The House resumed consideration of the motion that Bill , be read the second time and referred to a committee.
:
Madam Speaker, I cannot begin my speech without noting that next Tuesday, September 30, we will be observing National Truth and Reconciliation Day. We will therefore not be sitting on that day. I would like to stand with my colleagues from the Bloc Québécois who, like me, have the privilege of living near a reserve. I work with the Akwesasne reserve, so I would like to say hello to my friend Grand Chief Abram Benedict, for whom I have great respect. He is responsible for the Ontario portion of the Akwesasne reserve, which is divided into three sections, located in the United States, Quebec and Ontario. I also want to say hello to Grand Chief Lazore, who was elected just a year ago and for whom I also have great respect.
During a meeting, Grand Chief Abram Benedict shared his main complaints with me. Since I am the Bloc's public safety critic, we discussed Akwesasne's need for legislation to regulate all police forces on its territory. Policing is currently managed provincially, and the people of Akwesasne would like to have one police force covering their entire territory.
He also told me about travel issues. Sometimes, people have to cross the American border to access the Akwesasne reserve, which poses problems for people who live on the reserve.
We had some good discussions. I believe that honest and sincere discussion is imperative to walk the path of truth and reconciliation. That was a brief word of introduction to set the stage for a very special day coming this September 30.
This legislation is fairly technical. As mentioned by my colleague, the Conservative Party critic for public safety, I do not think that anyone here would claim to be an expert in cybersecurity, considering its complexities. However, we recognize the importance of implementing a legislative framework to protect sectors and systems of critical importance to Quebec, the provinces and Canada.
What is Bill exactly? Allow me to read a few paragraphs from the bill to give members a quick idea.
The first part is quite simple. It amends the Telecommunications Act by adding a part on cybersecurity that empowers the government “to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.” Obviously, that is very important.
The bill also provides for a penalty scheme to promote compliance with orders and regulations made to secure the Canadian telecommunications system. This will allow the government to prohibit companies from using products and services from high-risk suppliers.
The second part of the bill would enact the critical cyber systems protection act to provide a framework for the protection of critical cyber-infrastructure or cyber-businesses in the federally regulated sector. Basically, the bill will authorize the government to designate any service or system as a vital service or system and to establish classes of operators for those services and systems. In the bill, the government says that this will serve as a model for provinces, territories and municipalities to secure critical infrastructure. The second part of the bill will apply more to operators in the telecommunications, energy, finance and transportation sectors, which are all critical sectors related to national security.
The legislation will make it possible to designate certain systems and services in the federally regulated sector as vital to national security or public safety.
The bill is very clear. It lists six vital services and vital systems in schedule 1. Let us look at them together. Obviously there are telecommunications services. Then we have interprovincial or international pipeline and power line systems, nuclear energy systems and federally regulated transportation systems, such as ports, trains, planes and airports. There are also banking systems, followed by clearing and settlement systems.
I would like to note, as all my colleagues have, that Bill C‑8 is practically a carbon copy of Bill , with just a few exceptions.
I read the legislative summary when I was preparing this speech, and I would like to mention once again that the analysts at the Library of Parliament do extraordinary work. They help us better understand the bills, they provide us with the tools to improve bills and they raise concerns for us to clarify. I would like to thank them today because they are doing a truly extraordinary job of supporting us in our work every day, especially our legislative work.
I was saying that Bill C‑8 is almost a carbon copy of Bill C‑26. There are a few small changes. We know that Bill C‑26 died on the Order Paper. It had almost made it all the way through the legislative process in the House, but it died on the Order Paper in the Senate.
I want to point out that a lot of work was done in committee. The committee held eight meetings. My colleague at the time, Kristina Michaud, studied Bill C‑26 carefully with her assistant and the Bloc Québécois's research team and proposed some 26 amendments, most of which were considered, voted on and adopted. That just goes to show that the opposition's work, particularly in committee, also serves to improve government bills.
I am saying that because the Bloc Québécois is a party that is often praised for its diligence and professionalism. We are a party that works hard. We always look at bills from the same angle: Is the bill good for Quebec? Often, if a bill is good for Quebec, it is also good for the other provinces in Canada.
However, if it is not so good for Quebec, we are able to take advantage of the opportunity for debate to try to point out to our colleagues that there are some provisions that are not in Quebec's interest. That is really our mission here in the House of Commons, or part of it, at least. I would really like to thank Kristina Michaud, her assistant and the research team for doing such a great job throughout the study and for improving Bill C‑26 through amendments.
Of course, during this process, we submitted amendments that were not adopted. These amendments were rejected by the NDP, the Conservatives and the Liberals. The situation is different now, and we hope that we will be able to convince the government that the amendments we proposed to Bill C‑26 are relevant and should be incorporated into Bill C‑8.
That being said, I would like to reassure the government right away that the Bloc Québécois is in favour of the bill. It is true that Canada is lagging behind on the issue of cybersecurity for countering cyber-attacks and cyber-threats. However, the committee will still need to spend a few hours hearing from witnesses who have concerns, and it will also need to take into account the Bloc Québécois's amendments.
The amendments we proposed focused on government accountability. We wanted to include a reporting requirement and a requirement for greater transparency. I have to say that Bill C‑8 gives the minister a number of powers. We therefore felt it was important that the minister be required to table reports.
On the privacy issue, the amendments we proposed were adopted. However, I think that section of the bill warrants further analysis. It would be useful to hear from witnesses who specialize in the management of private information and in documentation. I think we will continue this work on privacy protection by consulting experienced witnesses in order to enrich our thinking.
Despite the work that was accomplished and the amendments we proposed, certain concerns remain, particularly regarding the businesses covered by the bill. Are the businesses willing to invest? Will they be able to quickly comply with the requirements set out in the bill? That is one of our concerns, because it seems that businesses will have a lot of work to do, and we are wondering whether better support would be needed.
It is clear to us that the government has been mindful of the lack of clarity surrounding the designation of classes of operators. In fact, research conducted by the Library of Parliament found that there is some ambiguity, a lack of legislative clarity, in the way operators are designated. We hope that the work done in committee will allow us to delve deeper into this issue and explore the possibility of clarifying the definition of “designated operator”.
We also have concerns about the unlimited power to make orders and collect information, particularly with respect to telecommunications service providers and designated operators of critical cyber systems. Legal experts have expressed reservations about the protection of personal and confidential information, including information covered by solicitor-client privilege. Protecting this type of information could be challenging, given the new search powers. More improvements are needed to ensure that Bill includes every measure necessary to protect privacy and personal information.
That brings me to the part that concerns us more, the part about Hydro-Québec. As we have said time and again in this House, the Bloc Québécois objects to federal government intrusion in Quebec's jurisdictions. As we know, Hydro-Québec owns all the transmission lines in our territory, and as far as we are concerned, this ownership is not up for discussion. It represents a pivotal gain dating back to the Quiet Revolution that enables us to produce green, affordable electricity for all Quebeckers. As we see it, the bill infringes on provincial jurisdiction over electricity.
Let me explain so that it is clearer, since we will have to discuss this in committee. The Canadian Energy Regulator Act states that provincial laws apply to parts of an international power line that are within a province. A province may therefore designate a regulatory agency to exercise its powers, rights, and privileges over those parts. For a line to fall under the jurisdiction of the federal government and the Canada Energy Regulator, the interprovincial line must be designated by order. In Quebec, no lines are under federal jurisdiction or subject to the Canadian Energy Regulator Act.
This poses a significant problem for us. This was already the case with Bill and it is still the case with Bill . Bill C‑8 technically affects interprovincial lines. The Canadian Energy Regulator Act and Bill C‑8 are contradictory on the issue of jurisdiction. However, the Canadian Energy Regulator is designated as the regulator of vital systems in Bill C-8. In our opinion, this is a combination of inconsistency and interference.
Under the guise of cybersecurity, Bill C‑8 expands the jurisdiction of the Canadian Energy Regulator to cover the entirety of an international line, even the intraprovincial parts. In our view, the law should acknowledge the jurisdictions of the provincial regulatory agencies, like Hydro-Québec. We see Bill C‑8 as a blatant encroachment, and it certainly does not address the matter of overlapping jurisdictions or even duplication of responsibility.
At a time when the government is imposing budget cuts on Quebec and on Canada, we find it hard to understand why, through Bill C‑8, the federal government is imposing standards on Hydro-Québec and claiming supremacy, given that Hydro-Québec has its own cybersecurity protection systems.
The provinces even have the authority to impose penalties if reliability standards are violated. In our view, Bill C‑8 interferes in an area already covered by the critical infrastructure protection, or CIP, standards of the North American Electric Reliability Corporation. These standards apply to the critical infrastructure that the bill seeks to implement. As a result, an operator could be penalized twice for the same violation. Which would take precedence? These are some of the things we are wondering about. We think that the jurisdiction of Quebec and Hydro‑Québec should be respected.
The bill enabled the federal government to fine Hydro-Québec if Hydro-Québec did not comply with the federal standards. That is rather absurd because Quebec has been managing a hydroelectric system for a long time and Hydro-Québec, which experiences cyber-attacks nearly every day, has a rather robust system.
There could even be penalties of up to $15 million if the business is found to be non-compliant, which is considered to be a separate violation, when Hydro-Québec is already adhering to standards. That is my point.
Hydro-Québec already follows North American standards. Since we supply electricity to the United States, we must meet North American standards. It seems like Bill C‑8 ignores what is currently happening with Hydro-Québec's actual responsibilities and tries to encroach on its jurisdiction. I am not sure whether the Government of Quebec was consulted. I am not sure whether Hydro-Québec was consulted either.
Yes, the government needs to collaborate nationally with the provinces and territories on a bill, but it needs to reassure Hydro-Québec and Quebec that certain provisions of Bill C‑8 will be reviewed in order to respect the jurisdiction of Hydro-Québec and the provinces.
On that note, I invite my colleagues to ask me a few questions if they want to better understand our view, which is that Bill C‑8 is an important bill but needs to be amended to ensure that the federal government is not interfering in Quebec's affairs and jurisdictions.
:
Madam Speaker, let me begin by saying that I will be splitting my time with the member for .
I am very pleased to rise today to speak in support of Bill , an act respecting cyber security. This critical piece of legislation will strengthen Canada's resilience against public and private cyber-threats.
I believe that all of my parliamentary colleagues would agree that cyber-threats are now a major security concern in Canada. Bad actors are going to extreme lengths to disrupt our daily lives by carrying out cyber-threats against critical infrastructure. These disruptions have very serious consequences given our day-to-day reliance on technology. Whether for banking, communications or government services, cyber-incidents can affect every aspect of our lives. That is why it is imperative that we update our laws in order to mount an adequate and agile response to modern-day threats.
In June, our government introduced Bill , which represents an important step in combatting cybercrime and protecting our critical infrastructures from cyber-threats. The possibility that the critical infrastructures Canadians rely on for essential services could be hit by cyber-incidents poses a threat to our public safety, national security and economic prosperity.
Cyber-threats are becoming more and more frequent and sophisticated, and are increasingly sponsored or supported by states. Moreover, Canada's critical infrastructure is becoming increasingly digitized and interconnected, particularly with the emergence of new technologies such as 5G and 5G+. Any compromise in the telecommunications, energy, finance or transport sectors could jeopardize the security of Canadians or cause significant damage to the Canadian economy.
Passing this bill represents an important step in the government's ongoing work to combat cyber-threats, address vulnerabilities and ensure the security of Canadians and Canadian private, public and quasi-public businesses. This bill aims to strengthen national security, public safety and economic prosperity by better protecting Canada's telecommunications system against threats and enhancing the cybersecurity of federally regulated critical infrastructure.
Bill will help strengthen our economic prosperity, as resilient infrastructure is precisely what global investors are looking for. Digital sovereignty is also a global objective. It is unrealistic to believe that investments or investors will come if we do not demonstrate a clear commitment to protecting our critical infrastructure.
To that end, this bill introduces security-related amendments to the Telecommunications Act and establishes a new cybersecurity framework aimed at strengthening the resilience of our country's critical cyber systems. The amendments to the Telecommunications Act are intended to ensure the security of Canada's telecommunications system. In particular, they are intended to protect it from threats posed by high-risk providers. These amendments will give the government clear and explicit legal authority to require telecommunications operators to take the necessary measures to protect their systems.
The bill also enacts the critical cyber systems protection act, which requires designated operators in the finance, telecommunications, energy, and transportation sectors to protect their critical cyber systems. This obligation includes implementing a cybersecurity program and reporting cybersecurity incidents to the Canadian Centre for Cyber Security.
Through cybersecurity incident reporting, our intelligence agencies will be better equipped to monitor trends and new methods used by bad actors. Let me say it again: Bad actors are much more agile and improve much faster. Unfortunately, they tend to find their way around systems. At times, this renders all government systems out-of-date.
The critical cyber systems protection act also provides the government with a new tool for taking action to fight cybersecurity threats or vulnerabilities as needed, and to protect Canadian cyber systems more effectively. This legislation will help our government fulfill its security mandate and meet its security priorities.
This government is committed to fighting modern threats like foreign interference, transnational repression and cybercrime. Because these crimes are often interconnected, this bill would play a key role in this fight by enabling the government to take action to promote the safety and security of Canada's critical infrastructure.
It is time to update our legislation so that it is able to address 21st-century threats and challenges. If this bill receives royal assent, the provisions of the critical cyber systems protection act will be implemented gradually, and the consultations under way between the government and industry stakeholders regarding the development of regulations will continue in order to minimize the potential impacts on the sectors affected.
By giving the government the capacity to take direct measures against cyber-threats or vulnerabilities, this bill will strengthen the cybersecurity of Canada's essential infrastructure through its regulatory framework, while enabling the Communications Security Establishment to be better informed of the cyber-threats facing that infrastructure. The new powers granted by the bill will help us to proactively monitor the ever-changing landscape of cyber-threats and take quick action to stop threats and address vulnerabilities.
It often seems that not a day goes by without us hearing about a cyber-incident that has occurred somewhere in the world or in Canada. Canadians hear about these incidents and are rightly concerned about the security of their personal information and the disruptions that could be caused to the systems they rely on every day, such as financial and banking systems. We need to respond to these concerns. As legislators, it is our duty to do all we can for them.
Cybersecurity is not a partisan issue. That is why I invite my hon. opposition colleagues to support us in our efforts to strengthen our collective security. We are monitoring developments in Canada and abroad, and we are taking appropriate action. The government will continue to consult stakeholders and interested parties throughout the regulatory process. While changes are definitely needed to strengthen our systems and infrastructure, we want to ensure that there is as little disruption as possible to industry, which will be a key partner in combatting cybercrime and in strengthening our resilience.
In closing, I once again invite all of my parliamentary colleagues to support this bill in order to protect Canada and Canadians from cyber-threats.
:
Madam Speaker, I want to thank my colleague, the member for , for splitting his time with me.
Cybersecurity is no longer a distant concern of experts in back rooms; it is a kitchen table issue. Canadians expect their lights to come on, their paycheque to be deposited, their medical records to be private and their phone to connect them to loved ones without interruption. They expect those things to be safe from hackers, hostile states, nefarious actors and, yes, overreach by their very own government. Cybersecurity is not an abstract concern; it is about whether families can trust their power grid to stay on, whether a rural clinic can keep its patient records safe and whether small businesses can keep their doors open without fear of being taken down by hackers.
Canadians deserve real protections against cyber-threats. They are a reality in today’s world, and we all recognize that. In that respect, I acknowledge that Bill reflects a pressing reality: Canada must strengthen the resilience of our critical infrastructure. However, in our rush to act, we must also ensure that we get the right balance. If we protect our systems but undermine our rights, if we secure our networks but destabilize our economy, then we will have built a fortress with the doors left open.
Bill as it stands raises several concerns. The Liberals tell us the bill is proof of their so-called innovation agenda, but when we look closely at the fine print, the reality is far more complicated. Bill C-8 is a near carbon copy of Bill , a bill that died when Parliament was prorogued earlier this year, and while some minor improvements have been made, some fundamental flaws remain. This is where I would like to focus my remarks as I and my colleagues in the NDP consider the ramifications of the bill. Allow me to bring those questions forward with the hope of bringing some clarity and changes to the bill.
First is the scope of ministerial powers. Under the bill, the Minister of Industry could compel telecommunications providers to rip out equipment, ban entire suppliers or suspend agreements. Imagine that a company might have to pass the costs of that on to its customers or close its doors entirely.
While the explained that safeguards exist to prevent disproportionate orders from crippling providers and leaving rural Canadians disconnected, Bill would grant sweeping powers to cabinet and the Minister of Industry: powers to ban telecom companies from using certain equipment, to force its removal, to suspend services and to terminate contracts. These orders could be issued without prior judicial approval, without parliamentary review and without independent oversight. When we concentrate this much power in the hands of a single minister, we need checks and balances. Where are they in the bill?
Second are the risks to privacy and civil liberties. The bill would allow for mandatory information sharing between telecoms, regulators and federal agencies, and possibly onward to foreign governments. The standard for this disclosure is simply the minister’s own judgment of what is “necessary”. This is vague, subjective and wide open to abuse. Why are there no requirements in the bill for privacy impact assessments? Why are there no guarantees that collected data would not be repurposed for unrelated purposes?
Third is the absence of compensation or worker protection. If a company is ordered to rip out equipment or shut down services, there would be no compensation. For small Internet providers, that could mean bankruptcy. For their workers, it could mean layoffs. For rural and remote communities, it could mean disruptions in already fragile service. Where is the government’s plan to support the workers, providers and communities that would bear the costs of compliance?
Fourth are the penalties. Bill envisions fines of up to $15 million a day for corporations and up to $1 million a day for individual employees. Think about that: A frontline worker following orders from management could face personal ruin under the regime. Where are the safeguards to ensure fairness, due process and appeal rights?
Fifth is the one-size-fits-all approach. The bill would lump together banks, telecoms, nuclear facilities and energy co-operatives under a single compliance framework. All of them would face the same 90-day timeline to stand up cybersecurity programs, no matter their size or capacity. For large corporations, perhaps this is feasible, but for small operators or co-ops, it could be impossible. Should compliance obligations not be tailored to the realities of different sectors?
Sixth are international consequences. Canada’s adequacy status under the European Union’s GDPR is the foundation of much of our digital economy. It is what allows European data to flow into Canadian systems, supporting banks, airlines and cloud providers, but the European Commission reviews adequacy every four years. If it sees that Canada is granting unchecked surveillance powers, or if it sees data repurposed without necessity and proportionality, we risk losing that adequacy decision. We have already seen what happened to the United States under Schrems II. Does the government truly want to put Canada in the same position?
New Democrats agree that cybersecurity is essential, but cybersecurity must not come at the expense of democracy, accountability, privacy or fairness for workers and communities.
Here are the questions we are putting on the record for the and the government to answer. Why has the government chosen to concentrate so much power in cabinet without requiring independent judicial and parliamentary review? Why would there be no independent oversight body to ensure that orders are proportionate and justified? Why would the bill not guarantee privacy impact assessments or limit onward disclosure of Canadians’ personal data to foreign governments? Why has the government not proposed compensation or transition supports for workers and small providers who would bear the financial burden? Why would penalties be so extreme that individual employees could be personally liable for millions of dollars, even when following management orders? Why would the same compliance framework be applied to banks, nuclear facilities and small ISPs alike? Has the government conducted and published a risk assessment of how Bill could affect Canada’s adequacy standing with the European Union?
The Liberals say the bill would modernize our telecom laws and defend Canada, but democracy must not be sacrificed in the process. Strong cybersecurity should also mean strong democracy. It should protect Canadians from foreign threats without opening the door to unchecked government overreach.
New Democrats will continue to push for changes, independent oversight, stronger privacy protections, fair treatment for workers and communities, proportional penalties and sector-specific flexibility. We can protect Canadians from cyber-threats without trampling on rights, without ignoring workers and without undermining our economy. Bill is an opportunity to strike the right balance, but right now it does not seem well equipped to do that.
Canadians want more answers, transparency and oversight from overreach, as we have seen the tendency of the new to move headlong toward centralization without considering the consequences for public policy and its effects on everyday Canadians.
:
Madam Speaker, I will be sharing my time with the member for .
Before I begin, I want to thank the people of Richmond Centre—Marpole for bestowing their trust in me and electing me as their member of Parliament. I am deeply honoured by their confidence, and I am committed to serving them faithfully, with their interests always my top priority. Every time I rise in the House, it is with their voices in mind.
We are debating Bill , the government's latest attempt at a cybersecurity framework. To understand Bill C-8, we must remember where it comes from. This is essentially the reintroduction of Bill , which the government first brought forward in 2022. Conservatives supported the principle of Bill C-26, the idea that Canada needs stronger protections for critical cyber systems. However, we also raised serious, legitimate concerns about how the bill was drafted.
We warned that Bill would concentrate too much unchecked power in the hands of the ministers. We warned that its secrecy provisions would undermine transparency and accountability. We warned that the cost of compliance would inevitably be passed down to ordinary Canadians through higher phone bills and banking fees. We warned that the legislation was focused on the wrong targets, federally regulated banks, pipelines and telecom companies, while leaving out the institutions Canadians actually see attacked most often: hospitals, municipalities and schools.
Those warnings were echoed not only by Conservatives but also by industry leaders, civil liberty groups and privacy experts. The Standing Committee on Public Safety and National Security heard those criticisms over many months. What happened? Bill stalled in committee and never passed. It died on the Order Paper because it could not overcome its flaws.
Now the government has come back with Bill , and to be fair, there has been one improvement. The government removed the so-called secret evidence clause, the provision that would allow ministers to rely on confidential materials in court challenges without disclosure to affected parties. It was a step in the right direction, and Conservatives acknowledge that change.
However, let us be clear: Beyond that one tweak, almost everything else is the same. The sweeping ministerial powers are still there. The indefinite secrecy is still there. The lack of oversight is still there. The downloading of costs onto consumers is still there. Most importantly, the narrow scope of the bill, covering only federally regulated industries while excluding hospitals, municipalities and schools, is still there. Canadians deserve better than a reheated version of a flawed bill. A single fix does not change the reality that this legislation would fail in its core purpose, which is protecting Canadians where they are most vulnerable.
Let me bring this closer to home. Cyber-attacks are not theoretical, and they are not distant. They are happening right now, and they are hitting our communities hard. In British Columbia, the B.C. government itself was breached. State-sponsored actors infiltrated its email systems and accessed sensitive personal information. Vancouver Coastal Health, which cares for more than a million people, was hit with ransomware that disrupted hospital operations and delayed patient services. The City of Richmond, my own city, faced cyber-intrusions and compromised email systems, threatening the delivery of municipal services. Even the Richmond School District fell victim to a cyber-attack that exposed private and financial information of teachers, staff and families.
These are not hypotheticals. They are real attacks on real people. Not one of these institutions would be protected under Bill .
That is the first fatal flaw. Bill offers Canadians a false promise of security. The government says it would protect vital systems, but the very systems Canadians interact with every day, their hospitals, their local governments, their children's schools, would be left outside the law's reach. A cybersecurity bill that does not secure hospitals, cities or schools is like locking the front door and leaving the back door wide open.
The second flaw is secrecy. Just like Bill , Bill would grant sweeping powers to ministers and to cabinet. With the stroke of a pen, the government could order a company to block a service, rip out equipment or suspend operations, and those orders could be kept secret indefinitely. Companies could even be kept from telling Canadians that the government had interfered with their networks. Operational secrecy during an active attack may be justified, but secrecy without time limits or oversight is simply unacceptable. That is not transparency, that is not accountability, and it does not inspire public trust. Canadians deserve to know, after the fact, what actions were taken in their name.
The third flaw is cost. Bill , like Bill before it, makes it explicit: There would be no compensation for companies forced to comply with government orders. If a telecom company was told to strip out hundreds or millions of dollars of equipment, Ottawa would not pay a cent. Those costs would land on Canadians, who would see higher phone bills, higher bank fees and slower upgrades to essential services. National security should be funded fairly, not through hidden taxes on consumers.
The fourth flaw is scope. The government may argue that by forcing telecom companies to strengthen their networks, hospitals and schools that rely on those networks are indirectly protected, but that argument does not hold up. The attacks we have seen in British Columbia did not come through telecom backbones; they came through local servers, outdated software and ransomware emails. Protecting the pipes does not protect the people.
The government may also claim that the bill would help stop foreign interference, but again, this is spin, not substance. Bill would deal with cyber-intrusions into networks. It would do nothing to address the broader reality of foreign interference, such as disinformation campaigns, covert political financing, intimidation of diaspora communities or manipulation of democratic institutions. Suggesting that Bill C-8 would stop foreign interference misleads Canadians and risks creating dangerous complacency.
What would Canadians really get with Bill ? They would get a law that still misses the real victims of cyber-attacks. They would get a law that still hides decisions from public view. They would get a law that still sticks consumers with the bill. They would get a law that still does almost nothing to address the broader threat of foreign interference.
That is not cyber-resilience. That is not leadership. That is smoke and mirrors. Conservatives believe in stronger cybersecurity, but we believe in getting it right. What Canada needs is legislation that actually works with provinces and municipalities to protect the services Canadians rely on most: hospitals, schools and local governments. We need legislation that provides oversight and accountability, not blank cheques for secrecy. We need legislation that shares the cost of national security fairly, instead of forcing families to pay through hidden charges. We need legislation that integrates—
:
Madam Speaker, it is an absolute honour to rise in this chamber to talk about a very serious matter: those who are and are not addressed in the bill before us, Bill .
Let me hearken back to a previous parliament when I had my first opportunity to work with the splendid member for . We were both on the industry committee, and during our time on that committee, Ottawa had a tornado incident. This tornado scared a lot of people and caused a lot of damage to Ottawa. Many people were quite surprised that after about eight or so hours, they were not able to use their cellphones to get in touch with their loved ones. This surprised me, because most people assume that in an urban centre such as Ottawa, there is continuous service, even after a strenuous event such as a tornado. I can only imagine someone trying desperately to reach their family and loved ones or to connect with work to say why they could not be there. To not have the ability to do that caused a lot of consternation in the community.
The member for put forward a motion for us to study this further, and some of the things we found out in regard to it were not reassuring. For example, there is no regulation surrounding what telecommunications companies have to have as backup. Essentially, a telecommunications company, such as Rogers or Telus, often have backup generators, but there is no provision to say for how long. We saw a system strained by a tornado, and the damage and fear were compounded by the telecommunications companies not having sufficient gas in generator tanks for them to continue service after the tornado incident. This is a small example of the vulnerabilities that currently exist within our system that hopefully Bill will address.
There are two components to this particular legislation. One, as I was referencing, refers to the Telecommunications Act, and the other would create new provisions surrounding cybersecurity.
I think most Canadians understand the dependence we now have on our ability to communicate with one another and access information quickly. If the systems that we so heavily depend on in our modern life were to become compromised, the disturbance that could have is not just about the inconvenience of, for example, not being able to access Environment Canada's weather reports. There could be other issues when it comes to banking. One only has to think about the incident in Toronto when suddenly Rogers flickered and no one was able to access their accounts. In fact, business owners were not able to do Interac transactions, and of course, small and medium-sized businesses had no way to take payment, because many of us rely almost exclusively on credit and debit cards. When most people stop and think about how dependent they are on technology and how interdependent these systems are, they quickly come to the conclusion that there should be something there.
I believe, as every member in this place would probably believe, that the government has a responsibility to protect its own systems. That has been done over time. Has it been perfect? No. There have been privacy breaches and attacks by entities. The NSICOP reports talk about how we are frequently targeted by authoritarian regimes. For example, the Communist Chinese regime in Beijing is cited in the reports, as is Russia.
There are also non-state actors who will try to hack into our different systems, so it makes sense to people when we say that the government should protect our information, health records, tax records and any personal information we have. People understand that, and they want their government to be secure, particularly when we start talking about national defence or our different security and intelligence systems. However, people do not always assume that the same protections that government encourages and codifies in its own practices are being done in the private sector. Bill would create a set of provisions to do that.
Conservatives believe strongly in the need to protect our national security and to make sure these critical systems we depend on will function when Canadians need them the most, during times of emergency or if we are attacked by our adversaries abroad. I believe the government understands this issue and is trying to find the legislation necessary.
That is where I am going to stop saying what I agree with and point out a few things.
It seems the government has smartened up a bit and adopted certain amendments that were pushed by Conservatives at committee stage in the last Parliament. That is a good thing. A good idea should be seen as such, and it should not matter which side it comes from. That is a problem we have in this place. Too often it is on who proposes an idea that one decides the merit of it, and that is wrong. It should be on the merit of the idea for the betterment of Canadians.
What I will say is when a party, particularly the governing party, is given tremendous powers and uses that authority for its own purposes, that becomes a problem. I can already see some of my friends across the way starting to waver, wondering where I am going with this. When the dropped the writ and effectively launched an election this past spring, there were consequences. The fact that this bill did not make it through and become law is 100% on the Liberal government today.
I wanted to make sure I stated that for the record, because when a puts his own government's interest ahead of the public interest, it should be called out, and they should be held accountable. I think the Liberal Party needs to listen, in a minority government, to other viewpoints that say this should have happened and it should have passed. Maybe the Liberals could have waited a bit longer, but they did not. They decided to put their own electoral interests ahead of societal interests.
It is important to know that it rests with the government, but we are here now. We are offering similar critiques and are happy they were listened to, in part, in the last Parliament and have been incorporated into the bill, but there are still some oversights.
For example, with respect to privacy, in a previous Parliament when I was on the industry committee, Statistics Canada ordered Canada's banks to give it holus-bolus a large amount of information, everything from mortgages to debits. We called on the chief statistician to account for this new collection of a massive amount of information. By the way, to their credit, someone at the big banks leaked it to the media. That is the only way we would have known about it. We brought the chief statistician of the day forward, who assured the committee that Statistics Canada was going to, basically, anonymize all of the information. Within four questions, that argument crumbled.
It crumbled, and so did the collection exercise, because it became quite apparent that Statistics Canada had not informed the minister that it was doing this, something it is required to do under law. I was very lucky to have some privacy experts reach out to me and give me some direction about what to ask, and the chief statistician's whole argument crumbled. He basically said that even though Statistics Canada would anonymize the data, it was very simple to reassemble it, to realign it and have someone's complete information.
I can tell members that Canadians care very much about their privacy rights. In a world where we are more interconnected and utilize technology all the time, where our digital thumbprint, so to speak, is everywhere, people care about where that information goes. Under this regime, the government has given itself almost a complete pass when it comes to the management of the privacy of Canadians.
The government would essentially do the same thing Statistics Canada did, saying they could take the information, order the information and use it however they want without any oversight. That is wrong.
Conservatives at committee are going to be talking about privacy rights, even if the ministers and the members on that committee do not want to talk about this, because we are there to make sure—
:
The Conservative Party takes the attitude that it is okay for it to significantly change the legislation and that we should just forget about members' being able to speak to it; heaven forbid that. However, when it comes to government legislation, the Conservatives have their politically motivated methods of filibustering.
Let us talk about Bill and Bill . What is Bill C-8? It is a reflection of Bill C-26, with a couple of relatively minor changes to it. Bill C-26 had second reading debate. It went to committee, had extensive debate there, came back for extensive debate here, and then went to the Senate.
At every stage, it was passed unanimously; everyone supported the legislation, yet the Conservatives look at the bill and say that they have new members. The government caucus has more new members than the Conservatives do, and we have a new . At the end of the day, the Prime Minister has taken a holistic approach in terms of what we need to do inside the House of Commons, and he said that the bill is important legislation. It would have a very real, tangible impact on our businesses and on Canadians.
We are looking for what Canadians mandated not only the Liberal Party to do, but also the Conservative, Bloc and New Democrat members and the leader of the Green Party. They want a higher sense of co-operation on the floor of the House of Commons. Even Conservative voters want more co-operation. We all know the bill is good, sound legislation, at the very least, that can go to the committee stage. If someone senses a little frustration on my part, it is based on other legislation that the government has before us.
Often what it takes is that we have to shame opposition members, particularly the Conservatives, into recognizing legislation is in the best interest of Canadians, and there is nothing wrong with allowing good legislation to, at the very least, go to a standing committee where experts, Canadians and members opposite can debate it, especially when there is a minister who stands up and says that if members have amendments, they should bring them forward. However, we do not see that happening. There is a very clear double standard.
We can look at the legislation itself. Malicious cyber-attacks are a reality. They are taking place today in many sectors, and they are not unique to Canada. They are a threat to the world economy, I would argue. Bill is a positive step in addressing that issue. It would ensure that we would have more sharing of information between governments, industry and stakeholders. It would establish more accountability, and one would think every member of the House would be in support of something of that nature.
In terms of cyber-threats, think of the critical industries the federal government is responsible for. Finance, communication, energy and transportation all have critical infrastructures, and we need the legislation. When we have a who says we want to build a strong, healthy economy, the best and strongest economy in the G7, in order to protect the interests of that economy, we need this type of legislation passed.
Let us talk about cyber-threats in terms of finance. The finance industry is so critically important to Canada. When I was first elected as a parliamentarian a few decades ago, we did not have things like online banking. We went to the bank and went through long lineups, and there were more banks in our communities.
I can say that changes that have occurred in our financial industry have been overwhelming in many different ways, and legislation needs to be brought forward to protect the interests of Canadians, whether in terms of identity theft or cyber-attacks, which can literally shut down or cause serious financial issues at a banking or credit union institution. What is wrong with legislation that reinforces the need to ensure there is a higher sense of accountability and more information sharing? Then, if a cyber-attack occurs at X, we can learn from that and make sure the industry as a whole is better informed in order to be able to deal with an attack of that nature.
It is very real. Nowadays, our business communities get more payments on credit cards and debit cards than they do in cash transactions. We can go to a mall or a store, anywhere we go where we see financial transactions, let alone the Internet itself. We need to protect and ensure that privacy information is kept private and, where there are bad actors, that the government is in a position to be able take action. That just deals with one component I made reference to as an example, finances.
In telecommunications and cellphones and things of this nature, what makes up the cellphone matters and subcontractors matter. These types of things are in Canadians' best interests. Whether it is energy, transportation, finance or telecommunications, I think it is a very strong, positive and warranted piece of legislation from the national government. That is why, when I started off my comments, it was all about the process. We have had a lot of discussion and debate. I am not saying that it has to pass today, but let us take a look at legislation that is before the House of Commons and be reasonable so we know we will be able to pass legislation and we know—
:
Madam Speaker, I rise to speak in support of Bill , an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts.
This legislation is a necessary, measured step to protect systems that Canadians rely on every single day. This bill would help critical infrastructure operators better prepare, prevent and respond to cyber-incidents. It would do what responsible governments must do: It would set clear, enforceable standards for operators in the most critical sectors; it would enable rapid, targeted interventions when threats emerge; and it would ensure that Canada is aligned with international partners that are facing precisely the same challenges. In this era, it is very important that we pass this piece of legislation.
Let me talk about two big things the bill would do. First, it would modernize the Telecommunications Act so that our security agencies and responsible ministers can issue targeted, time-limited directions to defend our networks against serious and evolving threats. Second, it would enact the critical cyber systems protection act, the CCSPA, which would set baseline, legally binding cybersecurity duties for designated operators in federally regulated critical sectors. This would mean cyber-risk management programs, timely incident reporting and accountability up and down the supply chain. Those are not “nice to haves” anymore; they are the basic hygiene that we need for running a critical service in 2025.
Colleagues will recall earlier efforts under Bill . With Bill , our government has brought back a refined, clearer and in some places improved framework because the threat landscape did not pause when Parliament did. Several independent analyses confirm that Bill substantially revives the Bill approach while correcting drafting issues and clarifying process where needed, and that is prudent governance.
Why does this matter? For Canada, cyber-risk is now an economic risk, a jobs risk and a public safety risk. A successful attack can freeze payrolls, disable hospitals, shut down pipelines or even take down our 911 lines.
Across London, manufacturers, research labs at Western University, students at Fanshawe College, local clinics and small businesses on our main streets all depend on secure networks. The southwestern Ontario supply chain and the supply chain across Canada, which include major investments in EVs, batteries and advanced manufacturing, cannot function with brittle digital infrastructure. When a single compromised supplier can ripple through an entire regional economy, cyber-resilience becomes a competitiveness strategy.
Essentially, what Bill would require under the CCSPA is that designated operators, such as those in banking and financial services, telecommunications, energy and transportation, must establish and maintain a cybersecurity program proportional to their risks, report cyber-incidents quickly and consistently, manage third party and supply chain vulnerabilities, and comply with enforceable directions in extraordinary circumstances. There are administrative monetary penalties for non-compliance because rules without consequences are just suggestions. We cannot afford to bring just suggestions forward.
On the telecom side, Bill would modernize the tool kit so that government can act surgically when credible threats emerge in our networks. These powers are not a blanket. They are tied to concrete risks and are subject to review. In today's environment, speed matters. A 72-hour delay can be the difference between a contained incident and a national outage.
Some civil society groups and legal scholars have raised important concerns about privacy, transparency and due process, especially around how directions are issued and reviewed and how information flows between government and private operators. I want to take the opportunity to acknowledge those concerns, which are clearly on the floor of this House. Some of our colleagues have mentioned them in this debate.
The goal of Bill is to protect Canadians, not to weaken their rights. As this bill advances to committee, I look forward to seeing the conversations that colleagues from across the aisle will have and the suggestions they will be putting forward. As we did before on Bill , I think we will be able to achieve a consensus on what this bill is going to look like. Essentially, the goal is to protect Canadians.
I also have some thoughts on some of the things we could look at. Number one is that we could look at tightened transparency around reporting, including public statistics on the use of cybersecurity directions wherever national security considerations allow. We can also look at strengthened due process, making judicial review avenues practical and timely, and clarify data handling and retention so information shared for cybersecurity is not used for unrelated purposes and that it is protected with robust safeguards.
I do not sit on the committee, but I do know we have colleagues on it from across the aisle who are going to have robust conversations on how to strengthen the bill as we did in the past. We voted for Bill . It is now back in the House, refined and reframed for all our colleagues to discuss and to propose measures they want to see within the spirit of wanting to protect cybersecurity for all Canadians.
I think these are reasonable and constructive asks that would make for good dialogue and would strengthen the bill. I am sure there will be more suggestions that I look forward to reading from my colleagues. I am sure they will support and pass the bill in a very timely manner, because if we are having a conversation about a cybersecurity bill in 2025, we need to pass it. I think we understand that the bill is not coming forward as a nice-to-have conversation; it is really critical.
Not every critical service is a national giant. Many are medium-sized providers or municipal utilities that keep water flowing and transit moving. For these operators, the question is often capacity. Having the people, the tools and the processes that meet modern standards is really important. I support complementary measures alongside Bill : practical guidance, shared services, threat intel programs that actually reach the front lines, and funding that helps smaller providers implement the basics, such as asset inventories, multi-factor authentication, network segmentation, backup discipline and tabletop exercises.
Standards without support risk becoming paper compliance. What we should be trying to do with our approach is to enable real resilience for Canadians. We also need to be honest about where the real attack surface is today: suppliers, managed service providers, and software dependencies. Bill 's supply chain provisions are a step forward, but we must continue to keep pushing for secure-by-design practices. The objective is learning and early warning, not blame-shifting.
I hope that colleagues at committee will have the time to ensure that timelines will also allow the time to consult, that thresholds and formats are clear, and that we streamline duplication with sectoral regulators where possible.
Critical services in indigenous and rural communities face unique constraints.
I do not think I will be able to finish my speech, but I want to say that the legislation is really important for all Canadians. I am happy to speak to and support the bill. I look forward, for all our colleagues who have been speaking to the bill today, to their actually helping us bring it to committee so we can bring amendments that are necessary and we can pass the bill as quickly as possible. They voted for it in the last Parliament under Bill . It is back now, and it is really important we pass it as quickly as possible.
:
Madam Speaker, I am pleased to rise and speak to Bill today. For those watching at home, in the previous Parliament, Bill C-8 was Bill .
I was pleased to sit on the public safety and national security committee, which went over that bill. I want to provide a quick overview, because part of the debate we are having in the House today is about why we are discussing the legislation again when it was discussed and advanced, pretty much to the finish line, in the last Parliament.
Bill went through committee. There were numerous amendments made by all parties. It came out and went to the Senate. The government asked the House of Commons to fast-track a different bill on foreign interference. In the government's own incompetence, it did not seem to realize that its foreign interference bill contained provisions that nullified the entire second part of Bill C-26. The Senate actually identified this problem. This caused such a delay to the bill that when the Liberal government decided to prorogue Parliament, despite the fact that it had not tested the confidence of the House, it actually resulted in the legislation being killed.
The government has been saying, “The dog ate my homework.” The fact is that the Liberal government was the one that killed the legislation in the last Parliament. That is the reason we are back here today.
Cybersecurity is an issue of critical importance. Cybersecurity has an impact on all aspects of our life. More and more of our daily life is being spent online, and we are becoming dependent on services and infrastructure that are vulnerable to cybersecurity threats. The threats posed by malicious actors are touching every aspect of society. They are touching industry, hospitals, pipelines and individual households.
As we know, with the government's implementation of soft-on-crime bail policies, criminals will always follow the path of least resistance. It is no different in the cybersecurity environment. When a country has poor cybersecurity legislation, it makes itself a target for these malicious actors and encourages that behaviour.
The Liberal government originally introduced Bill in June 2022, over three years ago. We only started to study the bill two years after it was introduced. We heard repeatedly from the Liberals that cybersecurity has been a high priority and that this is critically important legislation, but here we are, three years later, in an entirely new Parliament, going over the same legislation again.
These delays could have been prevented, but the Liberal government failed. It is unfortunate because we have heard repeatedly that Canada's cybersecurity has been neglected and remains a vulnerable and soft target.
The bill proposes to give sweeping powers to the government, and Conservatives believe that we cannot give the government a blank cheque. We need to study the legislation to ensure that we are creating effective mechanisms for combatting cybercrime without creating unnecessary red tape, bureaucracy or charter rights implications.
The bill has two key objectives. First, it seeks to amend the Telecommunications Act, to give the government the power to secure the telecommunications systems. Basically, the government would have the power to tell the telecommunications companies and others to do things or to not do things, such as removing equipment provided by a hostile foreign power that is being used in our telecommunications systems.
Second, it seeks to create the critical cyber systems protection act; in theory, this would allow the government to impose cybersecurity requirements on federally regulated industries. These industries could include the energy sector, pipelines, nuclear plants, the financial sector, banks, the health sector and other areas.
I believe there are some positive steps towards enhancing public safety in the bill. It is important for Conservatives to point out that there are some serious weaknesses that remain in Canada's cybersecurity posture. In fact, we are the last G7 country without a robust regulatory framework for cybersecurity.
Last summer, the Auditor General released a damning report on the government's capacity to combat cybercrime. I am going to quote her conclusions, because they were scathing:
...the Royal Canadian Mounted Police (RCMP), Communications Security Establishment Canada, and the Canadian Radio-television and Telecommunications Commission (CRTC) did not have the capacity and tools to effectively enforce laws intended to protect Canadians from cyberattacks and address the growing volume and sophistication of cybercrime. We found breakdowns in response, coordination, enforcement, tracking, and analysis between and across the organizations responsible for protecting Canadians from cybercrime.
This raises an important point. We can have all of the laws we want that say all the right things, and we do have some laws on cybersecurity, but it is clear from the Auditor General's report that the government has not invested in the capacity, the resources or the tools to implement the current cybersecurity laws that we have. We need to be assured that, by bringing the legislation forward, the government is not only planning to grant itself these powers but also giving law enforcement the capability to do something with these powers. That is something that it has not really done.
The trend continues to worsen. The Canadian Anti-Fraud Centre projects that losses from cybercrime will surpass over $1 billion annually by 2028. There are actual insurance products being created to protect people from cybercrime. That is not just money being lost to fraud. That is broken lives and ongoing mental health challenges that are devastating our citizens.
We know that coordinated and strategic attacks on our national infrastructure by criminals or foreign adversaries have wreaked havoc, and will continue to wreak havoc, on our society. A cyber-attack on our power grid in the middle of winter would be devastating to hospitals with vulnerable patients or to pipeline infrastructure. Canada has already faced concentrated cyber-attacks against its telecommunication companies since at least 2021, with the Communications Security Establishment saying that it is aware of malicious cyber-activities from People's Republic of China state-sponsored actors.
Canada and our allies have already been the target of cyber-attacks carried out by hostile state-sponsored or aligned groups. In fact, the RCMP, FINTRAC and Global Affairs Canada, just to mention a few, have all been previously breached by cyber-attackers. The seriousness posed by these attacks on our nation's most sensitive information cannot be understated. We need to know that the government is taking action to secure its own systems, not just telling the private sector that it has to secure its systems.
We know that the private sector is taking proactive measures to invest in cyber-defence. With hundreds of thousands of cyber-attacks, and that is not hyperbole, targeting Canada in the first six months of 2025, they have been forced to step up and the government has not.
I hear from constituents on a regular basis that they are concerned that the government's own cybersecurity measures are not up to snuff, particularly in regard to the Canada Revenue Agency. As malicious criminals become more sophisticated, Canadians need to know that their data is being stored in a safe and secure way. Therefore, it is common sense that the Liberal government should hold itself to the same standards that it is holding the private sector to in the legislation.
Bill was introduced way back in June 2022. This was in the wake of the government's decision to finally, after tremendous political pressure, ban ZTE and Huawei from the Canadian 5G networks. This was long after decisive action had already been taken by all of our Five Eyes partners.
I am pleased to say that I think Bill left committee in better condition than when it went in, but we have heard from many witnesses who are concerned about the over-centralization of powers that this is giving to cabinet ministers. There is also concern that the bill in its current form gives the government excess executive authority without full proper oversight and guardrails. In Bill , the government has continued to take a “trust us” approach to legislating Canada's cybersecurity, which is alarming to the many Canadians who are concerned that the government may overreach.
Conservatives believe that trust needs to be earned. As a great Conservative politician once said, “Trust, but verify”. Considering the Liberal government's habit of limiting free speech in bills like Bill and Bill in the last Parliament, and the illegal use of the Emergencies Act, I believe that many of these concerns are valid and should be addressed. Conservatives need to be able to study the bill, so we can provide amendments and listen to further witness testimony to ensure that accountability and oversight mechanisms are effective and that they are improved.
Another area of concern that was flagged by witnesses was the absence of a special national security-cleared lawyer to act on an applicant's behalf during a judicial review. This is actually a standard practice in other areas of national security when sensitive information is brought forward. Therefore, we find this omission questionable.
Basically, to explain that, part of the provision of the bill is to allow the government to conduct court hearings in secret. When we are dealing with top secret or sensitive information, we can see that there is a justification for that. We need to ensure that anyone who is caught up in that is getting the appropriate legal representation. That is a critically important factor.
Conservatives want to ensure transparency and accountability. We need strong oversight measures, clear retention limits and restrictions on how data can be collected, used and shared, especially with our foreign intelligence partners. We need to define “personal information”. The bill clearly fails to define what personal information is, which leaves the privacy of Canadians vulnerable. We need to ensure that the government is not allowed to keep these orders secret indefinitely without just cause, and we need to ensure there is no overreach of the powers it is giving itself.
Conservatives want to ensure there are appropriate consultations with and involvement of the Privacy Commissioner, the Intelligence Commissioner and other stakeholders in civil society in improving this legislation. We need independent oversight to ensure strong judicial oversight in accessing personal information. We need strong privacy safeguards to ensure that incident reports involving personal information are shared with the Privacy Commissioner. We need limitations so this data is only used in cases of cybersecurity. We need transparency requirements to mandate the disclosure of the secret orders after a reasonable period and consequences for failing to table those reports.
In summary, given the growing geopolitical tensions around the world, we cannot afford to be naive on matters of cybersecurity. We have sensitive research being conducted at our universities. We need to assert our sovereignty in the Arctic. Canada is a target for hostile powers wanting to undermine our country's national interests and go after our citizens.
We know that hostile states like North Korea, China, Russia and Iran have demonstrated the ability to hack into our critical infrastructure and will continue to take hostile action unless we take decisive steps to improve our cyber-defences. While this bill would be a step in securing our telecommunications systems and other federally regulated industries, it is not all-encompassing and there are some gaps. As Canadian society moves increasingly into a digital space, the government needs to remain vigilant and take proactive steps to ensure we are keeping up, because this landscape is always changing.
In conclusion, our Conservative team is looking forward to seeing this bill come back to committee, where we can propose meaningful amendments and listen to key witnesses and the concerns of Canadians so that they are addressed.
While this legislation is important, we need to ensure that we are not giving the government a blank cheque. We need to ensure that the government is held accountable so the powers it would be giving itself would only be used in a justified and proportionate manner.