergency contacts, and they are trying to limit this incident so it does not impact payroll for the over 14,000 Durham District School Board employees. There are 75,000 students who go to school across our region.

They have notified police of the attack. Their investigation is said to be very complex and time consuming, and they will be assessing the privacy impacts, but we can just imagine how this has impacted students and employees at Durham District School Board.

This is a really serious topic. I think we all need to give it the weight it deserves, and this legislation is trying to ensure we do our utmost to protect against these cyber-threats in the future.

However, we are not starting from scratch to tackle these threats. Since 2018, the Government of Canada has invested a total of approximately $4.8 billion in cybersecurity. Through the national cybersecurity strategy, the Government of Canada would be taking decisive action to strengthen Canada’s defence, preparedness and enforcement against cyber-threats. The strategy was paired with the largest investment in cybersecurity ever made by the Government of Canada, totalling close to $800 million in the 2018 and 2019 federal budgets.

In the 2021 budget, the government allocated an additional $791 million to improve and defend cyber-networks, enhance data collection and protect taxpayer information, and in the 2022 budget, another $852.9 million was committed to enhance the Communications Security Establishment and its ability to conduct cyber-operations, make critical government systems more resilient, and prevent and respond to cyber-incidents on critical infrastructure.

Under the strategy, two flagship organizations were established. One is the Canadian centre for cybersecurity, otherwise known as the cyber centre, under CSE, and the other is the national cybercrime coordination centre under the RCMP.

The cyber centre is a single, unified team of government cybersecurity technical experts. The centre is the definitive source of unique technical advice, guidance, services, messaging and support on cybersecurity operational matters for government, critical infrastructure owners and operators, the private sector, and the Canadian public.

The NC3 coordinates Canadian police operations against cybercriminals and established a national mechanism for Canadians and businesses to report cybercrime to police. In the example I mentioned in my riding of the Durham District School Board, it would report the cybercrime to the local police, and that would go up through NC3 as well.

Public Safety Canada’s Canadian cybersecurity tool also helps owners and operators of Canada’s critical infrastructure to evaluate their cyber-maturity against established benchmarks and by peer comparison. It offers concrete guidance on how they can become more cyber-resilient.

Public Safety Canada also coordinates and delivers cyber-based exercises for the critical infrastructure community to test and develop capabilities to respond to and recover from malicious cyber-activities. More broadly, the department, as the federal lead on cybersecurity policy, promotes communication and collaboration to raise awareness of cyber-threats and risks, including with our international partners. Public Safety Canada works closely with the Communications Security Establishment’s Canadian centre for cybersecurity to enhance the resilience of critical infrastructure in Canada. The cyber centre, in addition to providing public advisories, shares valuable cyber-threat information with Canadian critical infrastructure owners and operators.

Today I am very proud to say that we can begin to debate a new piece of legislation to further strengthen what we have built as a government. Today we are debating Bill C-26 for the second reading, and this legislation's objective is twofold.

The first part proposes to make amendments to the Telecommunications Act, which include adding security as a policy objective, adding implementation authorities and bringing the telecommunications sector in line with other critical infrastructure sectors. This would allow the government, when necessary, to mandate any action necessary to secure Canada’s telecommunications system, including its 5G networks. This would include authority to prohibit Canadian telecommunications service providers from using products and services from high-risk suppliers.

The second part introduces the critical cyber systems protection act, or CCSPA. This new act would require designated operators in the federally regulated sectors of finance, telecommunications, energy and transportation to take specific actions to protect their critical cyber-systems, and it would support organizations' ability to prevent and recover from a wide range of malicious cyber-activities, including malicious electronic espionage and ransomware.

[Ryan Turnbull, Liberal, Whitby, ON]

Madam Speaker, before I begin, I will just say that I will be splitting my time with the member for Kingston and the Islands.

It is an honour to rise today in the House to debate the second reading of Bill C-26, an act respecting cybersecurity. To me, cybersecurity is essential, and it certainly relates directly to our national security.

When we consider the challenges and opportunities we face in this field, the theme of collaboration underpins and needs to underpin all that we do.

The prevalence of cybercrime in an increasingly online world, improving cyber-defence posture in an unstable global environment, deep thinking about what the future holds in a world where innovation and change are exponential, a critical look at whether our policies and laws are up to the task, and the protection of content and intellectual property as data becomes one of the world's most precious resources: These are just some of the reflections that we have to have when considering this bill.

In Canada, being online and connected is essential. Now, more than ever, Canadians rely on the Internet for their daily lives. It is about more than just conducting business and paying bills. It is also about staying connected with loved ones across the country and around the world. We should be able to do all these activities safely and securely.

I would like to offer a few words about what we are doing here in Canada to get that balance right, and I would like to reinforce the importance of our commitment to protecting the cyber systems that underpin our critical infrastructure.

We can take the emergence of new technologies, such as 5G, as one clear reason we need to redouble our efforts. We think about our increased reliance on technology in light of the COVID-19 pandemic. We think about international tensions amidst Russia’s unprovoked and unjustified ongoing invasion of Ukraine, with threats ranging from supply chain disruptions to state and non-state malicious cyber-activity.

Through all of these remarkable events, the government has been working tirelessly to keep Canadians safe. We recognize that, now more than ever, secure and reliable connectivity is a necessity for our daily lives and our collective safety and security. It underpins the delivery of critical services, such as energy production, financial transactions, safe transportation and emergency communications.

As part of his mandate, bestowed by Prime Minister Trudeau, the Minister of Public Safety is seized with the opportunity and challenge of developing a renewed national—

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Mr. Speaker, we live in a world where every person is increasingly concerned with cybersecurity. So much of our lives is stored on our personal devices, protected by passwords and multi-factor authentication in the hopes of keeping our most private information secure.

Corporations are increasingly at risk. It seems as if every day we hear a new report of companies’ computer systems being hacked and their data held for ransom by thieves who have managed digital anonymity. Law enforcement officials say many such cybercrimes go unreported, with companies paying quietly and privately so as to avoid publicity.

Our public institutions are not immune either. Hospitals have had their computer systems attacked by intruders, putting patients' lives at risk. Emergency services have been attacked, as have the parliamentary computer systems.

Cyber-threats remain a national security and economic issue that threatens the safety and security of Canadians. Government and industry alike have highlighted the need for regulation in cybersecurity. There has been a lot of talk, but not much else.

Currently the Canadian government does not have a legal mechanism to compel action to address cyber-threats or vulnerabilities in the telecommunications sector, yet cybersecurity has become one of the primary issues each person and institution has to address. I am pleased that the government has introduced this legislation to allow us in the House to examine the cybersecurity concerns and needs of our nation.

Bill C-26 would amend the Telecommunications Act as well as other related acts. The intention would be to amend the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything that is necessary to secure the Canadian telecommunications system.

I do not think there is anyone in the House, indeed in the country, who would disagree with the objective. As I have already pointed out, there is a problem with cybersecurity in our society, and government has an important role to play in protecting Canadian individuals and institutions. Some may wonder about giving such power to the Governor in Council and the Minister of Industry, but there are rules for the judicial review of those orders and applications. This is not a granting of absolute power, but of limited power subject to the checks and balances needed in a democracy.

The bill would also enact the critical cyber systems protection act to provide a framework for the protection of the cyber systems of services and systems vital to national security or public safety. This, among other things, would authorize the Governor in Council to designate any service or system as a vital service or vital system. It would require designated operators to establish and implement cybersecurity programs, mitigate supply chain and third party risks, report cybersecurity incidents and comply with cybersecurity directions.

One would think that such cybersecurity measures should be common sense and not need to be mandated by government. Is it right to compel private corporations and organizations to use their own resources to invest in cybersecurity? It would seem to me that well-run businesses would put cybersecurity first. Not every aspect of a business generates income, and smart business managers and owners know that. As the cliché goes, they have to spend money to make money.

Implementing cybersecurity measures comes with a cost. There is no doubt about that. It would seem to me, though, that the cost would be considerably less than the cost of dealing with criminals holding their data for ransom after they have invaded their computer system and locked them out of it.

Cybersecurity makes common sense for business. However, given that implementing cybersecurity measures comes with a financial cost with no corresponding revenue, do we really want to rely on those who might put short-term profits first, or does it make more sense in this case for government to step in to save some business owners from themselves?

As someone who has spent most of his life working as a businessman, I am reluctant to suggest that business owners need to be saved from themselves, but as a Canadian I know that sometimes such action is necessary.

We have only to look at the history of one of Canada's most successful companies: Nortel. It is a company that might still exist if those running it had taken cybersecurity more seriously. With more than 94,000 employees worldwide, Nortel was a high-tech leader until its headquarters were bugged, its computer systems breached and its intellectual property stolen. Now it is just a memory. We will never know for sure, but perhaps if cybersecurity had been a higher priority at Nortel, it would still be providing jobs, products and services for Canadian people. If anyone ever asks why we would take cybersecurity seriously, the one-word answer is “Nortel”.

Though I am a little uneasy that this bill would almost certainly increase regulations and red tape, maybe there are ways that some of the excessive paperwork that seems to be beloved by the Liberals can be made reasonable. Certainly there is a need to ensure a level playing field of regulatory burdens for small and medium-sized businesses and organizations. If there is not, then I can see companies being forced into bankruptcy by the cost of implementing government-mandated cybersecurity procedures. I know that is not the government's intention, but as we have seen in the past, sometimes not all the impacts of government rule-making are foreseen. The Minister of Industry especially needs to ensure that the rules are workable and provide protection against attacks by criminals and malicious states.

Indeed, it is perhaps malicious states that we should be concerned about the most. The interconnectedness of computer systems and their use in controlling and maintaining our infrastructures mean we are increasingly vulnerable to a devastating attack. An enemy that could seize control of our electricity grid or our banking system could bring our nation to its knees without firing a shot. The nature of warfare has changed, and as a result we must change our defences.

Canada's national security requires being prepared for the security warfare threats that we face. The government has been slow to address cyber-threats and has seen a number of serious incidents occur, with no substantive legislative response for seven years. I am pleased that the government has finally chosen to act, and I am hopeful that we in the House can help improve this legislation. Cybersecurity is of paramount importance in the modern world. Canada cannot neglect it.

The House resumed consideration of the motion that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

Business of the House

[Mark Holland, Liberal, Leader of the Government in the House of Commons]

Mr. Speaker, we will need to wait for the unanimous consent motion to see what will happen. I will wait for that. There is good news for the member opposite in that he has the opportunity, at committee of course, to review those guns and make any suggestions his members would like. I am sure, as a long-serving member, he would be aware of that opportunity, but I just remind him of that.

The Speaker will be pleased to know we will continue with debate at second reading of Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts. Tomorrow we will begin debate at second reading of Bill C-23, the historic places of Canada act.

On Monday, we will begin debate at report stage and third reading on Bill C-32, the fall economic statement implementation act, 2022. Thursday will be the final allotted day of the current supply period. For the rest of the week, priority should be given to Bill C-32.

I would also like to indicate that on Tuesday there will be a statement by the minister on the commemoration of the Polytechnique massacre.

Telecommunications Act

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Madam Speaker, I have no problem clarifying. Several of the places I went into were following provincial orders, to be clear, and they were to record who showed up and whether or not they were vaccinated. That is what was done, and that is against PIPA and PIPEDA.

I will turn to the government's record on protecting us in terms of cybersecurity, and talk about Huawei.

In 2018, our Five Eyes partners were concerned about Huawei's connection to the Chinese communist government, and they were not going to allow Huawei into their networks. However, the Canadian government delayed a decision for four years. The Liberals waited until 2022 to ban Huawei. Why did they do that? It was so Bell and TELUS could implement Huawei technology, 4G technology, across the country. That is hardly a protection from a cybersecurity point of view, and it again speaks to why Canadians have lost trust in the government.

However, I will support the bill to go to committee. I have said that we need to do something for cybersecurity, and I have outlined what I think we need to do. I do not think we can leave these huge gaps that have been cited by numerous institutions.

The University of Toronto has written letters to the government, talking about what is wrong with the bill and what it would like to see. If members have not seen the report it did with the Munk School, called “Cybersecurity Will Not Thrive in Darkness”, there are a number of recommendations in the report that talk about what needs to be done to Bill C-26 to fix it. I would encourage the government to look at that, and I would expect it to become the substance of amendments that would be brought at committee.

Also, we should look at what the constitutional and civil liberties lawyers are saying. They are very concerned about the parts of the bill that would surveil Canadians, so I think we need to make sure we listen to what they have to say. They have written an open letter to the government, and I would recommend that the government take a look at that as well.

Finally, on accountability, due process and public regulation, there is potential for abuse. I would encourage the government to take a look.

I look forward to more discussion at committee.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Madam Speaker, it is a pleasure to rise today to speak to Bill C-26 on cybersecurity. I will be sharing my time today with the member for Edmonton Manning.

Canadians recognize that we need to do something in the area of cybersecurity. We have all experienced hackers. Myself, when I have bought something online, the next thing I know is my credit card is hacked and then all the pre-authorized transactions need to be changed. It is very time-consuming. I have been hacked numerous times on Facebook, as I am sure many have, as well as on Instagram and other places. Those are small examples that Canadians are seeing.

Let us think about the more serious cyber-hacking we are seeing, whereby government systems are hacked and breaches of information are happening. Businesses are experiencing this. I have a friend who is an anti-cyber hacker. For $2,500 a day, he goes around the world, helping companies that have been hacked to improve their protections.

Something needs to be done. I would like to talk today about what needs to be done, and then how the bill does or does not meet that need.

First, we have to identify what the critical systems are. What are the things we want to protect? If somebody hacks my Netflix account, it is not earth-shattering. However, there are things that are important, and I think everyone would agree that databases that protect our identity or have information about our identity are critical.

Financial institutions and people's financial information are critical. On our medical information, we have spent a lot of time on legislation and regulations on protecting medical privacy. Those, to me, would be three of them, but certainly, the critical systems need to be identified.

We need to make sure there are adequate protections in place. Not every business and level of government has the same amount of protections and technology in place. There is a journey of defining what adequate protection is and helping people get there.

In the case of breaches and having them investigated and addressed, the bill gives very broad powers to the minister. It allows the federal government to secretly order telecom providers to “do anything or refrain from doing anything...necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.”

Those three terms are not well defined, so I think there is some work to be done to define those better, but I do not really believe we want to give the government power to do anything it wants. Certainly, shutting down a system for protection is important when there is an actual threat and not just a potential future threat or a possible threat. In the case of a threat, the government needs the ability to act, but certainly we have to tighten up the language in the bill on that.

After there has been a breach, there needs to be preventive and corrective action. Preventive action would be additional technology walls or additional controls that are put in place to ensure that we have enhanced protection in the future. Corrective action is fixing the holes that people got into in the first place and punishing the hackers. It does not seem like any of that is happening today. The bill does not address that, but there should be some measures there to take corrective action.

I talked about the overarching powers and my concern with them. We cannot have the government continually coming up with bills in which it has not really defined what it is going to do but it tells us not to worry about it because the Governor in Council, after the fact and without any parliamentary oversight, will determine what we are going to do.

The Governor in Council means the Liberal cabinet ministers. I think we are at a place where people have lost trust in the government because there is no transparency. The bill allows the government to make orders in secret, without telling people what is done. The public cannot see it and is suspicious, because people have seen numerous examples of the government hiding things.

We have just come through a $19-million emergency measures act situation in which the Liberal cabinet ministers and the Prime Minister knew they were never going to disclose the documents that would prove or disprove whether they met the threshold, because they were going to hide behind solicitor-client privilege.

They have done it before, hiding behind cabinet confidence, like on the Winnipeg lab issue. Look at the documents we tried to get hold of there. The Liberals even sued the Speaker in order to hide that information from Canadians.

In the SNC-Lavalin scandal, we saw them hiding behind cabinet confidence. In the WE Charity scandal, we saw them hiding behind cabinet confidence. I am a little concerned, then, to find that in this cybersecurity bill, the Liberals are saying the government can make secret orders that the public is not going to ever know about. I think that is very dangerous. This is one of the reasons we are seeing an erosion of trust in Canada.

A recent poll posted by The Canadian Press showed that if we look at the trust index in Canada, only 22% of Canadians trust the government or politicians. That means four out of five Canadians do not trust the government or politicians, and it is partly because of what has gone on before, when things have been done such as people's banks accounts frozen and drones surveilling citizens. People have lost trust, so I do not think they are going to be willing to give a blank cheque to the government to do whatever it wants for cybersecurity, to control enterprises outside the government to get them to stop operating, for example. The riverbanks need to be much tighter on that.

People are concerned about their civil liberties, and I know there has been a lot of conversation about the lack of privacy protection in this country. We have regulations like PIPA and PIPEDA. My doctor cannot reveal my medical information; my employer cannot reveal my medical information, but various levels of government in the pandemic made it so that every barmaid and restaurant owner could know my private medical information and keep a list of it, which is totally against the law. Therefore, when it comes to cybersecurity we are going to have to make sure the privacy of Canadians' information is better protected, and I do not see that element here in the bill—

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I am pleased to rise to speak to Bill C-26, which will strengthen the security of critical infrastructure and Canada's telecommunications system.

Since June, many experts have been working to learn more about the provisions of this act and assess the value of what the government is proposing.

First, this bill is not structured in the usual way. I see that the urgent need to manage cybersecurity has been taken into account. This bill would give the minister new responsibilities, but the Governor in Council would also be able to act. The law is essentially a regulatory framework that will enable the government to make regulations to ensure the security of critical cyber systems.

I want to focus on the second part of the bill, because passing it will create a new law, the critical cyber systems protection act, which will provide a framework for the protection of critical cyber-infrastructure or businesses under federal jurisdiction. The affected sectors of our economy are identified as designated operators. It is easy to determine which businesses and organizations are affected.

The government has done well to specify who will must comply with the obligations: persons, partnerships or unincorporated organizations that belong to any class of operators set out in schedule 2 of the new law. Those classes will be identified by order.

Each class of operators will be assigned a corresponding regulator, such as the Minister of Innovation, Science and Industry, the Minister of Transport, the Office of the Superintendent of Financial Institutions, the Canadian Energy Regulator, the Bank of Canada or the Canadian Nuclear Safety Commission.

Schedule 1 of the new act sets out the vital services and vital systems that will form the basis of these designations, which may be added at a later date: telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems that are within the legislative authority of Parliament, banking systems, and clearing and settlement systems.

I would like to draw my colleagues' attention to Hydro-Québec. An important part of the bill that has the Bloc Québécois concerned is the part on vital services and vital systems, which could potentially involve interprovincial power lines and distribution networks. It is of paramount importance that this section of the bill be studied and clarified in committee to assess whether this will affect Hydro-Québec and, if so, how.

However, we are not against the underlying principles and objectives of securing and protecting interprovincial infrastructure. Hydro-Québec reportedly suffers more than 500 cyber-attacks a year, or roughly 41 attacks a month. That is more than one attack a day. This could jeopardize our power grid, putting the life and economic health of every Quebecker at risk. It could also jeopardize customers' personal information, although that is generally a secondary target in any attack against a publicly owned energy corporation.

Although Hydro-Québec has managed to fend off these cyber-attacks and protect itself by investing in systems, firewalls and employee training, why should we not take proactive measures? Not only is it very time-consuming for businesses like Hydro-Québec and Desjardins to protect themselves and react to the constant onslaught of cybersecurity attacks, but it is also very expensive. Hopefully, this bill will help prevent or limit these attacks by taking a proactive approach and regulating and promoting new cybersecurity frameworks among Internet service providers. This is particularly important in light of the increased threat to our infrastructure from bad state actors such as Russia or China.

Hopefully, unlike today, businesses will have resources they can consult for information about cyber-attacks.

This is also a national security issue. These states have become emboldened not just by the Canadian government's passive reaction, but also by the regulatory void. We need only think of Huawei and the threat it represents, as well as the damage it has caused to the national security of countries around the world, especially in Africa. The examples are quite striking. China has passed a law forcing all businesses to contribute to the advancement of the objectives of Chinese intelligence services, which is particularly alarming when we consider that this country uses coercive diplomacy, blatantly disregarding international standards.

Even though the federal government has finally banned Huawei technology, the decision was preceded by many years of uncertainty because of the pressure, power and influence that China could unfortunately bring to bear on us.

This decision showed how vulnerable we are to malicious actors on the world stage. That is why we need a regulatory framework, a way to respond to cybersecurity threats, particularly from foreign powers that are in a position of power and use the weakness of others to advance their own positions.

I met this morning with representatives from Shakepay, a Quebec-based financial technology company that operates a platform dedicated entirely to bitcoin, with over one million Canadian customers. One of the things that struck me in that meeting was the importance they place on security and customer protection. Of course, I had Bill C‑26 in mind. They told me that all customer funds are held in a trust at a ratio of 1:1 with Canadian financial institutions and leading cryptocurrency depositories. I learned that they are continually working to improve and promote the implementation of cybersecurity measures to protect their systems.

In preparing for my remarks today on Bill C‑26, I started thinking that we need to examine how we can build on the security standards of Quebec companies like Shakepay and that we need to determine whether the bitcoin and cryptocurrency industry should also be considered in Bill C‑26. Whether we like it or not, technology and customer habits may be leading us in that direction.

I would like to discuss cyber-resilience. I understand that the bill will not be studied by the Standing Committee on Industry and Technology, on which I sit. However, I see issues that affect industries that are in that niche of protecting systems from cyber-attacks. There are two things to keep in mind here: The attackers go after data using methods that were previously unimaginable, and they tend to favour methods that significantly delay the ability to resume operations. The desired consequences are financial and reputational damage.

The inherent complexity of the systems currently in place requires increasingly specialized resources. Innovation, research and development must be encouraged, in short, the entire ecosystem of this industry that works on the cyber-resilience of very high-risk systems. We need to ensure to attract the best talent in the world. The government must carry out its responsibilities at the same pace as it introduces these changes. Let us not forget, as the opportunities for cyber-attacks keep increasing, that we are always one incident away from our continuity of operations being disrupted.

Is there an urgent need for action? Yes, clearly. Is the government on the same page as the people involved in this industry? Unfortunately, it has fallen behind.

For the past year, the Standing Committee on Industry and Technology has been studying topics that enabled it to get to the heart of the advanced technologies used in the industries covered by this bill. The inherent complexity of the environments in which those industries operate expose critical data and system configurations to greater risks than ever before, so much so that we are no longer assessing the likelihood of a successful cyber-attack, but instead how to recover. In fact, as IT infrastructure has become increasingly complex, cyber-attacks have become increasingly sophisticated too.

I dare not imagine what will happen in the coming years, when AI reaches its full potential and quantum computing becomes available. What I am hearing is that hundreds of pieces of users' electronic data are stored each day on international servers. They cannot be thoroughly processed using currently available technology, but what will happen when quantum computers are able to process those data? Maybe we will be very vulnerable as a result of actions we take today by casually agreeing to things in an app or allowing our data to be collected. In short, in five years' time, we may be paying for what we are giving away today.

In conclusion, the Bloc Québécois supports the bill. We want it to be sent to committee to be studied in detail, as my colleague from Avignon—La Mitis—Matane—Matapédia said. I also welcome forthcoming opportunities for specialists in Quebec industries who are renowned for their expertise.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I will begin by saying that I will be sharing my time with the hon. member for Abitibi—Témiscamingue.

I am pleased to speak to this bill, which, I must say, was eagerly awaited by my party.

The Standing Committee on Public Safety and National Security had the opportunity to study the issue of cyber security. We heard from experts in this field, who told us what they think about Canada's cyber security preparedness or posture. The idea came from my Conservative colleagues, and it was a very good one.

Given what is happening in Ukraine with the Russian invasion, we know that there are still military threats in the 21st century. However, we are also dealing with the emergence of new technologies that pose non-military threats. I had the opportunity to talk about these non-military threats at the Organization for Security and Co-operation in Europe Parliamentary Assembly last week in Warsaw, Poland. I discussed non-military threats and how different countries must prepare for or guard against them.

What the Standing Committee on Public Safety and National Security heard is how difficult it is to prepare for these threats, because they are evolving so quickly. No one had anything particularly positive to say about Canada's preparedness.

I think that the willingness is there, and that is what the experts told us: Canada is trying to prepare for and guard against potential cyber-attacks. I said “potential” cyber-attacks, but they are already happening. We know there have been cyber-attacks on various infrastructure and companies in Quebec and Canada, especially in the private sector, in the past. Canada is not as prepared as it could be to face these attacks, but we were told that it may never be totally prepared. The same is true for all countries because, as I said, the technology is changing so rapidly.

For this reason, I think that adopting a cybersecurity framework is an extremely positive step. That is what the government promised. In its national cyber security strategy, it pledged to better regulate cyber systems in the federally regulated private sector. The 2019 budget earmarked $144.9 million to develop a new framework to protect critical infrastructure. That is exactly what the two main parts of this bill do. They are aimed at strengthening the security of the Canadian telecommunications system.

Part 1 of the bill amends the Telecommunications Act to add the promotion of security, authorizing the government to direct Internet service providers to do anything, or refrain from doing anything, that is necessary to secure Canada's telecommunications system. Part 2 enacts the new critical cyber systems protection act to provide a framework for the protection of critical cyber-infrastructure and companies under federal jurisdiction.

The act is essentially a regulatory framework. As my colleague from Abitibi—Témiscamingue mentioned earlier in his question to our Conservative colleague, we will have to see what impact this bill could have on Quebec, especially companies and organizations like Hydro-Québec, since it designates interprovincial power line systems as vital services and vital systems. More on that later.

We will also have to see in committee whether the vast regulation-making powers provided for in Bill C-26 are justified or whether they bypass Parliament for no reason. Certain groups that raised concerns in the media have contacted us as well. Their concerns about this bill are well founded. I will get back to this a little later on.

I would say that it is important to proceed carefully and properly with this bill. Any amendments made to the bill will have a direct impact on every transmission facility in Quebec, including those that will soon be built in my riding to offer adequate cell service to those who are still waiting. Some Canadian ridings are unfortunately still without cell service in 2022. Since my riding is one of them, the bill will have a significant impact.

Local telephone service providers, IP-based voice services, Internet service providers, long distance providers and wireless services will be subject to the amendments to the act.

This means that the amendments would allow authorities to secure the system if there is reason to believe that the security of the telecommunications system is under threat of interference, manipulation or disruption. In that case, telecommunication service providers could be prohibited from using or supplying certain goods or services.

As I understand the wording of the bill, which is rather complex, telecommunication service providers could even be prohibited from supplying services to a specific individual. It is important to realize that these are vast powers, and I hope that, when the bill is sent to committee for study, it will be detailed enough to include the factors that will be taken into account before such powers are granted.

As I was saying earlier, the act will make it possible to designate certain systems and services under federal jurisdiction as critical to national security or public safety. The new Critical Cyber Systems Protection Act will protect critical cyber systems in the private sector.

What, then, is a critical cyber system? I found it difficult to find a clear definition in French of what a critical cyber system is, but the government defines the term itself in the bill. It appears that it is a “system that, if...compromised, could affect the continuity or security of a vital service or vital system.”

The bills lists six vital services and systems in its schedule. These obviously include telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems that are under federal jurisdiction, banking systems, and clearing and settlement systems.

These are the areas this bill addresses. That is a lot to verify, and several actors are involved. Several ministers will be involved in the regulatory process after that, so it is important to study the bill carefully.

At this stage, a number of questions arise. For example, what impact will the bill have on certain interprovincial infrastructures, such as power lines and power grids? The act could impact Hydro-Québec and other non-federal infrastructures, such as aluminum smelters. As I understand it, the bill itself would designate interprovincial power lines as a vital service. That could have an impact.

In principle, the bill is not a problem for my party. When we call experts to testify before the committee, we will be able to determine whether or not it will have a positive impact. I think it could be very positive, but we need to look at its scope.

The Bloc Québécois has often supported the government in its efforts to ensure stricter control of broadcasting for certain vital infrastructures that could be in the crosshairs of foreign nations. Let us consider China and Russia, as I mentioned earlier. There is the Huawei saga and the development of the 5G network. The government's indecision for so many years proves that it would have been better to act beforehand rather than to react to the current situation. China's increasing power and its attempts at interference on several occasions, as well as Canada's vulnerabilities in terms of cybersecurity, are real. For example, we know that Hydro-Québec has been a potential target for Chinese espionage. The same could happen directly in our infrastructures. I think that this bill is relevant. We are very happy that the government introduced it. That is why the Bloc Québécois will vote in favour of sending the bill to a parliamentary committee so that we can hear what the experts have to say.

I would like to take these final moments to talk about the concerns voiced by certain groups. Professor Christopher Parsons of the University of Toronto said that the bill was so imperfect that authoritarian governments around the world could cite it to justify their own repressive laws. That is a worrisome statement. I will elaborate during questions and comments.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Madam Speaker, I will be splitting my time with the member for Sherwood Park—Fort Saskatchewan, a good friend of mine.

Today I get to address Bill C-26, and right off the top I will say that I think this is dumb legislation. Why do I say that? I say that because I do not think that it has attempted to do what it has stated it would do. Generally I find that this is another piece of legislation, probably the third or fourth that I have spoken on in this session of Parliament, where I am frustrated with the government in that it does not seem to do the hard work of governing.

Governing is a matter of balancing the interests and coming up with a statement or something that is clear. On the rule of law, we would anticipate the public and anticipate what the rules ought to be and then look at the law, read the law somewhere and say, “Oh, that is what we are supposed to be doing.”

Again, here we have a piece of legislation where there is a clear, identifiable problem. Canadians have seen a number of issues around the country and around the world where cybersecurity is under threat. Canadians are asking the government to govern, to set some parameters and guidelines as to what the expectations are around who gets to participate in cyberspace and how we ought to operate in cyberspace.

We see in this piece of legislation the classic attitude of “We're the government. We're here to help. Trust us. We got this.” We do not trust the government. Particularly, the Conservatives do not trust the government to do the things it needs to do. We have seen it try to hand out billions of dollars to its friends. I mentioned the WE scandal. We have seen it hand out money to its friends over at Baylis Medical. We have ample evidence of why we should not trust the government.

When it comes to cybersecurity, it is also an area where I do not trust the government. The government has been in power for seven years, and we have watched it drag its feet with an inability to come to a decision, for a whole host of reasons, around the Huawei situation. Was a particular company allowed to participate in the building of the infrastructure of our Internet architecture?

This is a major issue. We told the government that we don't think this Chinese Communist Party government-controlled company should be able to participate in the Canadian Internet infrastructure. We called on the government to ban the use of Huawei technology in our Internet infrastructure, yet it could not do it. It took the government years of dragging its feet, wringing its hands and doing a whole host of things. When the Liberals come forward with a bill like Bill C-26 and say to trust the minister and that they will get this right, I am sorry, but we do not trust the minister to get this right.

We have seen a number of security threats challenging our basic infrastructure. One we should really take note of, which was fairly recent, is the shutdown of a particular pipeline. We saw a dramatic spike in fuel prices across North America because the cybersecurity of a particular piece of pipeline infrastructure was not to the state that it should have been. This, again, comes to the fact around trusting the government to do its job, particularly this government.

One of the key roles of government in Canada and anywhere is the maintaining of peace and security, and we have a military, a police force and a judicial system for that. A growing area where we need to be concerned about peace and security is in cyberspace.

We should be able to feel that our property should not go missing. We should be able to own property, and it should be able to be maintained by us, all of these kinds of things. We expect the government to put forward registries so we can register our property, so that, if it goes missing, the government has a registry of it and we can use that to get our property back. It cannot just be expropriated from us, all of these kinds of things.

In the same way, that is increasingly a part of cybersecurity. The ownership of things in cyberspace, the ownership of websites and the ownership of even our own Twitter handles, for example, are increasingly things that are deemed to be cybersecurity.

The government seems to be lacking in the ability to protect Canadians' cybersecurity.

There is an iconic Canadian company, Ski-Doo. I do not know if people are snowmobilers, but I do enjoy snowmobiling, and Ski-Doo is an iconic Canadian company.

I do not know if people know this but, recently, Ski-Doo has been the victim of a cyber-attack and has lost control of its entire dealership network. Its own computer system has gone down. It has not been able to get it back. Somebody else has control of it now and it has not been able to get it back.

These are the types of things that I think are crucial. When one is going to bring in a bill that talks about cybersecurity, these are the kinds of things the government should be trying to keep secure. This is Canadian property. These are Canadian identities. These are Canadian brands. These are the things we need to ensure we can prosecute, that we can track these people down who are doing this kind of thing and that we can ensure cybersecurity.

I guess that is where I get a little frustrated with a bill like this. It says a lot of nice things at the top of it. The government comes here with a blanket statement around how it is going to defend cybersecurity, how cybersecurity is important and how we should all vote in favour of this particular bill. I imagine that we will.

However, the bill does not necessarily tell us what we are going to do. The banning of Huawei is not necessarily laid out in this. There are no criteria as to what the expectations are for companies to operate in this space, in terms of what they can be tied to and what they should not be tied to. It is just, “Trust us. We are the government and we are here to help.”

In addition, we have seen over the last number of years the opportunities for the government to put resources into law enforcement's ability to track some of this down. We can see changes to the Criminal Code, to ensure that some of these malware attacks or ransomware attacks could be tracked down and prosecuted here in Canada. This is a major concern for companies looking at investing in the world. They look at a country's ability to protect them from a cyber-attack but then also to prosecute those cyber-attacks.

I have a friend who works for the Calgary city police. He works in cybercrimes. He often works with police forces from around the world to track down folks who are using ransomware on Canadian companies.

He tells me they rarely, if ever, prosecute in Canada because our laws are so non-distinct around this that it is impossible to prosecute. Because these are multi-jurisdictional crimes, they will often take the prosecution of this to a jurisdiction that has better laws. He says he will work with 23 law enforcement organizations and they will bring a case in Europe, in eastern Europe or in Israel, because those places have much better laws to protect cybersecurity.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, we must always protect the civil liberties and rights of Canadians. Any legislation brought to the House needs to pass that means test, if I can call it that.

With reference to Bill C-26, it is definitely required that we update our cybersecurity laws to reflect the ongoing changes in technology that have happened over the last number of years and the increasing use of cybersecurity, cyber-threats, increasing digitization that has been going on in the world, and the fact that Canadians are increasingly interconnected in this world.

We need to maintain checks and balances within the system and ensure that individual rights of Canadians are protected.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, of course, fundamentally I believe in the oversight of government and ensuring that there are checks and balances.

When bills proceed to committee, obviously members within the pertinent committee should bring forth ideas to strengthen them, and that includes Bill C-26. Our main priority as MPs is to bring forth good legislation, to improve it and to protect the security of Canadians, whether it is their cybersecurity or health and safety. Bill C-26 would take us down that path.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I say good morning to all of my hon. colleagues, and I thank the hon. member for Davenport for her insightful discussion of this bill.

I am thankful for the opportunity to weigh in on Bill C-26, an act respecting cybersecurity, as we continue debate at second reading. Bill C-26 will take great strides to enhance the safety of our cyber systems and will make changes to allow for measures to be taken within our telecommunications system.

There are two parts to this act. Part 1 amends the Telecommunications Act to “promote the security of the Canadian telecommunications system” as a policy objective. An order-making power tied to that objective would be created for the Governor In Council, or GIC, and the Minister of Industry. That power could be used to compel action by Canadian telecommunications service providers if deemed necessary. With these authorities, the government would have the ability to take security-related measures, much like other federal regulators can do in their respective critical infrastructure sectors.

The bill would enable action against a range of vulnerabilities to these critical systems, including natural disasters and human error. The Department of Innovation, Science and Economic Development would exercise regulatory responsibilities, and an administrative monetary penalty scheme would be established to promote compliance with orders and regulations made by the GIC or Minister of Industry. Once amendments to the Telecommunications Act receive royal assent, GIC or ministerial orders could be issued to service providers.

Part 2 of the act would create the critical cyber systems protection act, or the CCSPA. The CCSPA would be implemented collaboratively by six departments and agencies: the departments of Public Safety; Innovation, Science and Economic Development; Transport; Natural Resources; and Finance, as well as the Communications Security Establishment. They will all play a key role. Indeed, across the Government of Canada, there is a recognition that cybersecurity is a horizontal issue, and it should be addressed through a streamlined government response across sectors, all rowing in the same direction.

Schedule 1 of the act would designate services and systems that are vital to the national security or public safety of Canadians. Currently, schedule 1 includes telecommunications service and transportation systems. It also includes, in the finance sector, banking systems and clearing and settlement systems, and, in the energy sector, interprovincial or international pipeline and power line systems and nuclear energy systems.

Schedule 2 of the act would define classes of operators of the vital services and systems identified in schedule 1, as well as the regulator responsible for those classes. Operators captured in a class are designated operators subject to the act.

In line with the responsibility to exercise leadership in matters related to national security and public safety, the Minister of Public Safety would have overall responsibility for the legislation and would lead a number of CCSPA-related processes.

Decision-making by GIC under the CCSPA would ensure that a broad range of relevant factors, including national security, economic priorities, trade, competitiveness and international agreements and commitments, are considered when making decisions that have an impact across sectors. The CCSPA would also leverage regulators' expertise and relationships with entities they already regulate under existing legislation.

The Canadian centre for cybersecurity, or the cyber centre, is responsible for technical cybersecurity advice and guidance within Canada, and that would be no different under the CCSPA. It would receive resources to provide advice, guidance and services to designated operators in order to help them protect their critical cyber systems; regulators in support of their duties and functions to monitor and assess compliance; and public safety and lead departments and their ministers, as required, to support them in exercising their powers and duties under the act.

The CCSPA would require designated operators to establish a cybersecurity program that documents how the protection and resilience of their critical cyber systems will be ensured. CSPs must be established by designated operators within 90 days of them becoming subject to the act, that is, when they fall into a class of designated operators published in schedule 2 of the act.

Once established, the CSP must be implemented and maintained by the designated operator in order to keep it up to date and responsive to changing threats and evolving technology. CSPs must include reasonable steps to identify and manage organizational cybersecurity risks, including risks associated with an operator's supply chain, and the use of third party products and services. They must also protect their critical cyber systems from compromise, detect cybersecurity incidents that affect or have the potential to affect CCS and minimize the impact of cybersecurity incidents affecting critical cyber systems.

This legislation would also help confront supply chain issues. With the increasing complexity of supply chains and increased reliance on the use of third party products and services, such as cloud-based data storage and infrastructure as a service, designated operators can be exposed to significant cybersecurity risks from those sources.

When a designated operator, through its CSP, identifies a cybersecurity risk to its CCS in relation to its supply chain or its use of third party services or products, the CCSPA would require the designated operator to take reasonable steps to mitigate those risks. Taking reasonable steps to mitigate risk is understood to mean reducing the likelihood of the risk materializing by, for example, securing a supply chain by carefully crafting contractual agreements to gain more visibility into equipment manufacturing, or by choosing another equipment supplier. It can also mean reducing the impact of a risk that materializes.

Under the CCSPA, there would also be a new obligation to report cybersecurity incidents affecting or having the potential to affect critical cyber systems to the Communications Security Establishment, for use by the cyber centre. A threshold defining this reporting obligation would be set in regulations. This would provide the government with a reliable source of information about cybersecurity threats to critical cyber systems. The availability of incident reports would enhance visibility into the overall threat for the cyber centre. Findings from the analyses of incident reports would make it possible for the centre to warn other designated operators and any operator of a cyber system of potential threats or vulnerabilities, and it would help to inform Canadians of cybersecurity risks and trends, allowing one organization's detection to become another's prevention.

The CCSPA would also create a new authority for the government. Under the act, the Governor in Council would be allowed to issue cybersecurity directions when it decides that specific measures should be taken to protect a critical cyber system from a threat or known vulnerability. Directions would apply to specific designated operators or to certain classes of designated operators. They would require those designated operators to take the measures identified and to do so within a specific time frame. Failure to comply with directions could be subject to an administrative monetary penalty or an offence that can lead to fines or imprisonment. The CCSPA would also includes safeguards to ensure that sensitive information, such as information that was obtained in confidence from Canada's international allies, is protected from disclosure.

All of this provides an overview of strong new legislation, which I hope I have adequately described in two distinct parts. I look forward to our continued debate of this landmark bill, and I encourage all colleagues to join me in supporting Bill C-26 today.

[Julie Dzerowicz, Liberal, Davenport, ON]

Madam Speaker, I think our Minister of Public Safety was very clear this morning. Without question, every time the government takes additional, decisive action and puts additional measures in place, there has to be corresponding transparency and accountability. We absolutely need to make sure there is enough of that in Bill C-26 so we have the confidence not only of the House but of Canadians with regard to having the proper accountability and transparency in place.

[Eric Melillo, Conservative, Kenora, ON]

Madam Speaker, I appreciate the comments from the government member across the way.

In the debate today, a number of concerns have been brought forward around some of the ministerial powers included in Bill C-26, as well as the lack of accountability mechanisms. I think we have heard from all parties about the desire to bring forward amendments and improvements at the committee stage.

Does the member opposite have a willingness to work with members of the House to ensure that we improve this bill and make sure it achieves the results it intends to?

[Julie Dzerowicz, Liberal, Davenport, ON]

Madam Speaker, I will be sharing my time with the hon. member for Vaughan—Woodbridge.

It is a true privilege for me to add my voice to the debate on Bill C-26, an act respecting cybersecurity, on behalf of the residents of my riding of Davenport, many of whom have written to me through the years about their concern around cybersecurity and the need for additional protections at all levels of government.

This bill represents the latest step in the government's constant work to ensure our systems, rules and regulations are strong and as up-to-date as possible. That is especially important when dealing with a topic as fluid and rapidly evolving as cyber-technology. We have known for quite some time we would need to be constantly vigilant on this issue.

In 2013, the government established the security review program operated by the Communications Security Establishment. In 2016, we conducted public consultations on cybersecurity. In 2018, we released the national cybersecurity strategy. In 2019, we allocated $144.9 million through budget 2019 to develop a critical cyber systems framework. In 2021, we completed an interdepartmental 5G security examination, which recommended an updated security framework to safeguard Canada's telecommunications system.

A cornerstone of the updated framework is an evolution of the security review program. It would allow for continued engagement with Canadian telecommunications service providers and equipment suppliers to ensure the security of Canadian telecommunications networks, including 5G. As a result of this multi-year work, to address these identified concerns and improve Canada's cybersecurity posture, including in 5G technology, we introduced Bill C-26.

The bill is intended to promote cybersecurity across four federally regulated critical infrastructure sectors: finance, telecommunications, energy and transportation.

Bill C-26 consists of two very distinct parts. Part 1 introduces amendments to the Telecommunications Act that would add security as a policy objective and create a framework that would allow the federal government to take measures to secure the telecommunications system. Part 2 introduces the critical cyber systems protection act, which would create a regulatory regime requiring designated operators in the finance, telecommunications, energy and transportation sectors to protect their critical cyber systems.

As I mentioned, 5G has the potential to be a transformative technology for Canadians. It promises to bring lightning-fast Internet speeds that are unlike anything we have experienced so far. The benefits of instant and real-time connectivity will be immediate and far-reaching for Canadians and Canadian businesses.

The COVID-19 global pandemic has underlined the importance of this connectivity, whether it is for virtual classrooms, work from home or keeping in touch with loved ones, but we need to be absolutely sure this technology is safe and secure as the technology is rolled out in Canada.

Canada already has a system in place to mitigate cybersecurity risks in our existing 3G and 4G LTE wireless telecommunications network. Since 2013, the Communications Security Establishment's security review program has helped mitigate risks stemming from designated equipment and services under consideration for use in Canadian 3G, 4G LTE telecommunications networks from cyber-threats.

Like previous generations, 5G technology will have new risks and vulnerabilities that will need to be addressed so Canadians can realize its full potential. 5G is considered more sensitive than 4G because it will be deeply integrated into Canada's critical infrastructure and economy, and will connect many more devices through a complex architecture. The deep integration, greater interconnection and complexity increase both the likelihood and potential impact of threats. That is why an examination of emerging 5G technology and the associated security and economic considerations continues to be very important.

The technical agencies of the Government of Canada, within the Department of Innovation, Science and Economic Development, and the safety and security agencies that fall within the Public Safety portfolio, Global Affairs Canada, National Defence and others, are all involved in the federal government's efforts to develop a made-in-Canada approach to ensuring the secure rollout of 5G wireless technology. Moving this bill forward will further that vital work.

In the meantime, our world-class national security and intelligence agencies continue to protect our country from a wide range of threats. As we know, those threats include a growing number of targeted attacks from state and non-state actors, including cybercriminals.

Canada's two main national security organizations, CSIS and CSE, which is short for Communications Security Establishment, are working tirelessly to mitigate these threats.

CSIS provides analysis to assist the federal government in understanding cyber-threats and the intentions and capabilities of cyber actors operating in Canada and abroad who pose a threat to our security. This intelligence helps the government to improve its overall situational awareness, better identify cyber vulnerabilities, prevent cyber espionage or other cyber-threat activity and take action to secure critical infrastructure.

For its part, the CSE is always monitoring for threats that may be directed against Canada and Canadians. The CSE is home to the Canadian centre for cybersecurity, which was established as a flagship initiative of the 2018 national cybersecurity strategy. With the cyber centre, Canadians have a clear and trusted place to turn to for cybersecurity issues. It is Canada's authority on technical and operational cybersecurity issues, a single, unified source of expert advice, guidance, services and support for the federal government, critical infrastructure for owners and operations, the private sector and the Canadian public. It helps to protect and defend Canada's valuable cyber assets and works side by side with the private and public sectors to solve Canada's most complex cyber issues.

For example, the cyber centre has partnered with the Canadian Internet Registration Authority on the CIRA Canadian Shield. The shield is a free protected DNS service that prevents users from connecting to malicious websites that might infect their devices or steal personal information. With the passage of the National Security Act in 2019, Canada's national security and intelligence laws have been modernized and enhanced.

As a result, CSIS and the Communications Security Establishment now have authorities they need to address emerging national security threats, while ensuring that the charter rights of Canadians are protected.

These updates are in line with CSIS's mandate of collecting and analyzing threat-related information concerning the security of Canada in areas including terrorism, espionage, weapons of mass destruction, cybersecurity and critical infrastructure protection.

The passage of the National Security Act also established stand-alone legislation for the CSE for the first time ever. With the Communications Security Establishment Act, the CSE retained its previous authorities and received permission to perform additional activities.

For example, the CSE is now permitted to use more advanced methods and techniques to gather intelligence from foreign targets. Under the CSE Act, CSE is mandated to degrade, disrupt, influence, respond to and interfere with the capabilities of those who aspire to exploit our systems and to take action online to defend Canadian networks and proactively stop cyber-threats before they reach our systems. It is also permitted to assist DND and the Canadian Armed Forces with cyber operations.

As Canada's national police force, the RCMP also plays a very important cybersecurity role. It leads the investigative response to suspected criminal cyber incidents, including those related to national security.

Cybercrime investigations are complex and technical in nature. They require specialized investigative skills and a coordinated effort. That is why, as part of Canada's 2018 national cybersecurity strategy and as a second flagship initiative, the RCMP has established the national cybercrime coordination centre, or NC3.

The NC3 has been up and running for over a year now. It serves all Canadian law enforcement agencies, and its staff includes RCMP officers and civilians from many backgrounds. Working with law enforcement agencies, government and private sector partners, the NC3 performs a number of roles, including coordinating cybercrime investigations in Canada.

All of this is backed up by significant new investments in the two most recent budgets. In budget 2019, we provided $144.9 million to support the protection of critical cyber systems and we later invested almost $400 million in creating the Canadian centre for cybersecurity, the national cybercrime coordination unit and increased RCMP enforcement capacity.

Whether it is nationally or internationally, I have full confidence in the abilities of all those in our national security and intelligence agencies who are working hard day and night to safeguard our cybersecurity and protect us from harm online. I am confident that Bill C-26 will go a long way to continue doing that.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, a group of organizations, including the Canadian Civil Liberties Association, OpenMedia and Leadnow, have written an open letter calling for improvements to Bill C-26. One of the items they call out is that secrecy undermines accountability and due process.

The member for Windsor West spoke a bit about this in his speech. Could he share more about the suggested improvements that would ensure better public reporting as part of Bill C-26?

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Madam Speaker, I am a little concerned with some of the elements in Bill C-26 that seem overly broad. They give the government powers to secretly order providers to do things or refrain from doing things, without any transparency. Does the member share my concern?

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, I am please to speak today to Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

It is really important to acknowledge that we are severely behind with regard to our protections in this matter. I am going to quote from myself, from when I once engaged the government and asked them this. “I am very concerned that we are not doing enough in Canada to protect the digital privacy of Canadians and am calling on the government to develop stronger frameworks and guidelines to improve cyber security in Canada. These are critical issues that must be addressed”. They must be addressed for the benefit of Canada, as our economy and commerce are currently under threat, as is our personal privacy.

When did I do that? That was in 2016. From 2016 to today, with the digital changes we have had, is a lifetime of change.

I got a response from the government at that time, basically saying it would refer matters and let them play themselves out in court.

One of the most famous cases that came forward at the time involved the University of Calgary, which had reportedly paid $20,000 in compensation to a group of organizations we do not know to protect the breach they had.

What has taken place over several different cases and also in our current laws has shown that it is okay to pay out crime and it is okay to pay out these types of requests for extortion and not even refer that matter back to the people whose privacy has been breached. We do not even have to report it as a crime to law enforcement agencies. It is very disturbing, to say the least. Getting this legislation is something, but it is still a long way off.

As New Democrats, we recognize very much that there needs to be balance in this. This is why I also wrote at that time to the then privacy commissioner of Canada, Jennifer Stoddart, about the cyber-attacks and data breaches.

There is concern about the amount of data and one's rights and one's protections and the knowledge one should have as an individual in a democracy. I do not think it is a conspiracy theory to have those kinds of concerns.

I would point to a simple famous case. As New Democrats are well aware, and I think other Canadians are as well, our number one Canadian champion of health care, Tommy Douglas, was spied upon by his own RCMP at that same time. That was in relation to bringing in Medicare. This is very well documented. We still do not have all the records. We still do not have all the information, and it is a very famous case.

Bringing in our number one treasured jewel, health care, led to a case where our own system was spying on an elected representative who was actually declared Canada's greatest Canadian by the public. We do not want to forget about those things because, when we are introducing laws like this, there is a real concern about one's ability to protect oneself and one's privacy, as well as the expansive conditions that are going to change, often with regard to personal privacy.

What also took place after that was that I was very pleased, in 2020, to put a motion forward at the House of Commons industry committee, where we studied, for the first time in Canadian history, fraud calls in Canada.

There are a lot of cyber-attacks through this type of operating system, and we need to remind ourselves that using this type of system, being our Internet service providers and the telecoms sector, is something that is done by giving up the public infrastructure and a regulated system of industry.

We have built a beast, in many ways, that has a low degree of accountability, and we are finally getting some of that restored. There are also some new programs coming in, like STIR/SHAKEN and other types of reporting that is required.

I want to point out that since we have done that, we have another report that will be tabled, or at least a letter. We have not decided yet, and there is still work going on, but we have had a couple more meetings in the industry committee about it and we have really heard lots of testimony that showed that there is more work that can and should be done.

A good example from the previous report that we did was recommendation number five, which went through sharing information between the RCMP and the CRTC. We have not seen the government act on it.

It is important to note that with this bill there has been a lot of talk about the types of things we can do internationally, as well. One of the things I would point out that I have been very vocal on, because I have had Ukrainian interns in my office for a number of years, is that we could use a lot of our leverage in terms of cybersecurity and training to help them to deal with the Russian hacking and other nefarious international players. That would not only help Ukraine right now in the war with Russia. It would also help with the other activity that comes out of this subsequently, which would help the world economies by having trained, solid professionals who are able to use their expertise and battle this with regard to the current state of affairs and also the future. This would be helpful, not only for the Ukrainian population but also for the European Union, Canada, North America and others, who will continue to battle more complex artificial intelligence and other cyber-attacks that take place.

One of the things I want to note is that in the bill, a proposed new section 15.2 of the act would give the Minister of Industry and the Minister of Public Safety the authority to make several types of orders. It relates to guiding TSPs to stop providing services if necessary. This is a strong power that we are pleased to see in this type of legislation.

What we are really concerned about, as the member for Elmwood—Transcona noted, is that there is no general oversight of the type that we would normally see on other types of legislation. Scrutiny of regulations was the one referred to. For those who are not familiar with the back halls and dark corners of Parliament, there is a committee that I was one of the vice-chairs of at one point in time. The scrutiny of regulations committee oversees all legislation passed in the House of Commons and ensures that the bureaucratic and governmental arms, including that of ministers, whatever political colour they will be of at that time, follow through with the laws of the legislation that is passed. Making this bill not have to go through that type of a process is wrong. I would actually say it is reckless, because the committee has to do a lot of work just to get regulatory things followed on a regular basis. It can be quite a long period, but there is that check and balance that takes place, and it is a joint Senate and House of Commons committee. It is unfortunate that the legislation tries to leave that out.

The legislation also does not have the requirement to gazette information in terms of making it public for the different types of institutions. That is an issue, and it also has a lot of holes when it comes to information that can be withheld and shared.

Why is that important with regard to confidence in the bill? It all comes down to the fact that many of the institutions at risk of being targeted involve not only the private sector, where we have seen not only abuse of customers themselves, or businesses with lax policies that do not protect privacy very well, but also others that have used abusive techniques and processes. Even right now, it is amazing when we think about the information in the process that is going on in the United States. The U.S. Senate is going to oversee the issue with regard to Taylor Swift tickets and Ticketmaster again. That is another one that has had a nefarious past with regard to privacy, information and how it runs its business. People can go back to look at that one, with Live Nation and so forth. At any rate, the U.S. is also involved in this.

I raised those things because it also comes from the soft things like that, which are very serious with respect to credit cards and to people's personal information that is shared. However, across the world and in Canada we also have municipal infrastructure and government institutions that are constantly under attack. That is very important, because it is not just the external elements with regard to consumer protection and business losses, which are quite significant and into the billions of dollars. It is also everything from water treatment facilities to health care facilities in terms of hospitals and utilities for power and hydro. All those elements can be used as targets to undermine a civilian population as well, and one of the things we would like to see is more accountability when it comes to those elements. There is definitely more to do.

One of the things I do not quite understand, and which I am pleased to see the government at least bring to committee, is what we could do to educate the population.

Our first intervention on this bill as New Democrats was several years ago, and it is sad that it is just coming to fruition now.

[Xavier Barsalou-Duval, Bloc, Pierre-Boucher—Les Patriotes—Verchères, QC]

Mr. Speaker, we are talking about Bill C‑26, which deals with national security, and discussions about national security inevitably include the issue of interference from elsewhere, from other countries. Security threats can be internal as well as external.

With respect to external threats, there is a lot of talk right now about the possibility that China interfered in our elections. Earlier, some of our colleagues mentioned that, a few years ago, the Prime Minister received nearly $70,000 in donations immediately after a bank that offers services specifically to Chinese Canadians set up shop in Canada. The donations, which were mostly from people with Chinese names, were made on the same day and within hours of the bank being authorized to open.

Does my colleague find that strange? Is he concerned that there might have been some kind of interference? It is hard to believe that this happened by accident and that it was all just a fluke.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Speaker, with thanks to the chamber, I am pleased to rise today to speak to Bill C-26.

Cybersecurity is a topic that is very much on the minds of many Canadians. It is something that many of us have had experience with in our personal lives, or we know somebody who has. Certainly, as MPs, we hear from folks who have fallen prey to various kinds of cyber-attacks online. We know it is a burgeoning criminal industry to take advantage of people online, grab their information and impersonate their identities. Canadians deserve to be protected from this kind of crime.

We also heard about the impact that cybersecurity attacks have had on our commercial industries. One of the examples that stands out in my mind of particular concern was the 2017 cyber-attack on Equifax, where the personal and financial information of thousands of Canadians was obtained illegally. It is an obvious concern for folks when they find out that a company they trusted with their personal information has been subject to this kind of attack.

We also know that our government has not been immune from these kinds of attacks. Hospitals and Global Affairs Canada have been the object of successful cyber-attacks. Earlier this fall, the House of Commons had a cyber-attack. MPs were warned about changing their email passwords for fear of information in their work accounts being exposed to outside eyes and ears that would find out what was going on in those accounts.

There is no question that it is a real issue. There is also no question, when we talk to experts on the file, that Canada is a laggard in respect to cybersecurity. There have been many debates in this place about the role of Huawei, for instance, in our 5G infrastructure. The government did finally take a decision on Huawei, I think the right decision, although late in the game with respect to our other Five Eyes allies. The idea with this legislation is that the government needs more legal authority in order to implement that decision. Of course, there are a number of ways it can do that.

The bill, as it stands, is not ready to go, but New Democrats are happy to send it to committee where we can hear from experts and try to improve it. When I say it is not ready to go, in my view, it is that for as long as it took for the government to reach a decision on Huawei, it clearly was not doing any work alongside its deliberations on Huawei to prepare for banning it. This legislation would largely give a broad, sweeping power to the Minister of Industry to decide later what exactly the government will have to do in order to ban Huawei and respond to other kinds of cyber-threats.

There is not a lot of detail in the legislation, and that is something we have seen from the government on other fronts. We have seen it on unrelated items, like the Canada disability benefit. It drafted a bill that had no content on the program. The attitude is “trust us and we will get it right later”. However, we also see a litany of problems with the way the government manages its business, whether we go all the way back to the SNC-Lavalin affair and the question of deferred prosecution agreements or other ethical issues that have come up in the context of this government.

I think Canadians are right to have a certain distrust of the government. The answer lies in mechanisms that impose accountability on the government, and those are very clearly absent from this legislation. In fact, not only are they absent from the legislation but the government also very explicitly exempts itself from some of the current types of accountability that do exist.

For instance, it exempts itself from the Statutory Instruments Act, which would make it possible for the parliamentary regulations committee to review orders that the minister may issue under the new authority granted to him in this act.

Therefore, not only would there be no new accountability measures commensurate with the new powers the government would be giving itself, but it would also be exempting itself from some of the accountability mechanisms already there. The government is also explicitly letting Canadians know its intention in the legislation to give itself the legal authority to keep those orders secret. Therefore, we have to contemplate the idea that there will be a whole branch of secret orders and laws that govern the telecommunications industry that Canadians will not know about, and the telecommunications companies may not have an adequate awareness of them.

Where I would like to go with this is to talk a bit more broadly about the Internet and about privacy rights on the Internet. When the new Canada-U.S.-Mexico trade agreement was signed, there was a number of provisions in that agreement that went too far in shoring up the rights of companies to keep their algorithms secret, for instance. There are other kinds of IP protections, or protections that are sold as IP but really mean that it is harder to get a transparent accounting of how companies operate on the Internet and of the artificial intelligence they use to navigate the Internet.

There is a way of dealing with the Internet that prioritizes secrecy for commercial purposes, but that same secrecy also breeds more opportunity for malignant actors on the web to go about their business and not have to worry they will have to expose what it is they are doing. Whereas, if we look to the European Union as another model, for privacy and conducting business on the Internet, there are a lot more robust protections there for the private information of consumers on the Internet, and there are a lot more reporting requirements for actors on the Internet.

The problem with the bill as it is written here is that it would be trying to fight secrecy with secrecy. When firefighters show up to a house that is on fire, they do not usually show up with a flamethrower. They show up with something else that can fight the fire instead of accelerating it.

I do not think Canadians, who are concerned about malignant actors on the Internet and the ways that they are able to exploit the dark corners of the Internet and the back doors of software, also think that the way to fight that is to let the government do it in secret without any reporting. Canadians are not thinking that, with less information available about actors within the digital space or government actions against cybersecurity threats, they are better off if they do not know what the actors on the Internet are doing, and they do not know what the government is doing about it.

The problem with the bill as written is that it would double down on the approach that we saw in CUSMA. It was about privacy for actors on the Internet and privacy for the government in how it deals with it. Instead, it could take a more open-source approach to say that the way forward on the Internet has to be that digital actors have to be upfront about the kind of business they are conducting on the Internet, the ways they do it and the algorithms they use. Governments, likewise, could then be pretty transparent about how they would deal with people who were non-compliant or who were breaking the rules.

New Democrats are concerned to see, along those broad lines, an approach to the Internet that says transparency and accountability, both for private actors and for public actors, is the way forward. Digital consumers deserve to have this information at their fingertips, so they understand what people are going to be doing with the information they enter on their computer, whether that is to purchase a book, get a loan or whatever kind of business they are doing on the Internet. They should have more rights to know how that information is handled, and the role of the government in keeping that information secure, rather than being told not to worry about it, because commercial interests have their best interest at heart, the government has their best interest at heart, and they do not need to know what is going on.

That is why the bill should go to committee, to be sure, because Canada does need its government to have the authority to implement the decision on Huawei and to do better in respect of cybersecurity. There is a lot of good work for committee members to do there, and a lot of amendments that ought to be made to the bill in order for it to pass in subsequent readings.

[Élisabeth Brière, Liberal, Parliamentary Secretary to the Minister of Mental Health and Addictions and Associate Minister of Health]

Mr. Speaker, 85% of Canada's critical infrastructure is owned by the private sector, provinces and non-governmental agencies.

Does my colleague think Bill C-26 will help standardize cybersecurity practices to better protect systems and services pertinent to Canada's cybersecurity?

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, an interesting debate is under way thus far on such an important issue with which we all have to come to grips. As changes in technology take place, we have to take that into consideration. I suspect that legislation dealing with privacy or cyber-attacks will be ongoing. Once the bill goes to committee, I am sure there will be a great deal of dialogue. I anticipate a great diversity of witnesses will come forward with ideas on the legislation.

I will pick up on the point I raised with the member opposite about the concern that the minister had too much power under this legislation. Often, when government brings forward legislation, opposition members bring forward concerns about how power is enhanced through the minister's office.

I have had the opportunity to briefly go through the legislation and I genuinely believe there is the right amount of balance. That is why I posed the question for the member. She suggested of reporting mechanisms, whether through an annual report or a report to a standing committee, and that has merit. I say that because I know there has been a great deal of effort in formulating this legislation. If there are ideas that would enhance or make the it that much stronger, we should be looking at that. I do believe the ministry is open to that.

When the member was quoting, I wondered where those quotes were from. She used those to amplify fears that one might be challenged to justify. For example, the member referred to an “evil government” based on quotes she had received. I am not saying it is her opinion, but she has raised it, saying this is a quote from some third-party organization and if we believe in that quote, it could lead to an evil government. We have witnessed that a great deal from the Conservative opposition on a variety of different issues, as if there is some sort of conspiracy. There is no conspiracy, contrary to what the member said, at least in one part of her speech. The government is not out to spy on Canadians.

The government takes the issue of the privacy of Canadians very seriously. We have brought forward legislation to that effect. This government has spent tens of millions of dollars on cyber threats. The government has had working groups and advisory groups dealing with cyber threats. We recognize the changes in technology and the impact they have had on society. I have said in the past that if we were to look at technological advancements, we would be challenged to find an area that has been as advanced as computer Internet technology. Just the other day, I was speaking to a private member's bill, saying that 10 or 20 years ago there were no such things as iPhones.

I note the member for Winnipeg South Centre is listening. He will recall that when we were first elected back in 1988, there was a big computer purchase of $5,000 made through Reg Alcock. We had a wonderful computer with a laser printer, which came with a keyboard and a mouse. At the time, when logging into the Internet with that wonderful and beautiful computer, the first thing we would hear was a dial tone. Then we would hear that stupid clicking sound, which meant we were actually connected to the Internet. We were all fairly impressed with that computer, and there were about 20 of us at the time.

We can compare that to where we are today. People can buy a laptop for $500 that has abilities and technological advancements more than tenfold of what we paid $5,000 for, with that long dial-up connection. In fact, people can purchase something brand new for $250 that is hooked into the Internet and running at a rapid speed. It is not even comparable to what it was.

There is so much advantage to technological change, but with that change comes risk, which is the essence of what we are debating through Bill C-26. Even though society has benefited immensely, we need to recognize there is a significant risk factor. That risk factor not only applies for the individual who might be surfing the net today, but it also applies to military operations taking place in Ukraine today.

Computers today are not optional. The Internet is not optional. They are essential services. That is why the Prime Minister, or one of the other ministers, just the other day made reference to the percentage of Canadians who were hooked up with high-speed connections and how we had literally invested billions to ensure that Canadians continued to get that access, with a special focus on rural Canada. We recognize that because it is no longer optional; it is an essential service.

The digital economy varies significantly. If we want to get a sense of this, we can turn to Hollywood and like-minded productions found on Netflix, CBC or the more traditional media outlets. We can look at some of the movies and TV shows out there. The other day I was watching an episode of a show called The Blacklist, which is all about cyber-attacks. I suspect a number of my colleagues might be familiar with that show.

One member talked about hydro. Manitoba, in fact all of Canada, should be concerned about our utilities. Through Hollywood productions, we are better able to envision the potential harm of cyber-attacks. A well focused cyber-attack can deny electricity to communities. It can shut down things that should never be shut down.

We talk about the sense of urgency. One would expect there will be mischievous lone individuals working in their basements, or wherever it might be in society, challenging systems. However, we also have state-sponsored cyber-attacks, and we should all be concerned about that.

In fact, that is why it was comforting when the minister made reference to the Five Eyes. I caught on right away that there are like-minded nations. Canada is not alone. There are like-minded nations that understand the importance of cyber-attacks and the potential damage that can be caused.

I will get back to the international side of things later, but when we think of what is at risk, think of digital data. Digital data comes in many different forms. One of the greatest collectors of data is Statistics Canada, an organization that invests a great deal in computers and technology to protect the data it collects from Canadians. Statistics Canada is actually respected around the world for its systems. It has absolutely critical data, and that data is provided to a wide spectrum of stakeholders, obviously including the national government.

Let us think of health organizations, the provinces and the collection of health records, or motor vehicle branches and passport offices. All of these government agencies have, at the very least, huge footprints in data collection.

Those are government agencies. We could also talk about our banking industries or financial industries. We can think of those industries and the information that is collected from a financial perspective when people put in an application for a loan. All of the information they have to provide to the lender, such as their history, is going into a data bank.

There is also the private sector. The other day we were talking about apps. One example is Tim Hortons. We were talking about it, as members might recall. The Tim Hortons app is fairly widely downloaded, and there is a lot of critical information within it. Canadians need to know, whether it is a government agency or private agency, that governments at all levels, in particular the national government, have their backs. That is the reason I started off by giving a very clear indication that even though Bill C-26 is before us today, we have been investing substantial financial resources through other types of legislation to provide assurances to Canadians so they know their information is in fact being protected.

There are actions on the Internet today related to our small businesses. The member opposite made reference to this and asked how the government is supporting small businesses. If a person has a small business today, chances are they are on the net. More and more consumers turn to the net for widgets and a multitude of different services.

As a result of that, there has been a great demand on small businesses. That is why we have a Minister of Small Business who looks at ways to not only provide tax relief but provide support. Sometimes it is done directly through financial measures and sometimes it is done indirectly by providing resources. However, let there be no doubt that there is support coming from the government. Whether it be a small, medium or large business, the government has a vested interest. We will do what we can. A good example of that is the individual who uses an ATM card when they make a small or large purchase at a small business.

The attacks we are talking about today can take many different forms. The digital economic side is definitely one of them, but there is also a social component to the Internet. When I think of the social component, I think about issues of privacy and of communications through, for example, social media. Again, Canadians have an expectation that the government is going to be there for them. Cyber-attacks take place in areas we all need to be concerned about. As I said, the more advanced we become, the more risk there is.

There are a lot of things that take place on the net that we need to be aware of and take action on. The exploitation of children is an example. That needs to be taken into consideration.

In the legislation, there is a very strong compliance component. As I raised, the minister would have the authority to make some things happen with our telecommunications companies and tell them to stop. I think that sort of action is necessary at times.

There is also a financial component so we can ensure a penalty is put in place as an incentive for people to abide by the legislation and the regulations, which are all there for one purpose and one purpose alone: to protect Canadians and institutions from risk. That is why we are investing in cybersecurity, ensuring respect for the privacy of Canadians and supporting responsible innovation.

We will continue to protect Canadians from cyber-threats in an increasingly digital world. This legislation is one aspect of what the government is doing to accomplish that. I believe that state-sponsored cyber-threats are one of the greatest concerns and one of the reasons we need to work with allied countries. I made reference to the Five Eyes. There are democratic, free, allied countries that recognize the potential harm of cyber-threats sponsored through governments. This legislation really sinks its teeth into that.

I hope that all members will get behind this legislation so we can ultimately see its passage to the committee stage. An official opposition member has indicated there is a great deal of interest in reviewing the legislation, the idea being to come up with ways to ultimately make the legislation better.

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Mr. Speaker, it is an honour to speak today in the House about Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making other consequential amendments.

This is a critical bill, and I am very happy to see the debate being undertaken today in the House. I do know that cybersecurity is important to the Minister of Public Safety, so I will give him credit for bringing this bill forward. It should be something that is important to all government ministers of every level of government. It is very important that we are having this debate today.

I was provided a briefing from cybersecurity experts from the minister's department just under a year ago. It was very informative about the risk Canada faces in terms of cybersecurity. Just to speak simply, I asked them what would be, in the worst case scenario, sort of a Pearl Harbor moment for Canada. They responded that it would be a cybersecurity attack on our electrical infrastructure or our pipeline infrastructure in the middle of winter. If there were a cyber-attack or a ransomware attack on the infrastructure that keeps Canadians warm in the middle of winter, that would be absolutely devastating, specifically in our coldest provinces, regions and territories in Canada.

Just to give Canadians an idea of the gravity of what we are talking about today and how important it is, not only that we bring forward cybersecurity legislation that builds capacity, but also that it be done right. There was a series of questions before my remarks that outlined a number of the issues in this bill.

I will just outline a number of recent cybersecurity attacks in Canada and also in the United States of late. We know that the Canada Revenue Agency was attacked in August 2020, impacting nearly 13,000 Canadians who were victims of that. There was also a hospital in Newfoundland, in October 2020, where the cybersecurity hackers stole personal information from health care employees and patients in all four health regions, as well as social insurance numbers belonging to over 2,500 patients. Very deeply personal and private data from these hospitals was stolen by cybersecurity hackers.

Global Affairs also most recently was attacked in January 2022, right around the time that Russia engaged in the illegal invasion of Ukraine. It was reported that it may have been Russian, or Russian state-sponsored, actors who were responsible for the cyber-attack on Global Affairs.

That was a very serious attack on another government department. The government is certainly not immune to these types of cybersecurity attacks.

Most famously, I would say, there was a ransomware attack on critical infrastructure in the United States back in May 2021. Pipeline infrastructure was attacked. President Biden issued a state of emergency. Seventeen states issued these states of emergency. It was very serious, and it just shows the capabilities of some of these cyber-threat actors, and the threat they pose to Canadians in their everyday lives and to Canada as a whole, as well as the threat to our allies.

This bill is coming forward in light of the government announcing most recently, in the past year, that it would ban Huawei from our 5G infrastructure. Conservatives and the House of Commons, in fact, have been calling on the government to do that for quite for some time. This legislation would help enable the practical implications of that ban. Again, it is certainly a very long time coming. Had this been done years ago, it would have saved our telecommunications and thereby the everyday users of our telecommunications companies, a lot of pain and a lot of money. I am concerned about the financial impact, although this is critical, that waiting so long to bring it forward would have on everyday Canadians and their cellphone bills, just as an example.

I am the vice-chair of the public safety and national security committee. I championed a study we are undertaking, which is in the process of being finalized right now, of Canada's security posture in relation to Russian aggression. A large part of that study was about cybersecurity. The experts we brought in repeatedly sounded the alarm that cybersecurity is of the utmost importance. It is something that the Government of Canada, the private sector, provincial governments and, frankly, municipal governments must take extremely seriously. It is rapidly evolving. I am going to give some quotes from a few of the experts to the lay the stage of what we are facing as Canadians.

Professor Robert Huebert of the University of Calgary said:

With regard to other cyber threats, we also know the Russians have shown an increasing capability of being able to interfere in various electronic systems and cyber systems of other states. We've seen this with their ability to influence the Ukrainian electrical system prior to the onset of the war in 2014.

This is the other war it engaged in over the last number of years. He also said that we are seeing this in other locations across the globe.

He went on to state:

Once again, it's hard to know exactly how well-defended [Canada has] become in being able to harden that part of cyberwarfare. There's no question, whatsoever, that the attention the Russians and the Chinese are giving this is increasing....

He compared that to the reports we are hearing from our American and British friends and allies who are saying the Chinese and Russians are extremely active on the issue of cybersecurity and involving state-sponsored actors launching attacks against countries like Canada and the United States.

We also had a woman named Jennifer Quaid, who is the executive director of the Canadian Cyber Threat Exchange, which is a private company that supports various companies to help boost their cybersecurity. She talked a lot about cybercriminals. This is an important piece. Even the minister talked about this as well.

First and foremost, she flagged that the Minister of National Defence of the current government said, “Cyber security is one of the most serious economic and national security challenges we face.” Therefore, it is quite a serious issue we are talking about today.

Ms. Quaid went on to say, “cyber-threats are becoming more sophisticated and are increasingly pervasive. Driven by the growth and global adoption of innovative technologies, cybercrime pays.”

She meant that cyber-threat actors can be grouped roughly into two categories, nation states conducting espionage and statecraft through the Internet, and criminals engaging in cybercrime for financial gain.

She went on to say, “It's this criminal element that has commercialized cybercrime”, meaning that cybercriminals and cybercrime have now become a thriving industry. She pointed out that the barriers to entry, the technical expertise needed to be a hacker, so to speak, is increasingly low. She said that several countries now are allowing cybercriminal groups to operate within their borders.

She also named something called a “hacktivist”, an activist hacker, of all things. We may have someone, in the name of social justice, hacking into a fossil fuel company, for example. Imagine if that happened in Canada in the middle of winter to our gas pipeline infrastructure. It would be devastating and deadly, so we have to keep an eye out for hacktivists, as she said.

She also pointed out that 25% of organizations in Canada have reported a cyber-breach. One in four. That is pretty significant. She said that the small and medium-sized enterprises that make up 98% of our economy are also being impacted. Almost 100% of our economy is being attacked in some form or another.

This is really important when we think of big banks and big, wealthy corporations that have pretty good cybersecurity infrastructure and have the money to do so. What feeds them is third party suppliers that may provide the various components or various mechanisms to undertake their important parts of the industry that company is engaged in. They are also at risk. Therefore, if a lower third-party provider of a major telecom is attacked, for example, that may seriously impact the ability of that telecom to deliver its services adequately to Canadians.

She mentioned that 44% of SMEs, small and medium-sized enterprises, do not have any defence. Almost half of our small and medium-sized enterprises, which dominate our economy, do not have any sort of defence and are not even thinking about cybersecurity. That is why today's discussion and this bill are important to be debated and have experts weigh in.

I will also quote Dr. Ken Barker, who is a professor at the Institute for Security, Privacy and Information Assurance at the University of Calgary. He talked a lot about the impact of cybersecurity on critical infrastructure. He mentioned that, in general, it is very vulnerable because it is built on legacy systems that, in essence, predate the Internet. As our legacy systems are getting online, this creates, as he explained, some gaps that hackers can take advantage of, which again puts our critical infrastructure at risk. That came up over and over at committee. He pointed out that our large private companies and our banks are investing a lot in cybersecurity, but again, as he and Ms. Quaid pointed out, it is their SMEs that are the most vulnerable.

I will conclude my quotations here with Caroline Xavier, who is the director of the Communications Security Establishment, which falls under the Department of National Defence. It is the part of government responsible for cybersecurity. Therefore, that she is the head of government cybersecurity is a simple way to look at it.

She said, “cybercrime is the most prevalent and most pervasive threat to Canadians and Canadian businesses. Cybercriminals trying to probe Canadian systems have been found in Russia, Iran and China, among others. [They] use various techniques such as ransomware”. They are specifically focusing on our critical infrastructure, and they certainly pose, as she said, “the greatest strategic threat to Canada.”

The bill before us would do a number of things. It is quite a large bill, so I will not go into every detail of what it would do, but in essence there are two parts. One would amend our existing Telecommunications Act. Of particular importance, it would give very broad and sweeping powers to the minister of industry to do a number of things. What has been criticized by a number of organizations is a specific part of the bill, which is in the summary, that says it would allow the minister and the Governor in Council to “direct telecommunications service providers to do anything, or refrain from doing anything”.

Those are very broad powers to be given to one minister, so that should immediately put up red flags for all of us. No one should have such vast sweeping powers over our telecoms. Again, I have built the case that we need better cybersecurity, but there is a big question mark here of whether we are giving too much power to one minister, one person, in all of Canada.

The bill also has a whole financial issue involved in it. To do anything, as it said, could have massive financial implications. Big companies such as Telus may be able to afford that, but our small telecoms may not be able to so much. It might bankrupt them. That is not great news, and there would be no financial component, in terms of compensation, for any of these losses, so there is a big question mark there as well.

Also, something of importance I find quite concerning is the way the bill is structured would result in a significant exchange of a lot of information from telecoms to the minister, which he could pass on to various ministers and government agencies. Is that very confidential information? It is certainly the cybersecurity plans. Does that include state secrets? Is it safe that we would be asking our telecoms this?

The second part of the bill involves all critical infrastructure companies in Canada, as was outlined by the minister, including provincial and Crown corporations, and the like, so the bill would really establish the process that all of these companies would have to provide their cybersecurity plans, and there would be a very strict reporting mechanism. We are talking about days, if not a few weeks, to get together these plans and provide them to the minister. There would be annual updates required. If a big company were to change a third-party provider, it would have to, in essence, immediately report that to the minister of industry.

There is a whole host of very cumbersome reporting mechanisms, and I do believe we need some of these, but a question remains, as I have outlined earlier, and the government is not immune to being hacked by cybercriminals. I just outlined three or four incidents when that happened. The bill would take all of our critical infrastructure, and all of companies' cyber-defence plans, along with countless other pieces of personal data of Canadians and others, and we would give that to the government. An argument could be made that this is needed, but where are the protections for that? Where is the defence of government to ensure that this would not end up in the wrong hands or that information is not hacked by cyber-actors?

That is a significant threat that needs to be addressed by the minister, and I was not assured from his remarks that this is something that is front and centre in his objective through the bill.

I would also say that there is a number of civil liberty organizations that have raised serious alarm as well. There was an open letter written to the minister from the Canadian Civil Liberties Association, the Canadian Constitution Foundation, the International Civil Liberties Monitoring Group, Leadnow, Ligue des droits et libertés, OpenMedia, and the Privacy and Access Council of Canada. All of the leaders of research and discussion of our civil liberties, all such major organizations in Canada, were quite alarmed by the bill in many ways and wrote an open letter to the minister that outlined a number of things.

In essence, they said the bill would grant the government sweeping new powers, not only over vast swathes of the Canadian economy, but also in intruding on the private lives of Canadians. To sum it up, and I think they said really quite well, “with great power must come great accountability.” There is great power in the bill, but the accountability side is lacking.

Before I go on to detail some of their concerns, I do want to outline what some other countries are doing. If we look at the U.S. and the EU, they have established similar bills in the past year or so. The EU actually has greater and more significant fines in many ways, and the U.S. provides more prescriptive and strict reporting mechanisms, such as, if a U.S. critical infrastructure company has a ransomware attack, the legislation outlines the company must report it to the government within 24 hours.

That actually might be something we may want to consider for the bill. If we are going to go there, we might as well have it in line with our American allies and make it tight. I do think that a reporting mechanism is one of the most important parts of this bill.

I want to go back to the civil liberties issue. With the government's track record on Internet regulation bills, such as Bill C-11 and others, a lot of people have their backs up about their personal freedoms online and their data, rightfully so. The civil liberties associations are raising some of the concerns that have not been assuaged thus far by the government or the Minister of Public Safety.

In the open letter, they mention that this, “Opens the door to new surveillance obligations”, which is quite concerning. In their view, and this has not been proven, “Bill C-26 empowers the government to secretly order telecom providers ‘to do anything or refrain from doing anything’”, as I mentioned. They believe that, if there was an abuse of this extreme power, it could be utilized by a government with ill intent, not to say that is the Liberal government's intent, but it could be utilized to survey Canadian citizens. It is quite concerning.

They go on in that realm to outline that the powers in this bill allow the administrative industry to terminate who telecoms work for, for example. They believe that could also be applied to individual citizens. They are looking at this and thinking, if a government wanted to punish a group of people, it could call up Telus, and this is very blunt and not overly academic in the way I am explaining it, to direct Telus it cannot do business with these people, cut off their access to the Internet and cut off their cell phones.

It is an extreme worst-case scenario, but it is worth flagging that there may be a bit of a backdoor in this bill that would allow that, should an evil government ever come along that is looking to abuse the civil liberties of Canadians. I would like to see that addressed and have safeguards put in place to prevent that type of abuse, should it ever happen in an extreme circumstance.

They also talk about how it “Undermines privacy” and that there are “No guardrails to constraint abuse”. Again, I think this is an area where opposition parties, in particular, and hopefully government members on the committee, can come together to ensure that there is an ombudsman put in place or an oversight body. We need something where the rights of companies, and more importantly of citizens, are protected from the abuses I have outlined, and there are many others.

There were also a lot of concerns from the Business Council of Canada. It wrote an open letter to the minister on behalf of large companies, and also small and medium-sized enterprises. In essence, what we are seeing is the red tape is extremely high, so we are worried that will impact our small and medium enterprises.

The business community, in general, has said that it seems that this bill, to sum it up bluntly, is all stick and no carrot. It is all hard-hitting. It is going to be super hard on us, and we better comply. I can hopefully go into more details about that in the question part of this debate, but there is no incentive structure built in.

There is no incentive to have companies share best practices with each other. I think the government should be a leader in encouraging the open sharing of best practices and experiences that protect the confidentiality of companies but allow them to share information, so other companies can be better equipped, and we can all work together as one big happy, cyber-secure family.

The Conservative Party of Canada is, first and foremost, concerned about national security and ensuring the federal government takes that leadership role in ensuring that Canada, as a whole, is secure against any possible threat, every eventuality, as the Minister of National Defence likes to say.

We are seeing serious gaps in our military. We can have stronger alliances in our Five Eyes intelligence sharing and other agreements. Certainly, that involves cybersecurity. Canada is vulnerable, like many countries in the world. In fact, most countries are dealing with these problems. The Conservative Party of Canada wants to see a more robust framework to incentivize and enforce reporting mechanisms to ensure our cybersecurity is protected, and to make sure there is not a ransomware attack on our pipelines in the middle of winter, which could kill thousands of Canadians from the cold, for example.

We will be looking to support this bill in going to committee, but I want to make it very clear that, if the issues in this bill, and I have outlined a few of them concerning privacy and impacts to business, are not addressed, the Conservative Party is ready to pull its support immediately and put up a very strong defence to stop this bill from going beyond committee. I want to make that very clear to the minister and the Liberal government.

We will get this to committee to hear from experts because we believe that is important, but it must be fixed. There are serious issues that need to be addressed and amendments that need to be made. I would ask Liberal members on the committee to get to work with us, so we can make this bill what it needs to be and make it better to ensure cybersecurity is protected in Canada today and for years to come.

[Marco Mendicino, Liberal, Eglinton—Lawrence, ON]

Mr. Speaker, this question allows me to highlight how Canada is co-operating with like-minded democracies around the world, both in the context of the Five Eyes relationship as well as the G7. I had a chance to meet with both counterparts very recently, one in Washington, D.C., and then, about two weeks ago, in Germany. It is without doubt that all the democracies within these multilateral forums are thinking very hard about how to manage threats in cyber, including ransomware, including the spread of disinformation and including the efforts of hostile actors to engage in cyber-espionage and the like.

The way we are advancing that collaboration is through information and intelligence sharing as much as possible, so that we can push back against efforts to attack our economies and to attack Canadian interests, etc.

Even as we present Bill C-26 for debate, to take decisive action here at home domestically by addressing the current gaps within our cyber-realm, we are also collaborating very robustly with partners around the world who are like-minded in managing these threats.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Speaker, folks would find that it is pretty easy to get agreement here on the idea that there is more to do in respect of cybersecurity. Where some of us may part ways is on the extent to which the government, while increasing its power to act, has not built into the bill corresponding checks and balances on its authority. Indeed, many of the orders it would give itself the power to issue under this act are secret orders. It has exempted itself from some of the normal reporting requirements.

I want to test the minister today on his openness to amending the bill at committee to ensure that there are appropriate checks and balances commensurate with the new and quite wide-ranging powers the government is proposing to grant itself in Bill C-26.

[Marco Mendicino, Liberal, Minister of Public Safety]

moved that Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

Mr. Speaker, it is an honour to help kick off second reading debate of Bill C-26, an act respecting cybersecurity. I know this chamber has been anxiously awaiting the chance to advance discourse on this important legislation.

I will begin by saying that cybersecurity is national security. We need to make sure that our defences meet all of the challenges that are reflected today, and we need to make sure that both the public sector and the private sector are able to better protect themselves against malicious cyber-activity, including cyber-attacks. It is about defending Canada and the critical infrastructure we rely on, and we know that this will not be the last we hear of this issue.

What we decide now in the cybersecurity realm will help us form a launching pad for the way forward, because we know that our actions in the cybersphere are always a work in progress. We know that meeting the moment means that our actions must continually, effectively and safely provide a foundation for the way Canadians thrive in the 21st century.

Being online and connected is essential to all Canadians. Now, more than ever, Canadians rely on the Internet for their daily lives. It is about more than just conducting business and paying bills. It is also about staying in touch and connected with loved one from coast to coast to coast and indeed around the world. Our critical infrastructure is becoming increasingly interconnected, interdependent and integrated with cyber systems, particularly with the emergency of new technologies such as 5G, which will operate at significantly higher speeds and will provide greater versatility, capability and complexity than previous generations.

These technologies certainly create significant economic benefits and opportunities, but they also bring with them new security vulnerabilities that some may be tempted to prey on.

The COVID-19 pandemic showed how important it is for Canadians to have secure and reliable connectivity. The government is determined to boost security for Canada's cyberfuture.

We also know about the inherent threats to our safety and security. Cyber-threats remain a significant national and economic security issue that can threaten that safety. The Canadian centre for cybersecurity's “National Cyber Threat Assessment 2023-2024” found this:

State-sponsored and financially motivated cyber threat activity is increasingly likely to affect Canadians....

Cybercriminals exploit critical infrastructure because downtime can be harmful to their industrial processes and the customers they serve. State-sponsored actors target critical infrastructure to collect information through espionage, to pre-position in case of future hostilities, and as a form of power projection and intimidation.

These activities will not cease. Malicious actors could take advantage of increased connectivity to trigger malicious events that could also potentially have severe effects on our public safety and national security.

Large corporations and critical infrastructure providers are targeted by actors probing for vulnerabilities and opportunities for penetration, theft and ransomware attacks.

Like its allies, Canada has made efforts to address these vulnerabilities and to ensure the security of Canadians and Canadian businesses.

Canada has long recognized the importance of securing our cyber systems. In 2013, Canada established a collaborative risk mitigation framework, the Communications Security Establishment's security review program. This program has helped to mitigate risks stemming from designated equipment and services under consideration for use in Canadian 3G, 4G and LTE telecommunications networks.

Furthermore, consultations with Canadians in 2016 informed the 2018 national cybersecurity strategy. This strategy established a framework to guide the Government of Canada in helping to protect citizens and businesses from cyber-threats and to take advantage of the economic opportunities afforded by digital technology.

In 2019, the government paid $144.9 million to develop a framework for the protection of critical cyber systems.

In 2021, the government completed its interdepartmental review of 5G telecommunications security. The findings included a recommendation to work with the industry on moving forward with the current risk mitigation framework for the products and services intended for Canadian telecommunications networks.

All this work done over many years to address these known problems and to improve Canada's cybersecurity posture, including with 5G technology, brings us to the bill before us today.

The objectives of Bill C-26 are twofold. One, it proposes to amend the Telecommunications Act to add security, expressly as a policy objective. This would bring the telecommunications sector in line with other critical infrastructure sectors.

The changes to the legislation would authorize the Governor in Council and the Minister of Innovation, Science and Industry to establish and implement, after consulting with the stakeholders, the policy statement entitled “Securing Canada’s Telecommunications System”, which I announced on May19, 2022, together with my colleague, the Minister of Innovation, Science and Industry.

As we announced at the time, the intent is to prohibit the use of products and services by two high-risk suppliers and their affiliates. This would allow the government, when necessary, to prohibit Canadian telecommunications service providers from using products or services from high-risk suppliers, meaning these risks would not be passed on to users. It would allow the government to take security-related measures, much like other federal regulators do in their respective critical infrastructure sectors.

The second part of Bill C-26 introduces the new critical cyber systems protection act, or CCSPA. This new act would require designated operators in the federally regulated sectors of finance, telecommunications, energy and transportation to protect their critical cyber systems. To this end, designated operators would be obligated to establish a cybersecurity program, mitigate supply chain third party services or product risks, report cybersecurity incidents to the cyber centre and, finally, implement cybersecurity directions.

It would include the ability to take action on other vulnerabilities, such as human error or storms that can cause a risk of outages to these critical services. Once implemented, it would support organizations' abilities to prevent and recover from a wide range of malicious cyber-activities, including cyber-attacks, electronic espionage and ransomware.

The rollout of 5G technology in Canada is well under way. This technology will allow Canadians to move more data faster. It will bring benefits for Canadians and our economy, but with these benefits comes increased risk. Canada's updated framework, established in part 1, aligns with actions taken by our Five Eyes partners, particularly in the United Kingdom. I will add that I recently met with our counterparts in Washington, D.C., not too long ago.

It would allow Canada to take action against threats to the security of our telecommunications sector if necessary. Legislative measures would provide the government with a clear and explicit legal authority to prohibit Canadian telecommunications service providers from using products and services from high-risk suppliers, such as Huawei and ZTE, if required and after consultation.

Once these amendments receive royal assent, the government will be in a position to apply these new order-making powers to the Telecommunications Act.

The CCSPA established in part 2 is also consistent with critical infrastructure cybersecurity legislation established by our Five Eyes partners and would provide a consistent cross-sectoral approach to cybersecurity for Canadian critical infrastructure.

Designated operators would be required to protect their critical cyber systems through the establishment of a cybersecurity program and to mitigate any cybersecurity risks associated with supply chain or third party products and services.

Cyber-incidents involve a certain threshold that would be required to be reported, and legislation would give the government a new tool to compel action, if necessary, in response to cybersecurity threats or vulnerabilities. Both parts 1 and 2 of Bill C-26 are required to ensure the cybersecurity of Canada's federally regulated critical infrastructure and, in turn, protect Canadians and Canadian businesses.

Overall, Bill C-26 demonstrates the government's commitment to increasing the cybersecurity baseline across Canada and to help ensure the national security and public safety of all Canadians.

Cybersecurity is also essential in the context of our economic recovery after the COVID‑19 pandemic. In our increasingly connected world, we must implement the measures required to guarantee the security of our data and ensure that data is not exploited by actors, state-sponsored or not, who constantly seek to exploit our systems.

Recovery from cybersecurity incidents is both costly and time-consuming. Accordingly, when it comes to improving cybersecurity, the interests of government and private industry are aligned. Nevertheless, an administrative monetary penalty scheme and offence provisions would be established within both parts of the bill to promote compliance with orders and regulations, where necessary.

All of the actions I highlighted today form a key part of our ongoing commitment to invest in cybersecurity, including to protect Canadians from cybercrime and to help defend critical private sector systems. Like our allies, Canada has been working to address these vulnerabilities to keep Canadians and Canadian businesses safe. However, we have to be sure that we are ready for the threats that lie on the landscape.

For example, unlike laws governing other critical infrastructure sectors, the Telecommunications Act does not include any official legislative authority to advance the security of Canada's telecommunications system. Despite the existence of multiple programs and platforms enabling public and private collaboration in the telecommunications sector, participation is voluntary.

In addition, across Canada's highly interconnected and interdependent critical infrastructure sectors, there are varying levels of cybersecurity preparedness and no requirement to share information on cyber-incidents currently. Moreover, the government has no legal mechanism to compel action to protect these systems at this time. These are important gaps that the legislation introduced today seeks to address. That is why the government is establishing a strong and modern cybersecurity framework to keep pace with the evolving threats in our environment.

In short, the legislation would form the foundation for securing Canada's critical infrastructure against fast-evolving cyber-threats while spurring growth and innovation to support our economy. Cyber systems are understandably complex and increasingly interdependent with other critical infrastructure. This means the consequences of security breaches are far-reaching. It is also the reason that a consistent, cross-sectoral approach to cybersecurity is built into this legislation.

Bill C-21, which we have tabled and are now debating, would protect Canadians and the cyber systems they depend on well into the future. Significantly, this legislation can serve as a model for provinces, territories and municipalities to help secure critical infrastructure outside of federal jurisdiction. It is an essential addition to Canada's already robust arsenal, which is there to protect us and our economy against cyber-threats. It would allow us to continue taking even stronger action against threats to the security of our telecommunications sector and ensure Canada remains secure, competitive and connected.

I encourage all members to join me in supporting this landmark cybersecurity legislation, Bill C-26, today.

Business of the House

[Mark Holland, Liberal, Ajax, ON]

Mr. Speaker, we are not going to stop the supports we have for Canadians. In fact, I would suggest to the member opposite that making sure our most vulnerable are protected is critical. That is why we have a number of things we are going to be doing in that regard, which I will illuminate in a moment.

As to the other question that was put, I do seriously want to ask, if the Conservatives are opposed to action on the climate, whether they have reflected about what the costs are. These are not costs that will be borne for a year or two but for all time. It is something to reflect on regarding the questions that were posed to me.

I am pleased that this afternoon we are going to complete the second reading debate of Bill S-4, an act to amend the Criminal Code and the Identification of Criminals Act and to make related amendments to other acts. Tomorrow, we will go back to the second reading debate of Bill C-20, concerning the public complaints and review commission act. On Monday, we will resume second reading debate of Bill C-27, the digital charter implementation act, 2022. For Tuesday and Wednesday, we will call Bill C-29, an act to provide for the establishment of a national council for reconciliation, which was reported with amendments from committee earlier this week.

Mr. Speaker, I see you moving in your chair, so you will be happy to know that, finally, for next Thursday, our plan is to commence second reading debate of Bill C-26, the critical cyber systems protection act.

Democratic Institutions

[Pam Damoff, Liberal, Parliamentary Secretary to the Minister of Public Safety]

Mr. Speaker, I would remind the House that the purpose of foreign interference is to sow chaos and throw our democratic institutions into disarray.

That is why we are taking action to combat attempted foreign interference, beginning with our national security agencies who conduct investigations and use all the tools at their disposal. It also includes significant work to shore up Canada's institutions and critical infrastructure, such as Bill C-26, which would bolster cybersecurity and give new tools to the RCMP. I invite all members of the House to support the government in supporting Bill C-26.

[Marco Mendicino, Liberal, Minister of Public Safety]

Mr. Speaker, protecting Canadian democracy is a responsibility we take very seriously. We are taking steps to combat foreign interference attempts. It starts with election officials and law enforcement and intelligence services, those who investigate and use all the tools at their disposal. Strengthening Canada's essential infrastructure and institutions is a big job. It takes legislation like Bill C‑26 to reinforce cybersecurity and give the RCMP additional resources.

[David Adams, President and Chief Executive Officer, Global Automakers of Canada]

Thank you, Mr. Chair and members of the committee, for the opportunity to speak to you today on behalf of the 15 member companies of the Global Automakers of Canada.

Our manufacturing members, Honda and Toyota, represent 55% of the Canadian light-duty vehicle production through September 2022, while all members, as exclusive Canadian distributors of some of the world's largest global automakers, were responsible for 62% of Canadian sales in 2021.

My members recognize the importance of having an open, fair and competitive repair industry while maintaining safety and quality standards for the benefit of consumers. That is what the Canadian Automotive Service Information Standard provides to the automotive industry.

That said, some in the automotive aftermarket have utilized this bill to try to secure more rights, which we have yet to understand. We have serious concerns about Bill C-244 because it exposes vehicles to the prospect of theft, hacking, and compromised vehicle safety and emissions standards on which vehicle manufacturers are stringently regulated before they can put a vehicle on the road and afterward. The bill allows the circumvention of technological protection measures in a computer program if the circumvention is solely for the purpose of diagnosis, maintenance or repair of a product. In practical terms, how does an ordinary person circumvent technological protection measures? More importantly, what are the ramifications of anyone's being provided the capability of legally circumventing TPMs for any reason?

For an automobile that operates on public roads at potentially high rates of speed, we believe the risks of injury or death for the user and the general public are obviously exponentially greater than are those from other products when TPMs are removed. Critically, how would a consumer, the manufacturer or potentially the courts know who had circumvented the TPMs and for what reasons? What would be the due diligence undertaken to ensure that the individual undertaking the circumvention of any TPMs had the appropriate certification and training to undertake the diagnostic repairs? Will the circumvention of TPMs be recorded on a consumer's bill of sale so consumers understand their potential consumer protection recourse? Will the repairer also take on the responsibility and liability associated with the circumvention of TPMs? Will the repairer provide a full and complete record of repair work undertaken to the manufacturer, to establish continuity of service in the event liability issues arise with respect to safety or emissions non-compliance or cybersecurity attack?

When MP Bryan May brought forward a previous iteration of this bill, it was made clear that the automotive industry was not the subject of the bill, because we have had a solution in place that has worked since 2010, known as the Canadian Automotive Service Information Standard, or CASIS for short. Under that voluntary agreement, manufacturers are required to provide the service information, training tools and equipment to the aftermarket so that any qualified mechanic can repair a consumer's vehicle. We're proud of the support, expert advice and help desks that our industry makes available to automotive mechanics across the country. We are open to exploring ways to improve upon this.

For the automotive industry, the right to repair clearly exists. Repair statistics bear this out when comparing repairs done by the aftermarket vis-à-vis OEM dealers. Therefore, members have been aggressively lobbied by the automotive aftermarket for so-called “rights” that already exist.

Finally, Bill C-26, an act respecting cybersecurity, is before Parliament. It will introduce more stringent standards and monitoring to ensure that Canadians are protected from cybersecurity risks and threats, yet the bill before this committee would open up opportunities for cybersecurity risks and hacking. It is not only incongruent but also puts consumers at unnecessary risk.

Indeed, consumer protection is at the heart of this issue. Consumers need to be assured that when their vehicle is serviced and repaired, it is done so to OEM service and repair standards, and that those repairing the vehicle are accountable and liable, both to the consumer and to regulatory authorities, for such repairs.

We are on board with right-to-repair solutions. We have been for the last dozen years, since CASIS was established. This solution benefits consumers and the aftermarket without creating dangerous safety and cybersecurity vulnerabilities.

Thank you very much for your time. I look forward to your questions.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Thank you.

I want to get in another question for CSE. I have only a couple of minutes left.

You're aware, I think, of the government's legislation, Bill C-26, which is going to designate vital systems and vital service providers and which makes some pretty significant amendments to the Telecommunications Act. A lot of what you talked about regarding the disinformation campaigns we as a committee are very familiar with. It has informed a lot of the studying of ideologically motivated violent extremism.

Aside from what's included in Bill C-26, I'm interested in CSE's working relationship with social media companies. Can you provide an assessment of how that is and tell us what more policy-makers and the legislative sphere need to pay attention to in order to maybe make your job a bit easier in that relationship?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Perfect. Thank you.

I assume you had a chance to look at Bill C‑26. I would like to know what you think of it.

Like Minister Champagne, are you confident that this bill will address the need for a strong and resilient network? We're seeking both qualities.

Have you ever analyzed the issue? Do you see any ways to improve this bill?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Thank you for your question, Mr. Deltell.

First, as you said, this was a different kind of outage. I made it very clear to millions of Canadians, as well as to the head of Rogers, that this was absolutely unacceptable.

I would answer your question by saying that we have done three things to make our telecommunications systems more resilient. The first was to affirm our intention to exclude Huawei and ZTE from 4G and 5G networks in Canada.

The second thing was to introduce Bill C‑26, as you know. I mentioned earlier that this will provide increased authority for cybersecurity, but also, and I think this is important for the committee, it will give the Minister of Industry additional powers. As we know, security is not currently one of the objectives of the Telecommunications Act.

The third thing, and I'll stop here, concerns the new CRTC directive on resilience.

So these steps had already been taken, and we are certainly going to continue to do more, as I said at the outset.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

MP Masse, you know me. I'm one who always co-operates with colleagues on both sides of the aisle. As I said, the immediate action I took within hours were first steps. I did not exclude anything. I'm happy to listen to this committee and its recommendations.

I think one thing we can work on together is the new CRTC policy direction. Some have called it “historic” in changing the nature of what matters to this government and, I would say, to Canadians largely, that it is competition and affordability.

I have been very tough on the telecom companies because this was warranted. Like I said, they listened to me when I demanded.... No one was suggesting otherwise. They said, “Minister, we will do exactly what you want within the timeline.”

To your point of whether there could be additional steps taken in terms of what powers would be needed in addition to Bill C-26, I would be happy to look at what this committee can recommend, and I certainly will look at that.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I was saying earlier that Bill C‑26 will give the Minister of Innovation, Science and Industry greater powers.

This will allow for something important, and experts will testify to this. This will amend Canada's Telecommunications Act by adding security as an objective. This is not currently part of the objectives.

So this is a step that has already been taken, and it was taken long before what we've experienced over the past few days. This will give the additional powers to the minister so that he can require telecommunications companies to be more robust and resilient in their networks.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

You'll be able to rely on a binding formal agreement, sir, for the first three things I mentioned. This is going to be a formal binding agreement. This is not like the way you described. I demanded. There's no discussion. It's going to be done. There's no room for manoeuvring.

The second thing I would say, sir, with respect to Bill C-26—and I think you know because you're a very experienced legislator—amending the telecom act to add security to it will give additional power to the minister. It's not only that they will follow what I said, but if you support Bill C-26 with colleagues, it would add legal power to demand that. Once you add security to the objective of the telecom act, it would give broad power to the ministers to do what I did.

Now they did it. I demanded it. They're going to do it. We're going to do more and with Bill C-26, I think that you and I with colleagues will be able to better protect the public.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

No, but when I demanded that they put in these measures.... That's why we're rectifying it, MP Masse. Now we're going to have that. We'll have Bill C-26. In addition to that....

We're all on the same side. I spoke on behalf of 12 million Canadians. I said that this is what we demand now. To your point, sir—let me just finish—the CRTC will be investigating and they will be asking these questions about refunds. I said publicly the first day that I expect and demand that Rogers compensate people fairly and proactively. I said that from the get-go.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

With Bill C-26, you're right. That will promote cybersecurity, but it will do one important thing, with respect, sir. It will amend the Telecommunications Act to add security as an objective, which will give additional power to the minister if he needs to direct the company. We also have the new CRTC policy direction.

If you were at that meeting, you would say that I was not in a mood to listen to them. This was a directive that I issued to them. They complied immediately with what I demanded.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

With respect, MP Masse, this is not about, in a sense, the minister talking with the CEO. This is demanding. I wish you would have been on that call because you would have seen this was no time for challenging the Minister of Industry. I was talking on behalf of millions of Canadians.

Let me say three things we've done on the legislative side that will add to what we've been doing. The first thing you will recall very vividly. We decided in May to provide more resiliency in our our intention to exclude ZTE and Huawei from our 4G and 5G network. We introduced Bill C-26 on June 14, which will do two things.

With respect sir, let me just say—

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

We will work with the experts. I would add that I did not ask, but rather imposed on the companies the three measures mentioned, that is, to establish by a formal contract mutual assistance, emergency roaming and the communication protocol with the government and citizens. My team and I imposed these requirements and I said, few hours after the system was restored, that immediate and urgent action was needed to ensure the resilience of the system.

You will agree that this is a first step and that is why the committee's work is important. We want to get to the bottom of this, and when we have the findings as to why there was a code error in a normal update procedure, how this could have happened, and what the fault was, we will need to establish a redundancy in the system. That's what we're going to tackle.

In fact, I intend to do more. In addition, Bill C‑26 will give us additional cybersecurity authorities, and I intend to use them wisely to ensure greater resilience.

Telecommunications

[Justin Trudeau, Liberal, Prime Minister]

Mr. Speaker, I would like to thank the member for Vancouver Granville for his question and his hard work.

Cybersecurity is national security. Bill C-26 will help both the public and private sectors better protect themselves against cyber-attacks and is one part of our robust strategy to defend Canada and the crucial infrastructure that Canadians rely on. We will always protect the safety and security of Canadians and we will take any actions necessary to safeguard our telecommunications infrastructure.

Telecommunications Act

[Marco Mendicino, Liberal, Minister of Public Safety]

moved for leave to introduce Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts.

(Motions deemed adopted, bill read the first time and printed)