Public Safety Committee on Feb. 5th, 2026

[The Chair, Liberal, Jean-Yves Duclos]

Good afternoon, everyone. We'll start the work.

I officially call this meeting to order.

Welcome to meeting number 22 of the House of Commons Standing Committee on Public Safety and National Security. Pursuant to the House order of October 3, 2025, we're meeting on our study of Bill C‑8, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts.

I would now like to welcome the witnesses, whom we are getting to know well and who will answer questions, if needed.

From the Department of Public Safety and Emergency Preparedness, we have: Colin MacSween, director general, national cyber security directorate; and Kelly-Anne Gibson, director, national security directorate.

From the Department of Industry, we have: Andre Arbour, director general, telecommunications and Internet policy branch; and Wen Kwan, director general, spectrum and telecommunications sector.

Other senior officials are seated in the room and can potentially move to the table if their presence is deemed necessary to answer questions.

We will now resume the clause-by-clause consideration of the bill. We're at amendment BQ‑1, which has been put on notice.

Is amendment BQ‑1 moved, Mrs. DeBellefeuille?

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Yes, I will move the amendment.

In my view, it essentially echoes the Privacy Commissioner's recommendation that the bill should be standardized based on the criteria of reasonableness, proportionality and necessity.

Therefore, this amendment clarifies the criteria and factors the minister or the Governor in Council will use to gather the information they need.

[The Chair, Liberal, Jean-Yves Duclos]

Very good.

I will note that, if amendment BQ‑1 is adopted, amendment CPC‑10 cannot be moved owing to a line conflict. Notice was given on amendment CPC‑10; therefore, it shows up a little later in the order of the amendments.

Mr. Caputo, the floor is yours.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Thank you, Mr. Chair.

Thank you, Mrs. DeBellefeuille.

I'm in favour of anything that limits the sweeping powers that are granted here. Let us not forget that Bill C-8 would grant unprecedented, substantial powers. While we perhaps lag behind our G7 counterparts, that doesn't mean any legislation we pass should be passed without scrutiny and without judicious forethought as to the powers we are granting, when we are talking about potentially removing people from the Internet for any sort of threat.

I know we've had a lot of discussions about any threat, but in this case, my understanding is that we will be curtailing power and adding an element of proportionality. In other words, Conservatives believe, and I hope this table will believe, that we should not be using a sledgehammer to kill a fly. Any government intervention must be proportional to the threat, and it is for that reason that I support BQ-1.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you, honourable member.

Is there any further debate?

Mr. Ramsay, go ahead.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

Right now, our reading of the bill is that the Governor in Council and the minister can only make orders when necessary to protect the communications system.

Those orders must be reasonable given the seriousness of the threat. For us, the amendment simply confirms what our understanding of the bill was already. In that sense, if the goal is more clarity for everyone, we agree on the amendment.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you, Mr. Ramsay.

Is there any further debate?

Seeing none, we can go to a vote. As usual, I will ask the clerk to take a recorded vote on the amendment.

[Dane Lloyd, Conservative, Parkland, AB]

I have a point of order.

[The Chair, Liberal, Jean-Yves Duclos]

Mr. Lloyd, the floor is yours.

[Dane Lloyd, Conservative, Parkland, AB]

Would it be quicker if we just said “on division” or something like that—not that I'm against it—instead of going through the roll call?

[The Chair, Liberal, Jean-Yves Duclos]

I can do that, but I prefer to be prudent, given that it's not always possible to know the exact point of view of everyone just by looking at faces.

I always see the faces, but they don't always indicate exactly how they would vote. I can do that on this amendment.

(Amendment agreed to on division [See Minutes of Proceedings])

[The Chair, Liberal, Jean-Yves Duclos]

That brings us to CPC-4.

Is CPC-4 being moved?

Mr. Caputo.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Thank you, Mr. Chair.

I move amendment CPC‑4.

I will speak to this amendment briefly, talking about whether a “specified person” refers to a telecommunications provider or to a person.

One of my greatest critiques of the bill as initially drafted was the nature of the vague language. I think all the lawyers here—or anybody here—would know that vague language leads to bad results. In fact, if you want to know why a lot of laws get struck down under the charter, it is vagueness.

Precision in language is always appreciated, which is why I support and am the primary mover of CPC-4.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you, Mr. Caputo.

Is there any further debate?

Ms. Acan, the floor is yours.

[Sima Acan, Liberal, Oakville West, ON]

Thank you, Mr. Chair.

My understanding is that this requested change would create a massive security loophole. This amendment seeks to narrow the scope of security orders so that they only apply to telecommunications service providers or the persons directly responsible for the security of services.

This is described as having a dramatic and detrimental impact on national security. Specifically, it would technically prevent the government from using Bill C-8 to enforce the 2022 policy statement, which allows for the prohibition of equipment and services from high-risk providers such as Huawei in Canadian networks.

I would like to ask the experts' opinion. Given that modern cyber-threats often exploit vulnerabilities within the global supply chain, could you please explain to us the technical risk to Canada's national security if this amendment prevents the government from issuing orders against third party, high-risk vendors that are not telecommunications service providers? Would this not effectively strip the government of its power to enforce the 2022 policy statement regarding the ban of equipment and services from providers such as Huawei?

[Andre Arbour, Director General, Telecommunications and Internet Policy Branch, Department of Industry]

I'd start by saying that the scope of the section is already on a telecommunications service provider. It gives the government the ability to tell a telecommunications service provider what it can use in its network. The obligation is on the telecommunications service provider itself as to whether it can buy certain types of equipment or procure certain types of services.

The type of corporate entity that a TSP will buy goods and services from is much broader than just other telecommunications service providers. It's equipment manufacturers. It's software producers. It's battery manufacturers, etc. There are a large number of those.

Basically, it's already scoped to say that there may be obligations on Bell Canada, or whoever, in terms of what they can procure or put in their network. The reason it's a “person” is that Bell Canada may procure goods and services from a wide variety of vendors.

If you limit the scope of that power to only taking action against buying from other telecom service providers or other people responsible for telecom services, you can't prevent them from procuring from equipment vendors that are high-risk.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you, Ms. Acan.

Is there any further debate?

Mr. Caputo, the floor is yours.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Thank you, Mr. Arbour.

The concern generally when we talk about overbreadth relates to, for example, an individual citizen being targeted. In this case, is it your view or expertise that in some cases, individual people need to be targeted because they are high-risk vendors, or are we generally talking about a corporate vendor and that's what we're talking about as “person”?

I hope that makes sense.

[Andre Arbour]

“Person” in the Telecommunications Act is a common term used. It is not the same as “person” in a colloquial sense. Here we're talking about corporate entities.

Random individuals do not sell goods and services to telecommunications service providers, so there's no impact on individuals via this clause. “Person” is referring to the legal concept of a person, which includes corporate entities.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

I suppose the legal concept of personhood does, and I'm aware of that, but the legal concept of personhood could extend to, say, a partnership or someone in a partnership that is just individuals. I guess that's where I'm caught up here. It's that the legal concept of personhood extends to corporations and to people.

How are we excluding individuals but including only corporate entities?

[Andre Arbour]

First of all, in the scope of the provision, the burden is only on telecommunications service providers. It is saying that telecommunications service providers may have restrictions on the entities they can contract with. If my brother-in-law had a business providing telecom services globally, he is not touched by this at all. The legal obligation would be on Bell, Telus or Rogers in terms of what they can put in their network.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you.

Are there any other questions or interventions?

Go ahead, Ms. Kirkland.

[Rhonda Kirkland, Conservative, Oshawa, ON]

Just to clarify, I have a question based on both of the questions asked by my colleagues.

I'm trying to understand how there's a security loophole and to simply clarify who is referred to by “specified person”. I understand that “person” in this context doesn't mean an individual person. However, could it in any way mean this, and what's the harm in clarifying that it's not that?

[Andre Arbour]

Again, the legal obligation is already on telecommunications service providers. The legal obligation would be on their ability to contract and procure, and “telecommunications service provider” is already much narrower than “person”.

The question is, who can they contract with? If you substitute “person” for “telecommunications service provider”, you can only restrict their ability to contract with other telecom service providers, but that's not the issue. The issue is that they're contracting with their supply chain, so that's why it's TSPs contracting with “persons”.

When we're talking about something as technical and complex as the goods and services that Bell uses to run its network, there's not an issue of individual rights. We're talking about contracting between corporations.

[Rhonda Kirkland, Conservative, Oshawa, ON]

I understand that. Is it a security loophole? Is it dangerous to clarify it? That's what I'm asking.