Mr. Speaker, I rise today to speak to Bill C-8, an act respecting cybersecurity and amending the Telecommunications Act.
Before being elected to represent the people of London—Fanshawe, I spent nearly three decades working in the information technology field. I started young. In 1996, at age 16, while still in high school at North Lambton Secondary School in Forest, Ontario, I took my first job with a small local Internet service provider. This was the era of dial-up Internet. Many Canadians remember the sound of connecting, waiting for the signal and slowly getting online. It felt new, exciting and, for many, private.
Working on the other side of that connection gave me a very different perspective. It was my first real exposure to how these systems actually function behind the scenes, and what struck me early on was how vulnerable people's information could be.
There is often an assumption that our information is private by default, but in reality, privacy in digital systems has always been more fragile than people realize. Today, the scale and consequences are far greater. That realization has had a lasting impact and has instilled in me a strong sense of responsibility to treat information with care, respect the trust that people place in the systems they rely on and recognize that privacy does not happen by accident in digital systems. It has to be built in, protected and enforced. That principle has guided me throughout my career, and it is exactly the principle that should guide us today as we consider Bill C-8.
There is no doubt that cybersecurity is a national security issue. Canada faces increasing threats from hostile actors, including foreign states, criminal organizations and sophisticated cyber networks. These threats target our infrastructure, institutions, businesses and, increasingly, everyday Canadians.
Increasingly, the cybersecurity landscape is being reshaped by artificial intelligence. AI is enabling faster, more adaptive cyber-attacks, from automated vulnerability scanning to highly convincing phishing and social engineering. At the same time, it is also strengthening our defences, improving threat detection, anomaly identification and response times across networks. The challenge before us is to ensure our policies keep pace with both sides of that reality.
Our telecommunication systems are a critical infrastructure. They underpin our economy, basic safety systems and national defence. Ensuring their security is not optional; it is essential.
Conservatives recognize this. We have constantly said that cybersecurity must be treated as a core component of Canada's national defence strategy. That is why we allowed the bill to come to committee, despite serious concerns about provisions that represented an unacceptable level of government overreach. The only responsible path was to bring it to committee and fix what needed to be fixed. It needed improvement.
As originally drafted, Bill C-8 would grant sweeping powers to the government, particularly to the minister, with insufficient safeguards, unclear thresholds and inadequate protections for privacy and freedom of expression. That is not an abstract concern. This is why getting the limits right in legislation like this matters so much.
One of the clearest examples of overreach in the original bill was in proposed section 15.2. As it was originally written, the bill would have allowed the minister to prohibit telecommunications providers from offering service to any specified person or direct that the service be suspended. Anyone can understand the difference between securing a network and controlling access to it. Imagine having a government official at every Internet provider, such as the one I worked at three decades ago when I was a teenager, dictating who can and cannot get Internet access. That is not the role of government.
If there are criminals or foreign actors who pose such a serious threat to our security that they must be cut off from essential communications, the bigger question is why they are not already in custody or removed from Canada in the first place.
Cybersecurity is about protecting systems from real threats. It is not about giving government a broad and loosely defined power to decide what person keeps their connection and which one loses it. That is not a small, administrative detail. In the wrong hands, it is the kind of power that risks turning cybersecurity into overreach.
The government has shown time and again that it will err on the side of overreach, including through the unlawful invocation of the Emergencies Act, for which courts found it exceeded the authority and infringed upon charter-protected freedoms. That is exactly why powers like this must be clearly defined, tightly constrained and subject to real accountability.
Conservatives pushed back against that overreach. Through amendments at committee, we forced changes that narrowed the scope of that authority, ensuring that it could not be directed arbitrarily at individual Canadians and that stronger thresholds and clearer limits apply. That is just one example.
More broadly, Conservatives worked to fix a pattern of overreach in the bill. We strengthened protections for rights and freedoms by ensuring that lawful expression, political debate and persuasion could not be treated as cybersecurity threats. We made privacy a required consideration, not an afterthought, and strengthened rules around the the collection, use and deletion of personal information. We raised the threshold for government action from vague references to threats to a much more serious standard of serious, systematic threats. We replaced weak tests such as relevancy with stronger requirements like necessary and proportionate tests. We required reasonable grounds for ministerial action and narrowed the scope of orders to matters tied to national security, national defence or international relations. We pushed for judicial oversight and greater transparency, because powers of this magnitude should not operate without accountability. Taken together, these changes significantly improved the bill. They did not remove the need for vigilance, but they brought the legislation closer to the balance that Canadians expect.
Cybersecurity is not just about technology. It is about trust. Canadians need to trust that the government will protect them from cyber-threats, but they also need to trust that their rights will not be unnecessarily compromised in the process. That trust is fragile and, once lost, it is difficult to rebuild. That is why it is so important that legislation such as Bill C-8 gets the balance right.
Now, while the bill has been approved, we also acknowledge a broader issue. For too long, the government has been slow to respond to evolving cyber-threats, yet quick to introduce legislation that requires significant correction. Cybersecurity is too important to get wrong. It is too important to treat as an afterthought. Canada needs a proactive, disciplined approach to cybersecurity that includes clear standards, strong partnerships with industry and legislation that is both effective and restrained.
Bill C-8 is a step in that direction, but only because Conservatives forced the changes that were needed to fix it. Despite our proposing major improvements to the bill, the Liberals fought us every step of the way. At committee, Conservatives were able to get an amendment through that required judicial authorization. Before the minister could use the new powers laid out in the legislation, the Liberals found a way to remove that amendment. Just like with the Emergencies Act, there is nothing to stop them from abusing their power. This is a massive concern for me.
As we move forward, we must remain vigilant. Technology will continue to evolve. Threats will become more sophisticated, and so too will the tools available to defend against them, including those powered by artificial intelligence. The pressure to expand government powers will only increase. That makes it even more important that we get the framework right now.
As both threats and defence evolve, we must ensure that our response remains grounded in clear limits, strong safeguards and respect for the rights of Canadians. In that environment, it will be essential to hold firmly to the principles that define us as a country. We must protect our infrastructure, but we must also protect our freedoms. We must respond to threats, but we must do so with restraint and accountability. We must never lose sight of the fact that cybersecurity is not an end in itself. It is a means to protect Canadians, their privacy, their livelihoods and their way of life.
I began my remarks by reflecting on my early experience in the IT field. Back then, even as a young person, I saw first-hand that privacy cannot simply be assumed. It must be actively protected. That lesson applies just as much as today, at a national level. With the powers granted in this legislation comes a responsibility, a responsibility to use those powers carefully, proportionately and with respect for the rights of Canadians.
Conservatives will continue to support strong cybersecurity protections with the appropriate limits. We fought hard to include those limits in the bill, but the Liberals removed some of them. We will also continue to ensure that those protections do not come at the expense of the freedoms that define us, because in Canada, security and liberty must go hand in hand.