Thank you, Mr. Chair.
Thank you for this opportunity to speak to Bill C‑8 on critical cyber systems protection.
As we know from Canada's national cyber-threat assessment, cyber-threats are evolving rapidly. Cyber-threat actors, both state-sponsored and others, are increasing in number and sophistication. Canada must be better prepared to deal with these threats to protect Canadians, our critical infrastructure and our economy.
Bill C-8 will enhance cybersecurity in four major sectors: finance, telecommunications, energy and transportation. Part 1 of the bill amends the Telecommunications Act to enshrine the security of Canada's telecommunications systems as a policy objective, bringing the security framework regulating the sector in line with those of other critical infrastructure sectors. That will allow the government to act swiftly in an industry in which seconds can decide the safety, confidentiality and ability of essential services.
The bill also introduces the new critical cyber-systems protection act, or CCSPA, which would legally require designated operators to protect their critical cyber-systems.
This part of the bill provides the tools the government needs to take further action to address a range of vulnerabilities.
Right now, the list of vital services and systems is comprised of the Canadian telecommunications services, banking systems, energy and transportation; however, the Governor in Council may also add to that list.
Those designated as operators of vital services and systems would be obliged to develop and implement cybersecurity programs and mitigate supply chain and third party risks, as well as comply with cybersecurity directions.
The CCSPA will also increase information sharing on cyber-threats by requiring the reporting of cybersecurity incidents above a certain threshold. Right now, there are no such legal requirements for industry to share this kind of information, which means that there could be threats that the government is not aware of. There is also a legal mechanism for the government to compel action in the face of known threats or vulnerabilities. When it comes to national security, we cannot rely on the goodwill of industry alone. We must enshrine the more robust cybersecurity framework into law.
Since the introduction of this legislation under former Bill C-26, which was passed unanimously in the House last year, there have been widespread consultations with stakeholders. We listened to the concerns that were raised.
Among these was a need for more oversight and transparency, as well as the need to ensure privacy is protected.
Canadians' privacy is already protected through a number of constitutional and legislative instruments, but Bill C-8 will provide greater certainty to Canadians that their privacy and personal information will be protected. When confidential information must be shared, it must be treated as confidential. Recipients of such information must similarly be respectful of that confidentiality.
The bill also assures Canadians that orders or directions issued under both part 1 and part 2 of the legislation will not be used to engage in surveillance or to intercept private communication. This responds directly to the concerns we heard from civil liberty groups.
Bill C-8 also includes the provision to increase the government's transparency and accountability. For example, stakeholders said that there was a potential for orders or directions to be issued without the government consulting or considering relevant factors such as whether reasonable alternatives exist to issuing an order or direction. As a result of these concerns, the bill includes a reasonableness standard and a non-exhaustive list of factors that the Governor in Council must first consider before issuing an order or direction.
Bill C‑8 provides transparency and accountability to Canadians. It also provides further reassurances to Canadians that their privacy and personal information will be protected.
I hope my honourable colleagues will agree that Bill C-8 would provide a strong foundation for securing Canada's critical infrastructure against fast-evolving cyber-threats.
I look forward to your questions and comments.
As well, I want to take this moment to thank the colleagues who are here at the table with me.
Thank you, Mr. Chair.
