Public Safety Committee on Feb. 8th, 2024

[Jennifer Quaid]

I would say that there's a balancing act. The bill is important; there is absolutely no question. There's also no question that it needs some modification. I think that with a little effort, enough of the bill can be fixed effectively to make it good legislation that can then be fine-tuned in the regulations. I think that with focus and effort, we can get it right and get it now.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. de Boer.

[Dr. John de Boer]

I fully agree. We need to get this moving now.

It's never going to be a perfect bill, but we need to make the adjustments we suggested, which are to clarify what is considered a cyber-incident and align it with the U.S.'s definition, and reporting timelines, as well. Clarity is really essential in times of crises, and so we need to do that.

Those are easy fixes. Those are things that we can probably fix with a few modifications. I would fill those gaps, get this passed and continue to work on other elements.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you.

Mr. Bradley.

[Francis Bradley]

Thank you very much.

Mr. Chair, this is an excellent question. Do we rush the bill through or do we amend it to make it right? My response is, let's do both. Let's rush this bill through, but rush it through while taking into consideration the 14 recommendations that we've made and make the amendments that respond to those 14 recommendations.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you.

I'm going to stay with you, Mr. Bradley.

You indicated in your written brief that the bill risks “adding very little security to our sector”. I was a bit troubled to read that. Certainly our electrical grid and the reliability of electricity are some of our most critical infrastructure components. You then state further that the bill “should provide tools and protocols to add to the safety of Canada's infrastructure sector.” What are those specific protocols and tools that you mentioned, if you haven't already mentioned them in your opening?

[Francis Bradley]

Thank you very much.

With respect to the bill not significantly adding to the security, and in fact potentially diverting attention, it is not an issue with the bill itself. It's that the bar has already been raised higher than what's in Bill C-26 as a result of the mandatory standards our sector is already subject to through the North American Electric Reliability Corporation standards regime. That bar has already been set higher.

What has been put in Bill C-26 does not improve upon that. It detracts. It diverts attention to a separate and second parallel reporting structure, as opposed to using those resources to work on a response.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

All right. Thank you.

Mr. de Boer, the Canadian Chamber of Commerce has indicated that a patchwork is a disadvantage to business if we don't get this right. BlackBerry produced a white paper back in 2022. The biggest obstacle you saw, which was mentioned briefly already, was the lack of skilled people and skilled resources to deal with this at the critical infrastructure business level first, and then maybe in a larger threat environment.

Do you see that changing since 2022, when that was written?

[Dr. John de Boer]

I also co-chair, with the Canadian Chamber, their “Cyber. Right. Now.” council, so—

[The Chair, Liberal, Heath MacDonald]

I'm sorry to interrupt, but I have to make this a hard stop. We're running out of time, and I want to make sure everybody has an opportunity.

Mr. Gaheer, go ahead, please.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Thank you, Chair.

Thank you to all of the witnesses for making time for this committee.

My questions are largely for Mr. Bradley from Electricity Canada.

How many organizations are represented under your organization?

[Francis Bradley]

Forty companies are principal members of the association, from the largest electricity companies in the country, such as Hydro-Québec, down to the municipal utilities in Ontario.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

How many of those organizations currently have a cybersecurity program in place?

[Francis Bradley]

All of them.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

I would assume that there's a little bit of variability in the different programs at different organizations.

[Francis Bradley]

Absolutely. Depending on the size of the organization, of course there would be variability, but all of those that are involved in the bulk power system are covered by the North American Electric Reliability Corporation's mandatory cybersecurity standards. As a result, those companies have very robust and consistent cybersecurity programs.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Okay.

What are the consequences of a successful cyber-attack against a critical infrastructure operator in the energy sector?

[Francis Bradley]

As has been mentioned already by this panel...not in Canada but in other jurisdictions. We've seen a loss of pipeline in the United States. In Ukraine, in 2015, we saw, for the first time anywhere in the world, a successful cyber-attack resulting in a loss of power to customers. That's not something that's happened here, but those are the potential consequences of cyber-attacks.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Obviously, this is a very vital sector. I think everyone here understands that. I think that's why I was a little bit surprised when you spoke in your opening testimony against the mandatory requirements in this bill and spoke against the immediate reporting.

When I listened to the testimony by Ms. Quaid, she indicated that reporting varies and the data is not reliable. I just wanted to get your take on that.

[Francis Bradley]

When a cyber-event is occurring, do we want our people working on paperwork for regulators or do we want them, at that moment, working on securing the systems? First and foremost, we want to have people working on securing the systems, and then looking at the reporting requirements.

It's a question of easing the reporting and regulatory burden, number one. Number two, my concern is about duplication here. We already have reporting requirements. We're talking about now creating a second reporting regime as well.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

You mentioned that this other regime is actually a higher standard. Wouldn't it be easier to meet the lower standard contained within this bill?

[Francis Bradley]

It would be, except that if the definitions are going to be different, it means having a separate and different reporting structure and different definitions.

In fact, not entirely joking, I said a number of years ago, when the government was beginning to move along this path, that they potentially could look at the NERC cybersecurity standards and look at replicating those for other Canadian critical infrastructure sectors. That would have made our life easier, certainly, if we'd looked at the existing regime we had and looked at applying it to other sectors.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

I guess you would agree that, whether it's this regime or another regime, mandatory reporting requirements are important and information collection is important.

[Francis Bradley]

Absolutely.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Thank you, Chair.