A law describes what should happen and sets out consequences when things go wrong, but it does not physically prevent an attack from occurring. The assumption this bill seems to rest on is that if the rules are clear enough, the infrastructure will be safe. However, rules do not stop a breach. They describe what happens after one. The people targeting Canadian systems do not factor in what Parliament has passed. They look for a door. This bill would require that a door be built into every qualifying service provider.
What in this bill—not the rules around it but the technical reality—keeps that door from being found?