Telecoms push back on CRTC’s proposed botnet blocking expansion

Major telecommunications companies across Canada voiced strong opposition to the CRTC’s proposal to expand its framework for limiting botnet traffic, arguing that overly prescriptive regulations and increased public reporting could undermine cybersecurity efforts and inadvertently aid malicious actors. The industry's comments were submitted in response to a CRTC proceeding that closed at the end of July, which sought feedback on incorporating additional blocking methods beyond blocklists and on potential new privacy and reporting requirements for telecom companies. Botnets are networks of computers, cellphones, or other devices that have been infected with malware, allowing individuals or groups to control the devices without the knowledge or consent of their owners. Earlier this summer the CRTC decided that telecom service providers (TSPs) have to be blocking botnets at the network level using authorized blocklists by Aug. 12. At the same time as it issued its decision, the CRTC launched the consultation on whether the framework should be expanded to include other forms of blocking, such as methods using file signatures, traffic volume anomalies, and network fingerprinting. Many carriers, including BCE Inc., Bragg Communication Inc. (Eastlink), Quebecor Inc., Saskatchewan Telecommunications Holding Corp. (SaskTel), and Telus Corp., argued that they require flexibility and operational discretion to respond effectively to cybersecurity threats. They asserted that expanding the framework could stifle innovation, force them to abandon critical measures, and leave Canadian networks and the public more vulnerable. Bell specifically argued that the federal government's existing cybersecurity framework, led by Public Safety Canada and implemented by the Communications Security Establishment Canada, “remains the most appropriate means of protecting Canadians from cybersecurity threats.” A central point of contention revolves around the CRTC's proposed reporting and disclosure requirements. Carriers almost universally agreed that extensive public reporting would enable bad actors to circumvent security measures, provide minimal value to consumers, and be overly burdensome to implement. Rogers Communications Inc. warned that malicious actors could exploit publicly available information to identify weaknesses or tailor attacks. Bell also stated that such detailed information, if not kept entirely confidential, would inevitably be leveraged by bad actors to avoid mitigation measures. Instead, many suggested that disclosure requirements should be limited to metrics recommended in a 2023 report by the CRTC Interconnection Steering Committee (CISC): the number of “indicators of compromise” blocked by each TSP and the number of false positives reported. Companies including Bell, Rogers, and Telus, urged the CRTC to put current reporting requirements on hold until further study by the CISC to ensure appropriate and reliable metrics. The carriers also requested that any reports be filed entirely in confidence, with only aggregated and anonymized data potentially released to the public. On privacy issues, most TSPs contended that existing Canadian privacy laws, such as the Personal Information Protection and Electronic Documents Act (PIPEDA), already provide enough safeguards around the collection, use, retention, and disclosure of personal information. They argued that additional regulatory requirements or prohibitions on data collection and use are unnecessary and inefficient. Bell specified that restricting the use of metadata, such as internet protocol (IP) addresses or port numbers, would compromise essential security practices. In contrast to the other telcos, TekSavvy Solutions Inc. proposed that the CRTC's framework be expanded to apply to all types of network-level blocking, including blocks done through court orders for copyright or trademark enforcement. Bell and Telus strongly rejected TekSavvy’s arguments for an expanded, uniform approach across all blocking, asserting it would undermine law enforcement, the court system, and hinder critical blocking activities, including those related to child sexual abuse material. Finally, Bell and SaskTel supported the establishment of a limitation of liability for carriers conducting blocking under the framework. They highlighted the CISC’s recommendation for such a measure, stating it would encourage carriers to adopt innovative technologies to protect Canadians and their networks. phalentm@thewirereport.ca

Telecoms push back on CRTC’s proposed botnet blocking expansion

Telecom |
By Phalen Tynes-MacDonald
| August 15, 2025

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Telecoms push back on CRTC’s proposed botnet blocking expansion

Telecom | By Phalen Tynes-MacDonald | August 15, 2025

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Bell and Rogers fighting over TPIA disconnection charges

CRTC considering raising telecom contribution threshold

CRTC seeks contractor for nationwide ‘secret shopper’ review of sales practices

Two CRTC commissioners dissent over tangible benefits for Montreal radio stations

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Telecom |
By Phalen Tynes-MacDonald
| August 15, 2025