Public Safety Committee on Feb. 5th, 2024

[Daina Proctor]

Thank you, Mr. McKinnon. I appreciate the question.

There are a number of international standards that we would rely upon. If I dare say, I would look forward to and welcome the opportunity to share with you what those international standards are during a more working session. For this debate and this discussion right now, the points I would draw out are certainly the definitions, the response times and the punitive nature of the responses.

The 72 hours on a specific incident being responded to—but a set severity of incident—would be a particular item of interest. Then there are the punitive aspects. The punishment of an individual for the infractions is a stretch too far, which I have not seen any other international regulations go towards; they go towards corporations. The accrual aspect is equally far.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

Do these comments pertain to the international standards, or are they part of your other...? You mentioned them already. Is this a matter of adhering to those standards to clarify those definitions and obligations?

[Daina Proctor]

I'm sorry. Can you repeat the question, Mr. McKinnon?

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

At some point we'll have to submit amendments to this bill. You indicated that we should adhere to international standards. It would be helpful if we had specific standards that we should adhere to. Are those standards sufficiently encompassing, or do they go too far? If you could clarify both of those aspects, it would be helpful.

[Tiéoulé Traoré]

We will make sure to get back to you with proposed amendments and examples of what we see as frameworks to achieve.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

You're concerned about definitions. Would that be assuaged with adherence to these standards?

[Daina Proctor]

Perhaps I can clarify that as well. My apologies if, during my opening statement, I indicated otherwise. Adherence isn't necessarily the encouragement that we would be offering. It's more that a number of aspects of Bill C-26 are much more far-reaching than established international standards for mature cybersecurity regimes, of our allies in particular.

It's not necessarily adherence to them, but more a recognition that we don't necessarily need to go beyond what they're already working towards in their private and public partnership and enablement of the industry.

I hope that gives a little bit of clarification. It's not necessarily an alignment to international standards, but a “not going farther than”, as we try to work together to bolster our critical infrastructure.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

These standards basically establish a border within which we ought to operate.

[Daina Proctor]

That's a good way to put it.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

Could we clarify what the risks are that we leave ourselves open to if this legislation does not pass?

I open this to everyone.

Go ahead, Mr. Shipley.

[David Shipley]

I draw your attention to April 2023, when a Russian-linked hacking group successfully penetrated a Canadian natural gas pipeline provider and was “able to increase valve pressure, disable alarms, and make emergency shutdowns.” By the way, this Russian hacking team wasn't even their best, so that's what we're risking when we fiddle while Rome burns on cyber-legislation.

I'm not saying we're going to have a Hollywoodesque total society shutdown. I'm saying people could get killed. I'm saying businesses could be negatively impacted economically. I'm saying there are people who want to throw a punch and hit us right in the nose. We are sticking our face up, without an ability to defend ourselves, and it's going to hurt.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

How would this legislation stop that kind of attack?

[David Shipley]

First, we have to walk before we can run. Let me put this into very clear terms: Canada is not even crawling when it comes to defending itself. If you want to look at a leader right now, look at Australia. We are lagging, and it's not going to be business that pays the price. It's going to be everyday Canadians.

Every time there's a cyber incident, it contributes to the cost of living crisis in this country. We need to get moving on this, and we need to get it right. The flaws in this legislation that have been pointed out are significant. They will set us back. Instead of making things better, we're going to make them worse.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

I'm not sure how much time I have left.

[The Vice-Chair, Conservative, Doug Shipley]

You have just a little over a minute.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

We'll chance for two minutes, Ms. Bahr-Gedalia, if you'd like to weigh in on these questions as well.

[Ulrike Bahr-Gedalia]

Mr. Shipley started with one example.

If you think about cyber incidents and threats, I don't think we can even keep up with any records and reporting in terms of how many there are a day. MP O'Connell, you mentioned Atlantic Canada, the Newfoundland health care infrastructure that was impacted as well. It's a snowball effect. If one portion of critical infrastructure gets impacted, it impacts our economy and society, and it also impacts how foreign direct investment will happen in the future. How do foreign entities see us? Do they want to settle in Canada? Do they want to build a future here as businesses, as communities and as talent?

I see it as a two-way.... While we have trouble in front of our own door, within the country, it is also on a global level. How do we get perceived and how do we best align ourselves and ensure that we are...? This is the cyber tag line right now: Lead the global cybersecurity future and be the most secure country on the planet. Canada can be that, and I think Bill C-26 is a step forward, but we need to speed it up a little, as it has already been in discussion for quite some time.

Thank you.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

Parliament proceeds at its own pace.

I think I'm out of time.

Thank you.

[The Vice-Chair, Conservative, Doug Shipley]

Ms. Michaud, you're up next for six minutes.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

I'd like to thank the witnesses for being here and for their patience.

Ms. Proctor and Mr. Traoré, you mentioned three important elements that seem essential to you in the context of this bill. Mr. McKinnon talked a little bit about the need to align with international standards, and I'd like to hear more about that as well. This is going to take a little bit of a longer discussion.

You also talked about the need to clarify the definitions in the bill, because there's a lot of room for regulations at the moment. That's more or less my understanding of the bill: it gives a lot of power to the Minister of Industry and the Governor in Council to make orders, and when I read it in its current form, I get the impression that it could go all over the map. It gives a lot of powers, but it's not really clear what the ministers could invoke, or what they could ask companies to do or force them to do.

So you're proposing that certain definitions be clarified, which could help to provide a framework for the government's actions later. I'd like to hear more about this.

[Tiéoulé Traoré]

There are two aspects to this. The first is the implementation of the bill and the regulatory framework. We all want the bill to be applied in the best way possible, of course. However, we find that some definitions leave room for interpretation. In cases where it's a major issue, we would prefer that the framework be much clearer so that people can comply with it more easily. Terms like “major incident” or “cybersecurity breach” are quite broad and generic. We find ourselves at an impasse. We think it's much simpler to clarify these terms now than to wait until the regulatory stage to establish definitions and end up in a bit of a mess when it comes to determining what to do. It's always better to clarify things right from the start.

The second aspect concerns government intervention. To be clear, we are committed to seeing the essence of the bill come to fruition, since cybersecurity breaches are a major issue. At IBM, we produce an annual report, and we've determined that the cost of a cybersecurity breach is $7 million per affected company, which increases to $12 million when the financial sector is involved. As a result, it's important to take action, and the government must show leadership in this regard. Its actions must also be well regulated, codified and predictable for the players in the system.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you.

Mr. Shipley, you talked about creating positive reasons for companies to implement a cybersecurity framework and inform the government. The government wants to force companies to do so under threat of monetary penalties.

Last week, a witness told us that tax incentives were needed. I asked him if we should switch things up, that instead of imposing monetary penalties, we should introduce tax incentives. He said no, that it was worth keeping the penalties for companies that didn't comply with the government's demands. Some companies may be concerned that this will create a lot of paperwork. So there's not a lack of willingness on the part of these companies to comply with these requests, but they are concerned about the delays and the costs that setting up such a framework could entail.

I imagine you consulted companies. What did you hear from them? Could a tax incentive be of interest to them?

[David Shipley]

Thank you for the question.

I apologize, my French isn't very good, so I'll answer in English.

The due diligence defence to the administrative monetary penalties is the first thing that becomes a positive thing. If I showed that we were in the spirit, trying to defend our organization, that we were doing what we should, that's a positive step that encourages me to invest, so I can show that. That's why it's so important that this gets addressed in the Telecommunications Act.

To be very clear, the Canadian private sector already spends $9 billion a year on cybersecurity, so we're not coming to Parliament and looking for a handout, for government to solve all problems. However, what's interesting is that this legislation deals specifically with very large enterprises and critical infrastructure. It does not deal with 98% of Canadian businesses, which are small businesses, 50% of which spend nothing on cybersecurity today, so they absolutely need help. As parliamentarians, you've heard the story of the impact of COVID-19 on small businesses, the debt load and more. They cannot afford yet another thing. Let's be very clear: The bill for cybersecurity for small businesses and large enterprises is because, at a national level, we fail to protect them from other countries and from criminals, so yes, I highly encourage other measures.

My point about the speed with which we need to move this legislation.... This is just the first step for laws you need to consider, and we need to get it right.

I'll be honest. Where Canadians are being hurt, and hurt badly, right now is in health care. You have five hospitals in Ontario right now that are still recovering from an ransomware attack. We still don't know what happened in Newfoundland and why it happened, nor have we learned from it. We know, from non-peer-reviewed research study in the U.S.—

[The Vice-Chair, Conservative, Doug Shipley]

Excuse me, but I have to ask you to wrap it up, please.

[David Shipley]

—that 40 to 60 Americans have died because of ransomware attacks against hospitals there, so yes, we need help. We need to get this law done first, and the first thing to make it better, from a positive side, is to have a due diligence defence.