Bill C-26

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

(Bill C-26: On the Order: Government Orders)

April 19, 2024—Consideration at report stage of Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, as reported by the Standing Committee on Public Safety and National Security with amendments—Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs.

(Bill concurred in at report stage, read the third time and passed)

(Bill C-40: On the Order: Government Orders)

June 17, 2024—Third reading of Bill C-40, An Act to amend the Criminal Code, to make consequential amendments to other Acts and to repeal a regulation (miscarriage of justice reviews)—Minister of Justice.

(Bill read the third time and passed)

(Bill S-6: On the Order: Government Orders)

May 3, 2023—Resuming consideration of the motion of Ms. Fortier (President of the Treasury Board), seconded by Ms. Khera (Minister of Seniors),—That Bill S-6, An Act respecting regulatory modernization, be now read a second time and referred to the Standing Committee on Industry and Technology.

(Bill read the second time and referred to a committee)

(Bill S‑9: On the Order: Government Orders:)

December 15, 2023 — Resuming consideration of the motion of Ms. Joly (Minister of Foreign Affairs), seconded by Mr. Beech (Minister of Citizens' Services), — That Bill S‑9, An Act to amend the Chemical Weapons Convention Implementation Act be now read a second time and referred to the Standing Committee on Foreign Affairs and International Development.

(Bill read the second time, considered in committee of the whole, reported, concurred in, read the third time and passed)

(Bill S-16. On the Order: Government Orders)

June 6 2024—Second reading and reference to the Standing Committee on Indigenous and Northern Affairs of Bill S-16, An Act respecting the recognition of the Haida Nation and the Council of the Haida Nation—Minister of Crown-Indigenous Relations.

(Bill read the second time and referred to a committee)

Business of the House

[Steven MacKinnon, Liberal, Leader of the Government in the House of Commons]

Mr. Speaker, for a moment there, I thought, for once, we were going to get away without a preamble, but we had a lot of amble there, a lot of post-amble.

I can assure my hon. friend that the law that is coming this fall would protect every single Canadian who draws their income from a paycheque, and 0.13% of Canadians would pay a modest amount of additional tax on capital gains over a quarter of a million dollars garnered in a single year.

Tax fairness not only will be written into the law, but also will continue to be the thing we talk about in the House.

Tomorrow, we will complete the report stage study of Bill C-40, Miscarriage of Justice Review Commission Act, which is also known as David and Joyce Milgaard's law.

I would like to request that the ordinary hour of daily adjournment of the next sitting be 12 midnight, pursuant to order made Wednesday, February 28.

Our priorities next week will be to complete report stage and third reading of Bill C-69, the budget implementation act, and second reading of Bill C-65, the electoral participation act. We will also give priority to other important bills, namely third reading of the aforementioned Bill C-40 and report stage and third reading of Bill C-26, the critical cyber systems protection act.

Finally, there have been discussions amongst the parties and, if you seek it, I think you will find unanimous consent for the following motion:

That the motion standing on the Order Paper in the name of the Leader of the Government in the House of Commons related to the appointment of Christine Ivory as Parliamentary Librarian, pursuant to Standing Order 111.1(2), be deemed adopted.

[Caroline Xavier]

We actually do continue to follow up with the entities. We continue to call them or work with them, and I don't want to leave anybody with the impression that there aren't relationships that exist. On the contrary, we have very great relationships with critical infrastructure, especially the energy sector, the telcos and the banks, where we meet with them regularly to talk about threats and to learn from each other about the threats they're facing. There are great relationships and governance bodies that exist to be able to work through understanding.

Having said that, though, we will continue to support and offer our support, but we can't force them. This is where, as I said in my opening remarks, Bill C-26 is really important in the four critical infrastructure sectors that have been identified as part of that bill, because they're really important to Canadians in the critical infrastructure space.

[Caroline Xavier]

Okay. I apologize for the interruption.

When requested, we provide cyber-defence services and maintain an open line of communication to mitigate potential threats.

To detect malicious cyber-activity on government networks, systems and cloud infrastructure, the cyber centre uses autonomous sensors, including network-based sensors, cloud-based sensors and host-based sensors. These defences protect systems of importance from an average of 6.6 billion attempted malicious actions per day.

CSC continues to monitor Government of Canada networks and systems of importance for cyber-threats. We are working in close coordination with government partners, including relevant security agencies.

We deliver foreign intelligence-informed cyber-defence.

Finally, I would like to call members’ attention to the solutions available to them. Indeed, the Canadian Centre for Cyber Security offers parliamentarians a support service, in addition to holding regular information sessions for political parties on cyber-threats, as well as providing a dedicated point of contact at the centre for accessing cybersecurity support.

Since 2017, the CSE has established four unclassified reports on cyber-threats to Canada's democratic processes, and our “National Cyber Threat Assessment 2023-2024” highlights how online foreign influence activities have become a new normal, with adversaries seeking to influence elections and impact international discourse related to current events.

Since 2014, interdepartmentally, the CSE's cyber centre has worked closely with Elections Canada to ensure that our election systems and infrastructure remain secure. The CSE also continues to work as part of the security and intelligence threats to elections task force, SITE. Cyber-incidents such as ransomware, DDoS and supply chain compromises are becoming more frequent across all industry sectors, and these incidents are negatively impacting our prosperity, privacy and security. That's why Bill C-26 is so important. It would give the government new tools and authorities to better bolster defences, improve security across critical federally regulated industry sectors, and protect Canadians and Canada's critical infrastructure from cyber-threats.

Four sectors are subject to the mandatory cyber-incident reporting in Bill C-26: finance, energy, telecommunications and transportation. These were all prioritized due to their importance to both Canadians and other sectors. They are critical enablers. Bill C-26 will improve our ability to protect ourselves from both the threats we observe today and the threats we will face tomorrow.

The federal government intends to launch its updated national cybersecurity strategy, which will communicate Canada's long-term approach to addressing evolving threats in cyberspace. Central to the new strategy will be a shift in focus towards a whole-of-society approach to Canada's national cyber resilience, where public and private entities and all levels of government work in close partnership to defend against cyber-threats, including threats to our institutions. The government also recently announced the defence policy update, “Our North, Strong and Free”, which proposes a significant new investment in the CSE through budget 2024.

Finally, an important aspect of Canada's whole-of-society approach to our collective security includes practising good cyber hygiene, including safe social media practices, especially in those public roles. The cyber centre has released guidance on ways to protect yourself online. It also has cybersecurity resources for elections authorities, political campaigns and Canadian voters. I really encourage you to take a look at our website, getcybersafe.gc.ca. I would also encourage organizations that have been impacted by cyber-threats to contact the cyber centre, so that it can help share threat-related information with partners to help keep Canada and Canadians safe online.

Further, to make cyber-incident reporting easier for Canadians, the CSE is also working with its federal partners to establish a single-window solution for reporting cyber-incidents, with the ultimate goal being to ensure that Canadians can always find the help they need. This was a key recommendation this week from the Auditor General.

To conclude, the CSE and the cyber centre remain active in their collaboration with all partners, including the House of Commons, to improve Canada's cyber-resilience and protect our democratic institutions. We will continue to monitor any developing cyber-threats and share threat information with our partners and stakeholders, as always.

Once again, thank you for your invitation to appear before you today. We are pleased to be able to contribute to this important discussion and give you an overview of the way the Communications Security Establishment and the Canadian Centre for Cyber Security both work every day to protect Canadians and their democratic institutions.

Thank you for your attention.

[Heath MacDonald, Liberal, Malpeque, PE]

This committee just did a review of Bill C-26. During that testimony, we heard that there were about 5.2 million cyber-attacks in four months in 2023, from September to December. I think that's correct. Of those, 62% targeted critical infrastructure.

In our testimony during our last meeting, Michel Juneau stated that “86% of our national infrastructure is either owned or operated by the private sector”. It's going to become a very serious issue, or it already is a very serious issue. We may not even be aware of what's transpiring underneath. What's the best way to go about delivering that message and ensuring that there are safeguards in place within this bill?

You talked a bit about 40 items that you guys did a report on. Can you talk a bit about them, and give us a couple of examples and their relevance?

[Trevor Neiman]

Thank you for the question.

The Business Council represents approximately 170 of Canada's largest, most successful businesses, so I can't speak to the specifics of the challenges facing small and medium-sized businesses, but what I can say is that small and medium-sized businesses are very much a part of the supply chains of large businesses. Large businesses are quite concerned about the security posture of small businesses, because they can often be an indirect route to attack large businesses.

There needs to be much more done in this space in terms of government support, and Bill C-26 is one way to help in that regard. The private sector itself is also willing to step up and do more. For instance, our members are very much committed to working with their supply chains to build up their baseline resiliency, including through education, capacity building and relationship brokering, including working jointly with Canada's security and intelligence community, with agencies like CSIS, the CSE and the RCMP.

[Aaron Shull, Managing Director and General Counsel, Centre for International Governance Innovation]

Thank you very much, Mr. Chair and distinguished committee members, for the opportunity to speak today on this important bill. It's a pleasure to be here.

Indeed, maybe I'll start by saying something that you probably don't all hear very often: Thank you very much. It was a real pleasure to see this bill proceed with the pace and with all of the work you're doing.

We're independent and non-partisan, so when I say this, I genuinely mean it. I know how hard you're working. We're sitting here in the evening, and everyone's working away to get this done, so thank you very much.

It's in that spirit that I plan to make three arguments.

Number one is that activities covered by the proposed foreign influence transparency and accountability act should extend to municipalities, and we need definitional clarity around who is a public office holder.

Number two, the registry and the commissioner should be in place before the next federal election.

Number three, the act should nest within a broader national security strategy.

Now, let me tell you what I mean by those things.

First, we need to extend this to municipalities, and we need definitional clarity. Now, in Canada, the preamble of a bill is an important tool for looking at its statutory interpretation. I don't want to put everyone to sleep by talking about the tools of that interpretation, but let me just say that the preamble provides an introductory statement that sets out the guiding principles, the values and the objectives of the legislation.

The preamble for the Foreign Influence and Transparency Accountability Act says:

Whereas efforts by foreign states or powers and their proxies to influence, in a non-transparent manner, political and governmental processes at all levels of government in Canada have systemic effects throughout the country and endanger democracy, sovereignty and core Canadian values;

I pause there to dwell on “all levels of government”, and just the impact of that.

Now we have to look at how it applies. The application of the act applies to:

(a) federal political or governmental processes;

(b) provincial or territorial political or governmental processes;

And, essentially, it applies to the governmental processes of indigenous groups and governments.

Now you have to look at the definitions. You go through them, and there's a definition of “public office holder”, but it's different in the Security of Information Act.

We're not covering municipalities here, and we have two different definitions in the same bill about what a public office holder is, so we're probably going to want to take a hard look at that.

If you contrast that with the Security of Information Act, what the bill says is that:

Every person commits an indictable offence who, at the direction of...or in association with, a foreign entity...engages in surreptitious or deceptive conduct...with the intent [to influence a political or governmental process, educational governance etc., etc., with a democratic right in Canada.]

It goes on to define a public office holder differently, and so now you have two pieces of legislation wrapped up in the same bill, effectively trying to do the same thing with different definitions of what a public office holder is.

I wonder why you wouldn't have concomitant obligations for registration. It's two sides of the same coin.

In my view, the SOIA provides the legal teeth to prosecute and punish covert foreign operations, while the FITAA—I don't know if that's what we're calling it, but I'll call it the FITAA—complements this by creating a preventive transparency regime aimed at exposing and deterring such activities through mandatory disclosure and public oversight.

It's a dual approach—deterrence and, hopefully, long-term preventative transparency.

Secondly, we must have the registry in place before the next federal election. You have to again go back to the purposes of the act, like we did at the beginning—“in Canada have systemic effects throughout the country and endanger democracy, sovereignty and core Canadian values”. It's not “might” have systemic effects; the bill says “have systemic effects”. It is a statement of fact.

If you were to meet that purpose, how can you not have it in place before the next federal election? It would be a little bit like bringing a birthday cake for a Saturday afternoon party on the following Tuesday. You will have missed it.

I watched the officials testifying. If it's too hard to do it all at once, just go with the federal government, the federal election. Roll it to provinces and municipalities separately and after. However, you have to get the birthday cake to the party.

Thirdly, it should nest within a broader national security architecture. The defence policy update said we're going to do a national security strategy every four years. The defence policy is going to be updated every four years. We have Bill C-26 that went through this committee, which I was happy to testify about. We have the CSE Act that's due for an update, a review, in 2022. The CSIS Act is now on a five-year review cycle. Bill C-34, on the Investment Canada Act....

This is all coming together. I think the point here is to look at all of the pieces of legislation and all of the various strategies—critical minerals, intellectual property, innovation, research, economic security. Look at them systematically, because adversarial states are looking at them systematically, believe me, and it requires a strategic approach.

As I said at the beginning of this, I've had the privilege of speaking with some of you before. I know how hard this committee works, and I know that you can do it, but I would just encourage you to think strategically and not just do the whack-a-mole thing on one piece of law.

Thank you very much, Mr. Chair.

[The Chair, Liberal, Heath MacDonald]

Thank you, Ms. Michaud.

I have a chair's ruling that I'm going to read.

The purpose of Bill C-26 is to help protect critical cyber systems in order to support the continuity and security of vital services and vital systems. The amendment would allow any law of the province relating to cybersecurity that provides for more stringent rules than those prescribed by regulations to prevail in that province. As House of Commons Procedure and Practice, third edition, states on page 770, “An amendment to a bill that was referred to committee after second reading is out of order if it is beyond the scope and principle of the bill.”

In the opinion of the chair and for the above-mentioned reason, giving precedence to a provincial law constitutes a new concept which goes beyond the scope of the bill as adopted by the House at second reading. Therefore, I declare the amendment inadmissible.

Thank you, Ms. Michaud.

We're at CPC-50.1, reference 12922438.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

This is a similar amendment, although the wording is slightly different. That tells me where my fellow members stand, but I will move it anyways.

The amendment would add the following provision:

(2) Any law of a province relating to cybersecurity that provides for more stringent rules than those prescribed by regulations made under subsection (1) is to prevail in that province.

Quebec, for instance, has a ministry of cybersecurity and digital technology. It's reasonable to think that Quebec's rules are pretty relevant, if not more stringent, as may be the case in other provinces. If so, the amendment would ensure that the rules of the province in question overrode the federal rules set out in Bill C-26.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you very much, Mr. Chair.

This is regarding the issue of Bill C-26 and to ask whether it needs operators to immediately report a cybersecurity incident.

The reality is that we heard testimony from the Canadian Chamber of Commerce and other witnesses about a 72-hour reporting period, with “immediate” being defined as 72 hours.

It's important to note that in the U.S., the Cyber Incident Reporting for Critical Infrastructure Act also talks about a 72-hour reporting time frame.

Our witnesses said very clearly that “immediately” made it potentially difficult for them to resolve the issue and to respond to the cyber-attack, because they would be concerned about the impacts of not reporting in that immediate time frame. A 72-hour window would provide the ability to combat the cybersecurity incident and do the reporting in a very timely way.

I'd like to move what we heard from witnesses and move NDP-10 to essentially provide an amendment such that the designated operator must report the cybersecurity incident within 72 hours from the time the operator reasonably believes the incident occurred.

[The Chair, Liberal, Heath MacDonald]

I call the meeting to order.

Welcome to meeting 101 of the House of Commons Standing Committee on Public Safety and National Security.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely by using the Zoom application.

I would like to make a few comments for the benefit of the witnesses and members.

Please wait until I recognize you by name before speaking. To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from any microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings. I will remind you that all comments should be addressed through the chair.

I will also quickly remind you of an informal meeting with the Norwegian delegation at 5:30 today, for those interested.

Pursuant to the order of reference of Monday, March 27, 2023, the committee is resuming its study of Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. Today the committee resumes its clause-by-clause consideration, beginning with clause 12.

I will now welcome the officials who are with us. They are available to answer questions regarding the bill, but will not deliver any opening statements.

From the Department of Industry, we have Andre Arbour, director general, strategy and innovation policy sector; from the Department of Public Safety and Emergency Preparedness, we welcome Colin MacSween, director general, national cybersecurity directorate, and William Hartley, acting manager; and from the Communications Security Establishment, we have Stephen Bolton, director general, strategic policy, and Richard Larose, senior technical adviser.

Thank you for joining us today. With that, we will begin—

Yes, Mr. Shipley, please go ahead.

[Andre Arbour]

The Telecommunications Act, as drafted currently, has a due diligence defence that applies broadly across the course of the act. Clause 10 of Bill C-26 would insert an exception that would essentially have it so that orders under Bill C-26 would not be subject to due diligence.

Rather than add amendments to insert due diligence back in, simply removing the exception in clause 10 would ensure that the due diligence defence that already exists in the telecom act would apply writ large. Just from a drafting standpoint, it avoids an exception and then a reinsertion of new language.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

This is another key decision point, and it's what we've repeatedly heard is the best route forward to improve Bill C-26. We heard from members of the coalition, and I'll remind you that the organizations involved include the Privacy and Access Council of Canada, OpenMedia, the National Council of Canadian Muslims, the Ligue des droits et libertés, the International Civil Liberties Monitoring Group and the Canadian Civil Liberties Association. All of them have said that an important component for ensuring that the public interest is protected is a provision for special advocates.

What this would do is add, after line 13 on page 8, the following:

(a.1) the judge must appoint a person from a list established by the Minister to act as a special advocate in the proceeding after hearing representations from the applicant and the Minister and after giving particular consideration and weight to the preferences of the applicant;

It would also add, after line 28 on page 8, the following:

(c.1) on the request of the Minister, the judge may exempt the Minister from the obligation to provide the special advocate with a copy of information if the judge is satisfied that the information does not enable the applicant to be reasonably informed of the case made by the Minister;

I won't read all of the amendment. I know that my colleagues around the table have had a chance to thoroughly review NDP-9, but the reality is that special advocates are top secret, security-cleared private practice lawyers, independent of government. We've already seen special advocates protecting the interests, for example, of permanent residents or foreign nationals subject to a security clearance certificate or other proceedings under the Immigration and Refugee Protection Act.

Currently, there is a list of special advocates who are cleared to defend individuals in matters like this, with the Immigration and Refugee Protection Act. There are apparently 10 special advocates available.

This is clear testimony we heard from numerous witnesses among the coalition members I mentioned. They are some of Canada's most reputable groups, and there is no doubt that having in place a special advocate would improve the legislation, so I want to move NDP-9.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I'll just follow up on that.

I know there are often exceptions for national security and whatnot. How can Canadians trust that, when an exception is laid out in Bill C-26...? This is larger than the conversation about this current proposed section. The minister is given discretion quite often to ensure they can use information if it's related to national security, etc. How can Canadians trust that the right balance is struck? This is a bigger conversation, but I think it will help speed up some of the forthcoming amendments.

Could you outline the processes in place to ensure that privacy is in fact protected and that, when an exemption is laid out in legislation, it's not opening it up for abuse?

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thanks very much, Chair.

My other committee is the access to information, privacy and ethics committee. While it notably prosecutes Liberal scandals, it also does a lot with privacy.

I would ask the officials if they could weigh in. I appreciate Ms. O'Connell's statement about it not being necessary, but I would ask if the officials could weigh in on the specific application of the privacy-related sphere in this and whether the amendments would make a notable difference compared to what is currently listed in the act versus what is in Bill C-26, as well as its applications of the myriad privacy rules that overlap here.