Evidence of meeting #99 for Public Safety and National Security in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was information.
A recording is available from Parliament.
6:50 p.m.
Conservative
Glen Motz Conservative Medicine Hat—Cardston—Warner, AB
One is “partial compliance”, is it not? Should paragraph (e) not be “partial compliance”?
6:50 p.m.
Liberal
6:50 p.m.
Liberal
Jennifer O'Connell Liberal Pickering—Uxbridge, ON
It's just the two types of compliance.
We do have the French translation if there is a question.
6:50 p.m.
Liberal
The Chair Liberal Heath MacDonald
Let's call for a vote.
(Subamendment agreed to [See Minutes of Proceedings])
6:50 p.m.
Liberal
The Chair Liberal Heath MacDonald
We're back to NDP-7. Shall it carry as amended?
(Amendment as amended agreed to [See Minutes of Proceedings])
We are now turning to CPC-9.
6:50 p.m.
Conservative
Doug Shipley Conservative Barrie—Springwater—Oro-Medonte, ON
We will be moving that amendment. CPC-9—
6:50 p.m.
Conservative
Glen Motz Conservative Medicine Hat—Cardston—Warner, AB
No. It's the same as NDP-7. That's the one we just finished.
6:50 p.m.
Conservative
Glen Motz Conservative Medicine Hat—Cardston—Warner, AB
We're withdrawing that one because NDP-7 was passed, and it's like BQ-6 and CPC-9.
6:50 p.m.
Conservative
6:50 p.m.
Liberal
6:50 p.m.
Liberal
Iqwinder Gaheer Liberal Mississauga—Malton, ON
Thank you, Chair.
This is just adding an NSICOP and NSIRA reporting requirement. There's a security-cleared group of individuals here that will be given transparency. It doesn't required that they act on the information, and therefore it doesn't interfere with their work either.
6:50 p.m.
Liberal
The Chair Liberal Heath MacDonald
Is there any further discussion?
Shall G-5.1 carry?
(Amendment agreed to [See Minutes of Proceedings])
Next we have NDP-8. If NDP-8 is moved, CPC-10 cannot be moved, as they are identical.
Mr. Julian.
6:50 p.m.
NDP
Peter Julian NDP New Westminster—Burnaby, BC
Thank you, Mr. Chair.
This is going to be, I think, one of these key decision points today in the legislation.
What was clear from the testimony we heard from a number of sources is that the cybersecurity protection act needs to be under the Statutory Instruments Act. In terms of transparency and the overall accountability of this legislation, there are a number of amendments we are offering that basically ensure the Statutory Instruments Act does apply.
This has come up as a recommendation from numerous sources in the testimony we heard. We have a number of amendments coming forward as we debate this bill. This is the first one. The Statutory Instruments Act should apply, and it should be accessible for regulations. The Standing Joint Committee for the Scrutiny of Regulations is something that we believe is important. That is why we're following up on the testimony we heard that clearly indicated this is an important component for transparency.
I am moving NDP-8.
6:55 p.m.
Liberal
Jennifer O'Connell Liberal Pickering—Uxbridge, ON
We do have some concerns with this. We think that adding the SIA becomes too broad and can add up to 18 months of regulatory processes. I want to make sure I'm clear and that all committee members can directly understand what this amendment would mean.
Here are my questions for the officials.
I'm curious about this amendment. If passed in the legislation and 18 months are added to a regulatory process, what damage could be done in that time frame and what harms to the network could be done in that time frame?
My second question is, does this have impacts on our national security and our relationships with other allies, like the U.S., with whom we have an interconnected grid? It's not just telecommunications, and that's what we have to remember.
Could the officials add some context to what harms, probably unintended, could come from adding this amendment?
6:55 p.m.
Director General, Strategy and Innovation Policy Sector, Department of Industry
Having followed the testimony, I certainly appreciate the sentiment behind the amendment. There are three categories of practical considerations that would pose challenges from an implementation standpoint.
The first is that the overall structure of the SIA—and the associated regulatory policy that goes with it—has challenges in a technological space and in a national security space given the range of incidents that can arise, that can arise quickly or that can evolve over time. In particular, more and more of our network is handled in software. With 5G, for instance, a lot of key functions are handled in a software patch-up that can move very quickly. There are incidents such as the SolarWinds incident I mentioned. This was a vendor that provided critical infrastructure subsystems to a range of different sectors. They themselves were compromised, which had spillovers all across different sectors.
The Colonial Pipeline incident with ransomware is another case. This ransomware incident for an oil distribution pipeline had huge impacts all across the eastern seaboard. Adding long stretches of delay throughout that process has real, tangible issues from an implementation standpoint.
A second exacerbating factor is that the underlying legislation we're dealing with is not subject to the SIA currently for the main activities, so this would be quite a large departure from the way regulation under the Telecommunications Act and the Radiocommunication Act is currently done. That would have further compounding effects.
The third category of consideration here is that the structure of the act was developed with the conception that the SIA would not apply. There are certain structures within the act to address the lack of the SIA applying. For instance, there are specific provisions around publication in the Canada Gazette when dealing with confidential orders. There are parallel provisions in the SIA. If we're going to have those parallel structures within this act elaborated upon with some of the amendments this evening, then reimposing the SIA will have some further parallel considerations.
I appreciate the intent behind it, but those are the practical considerations.
6:55 p.m.
Liberal
Jennifer O'Connell Liberal Pickering—Uxbridge, ON
Thank you.
Just following up on the two real-world examples you listed, assuming that this legislation was in place and, with this amendment, the SIA was required, what would that mean in those two examples? You can choose one for the sake of committee discussion, but it's potentially 18 months. Is that correct? What specifically would this do in those real world examples? Is it just a time delay or are there other regulatory processes that would essentially make this legislation...? What's the point of it if, after 18 months, you're dealing with ransomware or a cyber-attack? At that point, I think this becomes obsolete.
7 p.m.
Director General, Strategy and Innovation Policy Sector, Department of Industry
Certainly, there would be real world consequences that would make it hard to keep pace with the developments of technology and the sector. That is one of the considerations in the current regulatory sphere we're dealing with, where the SIA does not come into play in regulating under the telecom act and the radiocom act.
This would have implications for urgent situations where we'd be working around that, but also for important circumstances like dealing with high-risk vendor equipment, which does not necessarily have an emergency context but does have real-world considerations for dealing with our allies and coordinating continental telecommunications infrastructure.
7 p.m.
Conservative
Glen Motz Conservative Medicine Hat—Cardston—Warner, AB
I'll pass. Thank you. I had my question answered.
7 p.m.
Conservative
Doug Shipley Conservative Barrie—Springwater—Oro-Medonte, ON
Thank you.
Just to maybe speed this up a little bit, we will not be able to support this. We will be withdrawing our amendment, which is similar.