Government introduces two-part cybersecurity bill

The government’s new cybersecurity bill, introduced on Tuesday, is taking a two-pronged approach. One component will concentrate on telecommunications while the other focuses on telecom, transport, energy and finance. The legislation is called An Act Respecting Cyber Security (ARCS) and will be numbered Bill C-26. “In the 21st century, cyber security is national security – and this new legislation will ensure that Canada’s defenses meet the moment,” Public Safety Minister Marco Mendicino said in a news release. “Most importantly, it will help both the public and private sectors better protect themselves against cyberattacks. This bill is one part of our robust strategy to defend Canada and the crucial infrastructure that Canadians rely on.” The first part of the bill revolves around changes to the Telecommunications Act, and would add a policy objective “to promote the security of the Canadian telecommunications system,” and would give federal bodies authority to take "security-related measures" in the telecommunications sector, according to briefing documents. The Department of Innovation, Science and Economic Development (ISED) is taking the lead on this portion of the bill. ISED and the CRTC will have administrative oversight and the Minister of Innovation and the Governor in Council will be responsible for order making. The second part will see the introduction of the Critical Cyber Security Protection Act (CCSPA), which will be spearheaded by Mendicino. Regulators will be ISED, the Office of the Superintendent of Financial Institutions, the Bank of Canada, Transport Canada, the Canadian Energy Regulator and the Canadian Nuclear Safety Commission. The intention to offer the bill was first announced last month when Mendicino and Innovation Minister François-Philippe Champagne banned Huawei Technologies Co. Ltd. and ZTE Corp. from Canada’s 5G networks. “The Government of Canada will always protect the safety and security of Canadians and will take any actions necessary to safeguard our telecommunications infrastructure,” Champagne said in Tuesday’s release. “The changes announced today will support the long-term security of Canada’s networks while ensuring Canadians can continue to benefit from high-quality and secure telecom services.” In a not-for-attribution background briefing, senior officials of the six agencies involved in the bill said although ransomware attacks are believed to be underreported, the 304 cases reported last year represent a 151 per cent increase. The departments are Public Security, ISED, Transport Canada, Natural Resources, Finance Canada and the Canadian Security Establishment (CSE). The two agencies responsible for enforcing the provisions of the legislation are the CSE’s Canadian Centre for Cyber Security (known as the Cyber Centre) and the RCMP’s National Cybercrime Coordination Unit (NC3). The bill would give the Governor in Council the authority to issue what are being called Cyber Security Directives to designated operators, and these operators would be required to establish a cyber security program, mitigate supply chain and third party service or product risks, report incidents to the Cyber Centre, and implement the GIC's directions. All federally regulated industries will be subject to the provisions found in the 101-page bill. All telecommunications service providers (TSPs) and internet service providers (ISPs) are covered by the bill. Broadcasters are not included under ARCS but could be added at a later date, according to officials. The officials expressed hope that consultations will lead to a collaborative effort from government and industries. They also hope provinces and municipalities will follow the federal lead and introduce legislation that covers businesses not federally monitored. During the briefing, government officials defended a clause in the bill that permits cabinet to keep secret details of cyber hacking. There will be times when announcing such hacks would damage competitive information, they said. They added that such a use of the clause would be rare. Both sections of the bill permit administrative monetary penalties to be applied for non-compliance with the new law. These are there to ensure compliance rather than to punish, the officials said. Reporting of cyber attacks will be mandatory but protections do exist to guard industrial information. The officials expressed the hope the bill would be passed by the fall sitting of Parliament. -- Reporting by Paul Park at ppark@thewirereport.ca and editing by Michael Lee-Murphy at mleemurphy@thewirereport.ca

Government introduces two-part cybersecurity bill

News | 06/14/2022 6:45 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Related Stories

CRTC grants CanCon producers flexibility on stock footage costs

News | 03/24/2023 5:30 pm EDT

CRTC opening up Indigenous Broadband Funding steam in policy review

News | 03/23/2023 6:57 pm EDT

CRTC to review roaming charges after Champagne request

News | 03/23/2023 5:58 pm EDT

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us