Bill C-8

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

An Act Respecting Cyber Security

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, misinformation is really important on this. What the member is trying to say is that if any of the 55,000 people who work for Canada Post have any sense that there is any sort of a drug in a number 10 envelope, they will have the authority to open that envelope. I believe he knows full well that is not the case. A warrant would be required. Bill C-2 legislation would put Canada Post on the same playing field as Purolator and other companies.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

No, Madam Speaker, that is wrong. It says Canada Post may open a letter when its employees have reasonable grounds to suspect; a warrant is issued on reasonable grounds to believe. I cannot be any more clear. No, the member is wrong. I am sorry, he is wrong.

The House resumed consideration of the motion that Bill C-8, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, be read the second time and referred to a committee.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, my question is on Bill C-8, which we know is kind of a replacement, with some modifications, of Bill C-26. The member himself introduced a private member's bill just last week, talking about how it was reformative and about the many changes that would result as a direct response. That is programmed, so we know that after two hours of debate, it is going to committee.

This particular bill has already gone to committee, passed third reading, gone to the Senate and come back in a somewhat different form. I wonder whether the member would agree that there has been a lot of debate. He said he wants the bill ultimately to go to committee. Can he give us some sense of how long he believes the bill should stay in the House before it goes to committee?

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Madam Speaker, I believe that parliamentarians, particularly on our side as opposition, should have the opportunity to voice their concerns. Does that mean Conservatives are going to put forward 140 speakers to the bill? No. At the same time, the reality is that the member is asking me whether I promise. I promise to do so as long as he concedes I am right on Bill C-2.

We are here in our democracy, and I spoke about the honour of being here as members. At the end of the day, I think the people who have concerns about Bill C-2 or want to endorse it from the government side should have their opportunity to speak. I believe we should afford them every opportunity to do so. At that point, we can look at the bill's going to committee.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Madam Speaker, I cannot begin my speech without noting that next Tuesday, September 30, we will be observing National Truth and Reconciliation Day. We will therefore not be sitting on that day. I would like to stand with my colleagues from the Bloc Québécois who, like me, have the privilege of living near a reserve. I work with the Akwesasne reserve, so I would like to say hello to my friend Grand Chief Abram Benedict, for whom I have great respect. He is responsible for the Ontario portion of the Akwesasne reserve, which is divided into three sections, located in the United States, Quebec and Ontario. I also want to say hello to Grand Chief Lazore, who was elected just a year ago and for whom I also have great respect.

During a meeting, Grand Chief Abram Benedict shared his main complaints with me. Since I am the Bloc's public safety critic, we discussed Akwesasne's need for legislation to regulate all police forces on its territory. Policing is currently managed provincially, and the people of Akwesasne would like to have one police force covering their entire territory.

He also told me about travel issues. Sometimes, people have to cross the American border to access the Akwesasne reserve, which poses problems for people who live on the reserve.

We had some good discussions. I believe that honest and sincere discussion is imperative to walk the path of truth and reconciliation. That was a brief word of introduction to set the stage for a very special day coming this September 30.

This legislation is fairly technical. As mentioned by my colleague, the Conservative Party critic for public safety, I do not think that anyone here would claim to be an expert in cybersecurity, considering its complexities. However, we recognize the importance of implementing a legislative framework to protect sectors and systems of critical importance to Quebec, the provinces and Canada.

What is Bill C‑8 exactly? Allow me to read a few paragraphs from the bill to give members a quick idea.

The first part is quite simple. It amends the Telecommunications Act by adding a part on cybersecurity that empowers the government “to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.” Obviously, that is very important.

The bill also provides for a penalty scheme to promote compliance with orders and regulations made to secure the Canadian telecommunications system. This will allow the government to prohibit companies from using products and services from high-risk suppliers.

The second part of the bill would enact the critical cyber systems protection act to provide a framework for the protection of critical cyber-infrastructure or cyber-businesses in the federally regulated sector. Basically, the bill will authorize the government to designate any service or system as a vital service or system and to establish classes of operators for those services and systems. In the bill, the government says that this will serve as a model for provinces, territories and municipalities to secure critical infrastructure. The second part of the bill will apply more to operators in the telecommunications, energy, finance and transportation sectors, which are all critical sectors related to national security.

The legislation will make it possible to designate certain systems and services in the federally regulated sector as vital to national security or public safety.

The bill is very clear. It lists six vital services and vital systems in schedule 1. Let us look at them together. Obviously there are telecommunications services. Then we have interprovincial or international pipeline and power line systems, nuclear energy systems and federally regulated transportation systems, such as ports, trains, planes and airports. There are also banking systems, followed by clearing and settlement systems.

I would like to note, as all my colleagues have, that Bill C‑8 is practically a carbon copy of Bill C-26, with just a few exceptions.

I read the legislative summary when I was preparing this speech, and I would like to mention once again that the analysts at the Library of Parliament do extraordinary work. They help us better understand the bills, they provide us with the tools to improve bills and they raise concerns for us to clarify. I would like to thank them today because they are doing a truly extraordinary job of supporting us in our work every day, especially our legislative work.

I was saying that Bill C‑8 is almost a carbon copy of Bill C‑26. There are a few small changes. We know that Bill C‑26 died on the Order Paper. It had almost made it all the way through the legislative process in the House, but it died on the Order Paper in the Senate.

I want to point out that a lot of work was done in committee. The committee held eight meetings. My colleague at the time, Kristina Michaud, studied Bill C‑26 carefully with her assistant and the Bloc Québécois's research team and proposed some 26 amendments, most of which were considered, voted on and adopted. That just goes to show that the opposition's work, particularly in committee, also serves to improve government bills.

I am saying that because the Bloc Québécois is a party that is often praised for its diligence and professionalism. We are a party that works hard. We always look at bills from the same angle: Is the bill good for Quebec? Often, if a bill is good for Quebec, it is also good for the other provinces in Canada.

However, if it is not so good for Quebec, we are able to take advantage of the opportunity for debate to try to point out to our colleagues that there are some provisions that are not in Quebec's interest. That is really our mission here in the House of Commons, or part of it, at least. I would really like to thank Kristina Michaud, her assistant and the research team for doing such a great job throughout the study and for improving Bill C‑26 through amendments.

Of course, during this process, we submitted amendments that were not adopted. These amendments were rejected by the NDP, the Conservatives and the Liberals. The situation is different now, and we hope that we will be able to convince the government that the amendments we proposed to Bill C‑26 are relevant and should be incorporated into Bill C‑8.

That being said, I would like to reassure the government right away that the Bloc Québécois is in favour of the bill. It is true that Canada is lagging behind on the issue of cybersecurity for countering cyber-attacks and cyber-threats. However, the committee will still need to spend a few hours hearing from witnesses who have concerns, and it will also need to take into account the Bloc Québécois's amendments.

The amendments we proposed focused on government accountability. We wanted to include a reporting requirement and a requirement for greater transparency. I have to say that Bill C‑8 gives the minister a number of powers. We therefore felt it was important that the minister be required to table reports.

On the privacy issue, the amendments we proposed were adopted. However, I think that section of the bill warrants further analysis. It would be useful to hear from witnesses who specialize in the management of private information and in documentation. I think we will continue this work on privacy protection by consulting experienced witnesses in order to enrich our thinking.

Despite the work that was accomplished and the amendments we proposed, certain concerns remain, particularly regarding the businesses covered by the bill. Are the businesses willing to invest? Will they be able to quickly comply with the requirements set out in the bill? That is one of our concerns, because it seems that businesses will have a lot of work to do, and we are wondering whether better support would be needed.

It is clear to us that the government has been mindful of the lack of clarity surrounding the designation of classes of operators. In fact, research conducted by the Library of Parliament found that there is some ambiguity, a lack of legislative clarity, in the way operators are designated. We hope that the work done in committee will allow us to delve deeper into this issue and explore the possibility of clarifying the definition of “designated operator”.

We also have concerns about the unlimited power to make orders and collect information, particularly with respect to telecommunications service providers and designated operators of critical cyber systems. Legal experts have expressed reservations about the protection of personal and confidential information, including information covered by solicitor-client privilege. Protecting this type of information could be challenging, given the new search powers. More improvements are needed to ensure that Bill C-8 includes every measure necessary to protect privacy and personal information.

That brings me to the part that concerns us more, the part about Hydro-Québec. As we have said time and again in this House, the Bloc Québécois objects to federal government intrusion in Quebec's jurisdictions. As we know, Hydro-Québec owns all the transmission lines in our territory, and as far as we are concerned, this ownership is not up for discussion. It represents a pivotal gain dating back to the Quiet Revolution that enables us to produce green, affordable electricity for all Quebeckers. As we see it, the bill infringes on provincial jurisdiction over electricity.

Let me explain so that it is clearer, since we will have to discuss this in committee. The Canadian Energy Regulator Act states that provincial laws apply to parts of an international power line that are within a province. A province may therefore designate a regulatory agency to exercise its powers, rights, and privileges over those parts. For a line to fall under the jurisdiction of the federal government and the Canada Energy Regulator, the interprovincial line must be designated by order. In Quebec, no lines are under federal jurisdiction or subject to the Canadian Energy Regulator Act.

This poses a significant problem for us. This was already the case with Bill C-26 and it is still the case with Bill C-8. Bill C‑8 technically affects interprovincial lines. The Canadian Energy Regulator Act and Bill C‑8 are contradictory on the issue of jurisdiction. However, the Canadian Energy Regulator is designated as the regulator of vital systems in Bill C-8. In our opinion, this is a combination of inconsistency and interference.

Under the guise of cybersecurity, Bill C‑8 expands the jurisdiction of the Canadian Energy Regulator to cover the entirety of an international line, even the intraprovincial parts. In our view, the law should acknowledge the jurisdictions of the provincial regulatory agencies, like Hydro-Québec. We see Bill C‑8 as a blatant encroachment, and it certainly does not address the matter of overlapping jurisdictions or even duplication of responsibility.

At a time when the government is imposing budget cuts on Quebec and on Canada, we find it hard to understand why, through Bill C‑8, the federal government is imposing standards on Hydro-Québec and claiming supremacy, given that Hydro-Québec has its own cybersecurity protection systems.

The provinces even have the authority to impose penalties if reliability standards are violated. In our view, Bill C‑8 interferes in an area already covered by the critical infrastructure protection, or CIP, standards of the North American Electric Reliability Corporation. These standards apply to the critical infrastructure that the bill seeks to implement. As a result, an operator could be penalized twice for the same violation. Which would take precedence? These are some of the things we are wondering about. We think that the jurisdiction of Quebec and Hydro‑Québec should be respected.

The bill enabled the federal government to fine Hydro-Québec if Hydro-Québec did not comply with the federal standards. That is rather absurd because Quebec has been managing a hydroelectric system for a long time and Hydro-Québec, which experiences cyber-attacks nearly every day, has a rather robust system.

There could even be penalties of up to $15 million if the business is found to be non-compliant, which is considered to be a separate violation, when Hydro-Québec is already adhering to standards. That is my point.

Hydro-Québec already follows North American standards. Since we supply electricity to the United States, we must meet North American standards. It seems like Bill C‑8 ignores what is currently happening with Hydro-Québec's actual responsibilities and tries to encroach on its jurisdiction. I am not sure whether the Government of Quebec was consulted. I am not sure whether Hydro-Québec was consulted either.

Yes, the government needs to collaborate nationally with the provinces and territories on a bill, but it needs to reassure Hydro-Québec and Quebec that certain provisions of Bill C‑8 will be reviewed in order to respect the jurisdiction of Hydro-Québec and the provinces.

On that note, I invite my colleagues to ask me a few questions if they want to better understand our view, which is that Bill C‑8 is an important bill but needs to be amended to ensure that the federal government is not interfering in Quebec's affairs and jurisdictions.

[Marilyn Gladu, Conservative, Sarnia—Lambton—Bkejwanong, ON]

Mr. Speaker, the member spoke of a few problems with the bill. She mentioned amendments that the Bloc Québécois would like to move in committee.

Can she explain the amendments and the reasons for them?

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Mr. Speaker, although I cannot list the provisions, I can say that we will be moving a few amendments on privacy. We also intend to move amendments to ensure respect for Quebec's jurisdictions and ensure that Hydro-Québec can continue to collaborate with the United States, since it is already heavily regulated.

If the bill stays in its current form, with no amendments, we find it hard to imagine that Quebec and Hydro-Québec will be able to continue this collaboration. In our opinion, this part makes no sense and creates jurisdictional overlap. We are going to study this issue.

I like my colleague a lot. We both sit on the all-party border caucus. However, I cannot overlook the fact that the Conservatives, the Liberals and the NDP joined forces to defeat amendments on the issue of federal interference in Quebec's jurisdictions.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Mr. Speaker, I would like to know whether my colleague thinks this bill should be sent to committee as soon as possible so we can really study the amendments she talked about at length.

Does she think that should happen as soon as possible?

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Mr. Speaker, I agree with my colleague that this is a very urgent and important bill that deserves our attention. I would like to have the opportunity to study it in committee right away so that we can present our arguments and amendments and better define the issue of interference. Honestly, I do not think the Liberals and Conservatives fully understand what this means for Quebec and Hydro-Québec.

Sometimes these legislative measures are conceived out of a simple lack of knowledge or a strong inclination toward centralization. We are left with the impression that the government wants the provinces to gradually become mere subsidiaries, with all major decisions made only in Ottawa.

[Xavier Barsalou-Duval, Bloc, Pierre-Boucher—Les Patriotes—Verchères, QC]

Mr. Speaker, I have a question for my colleague, who did a good job explaining how Quebec is already doing a lot to ensure its security. Hydro-Québec is doing a lot in this area, because its infrastructure is massive and important to us. We want to protect it, because we care about it so much.

The federal government is proposing new standards and new ways of doing things that would create jurisdictional overlap and even force Quebec to do things differently, even though it already has the expertise and is capable of countering these threats. It is not really surprising to me that this is coming from the Liberals, given their penchant for centralizing everything in Ottawa.

Bill C-8 looks a lot like Bill C-26. Why were the reservations and concerns that the Bloc Québécois previously expressed not taken into account in Bill C‑8, given that the government already had the opportunity to hear these arguments? It also already had the opportunity to hear Quebec's concerns.

How did the Liberals respond to these concerns?

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Mr. Speaker, when it comes to interference in this case, there is really no difference between the Liberals, the Conservatives and the NDP because they all have the same penchant for centralization.

Earlier, my Conservative colleague, the public safety critic, with whom I serve on the committee, was telling me that cybersecurity and cyber-threats know no borders. I understand what he is saying, but the federal government cannot just introduce a bill forcing Hydro‑Québec to comply with two different ways of combatting cyber-threats. Our electricity grid has been in place for a long time, and there are really important mechanisms in place to counter cyber-threats and cyber-attacks. In any case, the grid is attacked every day because electricity is important and essential.

I am going to make it my duty to educate my colleagues on the Standing Committee on Public Safety and National Security and explain to them that there is no danger in letting Hydro‑Québec manage cybersecurity itself and counter cyber-threats itself.

[Abdelhaq Sari, Liberal, Bourassa, QC]

Mr. Speaker, I would like to thank my Bloc Québécois colleague and congratulate her on the relevance of the points she made. This is hardly about centralization. I am not an expert in this area, but I think we can agree that cybercriminals act quickly and nimbly. Their crimes are evolving so fast that our laws and those of other countries cannot keep up.

Does she not see that the constraints she is adding with her amendments could undermine our efforts to be as nimble as cybercriminals?

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Mr. Speaker, I thank my colleague, with whom I serve on the Standing Committee on Public Safety and National Security. I think we have something in common, specifically that we both want to understand the issues and learn more.

My answer to his question is no. Hydro-Québec already complies with North American standards. It feels as though Bill C-8 is another layer on top of existing standards. Hydro-Québec would then be stuck trying to comply two sets of standards and, in extreme cases, it could face penalties from two authorities. This needs to be explored further to see how that scenario could be avoided. We will discuss this in committee.

I do not have the answer, so I will ask the member for Bourassa the following question: Was Quebec consulted? Was Quebec's minister of cybersecurity and digital technology consulted? Were the other provinces asked for their opinions?

In my view, this bill calls for co-operation. When co-operation is required, it is important to take the time to consult those who will be affected.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, when I look at legislation, whether it is on finance, telecommunications, energy or our transportation industry, these are responsibilities that the federal government has. It is the federal government's responsibility to take a look at one of the greatest threats, that being cybersecurity. Putting in a framework and establishing this legislation is critically important. I do not think that what we want to see is dealing with energy. In Manitoba, we have a lot of hydro, much like Quebec. Manitoba and Quebec have a lot in common.

I see having the federal government take responsibility and provide that additional sense of security, given the importance of hydro power to both of our provinces, as a positive. How is it a negative thing? That is the question I have for the member.