Bill aimed at protecting telecom infrastructure against cyberattacks strikes at privacy rights, say civil society groups

A federal bill that would give the industry minister the power to direct service providers “to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system,” and would also create a framework to protect such systems “vital to national security or public safety” threatens privacy rights, warn civil liberties groups. Bill C-8 would amend the Telecommunications Act, and would also enact the Critical Cyber Systems Protection Act. Tamir Israel, director of the privacy, surveillance, and technology program at the Canadian Civil Liberties Association (CCLA), said that the proposed law’s objective is sound: to establish a regulatory regime that would allow the federal government to require vital services and systems—telecom services, pipeline and power-line operators, nuclear-energy facilities, federally regulated transportation systems, banks, and clearing and settlement systems that provide funds transfers—to implement cybersecurity programs. “Our issues are the way this legislation is framed and its potential for misuse, and that it could be actually used to undermine critical cybersecurity safeguards like encryption,” explained Israel, a lawyer by training. He said that under C-8, which is currently before the House Public Safety and National Security Committee, telecom service providers could be “paradoxically told not to upgrade a cybersecurity protocol and prevent them from adopting a more robust form of encryption to facilitate their monitoring of networks.” Matt Hatfield, executive director of OpenMedia, said the bill would allow the federal government to order telcos “to install device systems onto their networks, which would be an easy way to create man-in-the-middle attacks on communication through a device between you and whomever you’re communicating with on the network that steps in and collects your information during the transmission.” However, Public Safety Minister Gary Anandasangaree (Scarborough–Guildwood–Rouge Park, Ont.) told The Hill Times in an Oct. 27 interview that “concerns from organizations around privacy rights, I would suggest, are not warranted.” “C-8 does not authorize warrantless access to Canadians’ personal data,” he said, noting that the bill provides oversight through both the National Security and Intelligence Committee of Parliamentarians, and the National Security and Intelligence Review Agency. Anandasangaree said that recent cyberattacks—such as a breach of WestJet’s internal systems on the eve of the G7 Summit in Alberta this past June—highlight “a real need to have greater protection for our infrastructure, and greater transparency and accountability from those who manage infrastructure when threats do occur to our systems.” “It is to ensure that once and if an entity is hit, then it has an obligation to report so that others can take proactive measures and enable law enforcement to do its job,” said Anandasangaree. “It is a way for us to ensure that our critical infrastructure does not fall prey to nefarious countries and other actors who may simply use some vulnerability in one system to gain access to another to breach personal privacy and information of individuals or organizations.” The CCLA—along with other civil-society groups such as OpenMedia—presented a joint submission last December to the Senate National Security, Defence, and Veterans Affairs Committee when it was reviewing Bill C-26—C-8’s almost identical predecessor that passed the Upper Chamber but failed to receive royal assent earlier this year when Parliament was prorogued. In their brief, the groups recommended that the industry minister not be “permitted to make an order that would compromise the confidentiality, availability or integrity of a telecommunications facility service, or transmission facility.” That clause does not appear in C-8. Under the current bill, a telco could challenge a ministerial directive in the Federal Court, but the order and the judicial review might remain “secret,” as Israel highlighted. In a recent release, the Canadian Constitution Foundation said that under C-8, the industry minister—currently Mélanie Joly (Ahuntsic–Cartierville, Que.)—could “secretly order telecommunications service providers like Telus, Bell, and Rogers to stop providing services to individual Canadians.” “The minister would be allowed to make such an order if she has ‘reasonable grounds to believe that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation.’” Israel said that provision would extend beyond targeting someone “conducting malicious activity” online. “We often see, in the cybersecurity context, that people’s devices are taken over—their modem, their home computer, their phone—and that’s being used to generate malicious activity,” he explained. “This power would let the government to order these people disconnected from the internet. But there is no framework to let people know that they’ve been disconnected or why or support for them to ensure that they can do what they need to do to get reconnected.” Hatfield echoed Israel’s concern. “Canadians could actually quite unwittingly get caught up in a hacking network, and need to be contacted and reconnected,” he said. Israel said that C-8 would also facilitate the collection of “extremely sensitive information from people’s communication on the phone or internet who are implicated on a cybersecurity attack.” Kate Robertson, senior research associate at the Citizen Lab of the University of Toronto’s Munk School of Global Affairs and Public Policy, said that “it’s unprecedented to have such broad information-seizure powers be unaccompanied by judicial oversight.” “We are talking about the seizure of Canadians’ personal information that is the subject of a reasonable expectation of privacy,” she explained. “There are significant constitutional deficiencies that need to be rectified so that the cybersecurity bill, which is important in the public interest, doesn’t get entangled in constitutional challenges.” On Nov. 4, Robertson and Hatfield will appear before the House Public Safety Committee to address their concerns about C-8. In her submission to the committee, Robertson, a constitutional lawyer, argues that “the warrantless nature” of the collection power under the proposed law “should be this committee’s priority in studying the legislation.” Last November, federal Intelligence Commissioner Simon Noël, a former Federal Court judge, appeared before the Senate committee studying C-26 and was asked about protections against unreasonable search and seizure, as well as the interception of private communication. “In all cases I’ve known, you need a warrant,” he testified, which he noted can be obtained from the Federal Court, a justice of the peace, or from “a quasi-judicial officer,” such as the role he currently fills. “In the present bill, there is no such warrant requirement—except for dwellings,” said Noël. “It’s a first in Canada where anyone can go and search.” Privacy Commissioner Philippe Dufresne previously said parliamentarians should consider a ‘consistent threshold of necessity and proportionality … that applies whenever personal information is involved’ for similar legislation (photo: Andrew Meade/Hill Times Publishing). The intelligence commissioner also told committee members that he was not consulted on the government’s bill. Federal Privacy Commissioner Philippe Dufresne also appeared before the Senate committee last November, and recommended that members “consider establishing a consistent threshold of necessity and proportionality in Bill C-26 that applies whenever personal information is involved.” Anandasangaree said he planned to meet with both commissioners this week. He underscored that C-8 includes “safeguards where privacy rights will be not be jeopardized.” “We do believe that the nature of the threats we see to critical infrastructure does require the federal government and all players to have a full vision of what’s going on, and full transparency so that immediate action can be taken,” Anandasangaree said. “The impact on Canadians can be severe if the threat does succeed. The impact of not doing anything is that when information is gathered through attacks on critical infrastructure, that information can easily be shared across the world through nefarious actors and have immediate and dangerous impacts on individual Canadians.” Robertson, who also testified before the Senate committee on C-26 last November, said the government did not follow the privacy commissioner’s guidance when it tabled Bill C-8. She said that the government has also not followed its own direction regarding broad ministerial powers. Bill C-2, the Strong Borders Act, which the government also tabled in June, features a statutory provision that prevents orders to telecom networks “from being used to compromise encryption and undermine communications security,” as Robertson explained. “There is no protection in Bill C-8 for encryption and communications security,” she said. Bill C-8 would also enact the Critical Cyber Systems Protection Act (CCSPA) through which “designated operators” in “vital services and vital systems” sectors, such as telecom and banking, will be required to “establish and implement cybersecurity programs, mitigate supply-chain and third-party risks, report cyber security incidents, and comply with cyber security directions,” according to the proposed law. “We’re in a world where every private enterprise and every public-sector organization is subject to very serious cybersecurity threats,” said Charles Morgan, a partner with and national co-leader of multinational Canadian law firm McCarthy Tétrault’s cyber/data group. “The good guys are all in it together to try to ensure that steps are taken to protect the public, protect enterprise, protect government against malicious actors.” In a recent blog, McCarthy Tétrault outlined steps designated operators will need to take to comply with the law. Although such operators have yet to be identified in C-8, “the CCSPA does not—in its current form—contemplate any exemption or accommodation for small or medium-sized businesses that may be designated as operators,” reads the article co-written by Morgan. Anandasangaree said that designated operators will be identified by an order-in-council once C-8 becomes law. Bill C-8 would also empower regulators—such as the industry minister for telecom services, and the Bank of Canada for clearing and settlement systems—to “enter any place (including private property, but excluding dwelling houses without consent or a warrant) and examine anything on site, including any record, report or data.” However, Morgan said he doesn’t believe there is “any intent that regulators obtain access to personal information. It’s about establishing whether appropriate safeguards have been put in place to protect that information.” He does have a concern, though, regarding the administrative monetary penalties for violations under the CCSPA. “Fines are up to $15-million a day for non-compliance, and directors and officers may be held personally liable,” said Morgan, who highlighted that businesses could include a range in size from major companies to a small internet service providers. However, the public safety minister emphasized that “mom-and-pop operators” would not be designated under the legislation. The bill would allow Industry Minister Mélanie Joly to either prohibit a service provider from ‘using all products and services provided by a specified person,’ or direct a telco to remove such products from its network (photo: Andrew Meade/Hill Times Publishing). “We’re talking organizations that are billions of dollars in value,” said Anandasangaree, adding that the proposed law is intended to take their cybersecurity strategies “to the next level.” “I am well aware that when we implement a measure like this, it will have some impact—but certainly not to the point of debilitating an entity from operation,” he explained. “We expect operators to have a level of sophistication in critical infrastructure to be able to abide by the bill.” Hatfield said that C-26, and now C-8, was partly intended to legislate a directive then-innovation, science, and industry minister François-Philippe Champagne (Saint-Maurice–Champlain, Que.) gave to telcos in 2022 to “prohibit the inclusion of Huawei and ZTE products and services in Canada’s telecommunications systems.” While C-8 doesn’t identify those companies by name, it seeks to amend the Telecommunications Act “to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation,” and allow the industry minister to either prohibit a service provider from “using all products and services provided by a specified person,” or direct a telco to remove such products from its network. Robertson said that “the legislation is important in the long term, and has the potential to set Canada up with a framework at the federal level that can potentially serve the cybersecurity interests of Canadians for decades to come.” “It’s important for parliamentarians not to legislate out of fear, and to make sure that if we are going to embark on this type of approach to regulating cybersecurity that the model is pointed in the right direction,” she said. Hatfield urged parliamentarians to consider, when reviewing C-8, how United States President Donald Trump’s administration has used executive actions to skirt around existing American laws. “We’re all becoming more and more sensitive to how easily powers that are written in good faith can be used,” he said. “We only have to look south of the border at how certain powers are being stress-tested or abused by the current government. So, we want to make sure that Canada doesn’t write laws assuming the government will always do the right thing, but that we do have appropriate safeguards built in.” As Hatfield added: “It’s only the safeguards that were built in that are somewhat holding American democracy together right now.” news@hilltimes.com This story was originally published in The Hill Times

Bill aimed at protecting telecom infrastructure against cyberattacks strikes at privacy rights, say civil society groups

Regulatory |
By Christopher Guly
|October 29, 2025

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Bill aimed at protecting telecom infrastructure against cyberattacks strikes at privacy rights, say civil society groups

Regulatory | By Christopher Guly |October 29, 2025

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

CTA says new criminal legislation will help combat copper theft

UPDATED: CRTC disallows Bell-Cogeco appeal of Quebecor radio deal

Rogers revenue lifts up, adjusted profit down in Q3

Related Stories

Privacy Commissioner wants to see clearer definitions in Bill C-8

Telecoms push back on CRTC’s proposed botnet blocking expansion

OPINION | Cloudy with a chance of sovereignty: protecting our data beyond borders

OPINION: What should communications policy look like under a Carney government?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Regulatory |
By Christopher Guly
|October 29, 2025