Public Safety Committee on Feb. 12th, 2024

[Eric Smith]

You have to be careful about being speculative, but we've already seen the government make a policy statement in 2022 regarding a requirement to remove equipment from specific suppliers from the infrastructure, namely telecommunications providers, so that's an example.

The order-making powers are very broad, as you know: “to do anything, or refrain from doing anything”. It could be cutting off service to a particular organization, individual, or what have you. It could be requiring you not necessarily to take out equipment from your infrastructure, but to put certain equipment into your infrastructure, or to comply with certain standards. It could be weakening encryption, or it could be requiring you to intercept communications.

The way it's currently drafted could be very broadly interpreted.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

One other concern, as I understand it, is that making such orders public would potentially expose vulnerabilities in various industry practices to bad actors. Do you have any comments on that?

[Eric Smith]

Are you talking about the confidentiality of the order, or the confidentiality of information supplied?

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

If the order was made public, it might expose vulnerabilities to bad actors.

[Eric Smith]

That's a good question. We're definitely sensitive to that. Definitely, there are circumstances where there may be legitimate reasons why portions of an order or in some cases the entire order needs to be kept secret.

The way we look at it is that secrecy should be the exception rather than the norm. That's where I think it's appropriate to have.... Any judgment or requirement to keep an order confidential should be tested. It should go to a judge in order for the government to provide the evidence of why it should be kept confidential, so that there's the opportunity to test that assumption.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

You mentioned, in this context, the notion of a special adviser or advocate, if you will. Can you outline what you see as the role and the powers of such a role? Is there any body within the government, presently, that could step into that role as part of its work?

[Eric Smith]

There already are existing mechanisms in situations or court hearings where there is confidential or secret information that can't be made public or shared with the target. A special advocate who has the required security clearance can question the government, test the evidence and test the assumptions that were made. It's not a perfect situation, but it at least provides some mechanism by which the government's evidence can be tested.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

You mentioned the need for checks and balances. You mentioned the need for the rationalization of these orders. Can you suggest any further checks and balances that would be required here?

[Eric Smith]

Certainly. Right now, the way it's worded is that, if the minister believes it's necessary to do or not do something.... I think it's important to require that the order be made only after consulting prescribed expert bodies. That could be a C-stack, for example. It could be other cybersecurity bodies within the government. It's to determine not only whether there's a security threat, but whether the order is proportionate and balanced.

Let's face it, our communications systems are very complex. It may seem easy to say to remove this equipment or do something, but we want to make sure that experts, including the targets of the orders, if appropriate, can advise the government of what some unintended consequences could be to the system, or even the viability of some of the smaller providers who are asked to comply with those orders. That's a very important requirement that should be in the legislation.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

As a consequence of some of these orders, different providers may be required to add or remove equipment or change their software. That entails cost. Is it part of your submission that they should be indemnified from such costs?

[Eric Smith]

We're not saying that they should be indemnified. It could be just a drafting issue, but the legislation right now says that providers are not entitled to compensation. That's open to interpretation. Does that just mean they don't have a right at law of compensation, or does that mean they cannot be compensated?

What we're suggesting is that there should be discretion for the minister or the Governor in Council to award compensation on a case-by-case basis and that providers who are impacted by those orders should be able to make representations as to whether or why they should receive compensation.

For example, in the United States, the government set up a multi-billion dollar fund to help a certain class of providers remove Chinese-supplied equipment from their infrastructure.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

My last question is on the due diligence defence. Could you give us more information about that?

[Eric Smith]

Sure. It's kind of a puzzling thing for us in the legislation, because all other affected parties in the legislation are able to show.... If they're alleged to have committed a violation, a defence could be that they've done everything reasonably possible to avoid making that violation. It could be, for example, that the government says that you must replace this equipment in your infrastructure with equipment from somewhere else, and it's not even available on the market.

For whatever reason, the legislation says that we're the only parties that are not entitled to make that defence.

[The Chair, Liberal, Heath MacDonald]

Thank you, Mr. Smith and Mr. McKinnon.

We're going to move on now to Ms. Michaud, please.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

,

Thank you, Mr. Chair.

I want to thank the witnesses for joining us.

I would like to put my first question to the representatives of the Canadian Telecommunications Association. I'll then put a similar question to the representatives of the Canadian Bankers Association.

Almost everyone agrees that Bill C‑26 is a step in the right direction, and that it's relatively good news that the government wants to tackle the cybersecurity issue. However, there are fairly widespread concerns about the protection of personal information and privacy, in addition to the government's sweeping regulatory and order‑making powers in particular.

You represent carriers and companies that invest in telecommunications networks, such as Vidéotron, Rogers or Bell. I imagine that these large companies are already investing in ways to protect themselves against any cyber-attacks. They have the workforce to do so.

You may also represent slightly smaller companies with fewer customers. This could mean an additional workload for them. Some of them may have already endured cyber-attacks.

At this time, how do the companies that you represent protect themselves against cyber-attacks? What will Bill C‑26 change?

If the bill isn't amended, for example, to better regulate the government's powers, will somewhat smaller companies—such as small and medium‑sized businesses—consider it a burden or a relief?

I know that it's a fairly broad issue.

[Eric Smith]

It's a very good question.

One of the things is that our members have very robust cybersecurity processes already, and, as Mr. Ghiz mentioned in his remarks, they already collaborate deeply with government. Many of the things that could come about as a result of Bill C-26 are things that the industry is already doing. There is CSTAC, the Canadian security communications advisory committee, which puts out best practices and guidance, etc., for all the telecommunication service providers. Bill C-26 could allow the minister to actually order specific practices, for example input.

In terms of the regulatory burden, I don't know of any industry that welcomes additional regulations, as it does add some burden. Again, our members already have robust practices, so I think the additional burden is mostly around things like the reporting requirement. That's where the legislation could require some improvements. It says that we must “immediately report” an incident. Well, “immediately” is right away, and you wouldn't have enough information to even know if you'd had an incident. Some of those things can be improved.

I hope that has answered your question.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

,

Yes, it did, Mr. Smith. Thank you.

I would like to put the same question to the representatives of the Canadian Bankers Association.

According to the Office of the Superintendent of Financial Institutions, banks are increasingly the target of cyber attacks. We've seen some examples in recent months. I imagine that this may lead customers to worry about the protection of their personal information. As in the case of telecommunications companies, I imagine that banks already have certain mechanisms in place and that, as Mr. Smith was saying, they're already meeting the requirements of Bill C‑26.

What does this mean for banks? Is it a relief or a burden?

In your opinion, what should be better regulated?

[Angelina Mason]

I will confirm the view given by the Office of the Superintendent of Financial Institutions, that we do treat the reporting as mandatory.

I want to clarify a couple of things. One is that the reporting that goes to OSFI is for technology and cyber. If there's a technology incident, even if it's not cyber-related, or if you think of some sort of infiltration into your system, that is reported, because what OSFI is very concerned about is the resilience of our systems in being able not just to secure but also to deliver our services.

When you look at that type of reporting, it's intended to help identify areas of potential concern so that can then be shared back and people can have stronger systems. That's now being done within silos. We do that with OSFI.

The whole point of this legislation is to identify the critical sectors and say that the major players in these sectors, because of what they represent to the security of our whole ecosystem, should be reporting to one central location, so that you're not only hearing what's happening here but you're hearing what's happening in that sector, and we can identify if there's a shared concern, if there are learnings there and if somehow what's going on is connected.

A key part of this legislation is really to improve the available information to help combat cyber-threats. That's definitely a positive that we see, and that's why we've encouraged you to go even broader and allow voluntary sharing at all levels within the ecosystem. That's very positive. Also, there's the fact that we do our cybersecurity planning, and others do their cybersecurity planning, and now that will be validated and centralized so that, again, we can look for learnings about different things in different jurisdictions.

[The Chair, Liberal, Heath MacDonald]

Thank you, Ms. Mason.

Mr. Julian, go ahead, please.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thanks, Mr. Chair.

Thanks to our witnesses.

I'll start with you, Mr. Ghiz.

How many cyber-attacks has the Canadian Telecommunications Association had in the past year? I'd like to know whether you're finding that the trend is increasing, staying stable or decreasing.

[Robert Ghiz]

Unlike the financial individual who was on earlier, we're not a regulator and we're not privy to the private information of our members. Unfortunately, I don't have that information.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

However, anecdotally, there would be some discussion within the association, wouldn't there?

[Robert Ghiz]

In terms of private, personal business within, no, we're not privy to the information.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

I'll ask you this, then. If you were sharing best practices, surely the types of cyber-attacks may be similar across your sector. Is there information sharing that helps other companies, for example, put in place protections against cyber-attacks?

[Robert Ghiz]

They do that with themselves and with government through CSTAC. It's not through our association that this would happen.