Publication Search

Mr. Speaker, I rise today to speak to Bill C-26, an act about cybersecurity. In the 21st century, cybersecurity is national security, and it is our responsibility to protect Canadians from growing cyber-threats. We have to take the necessary steps to protect Canadians and our telecommunications infrastructure. Canadians must have confidence in the integrity, authenticity and security of the products and services they use every day.

This bill reflects the values of Canadians and is in line with our closest allies, including our Five Eyes partners. That is why we are investing in cybersecurity, ensuring respect for the privacy of Canadians and supporting responsible innovation. We will continue to protect Canadians from cyber-threats in an increasingly digital world. As said in our international cybersecurity overview, a free, open and secure cyberspace is critical to Canada’s economy, social activity, democracy and national security.

Canada faces cybersecurity risks from both state and non-state actors. Protecting Canada’s and Canadians’ cyber-infrastructure from malicious actors is a serious challenge and a never-ending task. Canada works with allies and partners to improve cybersecurity at home and to counter threats from abroad. This includes identifying cyber-threats or vulnerabilities and developing capabilities to respond to a range of cyber-incidents.

A few years back, we put forward the national cybersecurity strategy, a vision for security and prosperity in the digital age. As mentioned there, virtually everything Canadians do is touched by technology in some way. We are heavily interconnected and networked, a fact that not only enhances our quality of life but also creates vulnerabilities. From commercial supply chains to the critical infrastructure that underpins our economy and our society, the risks in the cyberworld have multiplied, accelerated and grown increasingly malicious.

Major corporations, industries and our international allies and partners are engaged in the global cyber-challenge, but many others are not and that represents a significant risk. The strategy's core goals were reflected in budget 2018, where $500 million was invested in cybersecurity. Part of the funding was for the new Canadian Centre for Cyber Security, which is Canada’s technical authority on cybersecurity. It is part of the Communications Security Establishment, and it is the single, unified source of expert advice, guidance, services and support on cybersecurity for Canadians and Canadian organizations.

It regularly publishes the “National Cyber Threat Assessment”, and I would like to quote from their latest one for 2023-24. It states:

Canadians use the Internet for financial transactions, to connect with friends and family, attend medical appointments and work. As Canadians spend more time and do more on the Internet, the opportunities grow for cyber threat activity to impact their daily lives. There’s been a rise in the amount of personal, business and financial data available online, making it a target for cyber threat actors. This trend towards connecting important systems to the Internet increases the threat of service disruption from cyber threat activity. Meanwhile, nation states and cybercriminals are continuing to develop their cyber capabilities. State-sponsored and financially motivated cyber threat activity is increasingly likely to affect Canadians.

In the latest assessment, they chose to focus on five cyber-threat narratives that they judge are the most dynamic and impactful.

First, ransomware is a persistent threat to Canadian organizations. Cybercrime continues to be the cyber-threat activity most likely to affect Canadians and Canadian organizations. Due to its impact on an organization’s ability to function, ransomware is almost certainly the most disruptive form of cybercrime facing Canadians. Cybercriminals deploying ransomware have evolved in a growing and sophisticated cybercrime ecosystem and will continue to adapt to maximize profits.

Second, critical infrastructure is increasingly at risk from cyber-threat activity. Cybercriminals exploit critical infrastructure because downtime can be harmful to industrial processes and the customers they serve. State-sponsored actors target critical infrastructure to collect information through espionage, to pre-position themselves in case of future hostilities and as a form of power projection and intimidation.

Third, state-sponsored cyber-threat activity is impacting Canadians. State-sponsored cyber-threat activity against Canada is a constant, ongoing threat that is often a subset of larger, global campaigns undertaken by these states. State actors can target diaspora populations and activists in Canada, Canadian organizations and their intellectual property for espionage, and even Canadian individuals and organizations for financial gain.

Fourth, cyber-threat actors are attempting to influence Canadians, degrading trust in online spaces. Cyber-threat actors' use of misinformation, disinformation and malinformation, collectively referred to as MDM, has evolved over the past two years. Machine learning-enabled technologies are making fake content easier to manufacture and harder to detect. Further, nation-states are increasingly willing and able to use MDM to advance their geopolitical interests.

Fifth, disruptive technologies bring new opportunities and new threats. Digital assets, such as cryptocurrencies and decentralized finance, are both targets and tools for cyber-threat actors to enable malicious cyber-threat activity. Machine learning has become commonplace in consumer services and data analysis, but cyber-threat actors can deceive and exploit this technology. Quantum computing has the potential to threaten our current systems of maintaining trust and confidentiality online. Encrypted information stolen by threat actors today can be held and decrypted when quantum computers become available.

Simply put, cyber-threats pose a growing risk to all Canadians and institutions. We are confronting this threat head-on. Our government regularly engages with domestic and international cybersecurity partners to protect Canada’s critical infrastructure and the systems that underpin essential services. We are working closely with critical infrastructure stakeholders and partners to ensure that they are better prepared to face cyber-based threats.

Our cybersecurity framework continues to detect, deter and disrupt state and non-state actors attempting to take advantage of the Canadian cyber-landscape. Our government is, and will always be, ready to respond to any malicious cyber-acts that threaten Canadian interests.

To conclude, the purpose of this act is to help protect critical cyber systems in order to support the continuity and security of vital services and vital systems by ensuring that, first, any cybersecurity risks with respect to critical cyber systems are identified and managed; second, critical cyber systems are protected from being compromised; third, any cybersecurity incidents affecting, or having the potential to affect, critical cyber systems are detected; and finally, the impacts of cybersecurity incidents affecting critical cyber systems are minimized.

Mr. Speaker, speaking of cybersecurity, I would like to hear what my colleague thinks of the allegations made in the Journal de Montréal two or three weeks ago about a woman of Chinese descent who was elected as a Brossard city councillor. We know that she was the director of two Chinese community centres, one in Montreal and one in Brossard, that are suspected of having become Chinese police stations.

It is suspected that this woman got elected to Brossard's city council because people from the Chinese government sent WeChat messages to members of Brossard's Chinese community, telling them to vote for her. This woman is believed to be a Chinese operative. There is a link to the Chinese government, which is using digital platforms to influence our municipal and even provincial and federal elections.

I would like to know what my colleague thinks about that. Does this not prove that it is more urgent than ever to launch an independent public inquiry into Chinese interference in this country?

Mr. Speaker, the hon. colleague mentioned the growing importance of protecting Canadians and Canada from state-sponsored activities with respect to cybersecurity. State actors are very active in exploiting advanced technologies to create disruption and to erode trust in our systems and institutions, so that is one of the major objectives of our government in proposing this bill.

Mr. Speaker, the government seems to be granting itself some pretty broad powers in the bill, especially to the Minister of Public Safety and the Minister of Industry. Maybe my colleague can explain, and assure Canadians, how these powers would not be unjustly applied to ordinary Canadians who have done absolutely nothing wrong.

Mr. Speaker, with our system of checks and balances, like here in the House, the government is held to account by the opposition benches, which is one of the ways the government's powers and the ministers' powers are monitored and controlled.

There is a broader aspect to this. This legislation deals with evolving technologies, which are very difficult to even define in the legislation. The legislation cannot be changed or amended frequently, which is why the legislation provides more opportunities for the government or the ministers of the day to pass on regulations so that they can immediately identify those and take remedial measures.

Mr. Speaker, it has been reported that small and medium-sized businesses could face immense financial pressure from increased red tape and reporting measures. The Business Council of Canada, in an open letter, indicated that businesses were concerned with the added red tape and the impact it would have on small and medium-sized businesses.

We realize, at least on this side of the House, that small and medium-sized businesses are the backbone of the economy. Is this the time to be adding more financial pressures to these businesses? Can the member think of alternative ways of being able to satisfy that?

Mr. Speaker, I agree with the member that small businesses are the backbone of Canada and the Canadian economy, with the majority of Canadians working in small and medium-sized businesses.

Related to this bill is the fact that this issue affects small-sized businesses disproportionately more, because they do not have enough resources to protect themselves from cyber-threats. In fact, as I mentioned in my speech, the new Canadian Centre for Cyber Security, which is part of the Communications Security Establishment, is there to provide expert advice, guidance, and service and support on cyber-threats and cybersecurity to Canadian organizations.

Mr. Speaker, it is a pleasure to rise and join the debate this morning in the House of Commons. I will be sharing my time with the member for Fort McMurray—Cold Lake.

Bill C-26 is a bill that addresses an important and growing topic. Cybersecurity is very important, very timely. I am glad that, in calling this bill today, the government sees this as a priority. I struggle with trying to figure out the priorities of the government from time to time. There were other bills it had declared as absolute must-pass bills before Christmas that it is not calling. However, it is good to be talking about this instead of Bill C-21, Bill C-11 or some of the other bills that the Liberals have lots of problems with on their own benches.

Cybersecurity is something that affects all Canadians. It is, no doubt, an exceptionally important issue that the government needs to address. Cybersecurity, as the previous speaker said, is national security. It is critical to the safety and security of all of our infrastructure. It underpins every aspect of our lives. We have seen how infrastructure can be vulnerable to cyber-attacks. Throughout the world, we have seen how energy infrastructure is vulnerable, like cyber-attacks that affect the ability to operate pipelines. We have seen how cyber-attacks can jeopardize the functioning of an electrical grid.

At the local level, we have experienced how weather events that bring down power infrastructure can devastate a community and can actually endanger people's health and safety. One can only imagine what a nationwide or pervasive cyber-attack that managed to cripple a national electrical grid would do to people's ability to live their lives in safety and comfort.

Cyberwarfare is emerging as a critical component of every country's national defence system, both offensively and defensively. The battlefield success of any military force has always depended on communication. We know now just how dependent military forces are on the security of their cyber-communication. We see this unfolding in Ukraine, resulting from the horrific, criminal invasion of that country by Putin. We see the vital role that communication plays with respect to the ability of a country to defend itself from a foreign adversary, in terms of cybersecurity.

I might point out that there is a study on this going on at the national defence committee. We have heard expert testimony about how important cybersecurity is to the Canadian Armed Forces. We look forward to getting that report eventually put together and tabled, with recommendations to the government here in the House of Commons in Canada.

We know that critical sectors of the Canadian economy and our public services are highly vulnerable to cyber-attack. Organized crime and foreign governments do target information contained within health care systems and within our financial system. The potential for a ransom attack, large and small, is a threat to Canadians. Imagine a hostile regime or a criminal enterprise hacking a public health care system and holding an entire province or an entire country hostage with the threat to destroy or leak or hopelessly corrupt the health data of millions of citizens. Sadly, criminal organizations and hostile governments seek to do this and are busy creating the technology to enable them to do exactly this.

The Standing Committee on Access to Information, Privacy and Ethics conducted three different studies while I was chair of that committee that were tied to cybersecurity in various ways. We talked about and learned about the important ways in which cybersecurity and privacy protection intersect and sometimes conflict. We saw how this government contracted with the company Clearview AI, a company whose business is to scrape billions of images from the Internet, identify these images and sell the identified images back to governments and, in the case of Canada, to the RCMP.

We heard chilling testimony at that committee about the capabilities of sophisticated investigative tools, spyware, used by hostile regimes and by organized crime but also by our own government, which used sophisticated investigative tools to access Canadians' cellphones without their knowledge or consent. In Canada, this was limited. It was surprising to learn that this happened, but it happened under judicial warrant and in limited situations by the RCMP. However, the RCMP did not notify or consult the Privacy Commissioner, which is required under Treasury Board rules. This conflict between protecting Canadians by enforcing our laws and protecting Canadians' privacy is difficult for governments, and when government institutions like the RCMP disregard Treasury Board edicts or ignore the Privacy Commissioner or the Privacy Act, especially when they set aside or ignore a ruling from the Privacy Commissioner, it is quite concerning.

This bill is important. It is worthy of support, unlike the government's somewhat related bill, Bill C-27, the so-called digital charter. However, this bill, make no mistake, has significant new powers for the government. It amends the Telecommunications Act to give extraordinary powers to the minister over industry. It is part of a pattern we are seeing with this government, where it introduces bills that grant significant powers to the minister and to the bureaucrats who will ultimately create regulations.

Parliament is really not going to see this fleshed out unless there is significant work done at committee to improve transparency around this bill and to add more clarity around what this bill would actually do and how these powers will be granted. There have been many concerns raised in the business community about how this bill may chase investment, jobs and capital from Canada. The prospect of extraordinary fines, without this bill being fleshed out very well, creates enormous liability for companies, which may choose not to invest in Canada, not fully understanding the ramifications of this bill.

There is always the capture. We have seen this time and time again with the government. It seems to write up a bill for maybe three or four big companies or industries, only a small number of players in Canada, and yet the bill will capture other enterprises, small businesses that do not have armies of lobbyists to engage the government and get regulations that will give them loopholes, or lawyers to litigate a conflict that may arise as a result of it. I am always concerned about the small businesses and the way they may be captured, either deliberately or not, by a bill like this.

I will conclude by saying that I support the objective. I agree with the concern that the bill tries to address. I am very concerned about a number of areas that are ambiguous within the bill. I hope that it is studied vigorously at committee and that strong recommendations are brought back from committee and incorporated into whatever the bill might finally look like when it comes back for third reading.

Mr. Speaker, I would like to invite my hon. colleague to take a higher-level view of an important issue because we are dealing here with cybersecurity and the need for protections, but we are also looking at a realm of artificial intelligence and things like that. These are things that can happen. People can 3D-print a gun that cannot be picked up by airport security. There is a lot of technology out there that could be purposefully harmful to individuals or to our whole society. In that regard, given some of the other conversations we have had about gatekeepers, would the member care to put a frame around the kind of gatekeeping that he and his party see as essential and necessary for the purpose of protecting Canadians?

Mr. Speaker, the primary function of government is to protect its citizens from external harm and to ensure that Canadians are able to live freely and safely in their communities.

I do have concerns about the gatekeeping aspect of this bill. I am concerned that if this bill does not get the balance of the regulation and the ability of commerce to continue, we will lose businesses and we will lose services and access to economic activity within Canada if we chase investment out through poorly thought-out regulations.

Yes, there is of course a delicate balance to be had. If we come down too hard on the side of regulation and gatekeeping, it will result in job loss and lack of investment, and the absence of investment would then compound businesses' abilities to actually deliver on cybersecurity.

Mr. Speaker, over the past few years, businesses and even political parties have been gathering data, whether through quizzes or games, not only on the person playing the game but also on all the contacts that person has on their phone.

I would like to know if my colleague finds this tactic to be ethical, given that these people were receiving unsolicited advertising. Does my colleague think the bill will put an end to this practice?

Mr. Speaker, that may be a better question for the government to answer, but I do not believe this is the intent of this bill. This bill is about cybersecurity. The government has another bill before the House, Bill C-27, which is a bit closer to privacy changes. The government has not proposed changes to the Privacy Act or the Elections Act, so I do not think this bill is relevant to the question that the member raised. The member is getting away from cybersecurity and into the much broader rubric of the privacy of Canadians. She raises some points, but I do not actually connect them to this bill.

Mr. Speaker, I want to ask some questions of the hon. member that are more related. I know it is a bit away from this bill, but he mentioned in his speech the work we are doing in our defence committee on cyber-defence and cybersecurity. I have two questions.

There have been calls for the International Criminal Court to declare cyberwarfare an actual war crime. What does the member think about that?

There is also the fact that we heard that Canada and its security institutions actually overclassify information by about 90%, and that if we could declassify a lot of that information, this would significantly help those security organizations deal with the specific threats we are seeing. I want to hear the member's opinion on that.

Mr. Speaker, with respect to the first question, I will set it aside and await more testimony and discussion at the defence committee about that.

With respect to the second point, about the overclassification of information, that is a good one and I am glad the member raised it. It actually speaks to the overall culture of secrecy that exists in the Government of Canada. This is a real problem that has been ongoing for years. The current government ran on a platform in 2015 to let the sunshine in and we have absolutely unprecedented secrecy within the government. The member raises a good point around the overclassification of documents.

Mr. Speaker, it is wonderful to have an opportunity to speak to Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts.

I think this is such an important topic, and it is something we need to be very aware of, especially in this increasingly digital era. We are seeing more and more attacks on cybersecurity happening here in Canada and around the world. I support the overall concept of the bill, and I want to see it go to committee so that we can have further study, as well as some amendments to alleviate some of the concerns that I, some of my colleagues and different stakeholders have brought forward. However, I have some questions I want to pose and put forward in the hope that the minister will have a plan to address some of them.

One big question I have is that the bill is pretty vague when it comes to the definition of “critical infrastructure”. Coming from northern Alberta, critical infrastructure can look very different from what it would look like in a larger centre in an area further south. One of the things I immediately thought of was whether a pipeline would count as critical infrastructure. Frankly, in northern Alberta, at the very minimum, pipelines not only export our oil but also bring up gasoline and natural gas, which are the ways we heat our homes. Most homes, at least in the Fort McMurray area, are heated with natural gas. In the wintertime, specifically and especially, if somehow a natural gas pipeline were to be the target of a cybersecurity threat, that could actually have devastating consequences and cause thousands of people to freeze.

I think this is the kind of question we have as to what exactly critical infrastructure is.

One of the other big pieces is that critical infrastructure seems to be defined in terms of what small and medium-sized businesses and not necessarily different government actors have. Different layers of government have different pieces of infrastructure that could also be attacked by cybersecurity threats. I think of provincial governments. Some of the big pieces for cybersecurity threats would probably be in hospitals, but it could go far beyond just a hospital, depending on the community. In the case of a specific emergency, like a fire, flood or some other natural disaster, the definition of critical infrastructure might be very different.

While I understand the idea of keeping it broad, a hacker or bad actor could specifically target an area in the case of an emergency or natural disaster because they know we are already in a weaker state. I think it is important to have some pieces in place so there can actually be plans to ensure that is not going to happen. That is something the legislation needs to define, and I would urge us to define it and specifically include pipelines as part of critical infrastructure. This is especially the case because we have gone into this space where so much is digitized.

There is digitization in just about every aspect of our world, so it becomes a question of actually having to define some of these pieces. We cannot just leave this all up to regulation. I think some baselines need to be set out in this piece of legislation in order to make sure we are actually talking about the same things. In this way, we can plan for future pieces of infrastructure we do not currently know are important and part of this plan.

While the legislation would give absolutely broad and sweeping powers to government, it does not seem to have any safeguards in place. I think the lack of safeguards is very concerning. I think back to the floods that were experienced in southern Alberta in 2012. Through the process of those floods, for a number of reasons that were not necessarily well defined, the RCMP decided to go into High River and seize guns. The RCMP made a decision not to seize guns in Calgary or other communities, but in High River, it decided to go in and seize guns.

This is a piece where we need to be very careful and make sure we have some safeguards in place. Then, in the case where there is government overreach in trying to prevent a security threat, there is recourse available that is defined in the legislation. It should not be left to regulation, where it could be changed at the whim of a minister. This is so important.

Another big, important piece that is scary to me is the fact that the government has all this work in place to make sure that small and medium-sized businesses, and other businesses, have security plans, which they must send to the government. However, what work is the government doing specifically to ensure that it is prevented from being part of a security threat? How many times has the federal government been hacked? In recent memory, it has been hacked a number of different times in different ways. This may be our email system or the House of Commons intranet. Some of these pieces are very much at risk. Is it a smart idea, from a security standpoint, to have everything housed in one place? What kinds of safeguards would we have such that information is not accessible should that aspect of the government be hacked? In turn, we want to make sure hackers do not find out all of our security plans so they can get around them or mess with things they identify as unprotected. That is one of the interesting pieces.

The bill also stipulates that businesses are to share with government but not that the government has to share with businesses. While I understand part of why the government would do that, I think having a two-way dialogue when it comes to this information is going to be important. We should be trying to work towards best practices whenever possible. An organization in one part of the country might be doing something that is innovative and substantially safer for all Canadians that prevents security threats compared with another part. Such information should be shared, not just held by government, so we can build on best practices in case there is an emergency at some point.

The other big question I have with respect to this bill is: What has the government done to work with municipalities, provinces and first nations governments to ensure that this is going to respond to their cybersecurity threats and cybersecurity needs? This is a piece where I do not want to let perfect be the enemy of good. Quite frankly, we are not going to know what the next big threat is; however, we need to make sure we are protected and must try to apply as many best practices as possible so that we do not open ourselves up to unintended risks.

This is about making sure we are taking care of all the little links in the chain. We can have a very robust system and an amazing plan in place, but if we have one weak link, it counts for nothing. That is why we need to send the bill to committee now. We need to have some very robust conversations with security experts from around this country and the world to make sure we do not have any weak links in the chain. All it will take is one weak link for this entire pyramid to collapse. It will crumble apart. This is something that, as Canadians, we all need to be prepared for and ready to address, as well as having meaningful and robust conversations around it.

With that, I am thankful for this opportunity.