Public Safety Committee on Oct. 30th, 2025

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Thank you very much to all the witnesses.

Where do I start? I'd like to start with Monsieur Noël and Monsieur Dufresne.

You both spoke a lot about what's not in this bill.

I'm sorry. I'm going to take a step back before I forget. We only have you for a few minutes today, unfortunately. What I would ask, if you are comfortable with it, is that, whatever we don't get to, especially.... You have given us comprehensive areas where the legislation is silent. Really, we're talking about two things here: the problematic aspects of the legislation—what's written and what's wrong with what's written—and what's not present.

Perhaps this already exists, but it would be exceptionally helpful to me if you were to enumerate those things. Otherwise, we're going through transcripts. I'm not sure if your office has the capability. I think it would be very helpful if you were able to say, “In our view, the legislation needs to include this, this and this.” That would help us tremendously at the clause-by-clause and amendment phase.

I'll leave that with you.

I'm going to focus on what's in the bill. I will give you both two minutes. Please point out specific provisions, if you can, because you've spoken in generalities thus far. If there is a specific section, can you point to it and say, “In my view, this section is a problem because...”? Am I clear?

Mr. Dufresne, do you want to have the first couple of minutes? Then we'll move on to Monsieur Noël.

[Philippe Dufresne]

Sure. Thank you, Mr. Caputo.

I highlighted three themes for recommendations: necessity and proportionality; information-sharing agreements and the minimum content there; and sharing authorities.

For necessity and proportionality, I'll start with the positive. There have been amendments to the minister's order-making power in the Telecommunications Act section. If we look at proposed subsection 15.1(2), we see this mentioned:

The provisions of the order must, in scope and substance, be reasonable in relation to the gravity of the threat, including that of interference, manipulation, disruption or degradation.

That doesn't use the words “necessity and proportionality”, but it achieves that purpose because you are talking about what you are trying to achieve and whether it would be proportional to that.

By contrast, if we look at the powers given to the Minister of Industry under proposed section 15.4, they would have the ability to require any person to provide to the Minister or any person designated “subject to any conditions that the Minister may specify, any information that the Minister believes on reasonable grounds is relevant”. That's not a necessity and proportionality test. That's a relevance test, so it's different.

Later in the bill, we have exchanges of information with foreign governments based on necessity. In the cybersecurity section of the legislation, we have the ability to issue some directions for cybersecurity. There, we have either necessity alone or an absence of necessity and proportionality.

My overarching point is this: In those sections, there is a precedent for a good necessity and proportionality clause. It's the proposed section that I cited. What's interesting is that, even in the cybersecurity bill, in proposed subsection 147(1), there is an annual report that would have to be prepared. In there, the legislation says, at proposed paragraph 147(2)(f), that the report would have to include “an explanation of the necessity, proportionality, reasonableness and utility of the directions.” I think that's an example of why this proportionality is necessary. There's already a recognition that it should be in the report, but it should also be in the power.

In terms of information-sharing agreements, then, we should specify the types of restrictions for sharing with other countries.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Thank you very much. If you have anything else, please let us know in writing. The more specific and concrete the better.

Monsieur Noël.

[Simon Noël]

Yes. I'll be precise.

My knowledge is on the CSE. I know the information that is being transferred to the CSE in order for it to be able to do its cyber-activities.

Where's the framework? Look at proposed section 17 in part 2 of the bill. It doesn't stipulate anything. It says there will be regulations eventually.

At the present time, under my legislation with the CSE, when a cyber-activity incident occurs, the minister gets involved and renders a decision. You go into action and then I get the decision. I approve it, amend it and change it, and then the results come out.

The other point I want to tell you is this. I heard the bureaucrats tell you earlier this week that it's technical information. I agree that it's technical information, but I also know that if you want a positive result on an incident of such importance, they need to go into the content. I've seen it in every cyber-operation I've been involved in.

You're asking me if there are other types. I'm not talking about it—I'm limiting myself to this—but it's clear that warrantless search and seizure creates a problem. I'll let others deal with that.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you, Mr. Noël.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Thank you.

[Simon Noël]

I also have problems with the personal information.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

If we don't get to them, please write to the committee on those points. I would really appreciate that.

Thank you.

[The Chair, Liberal, Jean-Yves Duclos]

That's a good comment, MP Caputo.

Let me turn now to MP Ramsay.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

Mr. Stupak, this is great. I'd like to know if Bill C-8 is a Canadian version of a similar bill elsewhere. In terms of benchmarking, what is in Bill C-8 that is not elsewhere, and what is elsewhere that is not in Bill C-8?

Can you elaborate on this, especially with the view of our main partners?

[Philip Stupak]

When I think about benchmarking, one of the first things Bill C-8 would do, which I think is quite wise, is consolidate some powers in the minister. This is important.

Right now, many countries have a distributed system of defining cybersecurity policy and reacting to the cybersecurity incident. By having this invested in the minister, you have one person who is ultimately responsible. When we created the national cyber director role within the United States, it was at the behest of our senate. Senator Angus King from Maine famously said he was doing this because he needed “one throat to choke.”

One of the important elements in Bill C-8 is that you are creating this uniformity within one minister. Obviously, there are other ministers and other ministries that will participate in implementing those actions, but having that one person to look over all of it is important.

What is a bit different—at least from the United States' system, which is what I can talk about—is the ability to direct industry to do certain actions. I wish I'd had that ability. That was something I was certainly lacking during my tenure at the White House. I could not direct industry to take specific actions. I think that is beneficial, especially when you're dealing with a cyber-incident where time matters. That's something that is not within our system, but you do have it here, and I think it is beneficial.

[Jennifer Quaid]

I absolutely agree with what Mr. Stupak said.

What is not in this, as I've said, is the safe harbour legislation, which is in the U.S. version. That has been critical because it has enabled organizations to share information—and this is not breach information. That goes to the regulator and the authorities guided by this legislation, where it belongs. This is the information about activity that falls below the level of a breach but is still an attack. Information like that can help other organizations defend against exactly the same attack.

Think about Scattered Spider for a minute. We've all heard about it in the news. It has been so successful because we're not sharing the information on how it gets in and what it does when it's in a system. If we could do that, we would help strengthen all the defences.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

I would like for Mr. Stupak to comment on the assertion from the Hon. Simon Noël that normally, when there's a technical cyber-attack, you need to go into content. What is your appreciation of that comment?

[Philip Stupak]

I do not believe that I would necessarily agree with that statement. I think you can often deal with cyber-attacks, when you are dealing with how you are stopping it, usually at the more technical level.

There are adequate protections we have put in place so that you do not have that privacy component you're looking into. Of course—and I say this very respectfully—I do think that occasionally content can be or needs to be looked at. However, that is not something I would suggest is always the case. We are frequently sharing TTPs for an attack, which do not go into content.

[Simon Noël]

In my experience, in a very short answer, on at least 12 cyber-incidents in Canada, there was, at the end, intrusion into content to the point that these intrusions into content were reported to the appropriate bodies. I'll limit myself to that.

That is my own experience, as a Canadian being in a very special position. I'm not saying that it's with all the technical information, but I'm saying, on an exceptional basis, content is shown.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

While we're on the subject, Mr. Noël, did the attacks you're referring to come from outside the country and were they perpetrated by other countries?

[Simon Noël]

Yes.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you, Mr. Ramsay.

Mrs. DeBellefeuille, you have the floor for six minutes.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Thank you very much, Mr. Chair.

Mr. Dufresne, you talked a lot about section 15. You said there's a provision regarding reports, but that it might be better to limit the minister's powers and ensure a correlation between powers. I'd like to talk about section 34 of the proposed critical cyber systems protection act, which has the word “order” in its title. Let's put aside section 15. Section 34 gives the superintendent a lot of power. They may, in writing, order what they want from an operator. You haven't talked about this section, but I worry about it.

Elsewhere in the bill, there's mention of a transparency process, but I'll give you an extreme example of what section 34 could allow. A superintendent could ask a supplier to reduce their encryption. The superintendent would then have access to conversations between clients and suppliers without any accountability or authorization. No one would know.

Am I right in saying that a lot of power is being given without any accountability requirement, and that a citizen has no way of knowing that authorities have access to their conversation?

[Philippe Dufresne]

That section refers specifically to the superintendent's powers. Other sections apply to the Bank of Canada and the industry minister. We're talking about a regulatory audit, a records audit. Audit authorities get that type of power through statutory instruments. That's not why I'm here today, and it's not one of my main concerns.

That said, I would point out that my third recommendation would require that these organizations share information and notify my office when cyber-attacks are committed and when they are made aware of incidents that could lead to privacy breaches for Canadians. I don't think the audits you're referring to concern this type of information. However, if they do, we need to be notified.

I'd like to follow up on the previous discussion about whether this includes personal information. In a way, I think the bill recognizes that it's possible, because it refers to personal information. Personal information is part of confidential information.

Regarding whether there are comparable provisions in other countries, in Europe, institutions have to notify data protection authorities. We don't have such provisions, so I think we could do better.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Would Microsoft, for example, be considered a company providing critical services to the Canadian government? I mean, they manage our entire Internet system. Could the superintendent of financial institutions give Microsoft an order under Bill C‑8, and would the company have to comply?

[Philippe Dufresne]

The vital systems are listed in schedule 1 of the bill. They are telecommunications services, pipeline systems, nuclear energy systems, transportation systems, banking systems and clearing systems. That's the list that would have to be used. Given the nature of Microsoft's operations, would they fall under telecommunications services? The operations in question would have to be looked at. When a company falls under that class of operators, it could be subject to orders to ensure cybersecurity.

I think this criterion should be tightened to ensure proportionality when it comes to personal information and require that my office be notified. My opinion is more or less in line with that of Judge Noël. An independent audit would increase Canadians' trust in the institutions.

The bill also allows for the sharing of information with other countries, so it's a good thing that it requires a written agreement. It's an improvement, but it could go further. Bill C‑12 has a boilerplate provision that allows for more requirements to be included in international agreements. There are minimum requirements regarding the scope of what can be accomplished.

Adding those elements would increase Canadians' trust in the institutions.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Thank you.

Mr. Dufresne, I would like to come back to what you and Mr. Caputo were talking about earlier.

Your remarks were very relevant, especially since you made a connection with Bill C‑12, which the committee will be studying.

You could give us examples of provisions we could improve in the bill to protect privacy. I think democracy is based on privacy protection, and the American model doesn't inspire confidence. We value this protection. Again, I think we have an opportunity to improve on Bill C‑26, and modernize this one even more to better protect the personal information of Quebeckers and Canadians.

I often read the reports of the agency that examines whether organizations are respecting the requirements related to the use of personal information, and I've realized that they are often in violation of those requirements. Given that, Bill C‑8 needs to be nearly perfect.

That's why we'll use your recommendations to bring tangible improvements to the bill through amendments.

[Philippe Dufresne]

I'll be happy to make recommendations.

On an international level, I'd like to mention the United Kingdom, one of the Five Eyes countries. For the British, necessity, relevance and proportionality have to be taken into account. They created a precedent in that regard.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Thank you.