Bill Respecting Cyber Security, Amending the Telecommunications Act and Making Consequential Amendments to Other Acts

Honourable senators, I rise today as the opposition critic to speak to Bill C-8, the cybersecurity act, at second reading. This bill is quite similar to Bill C-26, which died on the Order Paper in the last Parliament when Liberal Prime Minister Trudeau decided to prorogue Parliament.

Bill C-8 is divided into two parts. The first consists of amendments to the Telecommunications Act which aim to protect Canada’s telecommunications system from threats such as those related to supply chains, cybersecurity and natural disasters. This legislation gives the federal government the authority to make orders for this purpose, to ban high-risk suppliers and to levy administrative monetary penalties to promote compliance.

Part 2 of Bill C-8 creates the “Critical Cyber Systems Protection Act,” or CCSPA, a regulatory regime to strengthen cybersecurity in four critical federally regulated sectors: finance, telecommunications, energy and transportation. This act gives the Governor-in-Council — the cabinet — the power to give directions to designated operators in these sectors for the purpose of protecting essential cyber systems. This bill also outlines important obligations for designated operators under this law, namely, to establish a cybersecurity program; identify and mitigate supply chain or third-party risks to products or services; report cybersecurity incidents to the Communications Security Establishment, or CSE; and implement cybersecurity directions. Furthermore, this bill provides regulators new powers to create consequences for non-compliance, including administrative monetary penalties, as well as summary and indictable convictions.

It is thanks in large part to Conservative members of Parliament that Bill C-8 now includes amendments that have made this bill considerably better than when we reviewed it previously as Bill C-26.

Bill C-26 was a deeply flawed piece of legislation. If we, as the Conservative opposition in the Senate, had not insisted that Bill C-26 receive rigorous scrutiny at the Standing Senate Committee on National Security, Defence and Veterans Affairs in the fall of 2024, then Bill C-26 would be law today. Many of Bill C-26’s worst flaws had not yet really come to light when Bill C-26 was studied and passed in the House of Commons.

This shows the importance of having strong opposition in both houses of Parliament. The opposition’s role is to improve legislation by exposing and addressing its vulnerabilities and unintended consequences. This also illustrates the importance of an opposition caucus, the opposition senators, sitting in a weekly national caucus with MPs. By meeting with my national Conservative caucus colleagues every week, I was able to convey the serious shortcomings of Bill C-26 to our Conservative MPs.

I was the critic for Bill C-26. I gave long, detailed speeches critiquing Bill C-26 and its many flaws at second reading and third reading. I participated in lengthy National Security, Defence and Veterans Affairs Committee meetings on Bill C-26 in the fall of 2024, drawing out from many knowledgeable witnesses how flawed this bill was and what was needed to fix it.

These great committee witnesses essentially handed the Liberal government a “how-to” kit to fix this cybersecurity bill. Yet, the Liberal government failed to act on this, even though they had more than five months from the time the bill died on the Order Paper in early January 2025 until Bill C-8’s introduction in mid-June. Instead, this Liberal government chose to introduce an almost entirely unchanged bill.

Despite the Carney government’s desperate attempt at rebranding itself as “Canada’s new government,” it’s apparent this was just more of the same old, same old.

Upon the government’s introduction of Bill C-8, essentially the only material change that was made was the numbering change so that half the bill wasn’t nullified by the government’s foreign-registry Bill C-70, the Countering Foreign Interference Act, which the Liberal government had forced Parliament to pass in a matter of only a small number of days.

Why is it, honourable senators, that we bother to do committee study of legislation at all if many senators already have their minds decided before even hearing the first committee witness? During the study of Bill C-26 at the National Security, Defence and Veterans Affairs Committee, many — in fact, almost all — of the witnesses told us that major amendments to Bill C-26 were needed. We like to pat ourselves on the back here in the Senate about how important and valuable our committee study is here, but the fact remains that if we ignore the evidence that emerges from that committee study, those many hours of debate and consideration are rendered meaningless.

This Liberal government loves to trumpet how improved their independent Senate’s work is. And yet, many of the amendments brought forward by “independent senators” are actually technical amendments generated by the government, not from a high-functioning, independent Senate conducting meaningful reflection and work. Often, serious and well-founded amendments are rejected by a majority of the Liberal government-appointed senators toeing the government’s line or, on the rare occasion an amendment passes the Senate, it is often quickly rejected by the Liberal government.

This was the case with Bill C-26. I proposed a very reasonable amendment during committee deliberations, reviewed by the federal Privacy Commissioner and supported by him and several other expert witnesses. My amendment proposed that the Privacy Commissioner should be alerted when a major cyber incident occurs. The Privacy Commissioner asked for this amendment because if he is not alerted about this, how can he know to investigate and inform Canadians?

But my amendment was not passed by the committee. In fact, the vote was not even close. And even though the government had months to consider this afterward, they also failed to include it in the original version of Bill C-8.

When I asked government officials why my amendment hadn’t been included in the reintroduced Bill C-8, they told me it was because the House of Commons’ committee amendments fixed this issue. But given that I had brought the problem to their attention during committee study on Bill C-26, why didn’t the government fix it when they first introduced Bill C-8?

The government’s own briefing deck confirms that Bill C-8, as introduced, was almost entirely unchanged from Bill C-26. It reads:

When Bill C-8 was introduced in parliament, it was nearly identical to former Bill C-26 with only minor changes for consistency.

When I asked the officials at my critic’s briefing why, they said it was because Bill C-26 had initial widespread support in the House of Commons.

So, apparently, the government entirely ignored everything that transpired in the Senate on Bill C-26, including many weeks of intensive Senate committee study, hearing from dozens of expert witnesses, and my lengthy second and third reading speeches detailing serious flaws that were drawn out from those committee hearings.

The Liberal government’s first public consultations on this were in 2016. It has taken 10 years to even get this version of the bill, and its journey is not finished yet. Much of the detail governing this act will only be enacted through a series of regulations, and that will take two additional years once the bill has passed.

The process to get up-to-date cybersecurity legislation has been unbearably slow, and it is long overdue. After all that time and all that study, why did the government just reintroduce the same warmed-over legislation?

Even the government’s own Gender-based Analysis Plus, or GBA Plus, for Bill C-8 is nearly the same as the Bill C-26 version, which we only received near the end of the legislative process last time. Again, this document is mostly meaningless. It is a “summary” of the GBA Plus analysis that the Liberal government provides to cabinet. Why can’t the public and parliamentarians easily access the original documents? Claims of cabinet confidentiality about these documents are silly. There is really nothing confidential in them. It seems like just one more way for this Liberal government to shield itself from accountability.

Allow me to illustrate: The Bill C-26 and Bill C-8 GBA Plus documents are identical except for three paragraphs found in the former Bill C-26 document that are missing from the new Bill C-8 document. In their place is the word “redacted.”

I thought you might like to know what those missing paragraphs actually say. And remember, these have been redacted because the government has deemed that we’re not allowed to see it. Perhaps it’s too dangerous. Perhaps it’s too informative. Who knows?

It reads:

Through the prohibition of specific high-risk suppliers, it is possible that because these suppliers may have lower prices than their lower-risk competitors, some individuals or communities may experience delayed ability to participate in the benefits and opportunities that 5G telecommunications systems are anticipated to provide. Unequal experience of barriers to entry may be revealed along visibility lines as well as economic or geographic. The 2016 census indicates that of visible minorities in Canada, 20.8% are low income compared to 12.2% of the remainder of the population, including Indigenous peoples. It is possible that resulting regulations or orders may contribute to further raising that barrier.

The Government has taken and will continue to take steps to ensure these concerns are mitigated. For example, the proposed restrictions on high-risk suppliers for Fourth Generation (4G) and 5G networks announced in 2022 were designed to consider impacts on Internet access in rural markets with timelines that allow for replacement of equipment by 2027. This allows for predictability and changes in accordance with capital upgrade cycles.

Additionally, Orders to implement these restrictions will be subject to further consultation. Bill C-26 also specifically requires the government to account for the operational and financial impacts on TSPs, as well as the provision of services in Canada, including rural communities.

It’s interesting that the part which seems to have been redacted from the Bill C-8 GBA Plus document is the only part that contains information about potential negative effects on Canadians. Isn’t this what GBA Plus analysis is actually supposed to be for?

Just like its meaningless Bill C-26 GBA Plus predecessor, there is only one mention of “women and girls” in Bill C-8’s Gender-based Analysis Plus document. Why does this government continue to prepare these documents if they’re so useless? Perhaps they’re hoping no one actually reads them to know how purely performative they are. It’s a pretty sad state of affairs for a Liberal government that continues to laud its own ostensibly “feminist” credentials.

Also, like with Bill C-26, the leader of the Carney government in the Senate did not speak on Bill C-8, nor did any members of his Liberal government caucus or group or whatever. So yet again, senators were denied the opportunity to ask questions of the government about an important and complex bill. In fact, since becoming the Senate government leader, Senator Moreau has delivered exactly zero second reading or third reading speeches in the Senate Chamber. It’s quite shocking, honourable senators.

The Senate’s lines of accountability have almost all evaporated, except for those of us on the opposition Conservative benches. When an “independent” senator is the sponsor of a government bill, they can’t — and don’t — answer for the government. When Bill C-8’s sponsor, Senator McNair, responded to my questions after his sponsor speech this week, he said, “I don’t speak for the . . . government . . . .” The ability to ask the government questions and get answers from someone who is actually accountable to the government is fundamental to debate in the Senate Chamber.

More significant resources are available to the leader of the Carney government in the Senate than are available to other senators. As government Senate leader, Senator Moreau receives a $1.5-million annual budget to stickhandle the government’s legislation through the upper chamber, including many staffers designated for this purpose. So why is he silent when it comes time to explain to senators what the government’s legislative agenda is that they expect us to vote on? And why do Senator Moreau and his Government Representative’s Office, or GRO, group largely refuse to explain government legislation for Canadians’ benefit? It’s frustrating and, frankly, it’s detrimental to this institution and our democracy.

Of course, it is not completely unexpected, given that Senator Moreau’s Liberal leader, Prime Minister Mark Carney, shows a similar lack of interest in accountability in the House of Commons. In fact, Canadians are lucky if we see our Liberal Prime Minister in Parliament at all lately in between his various international jet-setting adventures or just dropping the puck at a hockey game.

In over a year as Canada’s Prime Minister, Mark Carney has made only one full speech in Parliament, which was 11 months ago following the Throne Speech. That is appalling.

Instead, the Liberal government tends to let its legislation linger, and when they do finally call legislation forward, they try to push it through Parliament at breakneck speed. And what’s the utterly predictable result of this legislative mismanagement? Mistakes. Bill C-26 was a perfect example of that.

When Bill C-26 was nearing its final stage in clause-by-clause study at Senate committee, it was discovered that the government’s previously passed foreign interference bill — Bill C-70 — would effectively gut the core of the second part of Bill C-26, rendering it meaningless. As a result, clauses and sections of Bill C-26 had to be renumbered to address the mistake, and therefore the bill had to be amended in the Senate and returned to the House of Commons for review — a problem entirely of the Liberal government’s own making. As we know, former prime minister Justin Trudeau then prorogued Parliament when he announced his resignation, which left Bill C-26 dead on the Order Paper.

What processes have this Liberal government established to ensure major mistakes like the Bill C-70 and Bill C-26 debacle never happen again? I fear absolutely none.

After the mistake was discovered during Senate committee study, I asked Liberal government officials that same question. I got zero clarity from them. Meanwhile, the Senate committee chair, Senator Yussuff, suggested a different tack, saying:

. . . when we scrutinize the bill again in the future and officials appear before us, perhaps we can start by asking them the question, “Are there any mistakes in this bill of which we should be aware?”

This hardly inspires confidence that this Liberal government will avoid such mistakes in future.

Furthermore, neither the Privacy Commissioner nor the Intelligence Commissioner was consulted about Bill C-8 by this Carney Liberal government until after the bill was introduced despite the criticism I raised about this in my speech at third reading on Bill C-26 in December 2024. So neither of these two important officials were consulted by the Carney Liberal government to improve this legislation in the serious ways they had requested. Instead, the government left the bill nearly unchanged.

Thankfully, the House of Commons made many significant improvements to Bill C-8. Among them was a Conservative amendment explicitly excluding lawful expression, political debate and persuasion from consideration as threats under this law. Others added: privacy and necessity as mandatory factors for consideration in the making of an order, require consent before releasing personal information and, in some cases, prohibit disclosure of personal data entirely. Another Conservative amendment required that grounds for ministerial actions should be reasonable, relevant to the gravity of the threat and necessary. Yet another stipulates that the threshold for action should be raised from simply “threat” to “serious and systemic” threat. Amendments also clarified rules around the deletion of information once it is no longer needed for the purposes of the act.

These House of Commons committee amendments strengthened Bill C-8, creating guidelines and consideration for orders made under this law and better protecting the rights and information of Canadians who are subject to it. This is a vast improvement over Bill C-26.

And despite all the important amendments made at the House of Commons committee, a government official told me at the critic’s briefing that the Charter Statement indicating compliance has not been and does not need to be updated. So none of the important amendments made strengthening this bill have diminished its Charter compliance. In fact, these House of Commons amendments created stronger protections for rights and freedoms in Bill C-8, thereby likely increasing the bill’s Charter compliance.

However, significant problems still remain in Bill C-8. Conservative MPs had proposed amendments which would have required judicial authorization before orders are made. Unfortunately, these amendments were ruled out of order by the Speaker of the House of Commons. While the other amendments outlining boundaries on ministerial power in Bill C-8 are helpful, requiring judicial authorization for orders would provide better protection to ensure that government power is used responsibly.

We have certainly heard concerns about this lack of oversight before. When we were studying its predecessor Bill C-26 at the Standing Senate Committee on National Security, Defence and Veterans Affairs during the last Parliament, federal Intelligence Commissioner Simon Noël testified about the possibility of warrantless searches under Bill C-26, saying:

In the present bill, there is no such warrant requirement — except for dwellings or maison d’habitation. They make that exception. Everything else, when they go into the office of one of the regulators, the regulator will be able to go in and get what he wants. Normally, that would go against the Charter.

I’ve read the Charter Statement by the minister, and I haven’t seen anything in that statement that would give a justification under section 1 of the Charter. I haven’t seen anything. It’s a first in Canada where anyone can go and search. And the Supreme Court of Canada is very private about this information. In this case, it’s totally absent.

When he testified at the House of Commons Security Committee six months ago, Commissioner Noël testified that Bill C-8 still lacks protection against warrantless searches, saying:

With regard to the warrantless search and seizure, it really triggers section 8 of the charter. It’s evident for any judge. It stands out, more so when there are penalties provided for that in the act. That triggers more—and that’s the Supreme Court saying that.

If you look at what you have in this bill now, you don’t have anything.

Government officials maintain that Bill C-8 will allow orders to collect only technical information, not personal information, but the Information Commissioner testified that personal or sensitive information can still get caught during the handling of technical information under Bill C-8, saying:

I heard the bureaucrats tell you earlier this week that it’s technical information. I agree that it’s technical information, but I also know that if you want a positive result on an incident of such importance, they need to go into the content. I’ve seen it in every cyber-operation I’ve been involved in.

You’re asking me if there are other types. . . . it’s clear that warrantless search and seizure creates a problem. . . .

Later in the meeting, Commissioner Noël continued:

In my experience, in a very short answer, on at least 12 cyber-incidents in Canada, there was, at the end, intrusion into content to the point that these intrusions into content were reported to the appropriate bodies. . . .

That is my own experience, as a Canadian being in a very special position. I’m not saying that it’s with all the technical information, but I’m saying, on an exceptional basis, content is shown.

There is, therefore, a need for increased oversight before the government conducts actions under this bill, not just review after orders have already been made and carried out. Without additional protection on the front end, the government can abuse its powers, and Canadians might only find out after the fact.

Unfortunately, I also still have concerns about the efficacy of the existing review provisions in Bill C-8. The bill contains a requirement to notify the National Security and Intelligence Committee of Parliamentarians, or NSICOP, and the National Security and Intelligence Review Agency, or NSIRA, after orders have been made. However, these measures are inadequate. NSICOP has essentially been muzzled in recent years, as we saw during the foreign interference inquiry. NSIRA has been affected adversely in recent years by budget cuts, and even they have noted that budgetary constraints will prohibit them from doing all the work they should be. The Vice-Chair of NSIRA recently said his team will “. . . have to make difficult decisions” about the reviews it takes on. Of course, the members of NSIRA are appointed by Liberal Prime Minister Carney, and they answer to him, so there is a considerable lack of transparency with this process, as well.

Law Professor Matt Malone shares many of these concerns regarding Bill C-8. He says bluntly, “In my view, a lack of oversight combined with a far-from-robust review mechanism is a recipe for disaster.” Professor Malone is also concerned that this threatens to make our privacy and data standards incongruent with those in Europe. At a time when Canada is looking to increase partnerships with non-American nations, this is obviously worrying.

In an academic paper on the topic published in 2025, Professor Malone wrote:

The European Commission has the power to make so-called “adequacy” decisions — determinations that foreign jurisdictions “adequately” protect Europeans’ data when it flows out of the EU to other countries.

While it may sound dully technical, in the data economy, securing an “adequacy” decision from the EU is a vital prerequisite to a strong trading relationship.

He also said:

In the event the European Union were to find Canada’s privacy framework lacking, this could upend the foundation upon which cross-border data flows between the two blocs now occur. In turn, that could create enormous uncertainty for Canadian actors in the digital economy. . . .

If we get this bill wrong, honourable senators, it could have significant repercussions for Canada’s future.

The Liberal government has taken 10 years to get a cybersecurity bill passed through Parliament. Their legislation before now has simply been inadequate. There is no question that Canada is long overdue for strengthening the law to protect cybersecurity in our critical systems and industries, but we must also be sure that the legislation we pass will appropriately safeguard the rights, freedoms and privacy of Canadian citizens. While our colleagues in the House of Commons have made significant improvements in this regard through amendments, I look forward to rigorously studying Bill C-8 at committee to ensure this legislation has the proper oversight Canadians expect and deserve.

Thank you.

Yes.

That doesn’t really have a lot to do with Bill C-8, but that is what he says he is doing. I look forward not only to some trips around that but also some to the United States to ensure that our relationship with our largest trading partner is also significantly helped.

Again, that does not really have anything to do with Bill C-8, but that’s fine.

Certainly, yes, Saskatchewan has important trading relationships around the world, but we also have a very important trading relationship with the United States. Therefore, I would like to know what Prime Minister Carney is actually doing with the United States because, right now, as one of my colleagues in the House of Commons said the other day, we know more about what Mexico and the United States are talking about than Canada.

I’m not sure if it’s resulted in more than an MOU at this point, so we’ll wait to see some actual details. Obviously, uranium is an extremely important product for Saskatchewan, as are potash and energy. Unfortunately, the Liberal government over the past 10 years has put so many terrible anti-energy laws into place, like Bill C-69, Bill C-48 — I could go on and on. The industrial carbon tax continues — we want to make sure, in Saskatchewan, that all these things are helped, including our very important agricultural industry.

I believe that Prime Minister Carney actually did just make a trip to Boston to see one of his kids. Regarding the puck-dropping that he just performed, he skipped Question Period to do that. I certainly think that Prime Minister Harper never did that.