Bill C-8

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties and the disposal of personal information; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.
Part 3 provides for a five-year review of the provisions enacted or amended by this Act.

Speaker's Ruling

[Sima Acan, Liberal, Oakville West, ON]

Mr. Speaker, as I mentioned in my speech, during committee studies and while answering all the questions from the floor, this bill is a critical bill to protect not only Canadians but also Canadians' information and data.

Every year, the amount of ransom money that companies have to pay criminals is huge. This bill would help protect those companies. It would not only protect those companies, but also protect Canadians, their privacy and their data.

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, I rise today to speak to Bill C-8, an act respecting cybersecurity and amending the Telecommunications Act.

Before being elected to represent the people of London—Fanshawe, I spent nearly three decades working in the information technology field. I started young. In 1996, at age 16, while still in high school at North Lambton Secondary School in Forest, Ontario, I took my first job with a small local Internet service provider. This was the era of dial-up Internet. Many Canadians remember the sound of connecting, waiting for the signal and slowly getting online. It felt new, exciting and, for many, private.

Working on the other side of that connection gave me a very different perspective. It was my first real exposure to how these systems actually function behind the scenes, and what struck me early on was how vulnerable people's information could be.

There is often an assumption that our information is private by default, but in reality, privacy in digital systems has always been more fragile than people realize. Today, the scale and consequences are far greater. That realization has had a lasting impact and has instilled in me a strong sense of responsibility to treat information with care, respect the trust that people place in the systems they rely on and recognize that privacy does not happen by accident in digital systems. It has to be built in, protected and enforced. That principle has guided me throughout my career, and it is exactly the principle that should guide us today as we consider Bill C-8.

There is no doubt that cybersecurity is a national security issue. Canada faces increasing threats from hostile actors, including foreign states, criminal organizations and sophisticated cyber networks. These threats target our infrastructure, institutions, businesses and, increasingly, everyday Canadians.

Increasingly, the cybersecurity landscape is being reshaped by artificial intelligence. AI is enabling faster, more adaptive cyber-attacks, from automated vulnerability scanning to highly convincing phishing and social engineering. At the same time, it is also strengthening our defences, improving threat detection, anomaly identification and response times across networks. The challenge before us is to ensure our policies keep pace with both sides of that reality.

Our telecommunication systems are a critical infrastructure. They underpin our economy, basic safety systems and national defence. Ensuring their security is not optional; it is essential.

Conservatives recognize this. We have constantly said that cybersecurity must be treated as a core component of Canada's national defence strategy. That is why we allowed the bill to come to committee, despite serious concerns about provisions that represented an unacceptable level of government overreach. The only responsible path was to bring it to committee and fix what needed to be fixed. It needed improvement.

As originally drafted, Bill C-8 would grant sweeping powers to the government, particularly to the minister, with insufficient safeguards, unclear thresholds and inadequate protections for privacy and freedom of expression. That is not an abstract concern. This is why getting the limits right in legislation like this matters so much.

One of the clearest examples of overreach in the original bill was in proposed section 15.2. As it was originally written, the bill would have allowed the minister to prohibit telecommunications providers from offering service to any specified person or direct that the service be suspended. Anyone can understand the difference between securing a network and controlling access to it. Imagine having a government official at every Internet provider, such as the one I worked at three decades ago when I was a teenager, dictating who can and cannot get Internet access. That is not the role of government.

If there are criminals or foreign actors who pose such a serious threat to our security that they must be cut off from essential communications, the bigger question is why they are not already in custody or removed from Canada in the first place.

Cybersecurity is about protecting systems from real threats. It is not about giving government a broad and loosely defined power to decide what person keeps their connection and which one loses it. That is not a small, administrative detail. In the wrong hands, it is the kind of power that risks turning cybersecurity into overreach.

The government has shown time and again that it will err on the side of overreach, including through the unlawful invocation of the Emergencies Act, for which courts found it exceeded the authority and infringed upon charter-protected freedoms. That is exactly why powers like this must be clearly defined, tightly constrained and subject to real accountability.

Conservatives pushed back against that overreach. Through amendments at committee, we forced changes that narrowed the scope of that authority, ensuring that it could not be directed arbitrarily at individual Canadians and that stronger thresholds and clearer limits apply. That is just one example.

More broadly, Conservatives worked to fix a pattern of overreach in the bill. We strengthened protections for rights and freedoms by ensuring that lawful expression, political debate and persuasion could not be treated as cybersecurity threats. We made privacy a required consideration, not an afterthought, and strengthened rules around the the collection, use and deletion of personal information. We raised the threshold for government action from vague references to threats to a much more serious standard of serious, systematic threats. We replaced weak tests such as relevancy with stronger requirements like necessary and proportionate tests. We required reasonable grounds for ministerial action and narrowed the scope of orders to matters tied to national security, national defence or international relations. We pushed for judicial oversight and greater transparency, because powers of this magnitude should not operate without accountability. Taken together, these changes significantly improved the bill. They did not remove the need for vigilance, but they brought the legislation closer to the balance that Canadians expect.

Cybersecurity is not just about technology. It is about trust. Canadians need to trust that the government will protect them from cyber-threats, but they also need to trust that their rights will not be unnecessarily compromised in the process. That trust is fragile and, once lost, it is difficult to rebuild. That is why it is so important that legislation such as Bill C-8 gets the balance right.

Now, while the bill has been approved, we also acknowledge a broader issue. For too long, the government has been slow to respond to evolving cyber-threats, yet quick to introduce legislation that requires significant correction. Cybersecurity is too important to get wrong. It is too important to treat as an afterthought. Canada needs a proactive, disciplined approach to cybersecurity that includes clear standards, strong partnerships with industry and legislation that is both effective and restrained.

Bill C-8 is a step in that direction, but only because Conservatives forced the changes that were needed to fix it. Despite our proposing major improvements to the bill, the Liberals fought us every step of the way. At committee, Conservatives were able to get an amendment through that required judicial authorization. Before the minister could use the new powers laid out in the legislation, the Liberals found a way to remove that amendment. Just like with the Emergencies Act, there is nothing to stop them from abusing their power. This is a massive concern for me.

As we move forward, we must remain vigilant. Technology will continue to evolve. Threats will become more sophisticated, and so too will the tools available to defend against them, including those powered by artificial intelligence. The pressure to expand government powers will only increase. That makes it even more important that we get the framework right now.

As both threats and defence evolve, we must ensure that our response remains grounded in clear limits, strong safeguards and respect for the rights of Canadians. In that environment, it will be essential to hold firmly to the principles that define us as a country. We must protect our infrastructure, but we must also protect our freedoms. We must respond to threats, but we must do so with restraint and accountability. We must never lose sight of the fact that cybersecurity is not an end in itself. It is a means to protect Canadians, their privacy, their livelihoods and their way of life.

I began my remarks by reflecting on my early experience in the IT field. Back then, even as a young person, I saw first-hand that privacy cannot simply be assumed. It must be actively protected. That lesson applies just as much as today, at a national level. With the powers granted in this legislation comes a responsibility, a responsibility to use those powers carefully, proportionately and with respect for the rights of Canadians.

Conservatives will continue to support strong cybersecurity protections with the appropriate limits. We fought hard to include those limits in the bill, but the Liberals removed some of them. We will also continue to ensure that those protections do not come at the expense of the freedoms that define us, because in Canada, security and liberty must go hand in hand.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, the government is very much concerned about the security of Canadians and the security of commerce. Cyber-threats are very real. They are tangible. They are happening. The government needs to respond. That is exactly what the legislation does.

Where I disagree is in this: There might be some who have a tinfoil hat mentality, in which they try to give the false impression that the government wants to interfere directly with personal information. Some of the examples I have seen, I think, are somewhat misleading.

Would he not agree that the overall principle of cybersecurity is that protecting Canadians and companies is the first priority?

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, with regard to the tinfoil hat community, I assure everyone that the Conservatives are not a tinfoil hat community. We are here to protect the freedoms that all Canadians enjoy, such as freedom of expression and privacy. With regard to the bill going through committee, it was the Conservatives' responsibility to respect those freedoms while balancing the cybersecurity protections that both private and public industry need.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Mr. Speaker, it is always a pleasure to rise on behalf of the people from Kamloops—Thompson—Nicola. I was the chief critic for the bill. I was the shadow minister as it was ushered through committee.

One thing I want to say is this: The bill was overly broad. As a party, the Liberals say they love the charter. One thing that will get a bill struck down as unconstitutional is overbreadth, such as use of language like “may” or “any threat”. The bill was a dog's breakfast when it got to committee.

I am proud of the people I sat with on the public safety committee, who looked at the bill, studied it scrupulously and added a proportionality test to it. They sought to add judicial oversight, which was ruled out of order yesterday by the Speaker, and sought to add things like “necessary” and “reasonable”.

The member for Winnipeg North says that these are tinfoil hat terms; no, these are apple pie when it comes to legal interpretation. The Liberals may not want to have those types of safeguards in the bill. I could say that we as Conservatives will always stand for clear constitutional laws. I invite comments.

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, I just want to add that, from a Conservative point of view, Canada's national security requires being prepared for the cyberwarfare threats we face. Conservatives fully recognize the importance of cybersecurity as part of the national defence strategy for public and private entities. The Liberal government has been slow to address cyber-threats, with no substantive legislative response for 10 years. For the amendments that went through the committee from the Conservatives, we are addressing this lack of substantive legislative response from the Liberal government.

[Sima Acan, Liberal, Oakville West, ON]

Mr. Speaker, as my colleague from the SECU committee, the critic for public safety, mentioned, there was the phrase “any threat”. Yes, “any threat” has to be in the bill because it is technical wording. If a person does not understand the technicality of cybersecurity, they will definitely come up with those ideas. “Any threat” means that we have to act even if the threat is a near miss, before it is a material threat. If it is a material threat, it is already too late. Our systems are gone.

Regarding privacy and freedom of speech, which my colleague mentioned in his speech and his previous answer, could he make it clear to us where in the bill it is actually attacking the privacy of individuals and freedom of speech?

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, with regard to threats, the Conservatives put proper limits on ministers' powers, such as raising the threshold for an action from a threat to a serious, systematic threat. With regard to that, it requires reasonable grounds for ministerial actions.

As for the concern of threats, there is also stipulation that it is to include serious, systematic threats, again, to fully recognize the importance of cybersecurity as part of the national defence strategy for public and private entities.

[Jasraj Singh Hallan, Conservative, Calgary East, AB]

Mr. Speaker, my colleague brought up the Liberal government's overreach and the distrust that Canadians have. We have seen the Liberals' track record of freezing the bank accounts of people they do not agree with, their ideology and the list goes on and on.

I would like for him to expand on why Canadians distrust the Liberal government so much.

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, first of all, Conservatives support the bill's going to committee to fix the glaring problems with it, such as the fact that Liberals have also demonstrated they are willing to breach people's privacy with Bill C-2. Conservatives have repeatedly forced the government to improve major shortcomings in government legislation. Cybersecurity is too important to leave in the hands of the Liberal government with all its failures.

The House resumed consideration of the motion that Bill C-8, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the third time and passed.

An Act Respecting Cyber Security

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Mr. Speaker, I am pleased to rise at third reading of Bill C-8, a very important bill. We agree with the government and with all members of the House that we needed a bill on cybersecurity.

We took the necessary time to debate this bill over a number of sittings. We heard from a number of witnesses and experts, and there was no filibustering by the Conservatives, the Bloc or the Liberals. No one filibustered. Why? It is because everyone agreed that this is an important bill and that it was important to improve it through a series of amendments.

The Conservative Party put forward amendments, the Bloc Québécois put forward amendments and even the government made amendments to its own bill. We even adopted an amendment proposed by a non-recognized party, because it made sense and improved the bill.

What exactly is Bill C-8? The bill is divided into two parts. Part 1 amends the Telecommunications Act to strengthen security by authorizing the government to direct Internet service providers to do or not do certain things that are necessary to secure the entire Canadian telecommunications system.

Part 2 of the bill creates a new act, the critical cyber systems protection act, which would provide a framework for the protection of critical cyber-infrastructure and companies under federal jurisdiction. When it tabled Bill C-8, the government expected us to pass it with little or no debate, considering that it was a carbon copy of Bill C-26, which had gone through the entire legislative process in the previous Parliament and died on the Order Paper in the Senate.

However, we in the Bloc Québécois have a very influential and conscientious House leader, and she refused. She said that we absolutely had to be able to debate Bill C‑8 because we had a new perspective and because time had passed. More importantly, during the debate on Bill C‑26, almost all of our amendments were defeated because of the deal between the NDP and the Liberals. Even though our proposed amendments to Bill C‑26 made sense, they were defeated quite easily, because the NDP had agreed to that bill.

As fate would have it, we began debating Bill C‑8 with a completely new perspective and, most importantly, in a new political context where the Bloc Québécois held the balance of power in committee. The Bloc used this power judiciously and rigorously, in a professional manner. Our goal was to come up with the best bill that would serve Quebec's interests, and so much the better if it served the interests of all other Canadians as well.

I will give some examples. In Bill C‑26, all of the recommendations made by Electricity Canada were rejected. Some of them dealt with Hydro‑Québec and the importance of respecting Quebec's jurisdictions, including that of Hydro-Québec. Hydro-Québec manages a hydroelectric network and an electricity transmission system that crosses provincial and U.S. borders, and it was already meeting very demanding and strict security regulations. All of a sudden, with Bill C‑8, it found itself in a situation where the federal government could decide everything without consulting the provinces or Quebec, even though officials and the party opposite were telling us that they would consult. As we know, for the federal government, consultation often means making decisions and consulting afterward.

In committee, we wanted to make sure that Electricity Canada's recommendations were heard properly. Obviously, we proposed an amendment that addressed its concerns, which were the same as ours, and that amendment was adopted. We were very pleased that a number of Bloc Québécois amendments were adopted.

One in particular was very important to me. We had one witness, Mr. Lefebvre, who explained why encryption is so important. I do not know how well-versed my colleagues are in digital and technological matters, but encryption is a central element of all digital systems. Basically, it is a security technique that makes readable information unreadable to any unauthorized person. Only people with the right key can decrypt the information and understand it. Encryption is used to protect sensitive information, such as messages, passwords and banking information. It is used in online communications, such as email, secure websites and some messaging apps, like WhatsApp, for example. Messages and calls are encrypted end to end.

We explored this part of Bill C‑8 in depth because we had no guarantee that the government would lower its encryption criteria given that it was so vulnerable to cyber-attacks just then. There was also potential for abuse due to easier access to conversations people could have on social media apps. The government listened to our concerns and those of the witnesses and put forward its own amendment, which made it crystal clear that there would be no changes to encryption. The Bloc Québécois had presented a similar amendment. We all agreed that there was a line we would not cross. By putting it right there in the bill, encryption is now protected.

We heard from some very good witnesses. We also heard from the Privacy Commissioner, who was surprised to find that Bill C-8 lacked consistency regarding three key criteria for accessing privileged information or sharing sensitive intelligence. He was concerned that the criteria of necessity, proportionality and reasonableness were not fully specified in the bill. They were included in some sections, but not in others.

We in the Bloc Québécois took the Privacy Commissioner's testimony very seriously, and we proposed amendments to ensure that, if sensitive information is shared, it is analyzed based on the criteria of necessity, proportionality and reasonableness before access is granted. Quite frankly, we will have to revisit these three criteria when we study Bill C-22, which provides legal access to information. We will ensure that these three criteria are included in the legislation, as they are important when it comes to accessing information and, above all, sharing it with various stakeholders.

We also supported amendments that were prepared by our Conservative colleagues. Unfortunately, those amendments were ruled out of order by the Speaker of the House. That is a shame, because they would have made it necessary to obtain a mandate to make regulations, which would prevent the minister from having too much power. I am worried, and I will always point out that the National Security and Intelligence Review Agency, or NSIRA, is the only monitoring agency for Canada's intelligence services and the RCMP. It is the only agency with a mandate to monitor those agencies to see whether they are complying with the law. In other words, are they abusing their powers or sharing information? Are they dealing with private information beyond what the law allows them to do?

Basically, ruling the Conservatives' amendment out of order gives the ministers more power. At the same time, the government decided to cut NSIRA's funding by 15%, which amounts to about eight positions, including lawyers, analysts and investigators. This means that ministers and public servants would have more power but NSIRA would have less power and fewer tools.

We were therefore disappointed to see that, despite cutting $2.7 million from NSIRA's $17-million budget, the government chose not to support the amendments from the Bloc Québécois and the Conservative Party, and the Speaker ruled them inadmissible today. This made us somewhat suspicious, given that the only office with an oversight function is having its budget cut by 15%. That is 15% of $17 million. It may not seem like much, but when we look at what it represents in terms of jobs at NSIRA, it is quite a lot.

We also listened to the workers who are part of the Canadian Telecommunications Workers Alliance, because they have expressed serious concerns regarding Bill C-8, particularly with regard to whistle-blowers. If someone observes misuse, practices that violate the law or improper use of access to information—including sensitive information—and decides to report it, what could happen to them? After hearing their testimony, the Bloc Québécois introduced an amendment aimed at protecting whistle-blowers who wish to report suspected wrongdoing. We are quite proud of that.

We are working with various witnesses. Just because a witness expresses an opinion or presents facts regarding a bill does not mean we have to accept everything they say. However, in the case of telecommunications workers, their explanations allowed us to tweak the bill, right up to the very last minute. The Conservatives, Liberals and the Bloc all agreed to incorporate their proposals.

Unfortunately, the chair rejected my amendment today. We realized that whistle-blowers were protected under part 1, but not under the new law, part 2. We attempted to introduce an amendment, citing the need for consistency. Unfortunately, it was rejected.

However, we are holding out hope for the time when the legislation will be reviewed, since another Bloc Québécois amendment has been tabled. This is such an important piece of legislation. Technology, cyber-attacks and cybersecurity are evolving so quickly, including artificial intelligence. We adopted an amendment requiring a review of the legislation and its benefits, strengths and weaknesses in five years so that it can be adjusted as needed. This Bloc Québécois amendment was adopted unanimously by all members, and we are happy with it. When it comes to the whistle-blowers covered by part 2 of the bill, perhaps we can take another shot at including whistle-blower protection during the next review.

I think that the Standing Committee on Public Safety and National Security did an exceptional and exemplary job in reviewing Bill C-8. I felt like I should pat myself on the back a little, because the Liberals often say that opposition members are obstructing proceedings. Earlier, during his speech on Bill C-8, a member of the committee said that we had done a good job. That is because we wanted to have the best bill possible. Both the Liberals and the Conservatives, just like the Bloc and the NDP, helped improve the bill. That is the beauty of democracy. If the opposition is strong and thorough, ultimately, it is the citizens who benefit, because the bill ends up even better.

In the time I have left, I would like to thank our chair, who masterfully led the committee's work; the vice-chair and member for Kamloops—Thompson—Nicola; as well as the parliamentary secretary and member for La Prairie—Atateken. I also want to thank our clerk, Mr. Cardegna. Our wonderful analysts, Alexsandra and Sabrina, did an exemplary job, as did our legislative adviser, Marie. Finally, I would like to acknowledge our interpreters, who were always present in person to support us.

I also want to thank Maxime Duchesne, the Bloc Québécois researcher. He is an extraordinary researcher. I want to thank my assistant Racim and the people who work for the House leader of the Bloc Québécois. They supported us, studied the amendments with us and helped us decide where we stood on our colleagues' amendments.

I also want to thank the people who work for the Bloc Québécois's chief whip, who help us at all of our meetings. We engaged in a lot of negotiations during the debate on Bill C‑8's clauses. Every staffer for every party whip was there because the goal was to reach an agreement and compromise to make sure Bill C‑8 was the best bill it could be.

This is not something we hear a lot, and it certainly does not make headlines, but this bill is the product of constructive, collaborative work. Bill C‑8 will be good for Quebec because the Bloc Québécois protected Quebec's interests. There is a Canadian law that is going through the legislative process, and it will be even better.

I want to sincerely thank everyone for working so hard to achieve the results we achieved. Contrary to what we hear too often from the Liberal government and its members, it is not true that the opposition filibusters. Just because we disagree and propose amendments does not mean that we are against a bill. With Bill C-8, we proved that when we work together for the public good, we can get things done, and done well.

Bill C-8 will continue to wend its way through the legislative process.

[Arielle Kayabaga, Liberal, London West, ON]

Madam Speaker, I thank my colleague for her speech, and I appreciate her approach to this bill, which seeks to strengthen security and cybersecurity. Earlier, the Leader of the Government in the House of Commons introduced Bill C-25, which will also touch a little on Internet safety for children and families.

We have talked about deepfakes. I would like my colleague to tell me how she sees these two bills, which will allow us work together on putting more security infrastructure in place for Canadians and Quebeckers.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Madam Speaker, I thank my colleague for her kind words and her question.

As a mother and grandmother, I welcome any measure that can really rein in attacks on individuals and their integrity in the digital realm.

I wish she had asked me a question about Bill C‑22, which is another bill that was introduced before the break. In my opinion, it will require the same rigorous study and the same amount of time for analysis because it is about legal access to personal information.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot—Acton, QC]

Madam Speaker, I would like to ask my colleague a question, and I thank her for her excellent grasp of the subject. My question may stray from the subject and be more institutional, given that my colleague herself talked about the power of the opposition parties and the constructive work we can do.

I had a similar experience at one of the committees I serve on. We studied Bill C-11 on sexual misconduct in the military, and most of the amendments passed with the joint support of the Conservative Party and the Bloc Québécois. In my view, the point of a parliamentary system is that it is not the government that has the last word, but rather Parliament. However, it was the democratic process that determined there would be more opposition members. It is therefore only natural that the opposition parties' combined positions on a bill should win out.

Does my colleague not find it frustrating when amendments adopted by a majority of members representing the makeup of the House are rejected outright by the Speaker?